berbew | 43608c94d0e181736f36daffd550d691239d30bdbf8898cf921d241a26c371e7

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 06:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

43608c94d0e181736f36daffd550d691239d30bdbf8898cf921d241a26c371e7N.exe
Size

1.6MB
MD5

c3ef906dfebf7f0ad5310de3bfc6f400
SHA1

683c51d96f6e61f10a2d8981d957083a8e43e64b
SHA256

43608c94d0e181736f36daffd550d691239d30bdbf8898cf921d241a26c371e7
SHA512

416ea51c110ca979bc24a875cff538fdc63281f0de93ade8badea0f52d7df1258fa620803b4577a9e84b8bb4a9a71f4eceb0c09c9b5f2bf08f1ed8b26a41d085
SSDEEP

24576:ftvr4B9f01ZmQvj4VznTKwe+xgq8/xMbO:ftkB9f0Vb4VznTKwenPf

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Baannc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Alnmjjdb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dckdjomg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qachgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bjpjel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Iphioh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnadagbm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onmfimga.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qdphngfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dkndie32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbfcmhpg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hemdlj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qdaniq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfjkjo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilqoobdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpmdfonj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bobabg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Npepkf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpbjkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ijegcm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnangaoa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebdcld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hplbickp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lcgpni32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npiiffqe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofhknodl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ipoheakj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nhokljge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dbicpfdk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fpimlfke.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmkigh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pjmjdm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bpfkpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Igfclkdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gpecbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jdaaaeqg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljceqb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lobjni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bdpaeehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ifmqfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mnhkbfme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bedgjgkg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ioolkncg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Coegoe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Eicedn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Felbnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fmpqfq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hplicjok.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmfhkf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilafiihp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nglhld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfodeohd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gfodeohd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jebfng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pjbcplpe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ppolhcnm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gikkfqmf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Coohhlpe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emjgim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Llodgnja.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmjkic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jgbjbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mnpabe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qlimed32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Executes dropped EXE 64 IoCs

pid	Process
3724	Pllgnl32.exe
3384	Polppg32.exe
4480	Pcjiff32.exe
1840	Pifnhpmi.exe
3680	Piijno32.exe
3816	Qcaofebg.exe
440	Ajndioga.exe
1684	Alnmjjdb.exe
4132	Afgacokc.exe
1392	Ackbmcjl.exe
3312	Aleckinj.exe
2024	Boflmdkk.exe
3376	Bkmmaeap.exe
3668	Bjpjel32.exe
4904	Bkdcbd32.exe
4492	Ccmgiaig.exe
4692	Cimmggfl.exe
3028	Cioilg32.exe
2380	Ciafbg32.exe
3616	Dpnkdq32.exe
1920	Dckdjomg.exe
4052	Dflmlj32.exe
4820	Djjebh32.exe
2376	Eiobceef.exe
2988	Elpkep32.exe
876	Eidlnd32.exe
4668	Eciplm32.exe
1720	Embddb32.exe
4612	Flinkojm.exe
4696	Fbfcmhpg.exe
4632	Fibhpbea.exe
1364	Fmpqfq32.exe
1656	Glengm32.exe
2100	Gbofcghl.exe
1196	Giinpa32.exe
3432	Gdobnj32.exe
4520	Gikkfqmf.exe
1136	Gpecbk32.exe
212	Gfokoelp.exe
968	Glldgljg.exe
768	Gbfldf32.exe
1828	Hmlpaoaj.exe
3660	Hbhijepa.exe
1680	Hibafp32.exe
3240	Hplicjok.exe
4000	Hkbmqb32.exe
1628	Hcmbee32.exe
3572	Hlegnjbm.exe
5100	Hdokdg32.exe
5076	Hkicaahi.exe
1008	Ipflihfq.exe
4460	Ikkpgafg.exe
1600	Iphioh32.exe
2728	Igbalblk.exe
872	Iloidijb.exe
2980	Iciaqc32.exe
1204	Ikpjbq32.exe
2956	Ilafiihp.exe
3352	Icknfcol.exe
3712	Ijegcm32.exe
324	Ilccoh32.exe
4836	Icnklbmj.exe
992	Jjgchm32.exe
4224	Jpaleglc.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ckbcpc32.dll	Pnplfj32.exe
File created	C:\Windows\SysWOW64\Hbobhb32.dll	Aaldccip.exe
File created	C:\Windows\SysWOW64\Jendmajn.dll	Qcaofebg.exe
File opened for modification	C:\Windows\SysWOW64\Jgnqgqan.exe	Jpdhkf32.exe
File opened for modification	C:\Windows\SysWOW64\Ckmonl32.exe	Chnbbqpn.exe
File created	C:\Windows\SysWOW64\Hmpcbhji.exe	Hffken32.exe
File created	C:\Windows\SysWOW64\Ngjkfd32.exe	Npbceggm.exe
File created	C:\Windows\SysWOW64\Cjijid32.dll	Nncccnol.exe
File opened for modification	C:\Windows\SysWOW64\Aopemh32.exe	Ahfmpnql.exe
File created	C:\Windows\SysWOW64\Ejhmqp32.dll	Fbfcmhpg.exe
File created	C:\Windows\SysWOW64\Hkfoel32.dll	Ondljl32.exe
File opened for modification	C:\Windows\SysWOW64\Ahfmpnql.exe	Aaldccip.exe
File created	C:\Windows\SysWOW64\Ennamn32.dll	Cgqlcg32.exe
File opened for modification	C:\Windows\SysWOW64\Iphioh32.exe	Ikkpgafg.exe
File created	C:\Windows\SysWOW64\Odmbaj32.exe	Olanmgig.exe
File created	C:\Windows\SysWOW64\Angdnk32.dll	Dhclmp32.exe
File created	C:\Windows\SysWOW64\Gikdkj32.exe	Gflhoo32.exe
File opened for modification	C:\Windows\SysWOW64\Mmhgmmbf.exe	Mjjkaabc.exe
File created	C:\Windows\SysWOW64\Ldcadhpd.dll	Jpdhkf32.exe
File opened for modification	C:\Windows\SysWOW64\Mebcop32.exe	Mnhkbfme.exe
File created	C:\Windows\SysWOW64\Ckmonl32.exe	Chnbbqpn.exe
File created	C:\Windows\SysWOW64\Dmennnni.exe	Ddnfmqng.exe
File created	C:\Windows\SysWOW64\Hmkigh32.exe	Hedafk32.exe
File created	C:\Windows\SysWOW64\Figmglee.dll	Ofhknodl.exe
File created	C:\Windows\SysWOW64\Ppjbmc32.exe	Pagbaglh.exe
File created	C:\Windows\SysWOW64\Qcaofebg.exe	Piijno32.exe
File created	C:\Windows\SysWOW64\Ccmgiaig.exe	Bkdcbd32.exe
File opened for modification	C:\Windows\SysWOW64\Ccmgiaig.exe	Bkdcbd32.exe
File opened for modification	C:\Windows\SysWOW64\Mnhkbfme.exe	Mgobel32.exe
File created	C:\Windows\SysWOW64\Mklbeh32.dll	Bdickcpo.exe
File created	C:\Windows\SysWOW64\Dicdcemd.dll	Npbceggm.exe
File created	C:\Windows\SysWOW64\Ahofoogd.exe	Akkffkhk.exe
File created	C:\Windows\SysWOW64\Cpkgohbq.dll	Akkffkhk.exe
File created	C:\Windows\SysWOW64\Jkmmde32.dll	Boihcf32.exe
File created	C:\Windows\SysWOW64\Mmjmhg32.dll	Coohhlpe.exe
File opened for modification	C:\Windows\SysWOW64\Feoodn32.exe	Fneggdhg.exe
File opened for modification	C:\Windows\SysWOW64\Akblfj32.exe	Adhdjpjf.exe
File opened for modification	C:\Windows\SysWOW64\Giinpa32.exe	Gbofcghl.exe
File opened for modification	C:\Windows\SysWOW64\Omegjomb.exe	Oldjcg32.exe
File created	C:\Windows\SysWOW64\Dfoomidj.dll	Pdmkhgho.exe
File created	C:\Windows\SysWOW64\Mqkiok32.exe	Mjaabq32.exe
File created	C:\Windows\SysWOW64\Pjbcplpe.exe	Pplobcpp.exe
File created	C:\Windows\SysWOW64\Cglbhhga.exe	Cpbjkn32.exe
File created	C:\Windows\SysWOW64\Jpdhkf32.exe	Jnelok32.exe
File created	C:\Windows\SysWOW64\Qcjdoc32.dll	Kqfngd32.exe
File created	C:\Windows\SysWOW64\Ppioondd.dll	Dbicpfdk.exe
File created	C:\Windows\SysWOW64\Dkndie32.exe	Dddllkbf.exe
File created	C:\Windows\SysWOW64\Icknfcol.exe	Ilafiihp.exe
File created	C:\Windows\SysWOW64\Nlfcoqpl.dll	Malpia32.exe
File opened for modification	C:\Windows\SysWOW64\Meiioonj.exe	Mnpabe32.exe
File created	C:\Windows\SysWOW64\Qoelkp32.exe	Qdphngfl.exe
File opened for modification	C:\Windows\SysWOW64\Cbbnpg32.exe	Ckhecmcf.exe
File created	C:\Windows\SysWOW64\Mgeakekd.exe	Mqkiok32.exe
File created	C:\Windows\SysWOW64\Jgmjmjnb.exe	Jofalmmp.exe
File created	C:\Windows\SysWOW64\Jponoqjl.dll	Pagbaglh.exe
File opened for modification	C:\Windows\SysWOW64\Polppg32.exe	Pllgnl32.exe
File opened for modification	C:\Windows\SysWOW64\Ajndioga.exe	Qcaofebg.exe
File created	C:\Windows\SysWOW64\Ikfhji32.dll	Flinkojm.exe
File created	C:\Windows\SysWOW64\Ememkjeq.dll	Knooej32.exe
File created	C:\Windows\SysWOW64\Nlhkgi32.exe	Nabfjpak.exe
File created	C:\Windows\SysWOW64\Oklfllgp.dll	Pddhbipj.exe
File opened for modification	C:\Windows\SysWOW64\Dddllkbf.exe	Cnjdpaki.exe
File opened for modification	C:\Windows\SysWOW64\Cimmggfl.exe	Ccmgiaig.exe
File created	C:\Windows\SysWOW64\Gmiadfmi.dll	Fmfgek32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9700	10056	WerFault.exe	494

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Emmdom32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akccap32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Malpia32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppgegd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djjebh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kcbnnpka.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dngjff32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgeakekd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jjgchm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpfcfmlp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nncccnol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cndeii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fmfgek32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lggejg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bpfkpp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kmdlffhj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gflhoo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mebcop32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aehgnied.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pkbjjbda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jghpbk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Johnamkm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Knenkbio.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnojho32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ilafiihp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afgacokc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kjmfjj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pifnhpmi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmlpaoaj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akqfkp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbfcmhpg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mnhkbfme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnfpinmi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpaleglc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ackbmcjl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jgeghp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oeehkn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkbmqb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pplobcpp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ilccoh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Coohhlpe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcpcdg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hplicjok.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdpjlb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Glbjggof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gmdcfidg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnkpnclp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgaokl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Feoodn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gfjkjo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Glldgljg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahippdbe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qhhpop32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahofoogd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bobabg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncofplba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipflihfq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flpmagqi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hplbickp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jmeede32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jphkkpbp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cioilg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ilqoobdd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhpofl32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbihneaj.dll"	Kqmkae32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mebcop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfniqp32.dll"	Ojigdcll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppioondd.dll"	Dbicpfdk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Emmdom32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Qhhpop32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bobabg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cgnomg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pllgnl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Iphioh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbdmdpjg.dll"	Johnamkm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glfdiedd.dll"	Ddgibkpc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kkconn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Efgemb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmjmhg32.dll"	Coohhlpe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dkodcb32.dll"	Mjlhgaqp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Flinkojm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kjhloj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ckeimm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Deqcbpld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kjmfjj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bkobmnka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jobfelii.dll"	Jljbeali.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Holfoqcm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdlfcb32.dll"	Ahfmpnql.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Baannc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhijep32.dll"	Cpfcfmlp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Fbfcmhpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gpecbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpejkd32.dll"	Gfjkjo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hplbickp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hplbickp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mjaabq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Glldgljg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cbbnpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gbofcghl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iikikigb.dll"	Cbdjeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkccgodj.dll"	Fpgpgfmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ikgbdnie.dll"	Ibfnqmpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jmeede32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Llmhaold.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Igbalblk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cndepccb.dll"	Pkbjjbda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ahdged32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ddnfmqng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jgkmgk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ahofoogd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fomnhddq.dll"	Coegoe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gikkfqmf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Iloidijb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kcpahpmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Blnoga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fiaael32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Impliekg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ngjkfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Akpoaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ladfllde.dll"	Hmlpaoaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hmlpaoaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ahfmpnql.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dkndie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ememkjeq.dll"	Knooej32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mnmdme32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Oloahhki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oidalg32.dll"	Dkfadkgf.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 3724	2208	43608c94d0e181736f36daffd550d691239d30bdbf8898cf921d241a26c371e7N.exe	84
PID 2208 wrote to memory of 3724	2208	43608c94d0e181736f36daffd550d691239d30bdbf8898cf921d241a26c371e7N.exe	84
PID 2208 wrote to memory of 3724	2208	43608c94d0e181736f36daffd550d691239d30bdbf8898cf921d241a26c371e7N.exe	84
PID 3724 wrote to memory of 3384	3724	Pllgnl32.exe	85
PID 3724 wrote to memory of 3384	3724	Pllgnl32.exe	85
PID 3724 wrote to memory of 3384	3724	Pllgnl32.exe	85
PID 3384 wrote to memory of 4480	3384	Polppg32.exe	86
PID 3384 wrote to memory of 4480	3384	Polppg32.exe	86
PID 3384 wrote to memory of 4480	3384	Polppg32.exe	86
PID 4480 wrote to memory of 1840	4480	Pcjiff32.exe	87
PID 4480 wrote to memory of 1840	4480	Pcjiff32.exe	87
PID 4480 wrote to memory of 1840	4480	Pcjiff32.exe	87
PID 1840 wrote to memory of 3680	1840	Pifnhpmi.exe	88
PID 1840 wrote to memory of 3680	1840	Pifnhpmi.exe	88
PID 1840 wrote to memory of 3680	1840	Pifnhpmi.exe	88
PID 3680 wrote to memory of 3816	3680	Piijno32.exe	89
PID 3680 wrote to memory of 3816	3680	Piijno32.exe	89
PID 3680 wrote to memory of 3816	3680	Piijno32.exe	89
PID 3816 wrote to memory of 440	3816	Qcaofebg.exe	90
PID 3816 wrote to memory of 440	3816	Qcaofebg.exe	90
PID 3816 wrote to memory of 440	3816	Qcaofebg.exe	90
PID 440 wrote to memory of 1684	440	Ajndioga.exe	91
PID 440 wrote to memory of 1684	440	Ajndioga.exe	91
PID 440 wrote to memory of 1684	440	Ajndioga.exe	91
PID 1684 wrote to memory of 4132	1684	Alnmjjdb.exe	92
PID 1684 wrote to memory of 4132	1684	Alnmjjdb.exe	92
PID 1684 wrote to memory of 4132	1684	Alnmjjdb.exe	92
PID 4132 wrote to memory of 1392	4132	Afgacokc.exe	93
PID 4132 wrote to memory of 1392	4132	Afgacokc.exe	93
PID 4132 wrote to memory of 1392	4132	Afgacokc.exe	93
PID 1392 wrote to memory of 3312	1392	Ackbmcjl.exe	94
PID 1392 wrote to memory of 3312	1392	Ackbmcjl.exe	94
PID 1392 wrote to memory of 3312	1392	Ackbmcjl.exe	94
PID 3312 wrote to memory of 2024	3312	Aleckinj.exe	95
PID 3312 wrote to memory of 2024	3312	Aleckinj.exe	95
PID 3312 wrote to memory of 2024	3312	Aleckinj.exe	95
PID 2024 wrote to memory of 3376	2024	Boflmdkk.exe	96
PID 2024 wrote to memory of 3376	2024	Boflmdkk.exe	96
PID 2024 wrote to memory of 3376	2024	Boflmdkk.exe	96
PID 3376 wrote to memory of 3668	3376	Bkmmaeap.exe	97
PID 3376 wrote to memory of 3668	3376	Bkmmaeap.exe	97
PID 3376 wrote to memory of 3668	3376	Bkmmaeap.exe	97
PID 3668 wrote to memory of 4904	3668	Bjpjel32.exe	98
PID 3668 wrote to memory of 4904	3668	Bjpjel32.exe	98
PID 3668 wrote to memory of 4904	3668	Bjpjel32.exe	98
PID 4904 wrote to memory of 4492	4904	Bkdcbd32.exe	99
PID 4904 wrote to memory of 4492	4904	Bkdcbd32.exe	99
PID 4904 wrote to memory of 4492	4904	Bkdcbd32.exe	99
PID 4492 wrote to memory of 4692	4492	Ccmgiaig.exe	100
PID 4492 wrote to memory of 4692	4492	Ccmgiaig.exe	100
PID 4492 wrote to memory of 4692	4492	Ccmgiaig.exe	100
PID 4692 wrote to memory of 3028	4692	Cimmggfl.exe	101
PID 4692 wrote to memory of 3028	4692	Cimmggfl.exe	101
PID 4692 wrote to memory of 3028	4692	Cimmggfl.exe	101
PID 3028 wrote to memory of 2380	3028	Cioilg32.exe	102
PID 3028 wrote to memory of 2380	3028	Cioilg32.exe	102
PID 3028 wrote to memory of 2380	3028	Cioilg32.exe	102
PID 2380 wrote to memory of 3616	2380	Ciafbg32.exe	103
PID 2380 wrote to memory of 3616	2380	Ciafbg32.exe	103
PID 2380 wrote to memory of 3616	2380	Ciafbg32.exe	103
PID 3616 wrote to memory of 1920	3616	Dpnkdq32.exe	104
PID 3616 wrote to memory of 1920	3616	Dpnkdq32.exe	104
PID 3616 wrote to memory of 1920	3616	Dpnkdq32.exe	104
PID 1920 wrote to memory of 4052	1920	Dckdjomg.exe	105

C:\Users\Admin\AppData\Local\Temp\43608c94d0e181736f36daffd550d691239d30bdbf8898cf921d241a26c371e7N.exe
"C:\Users\Admin\AppData\Local\Temp\43608c94d0e181736f36daffd550d691239d30bdbf8898cf921d241a26c371e7N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\Pllgnl32.exe
  C:\Windows\system32\Pllgnl32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3724
- - C:\Windows\SysWOW64\Polppg32.exe
    C:\Windows\system32\Polppg32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3384
  - - C:\Windows\SysWOW64\Pcjiff32.exe
      C:\Windows\system32\Pcjiff32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4480
    - - C:\Windows\SysWOW64\Pifnhpmi.exe
        
        C:\Windows\system32\Pifnhpmi.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1840
      - C:\Windows\SysWOW64\Piijno32.exe
        
        C:\Windows\system32\Piijno32.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3680
        
        C:\Windows\SysWOW64\Qcaofebg.exe
        
        C:\Windows\system32\Qcaofebg.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3816
        
        C:\Windows\SysWOW64\Ajndioga.exe
        
        C:\Windows\system32\Ajndioga.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:440
        
        C:\Windows\SysWOW64\Alnmjjdb.exe
        
        C:\Windows\system32\Alnmjjdb.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1684
        
        C:\Windows\SysWOW64\Afgacokc.exe
        
        C:\Windows\system32\Afgacokc.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4132
        
        C:\Windows\SysWOW64\Ackbmcjl.exe
        
        C:\Windows\system32\Ackbmcjl.exe
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1392
        
        C:\Windows\SysWOW64\Aleckinj.exe
        
        C:\Windows\system32\Aleckinj.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3312
        
        C:\Windows\SysWOW64\Boflmdkk.exe
        
        C:\Windows\system32\Boflmdkk.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2024
        
        C:\Windows\SysWOW64\Bkmmaeap.exe
        
        C:\Windows\system32\Bkmmaeap.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3376
        
        C:\Windows\SysWOW64\Bjpjel32.exe
        
        C:\Windows\system32\Bjpjel32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3668
        
        C:\Windows\SysWOW64\Bkdcbd32.exe
        
        C:\Windows\system32\Bkdcbd32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4904
        
        C:\Windows\SysWOW64\Ccmgiaig.exe
        
        C:\Windows\system32\Ccmgiaig.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4492
        
        C:\Windows\SysWOW64\Cimmggfl.exe
        
        C:\Windows\system32\Cimmggfl.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4692
        
        C:\Windows\SysWOW64\Cioilg32.exe
        
        C:\Windows\system32\Cioilg32.exe
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3028
        
        C:\Windows\SysWOW64\Ciafbg32.exe
        
        C:\Windows\system32\Ciafbg32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2380
        
        C:\Windows\SysWOW64\Dpnkdq32.exe
        
        C:\Windows\system32\Dpnkdq32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3616
        
        C:\Windows\SysWOW64\Dckdjomg.exe
        
        C:\Windows\system32\Dckdjomg.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1920
        
        C:\Windows\SysWOW64\Dflmlj32.exe
        
        C:\Windows\system32\Dflmlj32.exe
        23⤵
        Executes dropped EXE
        
        PID:4052
        
        C:\Windows\SysWOW64\Djjebh32.exe
        
        C:\Windows\system32\Djjebh32.exe
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4820
        
        C:\Windows\SysWOW64\Eiobceef.exe
        
        C:\Windows\system32\Eiobceef.exe
        25⤵
        Executes dropped EXE
        
        PID:2376
        
        C:\Windows\SysWOW64\Elpkep32.exe
        
        C:\Windows\system32\Elpkep32.exe
        26⤵
        Executes dropped EXE
        
        PID:2988
        
        C:\Windows\SysWOW64\Eidlnd32.exe
        
        C:\Windows\system32\Eidlnd32.exe
        27⤵
        Executes dropped EXE
        
        PID:876
        
        C:\Windows\SysWOW64\Eciplm32.exe
        
        C:\Windows\system32\Eciplm32.exe
        28⤵
        Executes dropped EXE
        
        PID:4668
        
        C:\Windows\SysWOW64\Embddb32.exe
        
        C:\Windows\system32\Embddb32.exe
        29⤵
        Executes dropped EXE
        
        PID:1720
        
        C:\Windows\SysWOW64\Flinkojm.exe
        
        C:\Windows\system32\Flinkojm.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4612
        
        C:\Windows\SysWOW64\Fbfcmhpg.exe
        
        C:\Windows\system32\Fbfcmhpg.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4696
        
        C:\Windows\SysWOW64\Fibhpbea.exe
        
        C:\Windows\system32\Fibhpbea.exe
        32⤵
        Executes dropped EXE
        
        PID:4632
        
        C:\Windows\SysWOW64\Fmpqfq32.exe
        
        C:\Windows\system32\Fmpqfq32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1364
        
        C:\Windows\SysWOW64\Glengm32.exe
        
        C:\Windows\system32\Glengm32.exe
        34⤵
        Executes dropped EXE
        
        PID:1656
        
        C:\Windows\SysWOW64\Gbofcghl.exe
        
        C:\Windows\system32\Gbofcghl.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2100
        
        C:\Windows\SysWOW64\Giinpa32.exe
        
        C:\Windows\system32\Giinpa32.exe
        36⤵
        Executes dropped EXE
        
        PID:1196
        
        C:\Windows\SysWOW64\Gdobnj32.exe
        
        C:\Windows\system32\Gdobnj32.exe
        37⤵
        Executes dropped EXE
        
        PID:3432
        
        C:\Windows\SysWOW64\Gikkfqmf.exe
        
        C:\Windows\system32\Gikkfqmf.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4520
        
        C:\Windows\SysWOW64\Gpecbk32.exe
        
        C:\Windows\system32\Gpecbk32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1136
        
        C:\Windows\SysWOW64\Gfokoelp.exe
        
        C:\Windows\system32\Gfokoelp.exe
        40⤵
        Executes dropped EXE
        
        PID:212
        
        C:\Windows\SysWOW64\Glldgljg.exe
        
        C:\Windows\system32\Glldgljg.exe
        41⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:968
        
        C:\Windows\SysWOW64\Gbfldf32.exe
        
        C:\Windows\system32\Gbfldf32.exe
        42⤵
        Executes dropped EXE
        
        PID:768
        
        C:\Windows\SysWOW64\Hmlpaoaj.exe
        
        C:\Windows\system32\Hmlpaoaj.exe
        43⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1828
        
        C:\Windows\SysWOW64\Hbhijepa.exe
        
        C:\Windows\system32\Hbhijepa.exe
        44⤵
        Executes dropped EXE
        
        PID:3660
        
        C:\Windows\SysWOW64\Hibafp32.exe
        
        C:\Windows\system32\Hibafp32.exe
        45⤵
        Executes dropped EXE
        
        PID:1680
        
        C:\Windows\SysWOW64\Hplicjok.exe
        
        C:\Windows\system32\Hplicjok.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3240
        
        C:\Windows\SysWOW64\Hkbmqb32.exe
        
        C:\Windows\system32\Hkbmqb32.exe
        47⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4000
        
        C:\Windows\SysWOW64\Hcmbee32.exe
        
        C:\Windows\system32\Hcmbee32.exe
        48⤵
        Executes dropped EXE
        
        PID:1628
        
        C:\Windows\SysWOW64\Hlegnjbm.exe
        
        C:\Windows\system32\Hlegnjbm.exe
        49⤵
        Executes dropped EXE
        
        PID:3572
        
        C:\Windows\SysWOW64\Hdokdg32.exe
        
        C:\Windows\system32\Hdokdg32.exe
        50⤵
        Executes dropped EXE
        
        PID:5100
        
        C:\Windows\SysWOW64\Hkicaahi.exe
        
        C:\Windows\system32\Hkicaahi.exe
        51⤵
        Executes dropped EXE
        
        PID:5076
        
        C:\Windows\SysWOW64\Ipflihfq.exe
        
        C:\Windows\system32\Ipflihfq.exe
        52⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1008
        
        C:\Windows\SysWOW64\Ikkpgafg.exe
        
        C:\Windows\system32\Ikkpgafg.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4460
        
        C:\Windows\SysWOW64\Iphioh32.exe
        
        C:\Windows\system32\Iphioh32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1600
        
        C:\Windows\SysWOW64\Igbalblk.exe
        
        C:\Windows\system32\Igbalblk.exe
        55⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2728
        
        C:\Windows\SysWOW64\Iloidijb.exe
        
        C:\Windows\system32\Iloidijb.exe
        56⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:872
        
        C:\Windows\SysWOW64\Iciaqc32.exe
        
        C:\Windows\system32\Iciaqc32.exe
        57⤵
        Executes dropped EXE
        
        PID:2980
        
        C:\Windows\SysWOW64\Ikpjbq32.exe
        
        C:\Windows\system32\Ikpjbq32.exe
        58⤵
        Executes dropped EXE
        
        PID:1204
        
        C:\Windows\SysWOW64\Ilafiihp.exe
        
        C:\Windows\system32\Ilafiihp.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2956
        
        C:\Windows\SysWOW64\Icknfcol.exe
        
        C:\Windows\system32\Icknfcol.exe
        60⤵
        Executes dropped EXE
        
        PID:3352
        
        C:\Windows\SysWOW64\Ijegcm32.exe
        
        C:\Windows\system32\Ijegcm32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3712
        
        C:\Windows\SysWOW64\Ilccoh32.exe
        
        C:\Windows\system32\Ilccoh32.exe
        62⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:324
        
        C:\Windows\SysWOW64\Icnklbmj.exe
        
        C:\Windows\system32\Icnklbmj.exe
        63⤵
        Executes dropped EXE
        
        PID:4836
        
        C:\Windows\SysWOW64\Jjgchm32.exe
        
        C:\Windows\system32\Jjgchm32.exe
        64⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:992
        
        C:\Windows\SysWOW64\Jpaleglc.exe
        
        C:\Windows\system32\Jpaleglc.exe
        65⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4224
        
        C:\Windows\SysWOW64\Jgkdbacp.exe
        
        C:\Windows\system32\Jgkdbacp.exe
        66⤵
        
        PID:3756
        
        C:\Windows\SysWOW64\Jnelok32.exe
        
        C:\Windows\system32\Jnelok32.exe
        67⤵
        Drops file in System32 directory
        
        PID:1148
        
        C:\Windows\SysWOW64\Jpdhkf32.exe
        
        C:\Windows\system32\Jpdhkf32.exe
        68⤵
        Drops file in System32 directory
        
        PID:32
        
        C:\Windows\SysWOW64\Jgnqgqan.exe
        
        C:\Windows\system32\Jgnqgqan.exe
        69⤵
        
        PID:2536
        
        C:\Windows\SysWOW64\Jjlmclqa.exe
        
        C:\Windows\system32\Jjlmclqa.exe
        70⤵
        
        PID:316
        
        C:\Windows\SysWOW64\Jdaaaeqg.exe
        
        C:\Windows\system32\Jdaaaeqg.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:696
        
        C:\Windows\SysWOW64\Jjoiil32.exe
        
        C:\Windows\system32\Jjoiil32.exe
        72⤵
        
        PID:5032
        
        C:\Windows\SysWOW64\Jqhafffk.exe
        
        C:\Windows\system32\Jqhafffk.exe
        73⤵
        
        PID:4384
        
        C:\Windows\SysWOW64\Jgbjbp32.exe
        
        C:\Windows\system32\Jgbjbp32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4476
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        75⤵
        
        PID:4624
        
        C:\Windows\SysWOW64\Jgeghp32.exe
        
        C:\Windows\system32\Jgeghp32.exe
        76⤵
        System Location Discovery: System Language Discovery
        
        PID:3540
        
        C:\Windows\SysWOW64\Knooej32.exe
        
        C:\Windows\system32\Knooej32.exe
        77⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:264
        
        C:\Windows\SysWOW64\Kqmkae32.exe
        
        C:\Windows\system32\Kqmkae32.exe
        78⤵
        Modifies registry class
        
        PID:1056
        
        C:\Windows\SysWOW64\Kkconn32.exe
        
        C:\Windows\system32\Kkconn32.exe
        79⤵
        Modifies registry class
        
        PID:3328
        
        C:\Windows\SysWOW64\Kmdlffhj.exe
        
        C:\Windows\system32\Kmdlffhj.exe
        80⤵
        System Location Discovery: System Language Discovery
        
        PID:2220
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        81⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\Kjhloj32.exe
        
        C:\Windows\system32\Kjhloj32.exe
        82⤵
        Modifies registry class
        
        PID:3280
        
        C:\Windows\SysWOW64\Kmfhkf32.exe
        
        C:\Windows\system32\Kmfhkf32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3236
        
        C:\Windows\SysWOW64\Kcpahpmd.exe
        
        C:\Windows\system32\Kcpahpmd.exe
        84⤵
        Modifies registry class
        
        PID:3428
        
        C:\Windows\SysWOW64\Kkgiimng.exe
        
        C:\Windows\system32\Kkgiimng.exe
        85⤵
        
        PID:1584
        
        C:\Windows\SysWOW64\Kcbnnpka.exe
        
        C:\Windows\system32\Kcbnnpka.exe
        86⤵
        System Location Discovery: System Language Discovery
        
        PID:4420
        
        C:\Windows\SysWOW64\Kjmfjj32.exe
        
        C:\Windows\system32\Kjmfjj32.exe
        87⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1012
        
        C:\Windows\SysWOW64\Kqfngd32.exe
        
        C:\Windows\system32\Kqfngd32.exe
        88⤵
        Drops file in System32 directory
        
        PID:1100
        
        C:\Windows\SysWOW64\Lklbdm32.exe
        
        C:\Windows\system32\Lklbdm32.exe
        89⤵
        
        PID:4972
        
        C:\Windows\SysWOW64\Lmmolepp.exe
        
        C:\Windows\system32\Lmmolepp.exe
        90⤵
        
        PID:1612
        
        C:\Windows\SysWOW64\Lknojl32.exe
        
        C:\Windows\system32\Lknojl32.exe
        91⤵
        
        PID:4584
        
        C:\Windows\SysWOW64\Ldgccb32.exe
        
        C:\Windows\system32\Ldgccb32.exe
        92⤵
        
        PID:4864
        
        C:\Windows\SysWOW64\Lkalplel.exe
        
        C:\Windows\system32\Lkalplel.exe
        93⤵
        
        PID:944
        
        C:\Windows\SysWOW64\Lnohlgep.exe
        
        C:\Windows\system32\Lnohlgep.exe
        94⤵
        
        PID:380
        
        C:\Windows\SysWOW64\Ldipha32.exe
        
        C:\Windows\system32\Ldipha32.exe
        95⤵
        
        PID:3912
        
        C:\Windows\SysWOW64\Lggldm32.exe
        
        C:\Windows\system32\Lggldm32.exe
        96⤵
        
        PID:5004
        
        C:\Windows\SysWOW64\Lnadagbm.exe
        
        C:\Windows\system32\Lnadagbm.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4184
        
        C:\Windows\SysWOW64\Lcnmin32.exe
        
        C:\Windows\system32\Lcnmin32.exe
        98⤵
        
        PID:4664
        
        C:\Windows\SysWOW64\Lkeekk32.exe
        
        C:\Windows\system32\Lkeekk32.exe
        99⤵
        
        PID:4024
        
        C:\Windows\SysWOW64\Lqbncb32.exe
        
        C:\Windows\system32\Lqbncb32.exe
        100⤵
        
        PID:4412
        
        C:\Windows\SysWOW64\Mkhapk32.exe
        
        C:\Windows\system32\Mkhapk32.exe
        101⤵
        
        PID:3940
        
        C:\Windows\SysWOW64\Mepfiq32.exe
        
        C:\Windows\system32\Mepfiq32.exe
        102⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Mgobel32.exe
        
        C:\Windows\system32\Mgobel32.exe
        103⤵
        Drops file in System32 directory
        
        PID:5216
        
        C:\Windows\SysWOW64\Mnhkbfme.exe
        
        C:\Windows\system32\Mnhkbfme.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5260
        
        C:\Windows\SysWOW64\Mebcop32.exe
        
        C:\Windows\system32\Mebcop32.exe
        105⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5304
        
        C:\Windows\SysWOW64\Mgaokl32.exe
        
        C:\Windows\system32\Mgaokl32.exe
        106⤵
        System Location Discovery: System Language Discovery
        
        PID:5348
        
        C:\Windows\SysWOW64\Mnkggfkb.exe
        
        C:\Windows\system32\Mnkggfkb.exe
        107⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Meepdp32.exe
        
        C:\Windows\system32\Meepdp32.exe
        108⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Mgclpkac.exe
        
        C:\Windows\system32\Mgclpkac.exe
        109⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Mnmdme32.exe
        
        C:\Windows\system32\Mnmdme32.exe
        110⤵
        Modifies registry class
        
        PID:5528
        
        C:\Windows\SysWOW64\Malpia32.exe
        
        C:\Windows\system32\Malpia32.exe
        111⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5572
        
        C:\Windows\SysWOW64\Mgehfkop.exe
        
        C:\Windows\system32\Mgehfkop.exe
        112⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Mnpabe32.exe
        
        C:\Windows\system32\Mnpabe32.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5660
        
        C:\Windows\SysWOW64\Meiioonj.exe
        
        C:\Windows\system32\Meiioonj.exe
        114⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Nlcalieg.exe
        
        C:\Windows\system32\Nlcalieg.exe
        115⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Ncofplba.exe
        
        C:\Windows\system32\Ncofplba.exe
        116⤵
        System Location Discovery: System Language Discovery
        
        PID:5792
        
        C:\Windows\SysWOW64\Njinmf32.exe
        
        C:\Windows\system32\Njinmf32.exe
        117⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Nabfjpak.exe
        
        C:\Windows\system32\Nabfjpak.exe
        118⤵
        Drops file in System32 directory
        
        PID:5880
        
        C:\Windows\SysWOW64\Nlhkgi32.exe
        
        C:\Windows\system32\Nlhkgi32.exe
        119⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Nhokljge.exe
        
        C:\Windows\system32\Nhokljge.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5972
        
        C:\Windows\SysWOW64\Nnicid32.exe
        
        C:\Windows\system32\Nnicid32.exe
        121⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Nagpeo32.exe
        
        C:\Windows\system32\Nagpeo32.exe
        122⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Nhahaiec.exe
        
        C:\Windows\system32\Nhahaiec.exe
        123⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Nnkpnclp.exe
        
        C:\Windows\system32\Nnkpnclp.exe
        124⤵
        System Location Discovery: System Language Discovery
        
        PID:3952
        
        C:\Windows\SysWOW64\Oeehkn32.exe
        
        C:\Windows\system32\Oeehkn32.exe
        125⤵
        System Location Discovery: System Language Discovery
        
        PID:5180
        
        C:\Windows\SysWOW64\Oloahhki.exe
        
        C:\Windows\system32\Oloahhki.exe
        126⤵
        Modifies registry class
        
        PID:5252
        
        C:\Windows\SysWOW64\Omqmop32.exe
        
        C:\Windows\system32\Omqmop32.exe
        127⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Oeheqm32.exe
        
        C:\Windows\system32\Oeheqm32.exe
        128⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Olanmgig.exe
        
        C:\Windows\system32\Olanmgig.exe
        129⤵
        Drops file in System32 directory
        
        PID:5472
        
        C:\Windows\SysWOW64\Odmbaj32.exe
        
        C:\Windows\system32\Odmbaj32.exe
        130⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Oldjcg32.exe
        
        C:\Windows\system32\Oldjcg32.exe
        131⤵
        Drops file in System32 directory
        
        PID:5608
        
        C:\Windows\SysWOW64\Omegjomb.exe
        
        C:\Windows\system32\Omegjomb.exe
        132⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Ohkkhhmh.exe
        
        C:\Windows\system32\Ohkkhhmh.exe
        133⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Ojigdcll.exe
        
        C:\Windows\system32\Ojigdcll.exe
        134⤵
        Modifies registry class
        
        PID:5820
        
        C:\Windows\SysWOW64\Oacoqnci.exe
        
        C:\Windows\system32\Oacoqnci.exe
        135⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Olicnfco.exe
        
        C:\Windows\system32\Olicnfco.exe
        136⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Omjpeo32.exe
        
        C:\Windows\system32\Omjpeo32.exe
        137⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Pddhbipj.exe
        
        C:\Windows\system32\Pddhbipj.exe
        138⤵
        Drops file in System32 directory
        
        PID:6100
        
        C:\Windows\SysWOW64\Pknqoc32.exe
        
        C:\Windows\system32\Pknqoc32.exe
        139⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Pecellgl.exe
        
        C:\Windows\system32\Pecellgl.exe
        140⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Pkpmdbfd.exe
        
        C:\Windows\system32\Pkpmdbfd.exe
        141⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Pmoiqneg.exe
        
        C:\Windows\system32\Pmoiqneg.exe
        142⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Pdhbmh32.exe
        
        C:\Windows\system32\Pdhbmh32.exe
        143⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Pkbjjbda.exe
        
        C:\Windows\system32\Pkbjjbda.exe
        144⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5732
        
        C:\Windows\SysWOW64\Pehngkcg.exe
        
        C:\Windows\system32\Pehngkcg.exe
        145⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Pkegpb32.exe
        
        C:\Windows\system32\Pkegpb32.exe
        146⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Pdmkhgho.exe
        
        C:\Windows\system32\Pdmkhgho.exe
        147⤵
        Drops file in System32 directory
        
        PID:6048
        
        C:\Windows\SysWOW64\Qmepam32.exe
        
        C:\Windows\system32\Qmepam32.exe
        148⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Qdphngfl.exe
        
        C:\Windows\system32\Qdphngfl.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5312
        
        C:\Windows\SysWOW64\Qoelkp32.exe
        
        C:\Windows\system32\Qoelkp32.exe
        150⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Qachgk32.exe
        
        C:\Windows\system32\Qachgk32.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5628
        
        C:\Windows\SysWOW64\Qlimed32.exe
        
        C:\Windows\system32\Qlimed32.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5852
        
        C:\Windows\SysWOW64\Aeaanjkl.exe
        
        C:\Windows\system32\Aeaanjkl.exe
        153⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Ahpmjejp.exe
        
        C:\Windows\system32\Ahpmjejp.exe
        154⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Aojefobm.exe
        
        C:\Windows\system32\Aojefobm.exe
        155⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Aahbbkaq.exe
        
        C:\Windows\system32\Aahbbkaq.exe
        156⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Ahbjoe32.exe
        
        C:\Windows\system32\Ahbjoe32.exe
        157⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Akqfkp32.exe
        
        C:\Windows\system32\Akqfkp32.exe
        158⤵
        System Location Discovery: System Language Discovery
        
        PID:5788
        
        C:\Windows\SysWOW64\Aajohjon.exe
        
        C:\Windows\system32\Aajohjon.exe
        159⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Ahdged32.exe
        
        C:\Windows\system32\Ahdged32.exe
        160⤵
        Modifies registry class
        
        PID:6212
        
        C:\Windows\SysWOW64\Akccap32.exe
        
        C:\Windows\system32\Akccap32.exe
        161⤵
        System Location Discovery: System Language Discovery
        
        PID:6272
        
        C:\Windows\SysWOW64\Anaomkdb.exe
        
        C:\Windows\system32\Anaomkdb.exe
        162⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Aehgnied.exe
        
        C:\Windows\system32\Aehgnied.exe
        163⤵
        System Location Discovery: System Language Discovery
        
        PID:6360
        
        C:\Windows\SysWOW64\Ahgcjddh.exe
        
        C:\Windows\system32\Ahgcjddh.exe
        164⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Ahippdbe.exe
        
        C:\Windows\system32\Ahippdbe.exe
        165⤵
        System Location Discovery: System Language Discovery
        
        PID:6464
        
        C:\Windows\SysWOW64\Baadiiif.exe
        
        C:\Windows\system32\Baadiiif.exe
        166⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Bdpaeehj.exe
        
        C:\Windows\system32\Bdpaeehj.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6560
        
        C:\Windows\SysWOW64\Boeebnhp.exe
        
        C:\Windows\system32\Boeebnhp.exe
        168⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Bepmoh32.exe
        
        C:\Windows\system32\Bepmoh32.exe
        169⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Blielbfi.exe
        
        C:\Windows\system32\Blielbfi.exe
        170⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Bafndi32.exe
        
        C:\Windows\system32\Bafndi32.exe
        171⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Bkobmnka.exe
        
        C:\Windows\system32\Bkobmnka.exe
        172⤵
        Modifies registry class
        
        PID:6780
        
        C:\Windows\SysWOW64\Bedgjgkg.exe
        
        C:\Windows\system32\Bedgjgkg.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6824
        
        C:\Windows\SysWOW64\Blnoga32.exe
        
        C:\Windows\system32\Blnoga32.exe
        174⤵
        Modifies registry class
        
        PID:6872
        
        C:\Windows\SysWOW64\Bnoknihb.exe
        
        C:\Windows\system32\Bnoknihb.exe
        175⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        176⤵
        Drops file in System32 directory
        
        PID:6960
        
        C:\Windows\SysWOW64\Blqllqqa.exe
        
        C:\Windows\system32\Blqllqqa.exe
        177⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Coohhlpe.exe
        
        C:\Windows\system32\Coohhlpe.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7052
        
        C:\Windows\SysWOW64\Chglab32.exe
        
        C:\Windows\system32\Chglab32.exe
        179⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Ckeimm32.exe
        
        C:\Windows\system32\Ckeimm32.exe
        180⤵
        Modifies registry class
        
        PID:7140
        
        C:\Windows\SysWOW64\Cndeii32.exe
        
        C:\Windows\system32\Cndeii32.exe
        181⤵
        System Location Discovery: System Language Discovery
        
        PID:6160
        
        C:\Windows\SysWOW64\Chiigadc.exe
        
        C:\Windows\system32\Chiigadc.exe
        182⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Ckhecmcf.exe
        
        C:\Windows\system32\Ckhecmcf.exe
        183⤵
        Drops file in System32 directory
        
        PID:6368
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        184⤵
        Modifies registry class
        
        PID:6432
        
        C:\Windows\SysWOW64\Cdpjlb32.exe
        
        C:\Windows\system32\Cdpjlb32.exe
        185⤵
        System Location Discovery: System Language Discovery
        
        PID:6504
        
        C:\Windows\SysWOW64\Ckjbhmad.exe
        
        C:\Windows\system32\Ckjbhmad.exe
        186⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Cbdjeg32.exe
        
        C:\Windows\system32\Cbdjeg32.exe
        187⤵
        Modifies registry class
        
        PID:6640
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        188⤵
        Drops file in System32 directory
        
        PID:6676
        
        C:\Windows\SysWOW64\Ckmonl32.exe
        
        C:\Windows\system32\Ckmonl32.exe
        189⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        190⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Dkokcl32.exe
        
        C:\Windows\system32\Dkokcl32.exe
        191⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Dbicpfdk.exe
        
        C:\Windows\system32\Dbicpfdk.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7000
        
        C:\Windows\SysWOW64\Dhclmp32.exe
        
        C:\Windows\system32\Dhclmp32.exe
        193⤵
        Drops file in System32 directory
        
        PID:7036
        
        C:\Windows\SysWOW64\Domdjj32.exe
        
        C:\Windows\system32\Domdjj32.exe
        194⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Dbkqfe32.exe
        
        C:\Windows\system32\Dbkqfe32.exe
        195⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Ddjmba32.exe
        
        C:\Windows\system32\Ddjmba32.exe
        196⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Dmadco32.exe
        
        C:\Windows\system32\Dmadco32.exe
        197⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Ddligq32.exe
        
        C:\Windows\system32\Ddligq32.exe
        198⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Dkfadkgf.exe
        
        C:\Windows\system32\Dkfadkgf.exe
        199⤵
        Modifies registry class
        
        PID:6704
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        200⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Ddnfmqng.exe
        
        C:\Windows\system32\Ddnfmqng.exe
        201⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6924
        
        C:\Windows\SysWOW64\Dmennnni.exe
        
        C:\Windows\system32\Dmennnni.exe
        202⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Dngjff32.exe
        
        C:\Windows\system32\Dngjff32.exe
        203⤵
        System Location Discovery: System Language Discovery
        
        PID:7136
        
        C:\Windows\SysWOW64\Deqcbpld.exe
        
        C:\Windows\system32\Deqcbpld.exe
        204⤵
        Modifies registry class
        
        PID:6192
        
        C:\Windows\SysWOW64\Emhkdmlg.exe
        
        C:\Windows\system32\Emhkdmlg.exe
        205⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Eofgpikj.exe
        
        C:\Windows\system32\Eofgpikj.exe
        206⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Ebdcld32.exe
        
        C:\Windows\system32\Ebdcld32.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6836
        
        C:\Windows\SysWOW64\Emjgim32.exe
        
        C:\Windows\system32\Emjgim32.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7016
        
        C:\Windows\SysWOW64\Enkdaepb.exe
        
        C:\Windows\system32\Enkdaepb.exe
        209⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Emmdom32.exe
        
        C:\Windows\system32\Emmdom32.exe
        210⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6484
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        211⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Ebimgcfi.exe
        
        C:\Windows\system32\Ebimgcfi.exe
        212⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Eicedn32.exe
        
        C:\Windows\system32\Eicedn32.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6340
        
        C:\Windows\SysWOW64\Epmmqheb.exe
        
        C:\Windows\system32\Epmmqheb.exe
        214⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Efgemb32.exe
        
        C:\Windows\system32\Efgemb32.exe
        215⤵
        Modifies registry class
        
        PID:6200
        
        C:\Windows\SysWOW64\Eifaim32.exe
        
        C:\Windows\system32\Eifaim32.exe
        216⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Enbjad32.exe
        
        C:\Windows\system32\Enbjad32.exe
        217⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Felbnn32.exe
        
        C:\Windows\system32\Felbnn32.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7064
        
        C:\Windows\SysWOW64\Flfkkhid.exe
        
        C:\Windows\system32\Flfkkhid.exe
        219⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Fneggdhg.exe
        
        C:\Windows\system32\Fneggdhg.exe
        220⤵
        Drops file in System32 directory
        
        PID:7208
        
        C:\Windows\SysWOW64\Feoodn32.exe
        
        C:\Windows\system32\Feoodn32.exe
        221⤵
        System Location Discovery: System Language Discovery
        
        PID:7256
        
        C:\Windows\SysWOW64\Fmfgek32.exe
        
        C:\Windows\system32\Fmfgek32.exe
        222⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7300
        
        C:\Windows\SysWOW64\Fngcmcfe.exe
        
        C:\Windows\system32\Fngcmcfe.exe
        223⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Fimhjl32.exe
        
        C:\Windows\system32\Fimhjl32.exe
        224⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Fpgpgfmh.exe
        
        C:\Windows\system32\Fpgpgfmh.exe
        225⤵
        Modifies registry class
        
        PID:7440
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        226⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Fpimlfke.exe
        
        C:\Windows\system32\Fpimlfke.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7532
        
        C:\Windows\SysWOW64\Fbgihaji.exe
        
        C:\Windows\system32\Fbgihaji.exe
        228⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Fiaael32.exe
        
        C:\Windows\system32\Fiaael32.exe
        229⤵
        Modifies registry class
        
        PID:7628
        
        C:\Windows\SysWOW64\Flpmagqi.exe
        
        C:\Windows\system32\Flpmagqi.exe
        230⤵
        System Location Discovery: System Language Discovery
        
        PID:7672
        
        C:\Windows\SysWOW64\Gfeaopqo.exe
        
        C:\Windows\system32\Gfeaopqo.exe
        231⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Glbjggof.exe
        
        C:\Windows\system32\Glbjggof.exe
        232⤵
        System Location Discovery: System Language Discovery
        
        PID:7760
        
        C:\Windows\SysWOW64\Gblbca32.exe
        
        C:\Windows\system32\Gblbca32.exe
        233⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        234⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        235⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7936
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        237⤵
        System Location Discovery: System Language Discovery
        
        PID:7980
        
        C:\Windows\SysWOW64\Gflhoo32.exe
        
        C:\Windows\system32\Gflhoo32.exe
        238⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8024
        
        C:\Windows\SysWOW64\Gikdkj32.exe
        
        C:\Windows\system32\Gikdkj32.exe
        239⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Goglcahb.exe
        
        C:\Windows\system32\Goglcahb.exe
        240⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Gfodeohd.exe
        
        C:\Windows\system32\Gfodeohd.exe
        241⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8156
        
        C:\Windows\SysWOW64\Glkmmefl.exe
        
        C:\Windows\system32\Glkmmefl.exe
        242⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Gojiiafp.exe
        
        C:\Windows\system32\Gojiiafp.exe
        243⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        244⤵
        Drops file in System32 directory
        
        PID:7312
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        245⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7380
        
        C:\Windows\SysWOW64\Holfoqcm.exe
        
        C:\Windows\system32\Holfoqcm.exe
        246⤵
        Modifies registry class
        
        PID:3484
        
        C:\Windows\SysWOW64\Hefnkkkj.exe
        
        C:\Windows\system32\Hefnkkkj.exe
        247⤵
        
        PID:3492
        
        C:\Windows\SysWOW64\Hmmfmhll.exe
        
        C:\Windows\system32\Hmmfmhll.exe
        248⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Hplbickp.exe
        
        C:\Windows\system32\Hplbickp.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7556
        
        C:\Windows\SysWOW64\Hffken32.exe
        
        C:\Windows\system32\Hffken32.exe
        250⤵
        Drops file in System32 directory
        
        PID:7624
        
        C:\Windows\SysWOW64\Hmpcbhji.exe
        
        C:\Windows\system32\Hmpcbhji.exe
        251⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Hoaojp32.exe
        
        C:\Windows\system32\Hoaojp32.exe
        252⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        253⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Hlepcdoa.exe
        
        C:\Windows\system32\Hlepcdoa.exe
        254⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Hoclopne.exe
        
        C:\Windows\system32\Hoclopne.exe
        255⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8052
        
        C:\Windows\SysWOW64\Hlglidlo.exe
        
        C:\Windows\system32\Hlglidlo.exe
        257⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Hoeieolb.exe
        
        C:\Windows\system32\Hoeieolb.exe
        258⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Ifmqfm32.exe
        
        C:\Windows\system32\Ifmqfm32.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7244
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        260⤵
        
        PID:2976
        
        C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        261⤵
        
        PID:4928
        
        C:\Windows\SysWOW64\Ibfnqmpf.exe
        
        C:\Windows\system32\Ibfnqmpf.exe
        262⤵
        Modifies registry class
        
        PID:7476
        
        C:\Windows\SysWOW64\Iipfmggc.exe
        
        C:\Windows\system32\Iipfmggc.exe
        263⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Ipjoja32.exe
        
        C:\Windows\system32\Ipjoja32.exe
        264⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Ibhkfm32.exe
        
        C:\Windows\system32\Ibhkfm32.exe
        265⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Iibccgep.exe
        
        C:\Windows\system32\Iibccgep.exe
        266⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        267⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8040
        
        C:\Windows\SysWOW64\Ioolkncg.exe
        
        C:\Windows\system32\Ioolkncg.exe
        268⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8140
        
        C:\Windows\SysWOW64\Igfclkdj.exe
        
        C:\Windows\system32\Igfclkdj.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7240
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        270⤵
        Modifies registry class
        
        PID:7404
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        271⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7480
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        272⤵
        System Location Discovery: System Language Discovery
        
        PID:7688
        
        C:\Windows\SysWOW64\Jpaekqhh.exe
        
        C:\Windows\system32\Jpaekqhh.exe
        273⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        274⤵
        Modifies registry class
        
        PID:8144
        
        C:\Windows\SysWOW64\Jmeede32.exe
        
        C:\Windows\system32\Jmeede32.exe
        275⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7296
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        276⤵
        Drops file in System32 directory
        
        PID:7472
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        277⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Jljbeali.exe
        
        C:\Windows\system32\Jljbeali.exe
        278⤵
        Modifies registry class
        
        PID:8064
        
        C:\Windows\SysWOW64\Johnamkm.exe
        
        C:\Windows\system32\Johnamkm.exe
        279⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7332
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        280⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7680
        
        C:\Windows\SysWOW64\Jphkkpbp.exe
        
        C:\Windows\system32\Jphkkpbp.exe
        281⤵
        System Location Discovery: System Language Discovery
        
        PID:7228
        
        C:\Windows\SysWOW64\Jedccfqg.exe
        
        C:\Windows\system32\Jedccfqg.exe
        282⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Kegpifod.exe
        
        C:\Windows\system32\Kegpifod.exe
        283⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Kpmdfonj.exe
        
        C:\Windows\system32\Kpmdfonj.exe
        284⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6208
        
        C:\Windows\SysWOW64\Kgflcifg.exe
        
        C:\Windows\system32\Kgflcifg.exe
        285⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        286⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\Koaagkcb.exe
        
        C:\Windows\system32\Koaagkcb.exe
        287⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        288⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        289⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\Kodnmkap.exe
        
        C:\Windows\system32\Kodnmkap.exe
        290⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Kgkfnh32.exe
        
        C:\Windows\system32\Kgkfnh32.exe
        291⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Knenkbio.exe
        
        C:\Windows\system32\Knenkbio.exe
        292⤵
        System Location Discovery: System Language Discovery
        
        PID:8484
        
        C:\Windows\SysWOW64\Kofkbk32.exe
        
        C:\Windows\system32\Kofkbk32.exe
        293⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Kgnbdh32.exe
        
        C:\Windows\system32\Kgnbdh32.exe
        294⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Kngkqbgl.exe
        
        C:\Windows\system32\Kngkqbgl.exe
        295⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Loighj32.exe
        
        C:\Windows\system32\Loighj32.exe
        296⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Lfbped32.exe
        
        C:\Windows\system32\Lfbped32.exe
        297⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        298⤵
        Modifies registry class
        
        PID:8752
        
        C:\Windows\SysWOW64\Lcgpni32.exe
        
        C:\Windows\system32\Lcgpni32.exe
        299⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8796
        
        C:\Windows\SysWOW64\Lfeljd32.exe
        
        C:\Windows\system32\Lfeljd32.exe
        300⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        301⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8884
        
        C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        302⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Ljceqb32.exe
        
        C:\Windows\system32\Ljceqb32.exe
        303⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8972
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        304⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Lggejg32.exe
        
        C:\Windows\system32\Lggejg32.exe
        305⤵
        System Location Discovery: System Language Discovery
        
        PID:9060
        
        C:\Windows\SysWOW64\Lnangaoa.exe
        
        C:\Windows\system32\Lnangaoa.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9104
        
        C:\Windows\SysWOW64\Lobjni32.exe
        
        C:\Windows\system32\Lobjni32.exe
        307⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9148
        
        C:\Windows\SysWOW64\Lflbkcll.exe
        
        C:\Windows\system32\Lflbkcll.exe
        308⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Mmfkhmdi.exe
        
        C:\Windows\system32\Mmfkhmdi.exe
        309⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Mcpcdg32.exe
        
        C:\Windows\system32\Mcpcdg32.exe
        310⤵
        System Location Discovery: System Language Discovery
        
        PID:2340
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        311⤵
        Drops file in System32 directory
        
        PID:8364
        
        C:\Windows\SysWOW64\Mmhgmmbf.exe
        
        C:\Windows\system32\Mmhgmmbf.exe
        312⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        313⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Mjlhgaqp.exe
        
        C:\Windows\system32\Mjlhgaqp.exe
        314⤵
        Modifies registry class
        
        PID:8560
        
        C:\Windows\SysWOW64\Mqfpckhm.exe
        
        C:\Windows\system32\Mqfpckhm.exe
        315⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        316⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Mjodla32.exe
        
        C:\Windows\system32\Mjodla32.exe
        317⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Mqimikfj.exe
        
        C:\Windows\system32\Mqimikfj.exe
        318⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Mjaabq32.exe
        
        C:\Windows\system32\Mjaabq32.exe
        319⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8896
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        320⤵
        Drops file in System32 directory
        
        PID:8980
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        321⤵
        System Location Discovery: System Language Discovery
        
        PID:9048
        
        C:\Windows\SysWOW64\Nnojho32.exe
        
        C:\Windows\system32\Nnojho32.exe
        322⤵
        System Location Discovery: System Language Discovery
        
        PID:9116
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        323⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        324⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        325⤵
        Drops file in System32 directory
        
        PID:8352
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        326⤵
        Modifies registry class
        
        PID:8468
        
        C:\Windows\SysWOW64\Nncccnol.exe
        
        C:\Windows\system32\Nncccnol.exe
        327⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8568
        
        C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        328⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8672
        
        C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        329⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8792
        
        C:\Windows\SysWOW64\Nnfpinmi.exe
        
        C:\Windows\system32\Nnfpinmi.exe
        330⤵
        System Location Discovery: System Language Discovery
        
        PID:8892
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        331⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Ngndaccj.exe
        
        C:\Windows\system32\Ngndaccj.exe
        332⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        333⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        334⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8384
        
        C:\Windows\SysWOW64\Nfcabp32.exe
        
        C:\Windows\system32\Nfcabp32.exe
        335⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        336⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        337⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Onmfimga.exe
        
        C:\Windows\system32\Onmfimga.exe
        338⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9068
        
        C:\Windows\SysWOW64\Opnbae32.exe
        
        C:\Windows\system32\Opnbae32.exe
        339⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        340⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4268
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        341⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        342⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Oghghb32.exe
        
        C:\Windows\system32\Oghghb32.exe
        343⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Onapdl32.exe
        
        C:\Windows\system32\Onapdl32.exe
        344⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        345⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\Ondljl32.exe
        
        C:\Windows\system32\Ondljl32.exe
        346⤵
        Drops file in System32 directory
        
        PID:2152
        
        C:\Windows\SysWOW64\Opeiadfg.exe
        
        C:\Windows\system32\Opeiadfg.exe
        347⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        348⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        349⤵
        System Location Discovery: System Language Discovery
        
        PID:9220
        
        C:\Windows\SysWOW64\Pjmjdm32.exe
        
        C:\Windows\system32\Pjmjdm32.exe
        350⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9264
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        351⤵
        Drops file in System32 directory
        
        PID:9312
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        352⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        353⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        354⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:9448
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        355⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9492
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        356⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9536
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        357⤵
        
        PID:9584
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        358⤵
        Drops file in System32 directory
        
        PID:9628
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        359⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9676
        
        C:\Windows\SysWOW64\Qmeigg32.exe
        
        C:\Windows\system32\Qmeigg32.exe
        360⤵
        
        PID:9724
        
        C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        361⤵
        
        PID:9772
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        362⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        363⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9864
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        364⤵
        Drops file in System32 directory
        
        PID:9908
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        365⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9956
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        366⤵
        
        PID:10000
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        367⤵
        
        PID:10048
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        368⤵
        Modifies registry class
        
        PID:10092
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        369⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        370⤵
        Drops file in System32 directory
        
        PID:10184
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        371⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        372⤵
        Drops file in System32 directory
        
        PID:9256
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        373⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9328
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        374⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        375⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        376⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9532
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        377⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9600
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        378⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        379⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9744
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        380⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        381⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9876
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        382⤵
        System Location Discovery: System Language Discovery
        
        PID:9972
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        383⤵
        Drops file in System32 directory
        
        PID:10032
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        384⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        385⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        386⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        387⤵
        
        PID:9320
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        388⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        389⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        390⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        391⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        392⤵
        
        PID:9844
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        393⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9952
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        394⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        395⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        396⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        397⤵
        Modifies registry class
        
        PID:9444
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        398⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9596
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        399⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9760
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        400⤵
        Drops file in System32 directory
        
        PID:9948
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        401⤵
        Drops file in System32 directory
        
        PID:10088
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        402⤵
        Drops file in System32 directory
        
        PID:9248
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        403⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9512
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        404⤵
        Modifies registry class
        
        PID:9788
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        405⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10056 -s 412
        406⤵
        Program crash
        
        PID:9700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 10056 -ip 10056
1⤵
PID:9524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ackbmcjl.exe

Filesize
1.6MB

MD5
090db84ba6466ba0f842b07953e5f8e3

SHA1
bd98e1a95489f4aac0382b067c8d325d95851fa9

SHA256
0caec1ab840848e9af032f2bdba8246632de48e500735f128fc9df228046c279

SHA512
8c67b2d269642079d72ae58d86360f10de01dff730e8b5ef0b821f9c0b15b37026945068d616cf3d828382cd4cad72d5f6b8d856ef4e7ab97272b8169793aff3

Download Submit
C:\Windows\SysWOW64\Afgacokc.exe

Filesize
1.6MB

MD5
7e62c0dbb3f785686315db384f38330a

SHA1
1a4738d1823b2b402c1c3740e25e031bff282967

SHA256
46fd129dd2843f49699eba90a794d2d06b4548ead222396fdcfb40c5079b4f4b

SHA512
2809b118e9298807bb8ce8baa2fdad3df1792c0b84493e48d792acbb018a6ae4f7c6630228c33cbbcadb113b091c54291a61e87584f9a8b59ed2d5d365abff55

Download Submit
C:\Windows\SysWOW64\Ahippdbe.exe

Filesize
1.6MB

MD5
c632310d46c7226a0c87f3723d47342d

SHA1
4f3c6137c818cab55b65703968a96c1053e9b3ba

SHA256
75bb3e7a59859bfe67a4d326a25fbc285937c0e083e859f61082c452d07e1a7e

SHA512
21ec0fd4a1dfefb5f4c033f3c286a6a1c34fea3fe781898a0abbfe2ea94e5153fc05adf9b8baa8109eca002be9c202a2ae00d73f6da6d78ab47782b20722cade

Download Submit
C:\Windows\SysWOW64\Ahofoogd.exe

Filesize
1.6MB

MD5
e74b839c4c24b108cd368ef07711dd0d

SHA1
9af514161c394b5662e322f0067a3bf009641fe1

SHA256
bf1a47987f4386de5f349fd97dc348e12fb21cb30de0cd30efc669e04259ae75

SHA512
9b2b60f19539d8e557a5a30e76ae40c3394708abc1a548f5261c5c1c6e8cf37ddce8d2f88c809a9d69381d4d198aa8ac051994ac4222457c4c72d6c54ca6d92c

Download Submit
C:\Windows\SysWOW64\Ajndioga.exe

Filesize
1.6MB

MD5
fcfc4f71636b6b79f24b82fb811265e0

SHA1
2c84ba8535aeebab1e02341d23c8371f9639172a

SHA256
37ea0ebf7d2cbe6f2bbdf0141a95607ec1f32a2d50eea8a5216a1766bf898ed6

SHA512
1afd4e3b1f3a8e302bc3279f134bd4e31236e686d0e1847215a93d00451936b8a2ad0ed31855f2ad51f4dc33563baf0cbf7e4e5c2005d8e6db28253c5f4af16b

Download Submit
C:\Windows\SysWOW64\Akkffkhk.exe

Filesize
1.6MB

MD5
ef06c76ee1bfc204150b80660df35388

SHA1
8051cb73c0f323ee05e564de742c02876a8239a2

SHA256
ba92d34f26226539ba8933f27b198df3183e8742e1760b32a02f3b1b54f42a5f

SHA512
39809d5582ba9353243dc5331e16b8723e137a7ef083f5cc61a0a241bc62b8bbcf0b32f900c27f306aff32f089d26985d5a8a1f6dd7c967f698ce57f5da1b616

Download Submit
C:\Windows\SysWOW64\Aleckinj.exe

Filesize
1.6MB

MD5
5dd11572b90104e35d614e804387422a

SHA1
4e91e815bc63299d30fd2381fce3e393299c5305

SHA256
16e321e88eb3a8d3fd0c6e2f4f6ccfa79d297a92d018e0e8f4fd0dcad7b62cea

SHA512
d308fc19367474516d1c2bbc11d471debcce3f603375e446fe917af1309315d85c6e232515fea94d9bd1ec2b3aa38b64c17b0fb5cf4ed17cc26e308f9bed3396

Download Submit
C:\Windows\SysWOW64\Alnmjjdb.exe

Filesize
1.6MB

MD5
b74a0741d2319d3c0383c70c21391411

SHA1
d22ef6a40d05077c6f4b7d07dead516c1d9089e5

SHA256
f5044ebc00c6fd624c0a3f98880c7d0fbd11235cc2e4b0da6a15533c9f431116

SHA512
f9c9871c41a79d462b9b0fb1581f6dd93d93c1fee76db5159cc123d51cc07952ec34b1eec5d24d99143b6256c2e4ed90b796358ec685bbaaaf71ca6628c2510d

Download Submit
C:\Windows\SysWOW64\Aopemh32.exe

Filesize
1.6MB

MD5
ebe9d930620a1df08191788ca6372dfe

SHA1
95bd59f2398b04be1b9999ce28121a8acd0ca164

SHA256
07f6af668efa1ecfd046250efbfe02598e8fd79342b9d5d466ee1cec0843b816

SHA512
b92fdd399064effa3f62f21cef298e4b91d9bbf1d8b6e37d48ea21cd149213134d1c14c12627e23f22d33e5dfa9c427a4116768ca6d9949a2deec310e51f10f9

Download Submit
C:\Windows\SysWOW64\Bhkfkmmg.exe

Filesize
1.6MB

MD5
b7e48809d9d92c54b1c017b1cb01b4e8

SHA1
5549026e2b03ecdd64cdba08c80aa7c10baf70cf

SHA256
29cb7bf827dd5e4200174d0fc988948a2bb0aa1b816fe8bd4d28ab361afa0d10

SHA512
89a5d2c1e45754f9ccc68b9782a7ebdfe777d14d50485f1296436d47160f6d4e1bbc671b466d470d2750a2085a6940ec9cf465e1ed1019de70e0aea61051db42

Download Submit
C:\Windows\SysWOW64\Bjpjel32.exe

Filesize
1.6MB

MD5
28f4b664a413af83f5c6f5156d01f59a

SHA1
bb96893a85566116cb3eac14cceda3911903a26b

SHA256
e111f1c8da2a1bd950b87257c605100c2a8f38c75af79bd4c0b19207f6bebb77

SHA512
50d9084cf4d0770642f9a9be7957751b3f5d90e7638f8421d39be486d2eb9696a2cd7908535982d8c5a64e1747d03997be97a93c8bd140be039b1b72b07bd20a

Download Submit
C:\Windows\SysWOW64\Bkdcbd32.exe

Filesize
1.6MB

MD5
eed1e9bf03c49605653adc2ab2b5f814

SHA1
d9a09a5fbb27a68582b6b310b33abb5ee4cc6dda

SHA256
23934fe75597df648248dfca40267131855dc8505de1c08fda0509539907259b

SHA512
2bf8cb7436dde0c9a0cb9fbdd73ec67378761a462da74bae3ae52794a40739b6dba9114d50b6672032c5d81cef7aa93367f3f42ec6f0409697c6a40a59557c3d

Download Submit
C:\Windows\SysWOW64\Bkmmaeap.exe

Filesize
1.6MB

MD5
557b92942296a01008b2d9e3aab57e80

SHA1
edbbb0e17ac3490ab05a641c69dacb37e6b451cb

SHA256
f6f2b3964763477b5ffc657d7afc2f336670ed4021dfa7de3370e4e691b83078

SHA512
0ba294d1b24d9a7bd18b2c7cdc87d34de6ecc97d5582377a9d6a5ac36327e0b9405fa308210c4cdd0a0fe2ce3f55a99be5727d470e14ffc308133357e6c82837

Download Submit
C:\Windows\SysWOW64\Bkobmnka.exe

Filesize
1.6MB

MD5
1ca4ef23e5ccfdc6f234f823b3446333

SHA1
3ffcfed0078a1234fcd57828d481b87cc599d1f4

SHA256
80946f3071a857efa2c87224ca10fcebe0a1ba133932bbdd66ee5b5bfde15a87

SHA512
bed9ed38cc3b6f704487c90e67a9c42bf5f2d888fa81bc4b3db0e93bd618ca6007edf3b8dc105e4abe856e2822a962e17442807e4f89ec7e66079b3928fcd926

Download Submit
C:\Windows\SysWOW64\Blielbfi.exe

Filesize
1.6MB

MD5
040ae904b84c9692f452427d67d4b376

SHA1
eaaf5774501d54323fdefaee7b51104e52d93c7a

SHA256
4ad571f4ae9ca2c1d3befc357f4f7262af4d22c118557bcff3dd73a3d57b36b0

SHA512
5428703a768a75b661bf8e687b36455599b45e6f18fcbfb7a027d65856d24d59c0d3b95e29c844972c4f94012f7977f96bea0e842e5790c251df89a0c3f38312

Download Submit
C:\Windows\SysWOW64\Bmjkic32.exe

Filesize
704KB

MD5
b1994fa421d2fa8fa9e2ae2eb0b3ca6c

SHA1
0d3e7477d4426b56bace359278a16451328add33

SHA256
1e86876fc09157389e84a98de855d87dd5700c2fc400a44bd97d59bafa035c27

SHA512
82cdca156e8ace05b3f96b1fbd7a051ec398255b17fc9f91b536d59fa36cd7d25f7154c1ac9deb78d2238f864090e361658e19f3dbcc60ef22ad87043a5d4c6d

Download Submit
C:\Windows\SysWOW64\Boeebnhp.exe

Filesize
1.6MB

MD5
9e2c8279f36e36b7ace426f7442c3a0e

SHA1
c4dfc1e731b688e95cafbfc8c62512e0da657e27

SHA256
532be6b410a563b2bae14fdc9001e5023655d8fdb919009bdfbbe4daf47245ba

SHA512
dc5aa214787a29dbcd322524299900c49c451443afd8d55128b5d0c89fd6a9f1c12880a373d2225846b00ead4acb998de4e171c71e16a11c62e471262ebc60b2

Download Submit
C:\Windows\SysWOW64\Boflmdkk.exe

Filesize
1.6MB

MD5
4ee3107093fc36338ee79f1f96da84e5

SHA1
ffe5996cbb6e2928714a958576f169381c1a9e22

SHA256
02beefe896e0787362a9d9c63eaccf8f56b0f6a1395ebdde59a64d5e2d1c13ca

SHA512
877ce606c6bab7f4919b0d794811177f747577623c7122d643431737c9ebfece28db3072a25de74e97e4b442499f6ef3863765d37fe2b5aec1b714ba4133a220

Download Submit
C:\Windows\SysWOW64\Cbfgkffn.exe

Filesize
1.6MB

MD5
1f5bbb2a98fee05c6a0d07bf8626d716

SHA1
ff221e70725c2901b54fac1f1b0410c450cae4f8

SHA256
42b3a2f2f15c0299f2f774f924e00d65b843a331d12aea47159240076fbd58b8

SHA512
510cb4fed926c9b75c685158a3ad94b06ed0686df33be421184919ddc5568a0ddc7b7a3b3be5ba66e4aff7a0b359eb7dd7636102c9ab587635cc4653f3650057

Download Submit
C:\Windows\SysWOW64\Ccmgiaig.exe

Filesize
1.6MB

MD5
c6dc606123792c094d4ad65f2736a27f

SHA1
1e3ba3038a6afd8bbb7f982f8a930b148a897a24

SHA256
9025d9111e5f9f3268700941926e5054a791aaa77a5f44ab497cc275ad370a39

SHA512
803c608f1b8ed313884cb417126453d0b58c2703db428149c8f8e259dceeaa20dbfee64620ee6ff1619998aad8e8f5b8022e846dd36ebc25bc878555b32ac7a3

Download Submit
C:\Windows\SysWOW64\Ccmgiaig.exe

Filesize
1.6MB

MD5
9df0410d6843f2a33eb8c6730d68b98a

SHA1
7f8c3c84138430083fdc4b18e93965bd0b3eb6ba

SHA256
a2f03f347087e3018e867a4ac0a915774fe596ce939db18521606770d889594b

SHA512
316666db4ff968c6b10f05135739774732b82f66aaf9c9a5f0ef3ed56a1cbf0e8aed27f7016e12f7332b80139e3661a92bae1ad7241fdc32caede609f508655a

Download Submit
C:\Windows\SysWOW64\Ciafbg32.exe

Filesize
1.6MB

MD5
041a05c3d962a3342614b1dda0a7ed91

SHA1
0417ba652f00311d96b968011d6f0cb86f44309e

SHA256
3fe711a1a8300244203b929149c1e7a33b4ab4e664ea7dbc0bd3083dc4c2fb4d

SHA512
2af93ab6dafd708afb8ffd43fc740666a6f78d7fadda8755e6d8f3bdb3266a73c56e354387d81b90b10b669394e91a75bfabaa68c772ebf08a3e5f1eadb7f0e4

Download Submit
C:\Windows\SysWOW64\Cimmggfl.exe

Filesize
1.6MB

MD5
bc694d82c7c05da4d522cd3ceaa6699a

SHA1
e7dec7cb894525be90cef254fbfeed9f426b77f6

SHA256
e10552d7609b0e1e7aecdf5e31146861f6463a5458d7e2732086887ec6ea73a2

SHA512
5e82acd9ce680dd5e05df0cdfd7f7bb106c4381be3522a7ca322879fa0ec4bf64b88720155754c58ee873a3a29c70ae3663851afe1eae118de1c7c742f830929

Download Submit
C:\Windows\SysWOW64\Cioilg32.exe

Filesize
1.6MB

MD5
df090bcb95c7f257fbc382825860bc00

SHA1
f242984548345db4a3300d76b663a1d939d4924d

SHA256
bc0edbe1e5f717c08901198aa2058188149bb095b9139a3d67adf9b839e0e6f6

SHA512
736de00aef8b23cbf579768a50959d536fc237f70f7abd92e7929e493f98b1ed961fe30f479714063e0ed78d08e4f44ffef9f7b2fb4c56fcdc683e3fe98686ca

Download Submit
C:\Windows\SysWOW64\Coohhlpe.exe

Filesize
1.6MB

MD5
a4a5d458ef071dcba8e71fc28187e309

SHA1
909a71e655ea63946cd918742e6fdd972ee9831b

SHA256
f96e6165d1e71838c6f97be9cb84b8d49edf292ca511435ae08e3fdd29ff7456

SHA512
ffacc379294076308c1579ad453fc9eb38cfa758dcae155dbb34dee0a6bbf4a8a526e470d1e2904b139ed55ddbc60b2dc5b2dfeb6a5c8047a5fe948cc5b6480f

Download Submit
C:\Windows\SysWOW64\Dckdjomg.exe

Filesize
1.6MB

MD5
a4859d1942c9b4585d1ae7e558dc4f6b

SHA1
f5c0906e6d84d7e0bbd2adb1c7c010d22bca49ba

SHA256
4fb98d0fb6eb72ad7c6496f150a9cdbf86e650242591e1f7075f2d8fa0ac3059

SHA512
eb69de6c8362ad8fe6995fad9f9a63823f921575a9b3f262463e398136d2415cba036cf495ec8c223a4110da9f5c57212b21b30c8a72e378b8be0f6c07c24c4f

Download Submit
C:\Windows\SysWOW64\Dflmlj32.exe

Filesize
1.6MB

MD5
228684b2ae6d6b0a64cf41f03af0f312

SHA1
2c4b999dbf27b11c951d27dfe0ea6e46653f1c5d

SHA256
e8be6eaa85569eb6813ae11b319a00a3871208436550373eb215d776c7686d83

SHA512
f29495858e6577b44e9fab797fec43c4935dae3ea0fa8b5b4c8adf5b29e36071caf6e7ea102a5bbac89aaf00c3c1f2aadfc79e35ed78b75660bea83339edbb34

Download Submit
C:\Windows\SysWOW64\Dflmlj32.exe

Filesize
1.6MB

MD5
a77f2c80a3a1215e51da7913ddbb339a

SHA1
fb9c79eb7aaf53a117412e6a8192090eb62deed3

SHA256
0bfd128d569b8c8514fb5773c38c0dc7c30dc374c63e5bda31687ce8ce3b44e6

SHA512
ae065eb0d9bc15b8802b7a8a934cbddab9308420b723d493ca3224880b3f2231b02d1bf3e106568d3c716a653c3616ef3e5922d930736f5c59e055512f0333ea

Download Submit
C:\Windows\SysWOW64\Djjebh32.exe

Filesize
1.6MB

MD5
9c545f8bd0fad7dc005d0bf6a510dd00

SHA1
d2b760c67feba373f75b561f82bdf8a340eaba41

SHA256
9734c3ac38cedbdf80fbe52ab2d5e722e7ce1ac4cc3dd40f0ad0bc25b2384a3f

SHA512
60c707626c0aaddebe1515f4ee146c0ac45feaf894cf6da2ec43e8bd0fb82a93010b4cc5f692d26b74df3e3b793bc86f1ace179119835891d70ca78d3012a65a

Download Submit
C:\Windows\SysWOW64\Dkndie32.exe

Filesize
1.6MB

MD5
c402eca55e746a19d8d0aad579c84960

SHA1
de1f1eac025e4dcc9c5f0dad91dcc16f6174addf

SHA256
79b72eb999b505367fb3147e44ab37fac497c44e3a496918c1d21cec021523f5

SHA512
b663741218ff10828120d62c347e7c528af5e8a85e7408fd82b30e95df7d575a0e2f14b942846fdd96b90954f05f0aa1017ef3277747a0925f04f3a223c6db20

Download Submit
C:\Windows\SysWOW64\Dmadco32.exe

Filesize
1.6MB

MD5
522f9933902e2f8032fbdfaccee3aa6a

SHA1
8f053a760e964d6a89dde7dbe333560b9653ac00

SHA256
6d9e5167765fb3539be996384abf5cff0aa7050a78ddd96cd66aa6423e4a7e76

SHA512
c7875f158274164dd3b69d4d408ca4563f275533355d0c3bc0aab322e720d3f4072ef522497b479e829780530a32cf3ba12c95956ab8c399fa8606ace7a45a76

Download Submit
C:\Windows\SysWOW64\Dpnkdq32.exe

Filesize
1.2MB

MD5
2ef5c1367d40213b1a2359f53fc9f698

SHA1
1382d46a3e4935533f9bf6259361ba36719779d2

SHA256
7504915adc0edd740f17f78cabeba538dc2bbe75f6ee773f422c535f2160035f

SHA512
bb05b0396ab12773d1569d1557f0b9638d144f8774fac6cb365426e6a25800db86d8d18536210f29d6fc52b208177bd0ffd1106280138dc54f860450449a1485

Download Submit
C:\Windows\SysWOW64\Dpnkdq32.exe

Filesize
1.6MB

MD5
6142c9223b7a7e2d9945420f2285c8c7

SHA1
3935cf208dc92e527402dc181994374d83ab7b0a

SHA256
9dfec7c11adef6105c807e75b7ab47d38561735d0fae625dcd0b1149e57421d0

SHA512
4675319f10a77c5d8ee8c157c58745c35e92e87f9aacae08f836da113632a9addcf86d59ca86796852ab029ad953be1fff0e622fa1f10feccb522b172cda4638

Download Submit
C:\Windows\SysWOW64\Ebdcld32.exe

Filesize
1.6MB

MD5
a72e05cb204b497fb24ad67a2b3ccc0a

SHA1
acf265c6f63fd59929a5f57a0cb6930b43344dfd

SHA256
f11f0ffb3104198af98d6344ae0bcdfe9052cfdefbaca880e3ce53e15d477553

SHA512
0144890c0eb214285c763c58438a37d06d02e94a89d1d43e99f53d96e46e71906204177f2858356959c93bae41978db3845fab340aabcfb0f821030353e43324

Download Submit
C:\Windows\SysWOW64\Eciplm32.exe

Filesize
1.6MB

MD5
86f2d85b7b43cc1ec452c26ca982793a

SHA1
2129994ae7ff9b76c4fcdf29984e52c5495713c5

SHA256
d4ae823615244613301f47b14c52cec0bc09e1d3b3fa7d25fddf8e6d10595fb7

SHA512
0ff009129d71b06cfe3b2abb5b7bd47da3633861062e0e189ab37bff0202cfc534efa836301c1f4c8eb5961a1aa36b66c4604477b77d2730c618f1dc67b5968d

Download Submit
C:\Windows\SysWOW64\Eidlnd32.exe

Filesize
1.6MB

MD5
6793ea0151c67249c33829a1b7f37987

SHA1
7026dbc29ff95e8e62297152630e16215b2bb1f3

SHA256
f6cb1257f41de4387ee775401c6c7550f7b333241a88500e96369dea40c01a04

SHA512
f87f615751d63ff86336706fc20d846378648164baba2a6cbcae97ad94c708e67e8c3b36505d165b5ba676e66394aad310b91c7e7c8fe0c1762bf498574ff9c9

Download Submit
C:\Windows\SysWOW64\Eifaim32.exe

Filesize
1.6MB

MD5
cff9e56dc811abbb9428e90b1a5d3a46

SHA1
ba56a17779cd266600ad96ca5fca3b3d5629d8a5

SHA256
b10f3779c170c5d6047225b1827a9be98d8439e803ff41c60ef48fa1ccdf2548

SHA512
c54f367c7db1d848ab64371e80343d77c990dc75b5481e45b850e3f628c4ee418f00c227d79538a0addede547120f600de02ff0928168aa07f5d5faa8e1262e1

Download Submit
C:\Windows\SysWOW64\Eiobceef.exe

Filesize
1.6MB

MD5
aceb2ccfbda3c634af84ece4c1b70b30

SHA1
cb243765ef2e31024bddb6ebdb34da8a99bbe359

SHA256
a2f0c4e5c3d413186ba3d5d7cb3dfa7f4b2ede2d9a242e2e7e5a104dfe38cca4

SHA512
4b626aa7f3924d1e6a3493dd59e67f0b94469798591edd403c1bd30c9c13a13251dbb5b649d4ed807756e99afdb1613c59339c8c4e7f21175d22180c747c32d1

Download Submit
C:\Windows\SysWOW64\Elpkep32.exe

Filesize
1.6MB

MD5
2141511bf254991e688f2e0a3cb17fdc

SHA1
d61c7c94fb08930b9aa5aadf89547fa4ad9899a9

SHA256
bdece07b5548932b1a4ba07c1c99fdfb6b3d7b0fd1f95aa7fcc858b01bfb4d2f

SHA512
463af02fe007606e38f9de5122005cb9bdb136b8fbbf87bbacf1e1f6fefe74eea5cc2df508eb80687e16a0d1111c4a026f90312d6222cf937f07feb93f0150e9

Download Submit
C:\Windows\SysWOW64\Embddb32.exe

Filesize
1.6MB

MD5
46fae52dfde820800addee07e591135e

SHA1
1f58d2e0e2997f97ba02d7e070b1c27dcd54a9ca

SHA256
6c4ea1f85e8ff4fdbe696ee2fe398b8b5b802bcd83a78fa7aece7ca56ffba5a8

SHA512
e9bb3bafee9bf3ea1f65b0ebd755e667b99a9aeae125fcf26f3c752a177979cbcedae3ef0ca789fd9a5cc0f8d8f1e7619cb9002510f6a6ed8e73e073ef91a139

Download Submit
C:\Windows\SysWOW64\Enkdaepb.exe

Filesize
1.6MB

MD5
618a0fa97584aad8e9b3c4e3508fded0

SHA1
716507885701b69d6d7d81e4bbfb673e36758bce

SHA256
963afb59ecbfdb4de6d767c505c293ccf13309fe642f51fdc61b5ac45dba1344

SHA512
3690a51c93e757d4c4a9be186e48a6dd9de751c8dd641746b31dfc1be52b50978ab985c161c799bc5038554203cd4a7c99ee162cfe32674639bed85316674a93

Download Submit
C:\Windows\SysWOW64\Fbfcmhpg.exe

Filesize
1.6MB

MD5
070fd9b55b2bad888b5b044d6575ab5a

SHA1
bdf9a530c666d5bbb5d7a55035882a8ef7222ae3

SHA256
c900d760deb10d992327f893ca49c94a7ddbdba217cad4bc270cf7710b067e8c

SHA512
b95451f3881476c64247692cb9eb0ae916b9b0af3b8333af1bd2559195eccaf616ed57132d4fa727018c06e9e2d54b329908b9d9ecd8d8e2503b9a9816e8372a

Download Submit
C:\Windows\SysWOW64\Fibhpbea.exe

Filesize
1.6MB

MD5
119c9c465085226765d2a9ebda405e0f

SHA1
d405b919c0dc5803a60a472b51498d2609f5dd9d

SHA256
01f95c272ea91d68de74e54c18ec2ea66c16bd330367cb3a975f0e0aa3f1c935

SHA512
1c03e899dd31ad3d62f94f99e970aec3d65769515005782323407469fd9e1a90783f6852a3d80041930006a4b7c13c3883f56b55ea10c9a11a28579758fd8052

Download Submit
C:\Windows\SysWOW64\Flinkojm.exe

Filesize
1.6MB

MD5
ed7484e19a518eb9a2a730d63f36d660

SHA1
9432d87f6ff62ce73de43581085d49a784bc69a3

SHA256
a882b82efc46e214edfaa59afedb970d62215552668080e6253089705075358f

SHA512
c2e82eb4dc2a40c3ad95f0525a6e1f4c7ac72e6634bc203955114cba0a9671e76472beb8197fa47f3cd9e83e67bb9d0dc4cf13a03fbde5b415fa2691041afedc

Download Submit
C:\Windows\SysWOW64\Fmpqfq32.exe

Filesize
1.6MB

MD5
ba33a42d47b76fab5c593f18449e48e2

SHA1
9da5fd5f5310db5eaaf84b38c104f56f39f66247

SHA256
67a748ba8d635485d626d046b54a96f96d055479f2c61ea62d83365d57a3fba6

SHA512
ad79b6690ed3862cb96e0ab9403b71a0b0d188d26ee8ae39f3c09ac45029c74ca8dc513dfaf954e42aa3a67a554adecf984486d0924080a2669566f33ede6c71

Download Submit
C:\Windows\SysWOW64\Fpgpgfmh.exe

Filesize
1.6MB

MD5
1aadc007eee605a7edd322b0d85d2703

SHA1
a39d15c4073a20c1a1fb556e7ee816d667abddb3

SHA256
6759458f972231f12e95c6c4c5a716582a3ff26e31166203c517689bcda31ba6

SHA512
44c6be09af2a377a6533a66dcf6927beaf9abed82b6616c972656af8b8163a7abfe4027c9da46472fbc5e6091359f7e60bd762f03256a3769d43007c7a76cd48

Download Submit
C:\Windows\SysWOW64\Gldglf32.exe

Filesize
1.6MB

MD5
2e06797ab0ce265c72f63d642a68cc72

SHA1
8b714f02a2c39c428dabdd765ce13ce4b7e4390e

SHA256
9f5c4d82bd6c9cafdf694d4a9a6cf735a31e99e0e17e5b21ff4ff406bf9d544c

SHA512
1c0095c38b0229cf0ecf4b2a1e3abadd0be85e8e1d35859a70a2fcdad9b5d29df7d9d91f4673fe343be8725b3c44eb159f034433226383599bcd6a054db4f13c

Download Submit
C:\Windows\SysWOW64\Gmdcfidg.exe

Filesize
1.6MB

MD5
733528ecd7f51fea9caf4102ca841d52

SHA1
f350c8cbc5fca3bee01f83965b4c843760b11d22

SHA256
7d9778d58c8af53f130b768dfb01240889601d8fa49b3ce00fd54f8a940dc3ae

SHA512
601407e2d8601a3fe7f711deb50568e3b7ee72ac3631340a4e7abb48290bea6a8aaa84e3b0981c7dd3c21366158643859281effd8dcfcdccfa887c9126dd3a53

Download Submit
C:\Windows\SysWOW64\Hkbmqb32.exe

Filesize
1.6MB

MD5
b3f0ab4314f8fd5ad8ac536783f8facc

SHA1
10b0e45f700865c2179e0ef22e1163642456eefd

SHA256
4793b0b58d73b4e35e11cfa1396b687f934c5c8fc4bd793e40f3d7d7dd8499b2

SHA512
84113b9cc16fccb950cef2c3d9d241285f613240197727fcd3296eb1fb7d21a97a27b16807536b7a7aa0215b0ad32c5ee5b357e595a540b165c16a7f6cc6c585

Download Submit
C:\Windows\SysWOW64\Hlegnjbm.exe

Filesize
1.6MB

MD5
eac07b4085a0e974936b3cd1f83e3a1d

SHA1
c02d057fd07eb586386c02985ae9d27ea5a799d8

SHA256
32095904e11cdd072b82e14e167d55e68a4e2c6696003bae4bc07e40df8d8670

SHA512
46ed3592df81e56f837d825503d33879c87464aee51cf917ef73483baa22bc67686aa426ea852602e5b59152b76f5e281ee85c4d7e7b2cb89e3a013e73d020e5

Download Submit
C:\Windows\SysWOW64\Igfclkdj.exe

Filesize
1.6MB

MD5
11dc0dcef164cc343e61f22b18429651

SHA1
90e3d0786d47a7a7db4bcc3fb09a0d092d119fb5

SHA256
ec8cb36825a23e6617d661d0bc17b4f1ac8ade02d5904315a7bc80bad072e075

SHA512
a6c909d0974d019119469ac2e5c30240213df48afbceefefa5a199484eaec661c4b1c356fe2c06f2390c7e222e5de3c1ab0d421d0a6805b66e69813d97f3eecb

Download Submit
C:\Windows\SysWOW64\Ikkpgafg.exe

Filesize
1.6MB

MD5
8fac500b84a6fd1f9f80737849b604dc

SHA1
a6b39c3ef62bb5eac5435b5c856bd4ea12e41ff2

SHA256
ecb8f62e83a0585243aebc140e84e2bf69acbeeb6d598acd69590deeb4e174c9

SHA512
962a03d1ba741f78645d1bb3b03bf0920168c5e5cdd3091bad8a682c4d8529e08fcbcd62ca44d6107eb233b0f5281c6bda7612b3b13d92231b6f9d4cc9a3189d

Download Submit
C:\Windows\SysWOW64\Imgicgca.exe

Filesize
1.6MB

MD5
cf63950fffcb983e0b672ae94f36028c

SHA1
37a3211038924b1a9f40f1c2bc155f189cf3f196

SHA256
14d50b5d931280fd44dff1a907742b766e280fcba239efb7f6109c10bb8aeb55

SHA512
d7226006788a87a7c447385c3401e3b618b7c64b2345ce1dcefe99c00adb13f49a540cf0e46d346501b91f75fd9b284c5346edf2fd6e69623aa051a8b091b3c0

Download Submit
C:\Windows\SysWOW64\Imiehfao.exe

Filesize
1.6MB

MD5
72aff9f93b91b04bbab0dc06ab452cbd

SHA1
8eb1b32e82766a47d5e65ee90a210c1dba09ec22

SHA256
597026f5ff8d1e45936730df8f4c6af84e587c239f31b3a5af061b1a545494d5

SHA512
519ff918d7c2d6ff41defeb5239982b846cd3405ff72c0e7aa19cbe9e1bdd9b44e448cf3958f864441a611d13477effd099f92bf2447e6e7f12795516eb8cd5e

Download Submit
C:\Windows\SysWOW64\Ipoheakj.exe

Filesize
1.6MB

MD5
2cc42fd466fd18cfa9b0e6e537df1f2f

SHA1
2e5930e53a881f525a0cf9003b3f2315c3ee110a

SHA256
63cbcf0d41725f48a0db121807d39d1161309b50b310debd5cf58c3e729e732e

SHA512
f270207bc95d1347318fbc072774417681bb7334ce6926d6e92b4106fbd9e41f20eead6d658fde6d34eb3c0d8b3d5782a938ab0696117fea2ef04f89a7ed7f42

Download Submit
C:\Windows\SysWOW64\Jdaaaeqg.exe

Filesize
1.6MB

MD5
34866cd7213e036e0de7d83e6008272f

SHA1
c3fa5c9cc9d4da270c5a6f90bafb167881064c9d

SHA256
7d56dc65f7eef0338f3395bbf46b18345e1bbf03ae33edeea3a4c6686f431cb0

SHA512
1237bdc34b64ee9d67eb849126fc2c79eb526dff07b091d151b93958e7c04d87b4bbc5b1de89977fb665b5078ecd5f1e4d85688784c762f8c06633ec1aa1e301

Download Submit
C:\Windows\SysWOW64\Jgkmgk32.exe

Filesize
1.6MB

MD5
e9e654ad3f00f6aec0d4a2df29df249a

SHA1
981663197ac9f49b26bbd8fe5a43b30a16adf4a6

SHA256
2a039edd341dfd71ded37c2a49f0f96943c3cd4a9671d7d51ce059f46c8b6e0d

SHA512
fafdf7efe9e30a104420b4a0e4677e1d77d2a0275933392b60fbe2e3b0cdb721e9e44f2e46c24543a03c342a9c8094a034a32cbbe723d929fddff4c5b166379e

Download Submit
C:\Windows\SysWOW64\Jljbeali.exe

Filesize
1.6MB

MD5
61db079c93ea4520829c5597214dc4c8

SHA1
aa5b9a8b7cf636602df7672dd3212842b56076ce

SHA256
4d71977c2da1c358c753a225e023fd0d2f015970f5ae93cd8b548bddc8e4421a

SHA512
033b8c1d59e7d65e10ba2e77f7df42c182c4717616569f721de5ffc9c8e865a6cbac3dc5815e132717e3751dc0cc4df7288acde1a0be3f5dbef1f591cea77148

Download Submit
C:\Windows\SysWOW64\Jnlbojee.exe

Filesize
1.6MB

MD5
b1c0a48b9f7249c3c41d7098e64356bb

SHA1
7711d61c4f16da0a39c6aadcff8047ee1a5b9161

SHA256
234bc1966a53e0046550c5d3414d91d71a1027b05e0212eb66f1505f34f9b1d0

SHA512
fae1c586947e1b69121e6d40b2446a80fc4d937b91abdf741c841964f7867d200010e973213565b4c68d09125d742ff71f0c34d053e603e21f3d76673258bca8

Download Submit
C:\Windows\SysWOW64\Jphkkpbp.exe

Filesize
1.6MB

MD5
105f68110cdcd25bf83c1e81910cdbb9

SHA1
d4753c472005c644f715f13531c84bedc2108482

SHA256
2ffa68ba3a2192dfb27c4aaca1d97d933951a11271e4ad05fe8ec3b73b64a962

SHA512
29a8fd2075d2404cba1d43b443370ffefc28075b6bdb4fe5d0579c201b67b953adffe6965e9f6358987427d4b3f8f8c33283b25547d9f0507f59b61d2fa9b3bc

Download Submit
C:\Windows\SysWOW64\Kegpifod.exe

Filesize
1.6MB

MD5
1d1b399f7e5afe18f4f573f52d955be3

SHA1
b9dd1acc38389e89499ea21363d8ae887c679736

SHA256
b18176017f4a5d4e18584c244e964de9eb26b5b91c3be8fada5c6be184fcbc55

SHA512
8b5f314956aa853b3894861781959c082d713a1dcbe380ff87a0878c61096a5491ccd91f6e14fe3553b848a2c3c54d501c8aba7e9e89ee8cae76605d3a6faaee

Download Submit
C:\Windows\SysWOW64\Kifona32.dll

Filesize
7KB

MD5
1ebd213071d585a1e50ae4c15c2ab82f

SHA1
6e79ac5a6910e7e7ed0e128c4ae348ef4f65588f

SHA256
aa8e7ca471bbf618fa137bccdb82cac0fafa0d77f3d93f0f7e108d3713b03c84

SHA512
0ee768459d4159d6c9be92ca17dcccbe2c92ac1d26ffa54465cbe07d6ac8023f0b8ce15cfa493695b7cf4c1c1d0d62bda060039498b01c4e30a875ee0434740a

Download Submit
C:\Windows\SysWOW64\Kkgiimng.exe

Filesize
1.6MB

MD5
9d5050a2513253e7546e3c251a3e3e89

SHA1
cd1719c34e16789488191276fbe3086bd51870db

SHA256
f99e37c51e786508026b35e47fa86bf5ca01f2d4ab3d330bd62b271a196101fa

SHA512
87039a65ca872f9498093a205121364e8e4d857ff962250bdfe6f063f95aef64bb68a4177745ba082ea5dd78e30e964d11c7523a1d4a5f37407bf69d6e9e5381

Download Submit
C:\Windows\SysWOW64\Kqfngd32.exe

Filesize
1.6MB

MD5
73f2d469196b406545775fc97065886e

SHA1
1a71bdae9e2037f0fd8048979a123f85c694b2ba

SHA256
c33eea730fbffe611329c4737698ed90c863dea997dc97f9d87d7480cb9123e3

SHA512
dcf080c26948b4f6f87659ceeabe1f2198db63551c0818fc4f10399b9af89275b698840b55e4b2d5e63b92a99a1a46a38599e81f7d2706ff0b3ab412b5e3f3b2

Download Submit
C:\Windows\SysWOW64\Lknojl32.exe

Filesize
1.6MB

MD5
3de43499fe54423cad608977f6bb7650

SHA1
ca80cc722337dd725b056cec455265c819ceb0a9

SHA256
80df887c538e4b99184c7a69991e5318f16a53ae33d94e0404cd3a9baa2afa49

SHA512
3170087360957ecba62340cc94edf7e5fff29c473a6ada3018e4af81499e81478284e9ce80eafca3d79c26f8d174ba67bbca90cf02f63e0ef9f04f62bf7bbcb2

Download Submit
C:\Windows\SysWOW64\Lmmolepp.exe

Filesize
1.6MB

MD5
2494a0381f1e4b01f8b2b2f7ea5202aa

SHA1
4f162089443b6a2b4aba65db220526512c8f3c4e

SHA256
ce9d6e2b6602a5322ad33a3e1604efa48d595fe7e54fbaec30aef41c14875b83

SHA512
a935a8631d92a40722dfc4c575aa876826ae81be5175ee4473e16057e311ba4ede8362b274c6d4499d07d5cab15028bb73c56717ab0ddcac76f2f555c0f6789c

Download Submit
C:\Windows\SysWOW64\Lnadagbm.exe

Filesize
1.6MB

MD5
4c30dbf5e0d805313e09dc0f9d34009e

SHA1
dc55ad497cd711f67d0e80fcd9c06661b64a7b9e

SHA256
f7f4259faffb5b5f3f5bada848f353473c03e2d14c6af225fec1cf9648c1fbbb

SHA512
ced061f13ff85c0dffc79fc99a5dd0f3ef13f32e82c2f56f096eee8188bb134af182b6d1839840171aacf9ff6cac42d95475bbc5b3724b666addc5f36117fed6

Download Submit
C:\Windows\SysWOW64\Lqbncb32.exe

Filesize
1.6MB

MD5
30117a660e3dbe2b25647aacc4f9f102

SHA1
2b98852bb7f0e5e3439eb1f77c0153e418a650ff

SHA256
a1bf420b012abeec995083938a2a8260f955ecbf468baeccee21db3b907b402e

SHA512
9b44d9420056003e95643a13a96cd27926c3edf709c83402368d5661b71eb63179100c194f34b5aa0f777d4ccbc311f77fd82d1e1ed87a3c7ec2a27e4434dcb2

Download Submit
C:\Windows\SysWOW64\Mkhapk32.exe

Filesize
1.6MB

MD5
1461a160ccfa5afe6e7a8b2049307425

SHA1
0fe058b4722829c8c8e684ab38af140c6731ff3e

SHA256
ceb60baef5930cf6d326a0e4ece5ac5036b0c1c61c98268448526fff5bfd6d10

SHA512
4d330df795e6bcffc38bbf389fba097db7b3ac35e54460a222186cda4e56248674d91cbb83c991e8cdbc209248814136733dfcd417345e1bd6740130952b0206

Download Submit
C:\Windows\SysWOW64\Mqimikfj.exe

Filesize
1.6MB

MD5
3ed0101366bda38511640e331c5b459c

SHA1
b124e9370a08002275cf539499e3625bc7eab5fb

SHA256
6be265e0d97471821e13bb58b54ae1c6b80d49d811f571d24fe7fcf828a9e965

SHA512
4e66c856273cd12f0845b10120c632a7965bc4e5fda6b2d06143deb459dab6de60205c2b6458b64bd0255408c447305d0527263498ee0cbd98d797ca31492eee

Download Submit
C:\Windows\SysWOW64\Nlcalieg.exe

Filesize
1.6MB

MD5
957807940806a8447bff88af11ae6ac8

SHA1
f54e426b43b6ba507e90eb33c4a5370c531a8d7e

SHA256
8bf85655f40acac5009523c5452cef48fa4d1e3756179a9c0bf79c776a60e230

SHA512
9ef3c8d5f384b623a8cfee3987b5cea30818a892eda96c6babcf884346deb14fed3155f23ceef604c33c3957f17d8ca17b94bf7e9f50639134592e692e136aca

Download Submit
C:\Windows\SysWOW64\Nnojho32.exe

Filesize
1.6MB

MD5
1008480c2bad0ac7debd7e67fa82a060

SHA1
dc38389af9291b1c91c1601509d964d5369295b8

SHA256
5cd5ca8b2f972e0dbc1af6f7abfa7e0f5802f7228fd4c86acfccf873165e59e0

SHA512
77bbd2c964bbc58bb66d021aa16a3cdd90f1ea9fa1c68fd44075816c12fea55cb3a3d33f57246fe03d3ea595bc62f58903d756ed1c83d2a30ee93d5b25298f9e

Download Submit
C:\Windows\SysWOW64\Oacoqnci.exe

Filesize
1.4MB

MD5
5e2fccb3ad05fe9b36fdcc7c9c33ed1e

SHA1
ec037e0bf0296662e107d69c194d805d074dc98e

SHA256
fd55658fb81797dd89442d07ff1ea7bbf6ea2a5da725ab6dec9832fcfbc05e8d

SHA512
5ce5a825978150d62e0e5866a23023d400d42ddcb88314a72ac0579b15912af2f33245391e08365db6bfbb61861910eb0e082c78b185590b9c3f8e1df7986c3f

Download Submit
C:\Windows\SysWOW64\Ohlqcagj.exe

Filesize
1.6MB

MD5
b78bf72335456349dbc6a5422ec3e882

SHA1
c2ca675cd77e739c7994631cfcee4538e74d2f59

SHA256
d47b77422fbea7d1205e99e5612777e101a54f728f48f2d4ff6213ff5aaf57fb

SHA512
151c90bbee88405c5548bea75dcd2a6484853297aa17cb074d9127a8eefa0b54c9661a1d53c562c2e330de3ae70ef33032be9aba8ec5cf5f860e983a0b41ca6e

Download Submit
C:\Windows\SysWOW64\Olanmgig.exe

Filesize
1.6MB

MD5
a8cfaa86da024c2a22b8a7d16f2aa2aa

SHA1
4bdac11ae343276fcde7d33ad1941c11c1ec68ce

SHA256
e309668ed9b8323d18559183e6d2243ae74594b3420aa95519dd8d6604ea5cd5

SHA512
d72ae7022d2470ed8b568bbd94c29ace1ad73969be36619c63b9eeadf6d06dd219d7ea81766866080cce73a31ea83379b9f2cbb5861e51891054db5ff4cb8c3f

Download Submit
C:\Windows\SysWOW64\Onapdl32.exe

Filesize
1.6MB

MD5
88a1f785682eba4848265ded662187ee

SHA1
1e61b0e19af5a49e07882ddb56991bdd70d8809c

SHA256
b2729c3b4fbc9d2d2a8cbf9a6e4b288e292495b19ff8f54c7e988ed00e97fe21

SHA512
59fc15151d7a8d32c34f5813aa1f6214ca297764d51494bdfeda0deac83654db80d5fc2de4f49f69de7bb88bcd7382b04fd8f4c85e9fdc0390149b80fe15f82b

Download Submit
C:\Windows\SysWOW64\Pcjiff32.exe

Filesize
1.6MB

MD5
0c05adb883a457bff8f8206f46ac5ba6

SHA1
cce4c36508b56c88995593d48015d2e8e547e2da

SHA256
7f39a686fe40969a70e0d3e25a953d74bfc15d2d325ba90439d7c36f61848ee4

SHA512
c3916f35509b6dacc113e6b3e7054df4e7939e805aaf5855e25fdad7c7571971600c5bd9292c53248f8f03c63c5e75fa2ca1702ad0256282f8254d2b3a18efe3

Download Submit
C:\Windows\SysWOW64\Pdmkhgho.exe

Filesize
1.6MB

MD5
8351abccffc28f1f87fc23434f4fcc26

SHA1
0f223ab0b8e33571e27a9f4234e754297d2eebe7

SHA256
71b002af95b0e3b42cb1d50db7e1485cbddb110958625996d72f9cd269af852d

SHA512
0b33d91364ca18d29e0bd668710b40e2b99185748d6e530d8028d98bef17b29053fe97e59d05fc62c3eec96afa5d40c85452dd935aeaf64b4c6a4cf79e3d5811

Download Submit
C:\Windows\SysWOW64\Pfdjinjo.exe

Filesize
1.5MB

MD5
a0b7cb786aa2230bb7ca5a85038bef17

SHA1
411ed747f1ab28776e516a5087f63f601d8e3ae7

SHA256
053d6cb0408e84e49a52d34d22d55c975e11c5f5067cdd2e5cabee583355d478

SHA512
cb01e68561b5adbe592b075a4a1d04fc09aca88e85725385a9fce2c089fede62c2c67dc54dbe9128ba43561799e8ee4e74aeee5ee1d8b18663c7cccba339daee

Download Submit
C:\Windows\SysWOW64\Pifnhpmi.exe

Filesize
1.6MB

MD5
8d7bf605882d3e89591dc9dbdb98aec1

SHA1
a832bc2921f5d0ae6b050e5448d742b31d3e6ff2

SHA256
e40dd159a1f9c7c233e3bbdfb92b66c2da74b87619e1e2375d745f47fa7285a2

SHA512
526fdf75ab9389aa92e8e7d5aafd530b4fc2fa901b3fd98e6cb7c423eedb741e6ad393e59fc0940d985a5059e2a1cb8ebc427ff2b87cb1cf8c38067887a0cb93

Download Submit
C:\Windows\SysWOW64\Piijno32.exe

Filesize
1.6MB

MD5
7c5013bca334d577317e04904a7004f1

SHA1
4dfaf641d6d5a8eb3f3350b72d319f2adf1a0219

SHA256
b68d8a85822827931902a8a864c07244c4e63f788f385b7cc027ed9e748d4a95

SHA512
ce9a4f0de37b80225e7ab400ecbc5616b5ea2639787762085a6aeb9fdef84153a48997dace6807cecc88cb1695d87815dac1bb357644784a1ffc67374a7a88eb

Download Submit
C:\Windows\SysWOW64\Pjbcplpe.exe

Filesize
1.6MB

MD5
f7ecb1332065b712fb0a19ac8eb6976f

SHA1
e4d26595e4c5dcee28f85729250f2c2e646ad820

SHA256
b1071b26bda365007649a670dc768467fbfd29d7bfa21ce756c65aebf4c8e87b

SHA512
143e16703b1a1756a48ed977a4cbe1d9806ccc9c1fa200003b76fb476f120af7e7db6849c7bdcf1ab925d35cc357f6d9bd7dd0f48eaba2cd147dea1615b67860

Download Submit
C:\Windows\SysWOW64\Pkbjjbda.exe

Filesize
1.6MB

MD5
04cecb412f650cad4d34c789ad667e0f

SHA1
49bb4ef8cea9cd7cd47ce22f9c9b7ee1f6a01eed

SHA256
7d9d833ed2cf61d909e45caffa57b5f4785cfbbcc285a561b7abe14da555bd1e

SHA512
8588be5d89acf7cadb4a019e0b3a221497e51dc9c0d56cc577b7ff878373bbb217919f8acc9fe67845b8a1c1ed7a2446d3f25f410a7b25cc92d630cfd1c456c8

Download Submit
C:\Windows\SysWOW64\Pkegpb32.exe

Filesize
1.6MB

MD5
6c793a6c8a7a0cc69913a1b36d6b2fab

SHA1
f8c4290e64f6191337a855f176097293781c4c91

SHA256
d3c0a24725d85feea89171658cdaa92e7d1641c7c430b38563b74e578062e0f4

SHA512
abbf87ba14fdd05d1cc056cd4d11e35bfaae667c9e19fcfb4cd6790835ca449a593b2e5045a2774256235782cbe9020d85e8d719982fa86bbe5159a52bf8ee83

Download Submit
C:\Windows\SysWOW64\Pknqoc32.exe

Filesize
1.6MB

MD5
da4f154a2f8d86e9de688a533758cb55

SHA1
44c9e9b0da2693b9db68424d3e1d28e060523eb7

SHA256
88bfffc0eb6de768911678cbabbc564a063559ce7aea5cbecae386cf3c030d71

SHA512
a1da8af8f228e7f9b251d650670ce90ab846e2ca4f32cc1fd6c2d59f58b61265f5fd8614e9270ad39d7aec7bade4264e4d53cb39aca4d50445dbe65885d3a8a7

Download Submit
C:\Windows\SysWOW64\Pllgnl32.exe

Filesize
1.6MB

MD5
73bbf8ec7a964146c1d718cdb91eedf1

SHA1
3d065bf2458b78b84fb2d301305dfc70c682e52c

SHA256
fe31724923f507ff8a2d2943c2097571dda4a6589c8771289edc13fecce365a1

SHA512
532628627ee6c27d879719dfe5b89839d097c5ec7d314f2383abda658760a8ed9c207a49e0f9b1cffef6012b3c5ae22d8b72254f127b199281d06a8308c19eb4

Download Submit
C:\Windows\SysWOW64\Polppg32.exe

Filesize
1.6MB

MD5
b62380aead82df7bcf0927392a0155ec

SHA1
44e50e839d410c68fab1016135b21f2550f6c2e6

SHA256
7653df4787de93b477718155798d733c043d4bd4d4306c3a6baa67212676617f

SHA512
dbc83694b23cd7bb1abc0f7ce9bed0d98a4d5751b84cdeee868c6969060aad82c66b529fe6db3f76c4b4b5eeaae31d7b8d431fc5f7ce90f45deb58ca21e77749

Download Submit
C:\Windows\SysWOW64\Ppgegd32.exe

Filesize
1.6MB

MD5
98ad7a8d563a37f30435ff29bd22e33c

SHA1
73b6a37941d0fc6f76a91700b7e92b154b8c66cd

SHA256
30e41cc56a19dd8305dacde682e103c216a0cf06fc1cb8229c349431cd13e3d7

SHA512
fea946401d76f399fbc4472ca7f54705bd704f8cd9fcf4402064a2a3a32a9fe311378e11babb45fe4f54082db50f846b5f6650be52a87629db26df714e451228

Download Submit
C:\Windows\SysWOW64\Qcaofebg.exe

Filesize
1.6MB

MD5
2979dac0cb668df89e150b25b8175a12

SHA1
01df9eb89cdd740fc16be9f0f0d31a262d84ba60

SHA256
a2d34106637de315bd1a34424bbedce06e54d9bb941c07b3949ed81c5bb54b63

SHA512
baba8aefa44e882b67fe83019a9f648b16b3436b4c7943df30100131ea79b95484edd542e0f6b9231b1d292ba89db8c26863d5acf11331c2a4ab906e684f90aa

Download Submit
C:\Windows\SysWOW64\Qlimed32.exe

Filesize
1.6MB

MD5
ad3d2ced9015faec3db1e519be32162a

SHA1
ad619700de7ffa74bd65af4e106ed41cd0cfbd73

SHA256
61f51565fd0ce3134350eee3db8e8403a9abe06ae909353748724e43fb67bef8

SHA512
279d229afd06accf677ec0647533c50a7a6d990a101160a8d2d94e5d9dd4b494f073f47dbfe71716a75065dd503133cc465c810574804fe21e47bd4871954422

Download Submit
C:\Windows\SysWOW64\Qmeigg32.exe

Filesize
1.6MB

MD5
4dd2c5c67cc6166ee0ef0cecc1594f84

SHA1
ebc1fff4fb78ae2c65f326c7038e48af41e68124

SHA256
4406549d862f38b3d245ea715d91674338405930cc0dd299ecf5f0ca8e823229

SHA512
ed3717825d5dc2128e46d1637c30c030edcc6d5e0474cd1a8251cee5eaf33ee45dda83864d3f8e0e41402dfb83e6f5dd93a6588f38a0df83bb4732c150d4a2b9

Download Submit
C:\Windows\SysWOW64\Qodeajbg.exe

Filesize
1.6MB

MD5
18c92bfef5cfd838e9676417b98bc6b5

SHA1
34dc63b1fd55bb7fba54683cb5dcd256832f342b

SHA256
b80c94af4ac2d71020fb8020e15cacb9a218a7363d364bf0356b80041341ab78

SHA512
a7a1592bd8c3c40d495a9aeba8f77643c18ce6b53e7a75b56d4018a53209091bf61f82c2a7374b09d7f2182d618e3d0c2f99eb925c0ebe331105d8cdda6a4799

Download Submit
C:\Windows\SysWOW64\Qoelkp32.exe

Filesize
1.6MB

MD5
d672a50a34966fd3c00f81b4e3c9feeb

SHA1
29b8409833aa5351cd5dd07a7610eab8fd36c2d1

SHA256
164fcd32f719af5992d96c61ee6279b9eea213d46af574b1d05e3d18fca90448

SHA512
bed01f57d4b1d878f12a596b1e2f7bc166c73ecec6ce70c9407ebae9351131b8e0ba8e7150873fe6fd11104c7153a9a8a9220ba67924c85ab019a7f01c4b6a44

Download Submit
memory/212-328-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/212-397-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/440-142-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/440-55-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/768-342-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/768-411-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/876-224-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/876-306-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/968-404-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/968-335-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1008-412-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1136-321-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1136-390-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1196-300-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1196-369-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1364-348-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1364-278-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1392-169-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1392-80-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1628-384-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1656-355-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1656-286-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1680-363-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1684-151-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1684-63-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1720-242-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1720-320-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1828-349-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1828-418-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1840-31-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1840-115-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1920-268-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1920-179-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2024-98-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2024-187-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2100-293-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2100-362-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2208-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2208-79-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2376-206-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2376-292-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2380-250-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2380-162-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2988-215-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2988-299-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3028-241-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3028-153-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3240-370-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3312-178-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3312-89-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3376-196-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3376-107-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3384-15-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3384-97-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3432-376-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3432-307-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3572-391-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3616-259-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3616-170-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3660-356-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3668-205-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3668-116-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3680-39-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3680-124-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3724-88-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3724-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3816-133-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3816-47-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4000-377-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4052-277-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4052-188-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4132-160-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4132-71-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4460-419-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4480-106-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4480-24-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4492-134-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4492-223-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4520-314-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4520-383-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4612-251-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4612-327-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4632-269-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4632-341-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4668-234-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4668-313-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4692-143-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4692-233-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4696-260-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4696-334-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4820-197-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4820-285-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4904-125-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4904-214-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5076-405-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5100-398-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads