berbew | acbe01a6e5e3c5721954746a466f16445732e57a686c5a11c96e0433fd08fa6d

Analysis

max time kernel
91s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2024 22:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

acbe01a6e5e3c5721954746a466f16445732e57a686c5a11c96e0433fd08fa6dN.exe
Size

163KB
MD5

d28bf8c51f89f8672bc521b7560681a0
SHA1

d4ecdd24429b515bb227f98cc7bf52d1d4832726
SHA256

acbe01a6e5e3c5721954746a466f16445732e57a686c5a11c96e0433fd08fa6d
SHA512

ef1df3c389faea355c824aa6f409436458885190281b43d91ae6c508d4c961a3b63876dd6339d2d13b8d58371745be98b3b68d9f69cf83a692006391bbb4555f
SSDEEP

3072:IkA2CW4X3Lkj1o/ulLcB6ltOrWKDBr+yJb:/FC7Xbkho/ulIB6LOf

Score

10^/10

berbew gozi backdoor banker discovery isfb persistence trojan

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://master-x.com/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://crutop.ru/index.php

http://kaspersky.ru/index.php

http://color-bank.ru/index.php

http://adult-empire.com/index.php

http://virus-list.com/index.php

http://trojan.ru/index.php

http://xware.cjb.net/index.htm

http://konfiskat.org/index.htm

http://parex-bank.ru/index.htm

http://fethard.biz/index.htm

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

Extracted

Family

gozi

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjkblhfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npbceggm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogcnmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lihpif32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pemomqcn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afkknogn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmmbbejp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gjdaodja.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fjhmbihg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Alkijdci.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Doagjc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mljmhflh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljkifn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjneln32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Igpdfb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Idhnkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nmigoagp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gdiakp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ccgjopal.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hiiggoaf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dcnqpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ljobpiql.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnjnqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ohcegi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iacngdgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ohkbbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Polppg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eiieicml.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Knnhjcog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iondqhpl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Obcceg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpjmnjqn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcphab32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkpbin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Efeihb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bcinna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdpmbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bklfgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhpfqcln.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jllhpkfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mhjhmhhd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dahfkimd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Enhifi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjpjel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jcbdgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kqdaadln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bemqih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eoideh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocjoadei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfccogfc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oocmii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fjhacf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jnhidk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cildom32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kqbdldnq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcoaglhk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lalnmiia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Llhikacp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnlnbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmdhcddh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fmpqfq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhamkipi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hdokdg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljhefhha.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew
Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Gozi family
gozi

Executes dropped EXE 64 IoCs

pid	Process
2644	Kkjlic32.exe
4572	Kbddfmgl.exe
2800	Lajagj32.exe
4212	Lgcjdd32.exe
1660	Ljbfpo32.exe
4356	Lalnmiia.exe
1588	Licfngjd.exe
2392	Lkabjbih.exe
4244	Lnpofnhk.exe
3700	Lankbigo.exe
4964	Lejgch32.exe
3348	Lieccf32.exe
4024	Lldopb32.exe
2404	Ljgpkonp.exe
3204	Lbngllob.exe
1080	Laqhhi32.exe
1580	Lihpif32.exe
3196	Lgkpdcmi.exe
2560	Ljilqnlm.exe
2080	Lndham32.exe
2420	Lacdmh32.exe
2924	Leopnglc.exe
3684	Lijlof32.exe
1888	Llhikacp.exe
3140	Ljkifn32.exe
2568	Mbbagk32.exe
4232	Maeachag.exe
900	Milidebi.exe
2212	Mlkepaam.exe
2044	Mjneln32.exe
5056	Mbenmk32.exe
2008	Mahnhhod.exe
4732	Miofjepg.exe
2492	Mlmbfqoj.exe
2156	Mnlnbl32.exe
1076	Mbgjbkfg.exe
4388	Meefofek.exe
3004	Mhdckaeo.exe
3092	Mjbogmdb.exe
2208	Mnnkgl32.exe
2396	Malgcg32.exe
3312	Micoed32.exe
4140	Mlbkap32.exe
404	Mnphmkji.exe
3576	Maodigil.exe
112	Mejpje32.exe
4540	Mhilfa32.exe
4604	Njghbl32.exe
3620	Nbnpcj32.exe
2516	Nemmoe32.exe
2140	Nihipdhl.exe
4996	Nlfelogp.exe
3616	Noeahkfc.exe
4160	Nacmdf32.exe
4788	Nijeec32.exe
4672	Nliaao32.exe
2084	Nognnj32.exe
4680	Nafjjf32.exe
1740	Neafjdkn.exe
4304	Nhpbfpka.exe
4664	Nknobkje.exe
2796	Nbefdijg.exe
476	Neccpd32.exe
2700	Nhbolp32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ckpbnb32.exe	Cmmbbejp.exe
File created	C:\Windows\SysWOW64\Icembg32.dll	Egnajocq.exe
File created	C:\Windows\SysWOW64\Enlcahgh.exe	Ecgodpgb.exe
File opened for modification	C:\Windows\SysWOW64\Ljgpkonp.exe	Lldopb32.exe
File created	C:\Windows\SysWOW64\Pcjiff32.exe	Pkcadhgm.exe
File opened for modification	C:\Windows\SysWOW64\Kcpahpmd.exe	Kqbdldnq.exe
File created	C:\Windows\SysWOW64\Ibingd32.dll	Ffqhcq32.exe
File created	C:\Windows\SysWOW64\Fdbkja32.exe	Fnhbmgmk.exe
File created	C:\Windows\SysWOW64\Kioodcbn.dll	Pkgcea32.exe
File opened for modification	C:\Windows\SysWOW64\Komhll32.exe	Jphkkpbp.exe
File opened for modification	C:\Windows\SysWOW64\Pjlcjf32.exe	Pbekii32.exe
File created	C:\Windows\SysWOW64\Egpnooan.exe	Enhifi32.exe
File opened for modification	C:\Windows\SysWOW64\Fjhmbihg.exe	Famhmfkl.exe
File created	C:\Windows\SysWOW64\Nhpbfpka.exe	Neafjdkn.exe
File created	C:\Windows\SysWOW64\Mohokaph.dll	Qepkbpak.exe
File created	C:\Windows\SysWOW64\Knknhqjn.dll	Dpdaepai.exe
File created	C:\Windows\SysWOW64\Hgfapd32.exe	Hdhedh32.exe
File created	C:\Windows\SysWOW64\Clkbmh32.dll	Nliaao32.exe
File created	C:\Windows\SysWOW64\Mfbhmo32.dll	Bemqih32.exe
File created	C:\Windows\SysWOW64\Ekbmje32.dll	Aajhndkb.exe
File created	C:\Windows\SysWOW64\Bbdhiojo.exe	Boflmdkk.exe
File created	C:\Windows\SysWOW64\Bcomgibl.dll	Qbonoghb.exe
File created	C:\Windows\SysWOW64\Qcclld32.exe	Qkmdkgob.exe
File created	C:\Windows\SysWOW64\Ajmdgelp.dll	Djjebh32.exe
File opened for modification	C:\Windows\SysWOW64\Knchpiom.exe	Kkeldnpi.exe
File opened for modification	C:\Windows\SysWOW64\Alelqb32.exe	Anclbkbp.exe
File opened for modification	C:\Windows\SysWOW64\Bemqih32.exe	Alelqb32.exe
File opened for modification	C:\Windows\SysWOW64\Fqeioiam.exe	Fdnhih32.exe
File created	C:\Windows\SysWOW64\Jnelok32.exe	Jkgpbp32.exe
File opened for modification	C:\Windows\SysWOW64\Jqhafffk.exe	Jnjejjgh.exe
File created	C:\Windows\SysWOW64\Aaenbd32.exe	Afpjel32.exe
File created	C:\Windows\SysWOW64\Iankhggi.dll	Lcmodajm.exe
File created	C:\Windows\SysWOW64\Gflonn32.dll	Ofjqihnn.exe
File opened for modification	C:\Windows\SysWOW64\Gdiakp32.exe	Ggepalof.exe
File created	C:\Windows\SysWOW64\Ffobhg32.exe	Fdqfll32.exe
File opened for modification	C:\Windows\SysWOW64\Jemfhacc.exe	Jblmgf32.exe
File created	C:\Windows\SysWOW64\Pbhgoh32.exe	Pafkgphl.exe
File created	C:\Windows\SysWOW64\Knooej32.exe	Kkpbin32.exe
File created	C:\Windows\SysWOW64\Acffllhk.dll	Pmbegqjk.exe
File created	C:\Windows\SysWOW64\Dnqcfjae.exe	Dkbgjo32.exe
File created	C:\Windows\SysWOW64\Mbbagk32.exe	Ljkifn32.exe
File created	C:\Windows\SysWOW64\Ggamph32.dll	Dikihe32.exe
File created	C:\Windows\SysWOW64\Fbjmhh32.exe	Fdglmkeg.exe
File created	C:\Windows\SysWOW64\Plkpcfal.exe	Ohmhmh32.exe
File created	C:\Windows\SysWOW64\Bpjmph32.exe	Bipecnkd.exe
File created	C:\Windows\SysWOW64\Nbbond32.dll	Mjneln32.exe
File created	C:\Windows\SysWOW64\Olhldm32.dll	Jpdhkf32.exe
File created	C:\Windows\SysWOW64\Pcleml32.dll	Jcikgacl.exe
File created	C:\Windows\SysWOW64\Enfqikef.dll	Pjdpelnc.exe
File created	C:\Windows\SysWOW64\Bjdjokcd.dll	Kpqggh32.exe
File created	C:\Windows\SysWOW64\Ohkbbn32.exe	Oihagaji.exe
File created	C:\Windows\SysWOW64\Injmlc32.dll	Dpbdopck.exe
File created	C:\Windows\SysWOW64\Dbkqfe32.exe	Dhclmp32.exe
File created	C:\Windows\SysWOW64\Edbiniff.exe	Enfckp32.exe
File created	C:\Windows\SysWOW64\Hjcakafa.dll	Lomjicei.exe
File opened for modification	C:\Windows\SysWOW64\Nckkfp32.exe	Nhegig32.exe
File created	C:\Windows\SysWOW64\Cdolgfbp.exe	Cpacqg32.exe
File opened for modification	C:\Windows\SysWOW64\Llhikacp.exe	Lijlof32.exe
File created	C:\Windows\SysWOW64\Acmobchj.exe	Akffafgg.exe
File created	C:\Windows\SysWOW64\Dfjpfj32.exe	Dpphjp32.exe
File created	C:\Windows\SysWOW64\Hgmgqc32.exe	Hdokdg32.exe
File opened for modification	C:\Windows\SysWOW64\Inlihl32.exe	Igbalblk.exe
File created	C:\Windows\SysWOW64\Ejlgio32.dll	Lnohlgep.exe
File created	C:\Windows\SysWOW64\Olaqbelh.dll	Cmhigf32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6712	6968	WerFault.exe	773

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Emjgim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bbaclegm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pojcjh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfcjfk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kqdaadln.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdmkhgho.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eehicoel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fmfgek32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qbajeg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gdaociml.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Icnklbmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmigoagp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahjgjj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Idahjg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfccogfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ohiemobf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oihagaji.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pkcadhgm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdjblf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dnngpj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fjhmbihg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fklcgk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phganm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jgbjbp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lqbncb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Clgbmp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lgbloglj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nijqcf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apnndj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djgdkk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pakllc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pekbga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ebejfk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qcaofebg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fnipbc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Omopjcjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lndham32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kqmkae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qclmck32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Okjnnj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmfkhmdi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qodeajbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mhldbh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mbbagk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Igpdfb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fmkqpkla.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kflide32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Neccpd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Plmmif32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeaanjkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjdpelnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppahmb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdpcal32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lancko32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lqpamb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aefjii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adkgje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dddllkbf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hhdcmp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acmobchj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dlieda32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lcimdh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Madjhb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phbhcmjl.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eqmlccdi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lbngllob.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pllgnl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lepglifa.dll"	Dmdhcddh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eppqqn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fjhacf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mokfja32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bcominjm.dll"	Bpjmph32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lihpif32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nekhop32.dll"	Oaompd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hkpqkcpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hdhedh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Miofjepg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Efccmidp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jcphab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kggcnoic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghdief32.dll"	Ljhefhha.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Apnndj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gakiqbgc.dll"	Dmoohe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncliqp32.dll"	Eplgeokq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifhahnbj.dll"	Gmdjapgb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eiohdo32.dll"	Hmnmgnoh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jlkipgpe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ohkkhhmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dagdgfkf.dll"	Iojkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omfajq32.dll"	Mbgjbkfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Inngdb32.dll"	Jcbdgb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jblmgf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fdmaoahm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eqmlccdi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Maodigil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fmpqfq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lggldm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fmfgek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkccgodj.dll"	Fiodpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggpdhj32.dll"	Gpelhd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ibgdlg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Injmcmej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eblimcdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aopemh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egnelfnm.dll"	Fglnkm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eblimcdf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qodeajbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Adepji32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fbhpch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dibkjmof.dll"	Glgcbf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mfenglqf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klndfknp.dll"	Nmfmde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmdkbp32.dll"	Bcinna32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jpdhkf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Afkknogn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lqbncb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eicedn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nmfmde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ephbhd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajndioga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ahpmjejp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ohcegi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bpjmph32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ljilqnlm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aoofle32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qekpedip.dll"	Fmikeaap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Alelqb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hhdcmp32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 2644	4932	acbe01a6e5e3c5721954746a466f16445732e57a686c5a11c96e0433fd08fa6dN.exe	83
PID 4932 wrote to memory of 2644	4932	acbe01a6e5e3c5721954746a466f16445732e57a686c5a11c96e0433fd08fa6dN.exe	83
PID 4932 wrote to memory of 2644	4932	acbe01a6e5e3c5721954746a466f16445732e57a686c5a11c96e0433fd08fa6dN.exe	83
PID 2644 wrote to memory of 4572	2644	Kkjlic32.exe	84
PID 2644 wrote to memory of 4572	2644	Kkjlic32.exe	84
PID 2644 wrote to memory of 4572	2644	Kkjlic32.exe	84
PID 4572 wrote to memory of 2800	4572	Kbddfmgl.exe	85
PID 4572 wrote to memory of 2800	4572	Kbddfmgl.exe	85
PID 4572 wrote to memory of 2800	4572	Kbddfmgl.exe	85
PID 2800 wrote to memory of 4212	2800	Lajagj32.exe	86
PID 2800 wrote to memory of 4212	2800	Lajagj32.exe	86
PID 2800 wrote to memory of 4212	2800	Lajagj32.exe	86
PID 4212 wrote to memory of 1660	4212	Lgcjdd32.exe	87
PID 4212 wrote to memory of 1660	4212	Lgcjdd32.exe	87
PID 4212 wrote to memory of 1660	4212	Lgcjdd32.exe	87
PID 1660 wrote to memory of 4356	1660	Ljbfpo32.exe	88
PID 1660 wrote to memory of 4356	1660	Ljbfpo32.exe	88
PID 1660 wrote to memory of 4356	1660	Ljbfpo32.exe	88
PID 4356 wrote to memory of 1588	4356	Lalnmiia.exe	89
PID 4356 wrote to memory of 1588	4356	Lalnmiia.exe	89
PID 4356 wrote to memory of 1588	4356	Lalnmiia.exe	89
PID 1588 wrote to memory of 2392	1588	Licfngjd.exe	90
PID 1588 wrote to memory of 2392	1588	Licfngjd.exe	90
PID 1588 wrote to memory of 2392	1588	Licfngjd.exe	90
PID 2392 wrote to memory of 4244	2392	Lkabjbih.exe	91
PID 2392 wrote to memory of 4244	2392	Lkabjbih.exe	91
PID 2392 wrote to memory of 4244	2392	Lkabjbih.exe	91
PID 4244 wrote to memory of 3700	4244	Lnpofnhk.exe	92
PID 4244 wrote to memory of 3700	4244	Lnpofnhk.exe	92
PID 4244 wrote to memory of 3700	4244	Lnpofnhk.exe	92
PID 3700 wrote to memory of 4964	3700	Lankbigo.exe	93
PID 3700 wrote to memory of 4964	3700	Lankbigo.exe	93
PID 3700 wrote to memory of 4964	3700	Lankbigo.exe	93
PID 4964 wrote to memory of 3348	4964	Lejgch32.exe	94
PID 4964 wrote to memory of 3348	4964	Lejgch32.exe	94
PID 4964 wrote to memory of 3348	4964	Lejgch32.exe	94
PID 3348 wrote to memory of 4024	3348	Lieccf32.exe	95
PID 3348 wrote to memory of 4024	3348	Lieccf32.exe	95
PID 3348 wrote to memory of 4024	3348	Lieccf32.exe	95
PID 4024 wrote to memory of 2404	4024	Lldopb32.exe	96
PID 4024 wrote to memory of 2404	4024	Lldopb32.exe	96
PID 4024 wrote to memory of 2404	4024	Lldopb32.exe	96
PID 2404 wrote to memory of 3204	2404	Ljgpkonp.exe	97
PID 2404 wrote to memory of 3204	2404	Ljgpkonp.exe	97
PID 2404 wrote to memory of 3204	2404	Ljgpkonp.exe	97
PID 3204 wrote to memory of 1080	3204	Lbngllob.exe	98
PID 3204 wrote to memory of 1080	3204	Lbngllob.exe	98
PID 3204 wrote to memory of 1080	3204	Lbngllob.exe	98
PID 1080 wrote to memory of 1580	1080	Laqhhi32.exe	99
PID 1080 wrote to memory of 1580	1080	Laqhhi32.exe	99
PID 1080 wrote to memory of 1580	1080	Laqhhi32.exe	99
PID 1580 wrote to memory of 3196	1580	Lihpif32.exe	100
PID 1580 wrote to memory of 3196	1580	Lihpif32.exe	100
PID 1580 wrote to memory of 3196	1580	Lihpif32.exe	100
PID 3196 wrote to memory of 2560	3196	Lgkpdcmi.exe	101
PID 3196 wrote to memory of 2560	3196	Lgkpdcmi.exe	101
PID 3196 wrote to memory of 2560	3196	Lgkpdcmi.exe	101
PID 2560 wrote to memory of 2080	2560	Ljilqnlm.exe	102
PID 2560 wrote to memory of 2080	2560	Ljilqnlm.exe	102
PID 2560 wrote to memory of 2080	2560	Ljilqnlm.exe	102
PID 2080 wrote to memory of 2420	2080	Lndham32.exe	103
PID 2080 wrote to memory of 2420	2080	Lndham32.exe	103
PID 2080 wrote to memory of 2420	2080	Lndham32.exe	103
PID 2420 wrote to memory of 2924	2420	Lacdmh32.exe	104

C:\Users\Admin\AppData\Local\Temp\acbe01a6e5e3c5721954746a466f16445732e57a686c5a11c96e0433fd08fa6dN.exe
"C:\Users\Admin\AppData\Local\Temp\acbe01a6e5e3c5721954746a466f16445732e57a686c5a11c96e0433fd08fa6dN.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Windows\SysWOW64\Kkjlic32.exe
  C:\Windows\system32\Kkjlic32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Windows\SysWOW64\Kbddfmgl.exe
    C:\Windows\system32\Kbddfmgl.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4572
  - - C:\Windows\SysWOW64\Lajagj32.exe
      C:\Windows\system32\Lajagj32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2800
    - - C:\Windows\SysWOW64\Lgcjdd32.exe
        
        C:\Windows\system32\Lgcjdd32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4212
      - C:\Windows\SysWOW64\Ljbfpo32.exe
        
        C:\Windows\system32\Ljbfpo32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1660
        
        C:\Windows\SysWOW64\Lalnmiia.exe
        
        C:\Windows\system32\Lalnmiia.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4356
        
        C:\Windows\SysWOW64\Licfngjd.exe
        
        C:\Windows\system32\Licfngjd.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1588
        
        C:\Windows\SysWOW64\Lkabjbih.exe
        
        C:\Windows\system32\Lkabjbih.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2392
        
        C:\Windows\SysWOW64\Lnpofnhk.exe
        
        C:\Windows\system32\Lnpofnhk.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4244
        
        C:\Windows\SysWOW64\Lankbigo.exe
        
        C:\Windows\system32\Lankbigo.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3700
        
        C:\Windows\SysWOW64\Lejgch32.exe
        
        C:\Windows\system32\Lejgch32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4964
        
        C:\Windows\SysWOW64\Lieccf32.exe
        
        C:\Windows\system32\Lieccf32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3348
        
        C:\Windows\SysWOW64\Lldopb32.exe
        
        C:\Windows\system32\Lldopb32.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4024
        
        C:\Windows\SysWOW64\Ljgpkonp.exe
        
        C:\Windows\system32\Ljgpkonp.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2404
        
        C:\Windows\SysWOW64\Lbngllob.exe
        
        C:\Windows\system32\Lbngllob.exe
        16⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3204
        
        C:\Windows\SysWOW64\Laqhhi32.exe
        
        C:\Windows\system32\Laqhhi32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1080
        
        C:\Windows\SysWOW64\Lihpif32.exe
        
        C:\Windows\system32\Lihpif32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1580
        
        C:\Windows\SysWOW64\Lgkpdcmi.exe
        
        C:\Windows\system32\Lgkpdcmi.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3196
        
        C:\Windows\SysWOW64\Ljilqnlm.exe
        
        C:\Windows\system32\Ljilqnlm.exe
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2560
        
        C:\Windows\SysWOW64\Lndham32.exe
        
        C:\Windows\system32\Lndham32.exe
        21⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2080
        
        C:\Windows\SysWOW64\Lacdmh32.exe
        
        C:\Windows\system32\Lacdmh32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2420
        
        C:\Windows\SysWOW64\Leopnglc.exe
        
        C:\Windows\system32\Leopnglc.exe
        23⤵
        Executes dropped EXE
        
        PID:2924
        
        C:\Windows\SysWOW64\Lijlof32.exe
        
        C:\Windows\system32\Lijlof32.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3684
        
        C:\Windows\SysWOW64\Llhikacp.exe
        
        C:\Windows\system32\Llhikacp.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1888
        
        C:\Windows\SysWOW64\Ljkifn32.exe
        
        C:\Windows\system32\Ljkifn32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3140
        
        C:\Windows\SysWOW64\Mbbagk32.exe
        
        C:\Windows\system32\Mbbagk32.exe
        27⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2568
        
        C:\Windows\SysWOW64\Maeachag.exe
        
        C:\Windows\system32\Maeachag.exe
        28⤵
        Executes dropped EXE
        
        PID:4232
        
        C:\Windows\SysWOW64\Milidebi.exe
        
        C:\Windows\system32\Milidebi.exe
        29⤵
        Executes dropped EXE
        
        PID:900
        
        C:\Windows\SysWOW64\Mlkepaam.exe
        
        C:\Windows\system32\Mlkepaam.exe
        30⤵
        Executes dropped EXE
        
        PID:2212
        
        C:\Windows\SysWOW64\Mjneln32.exe
        
        C:\Windows\system32\Mjneln32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2044
        
        C:\Windows\SysWOW64\Mbenmk32.exe
        
        C:\Windows\system32\Mbenmk32.exe
        32⤵
        Executes dropped EXE
        
        PID:5056
        
        C:\Windows\SysWOW64\Mahnhhod.exe
        
        C:\Windows\system32\Mahnhhod.exe
        33⤵
        Executes dropped EXE
        
        PID:2008
        
        C:\Windows\SysWOW64\Miofjepg.exe
        
        C:\Windows\system32\Miofjepg.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4732
        
        C:\Windows\SysWOW64\Mlmbfqoj.exe
        
        C:\Windows\system32\Mlmbfqoj.exe
        35⤵
        Executes dropped EXE
        
        PID:2492
        
        C:\Windows\SysWOW64\Mnlnbl32.exe
        
        C:\Windows\system32\Mnlnbl32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2156
        
        C:\Windows\SysWOW64\Mbgjbkfg.exe
        
        C:\Windows\system32\Mbgjbkfg.exe
        37⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1076
        
        C:\Windows\SysWOW64\Meefofek.exe
        
        C:\Windows\system32\Meefofek.exe
        38⤵
        Executes dropped EXE
        
        PID:4388
        
        C:\Windows\SysWOW64\Mhdckaeo.exe
        
        C:\Windows\system32\Mhdckaeo.exe
        39⤵
        Executes dropped EXE
        
        PID:3004
        
        C:\Windows\SysWOW64\Mjbogmdb.exe
        
        C:\Windows\system32\Mjbogmdb.exe
        40⤵
        Executes dropped EXE
        
        PID:3092
        
        C:\Windows\SysWOW64\Mnnkgl32.exe
        
        C:\Windows\system32\Mnnkgl32.exe
        41⤵
        Executes dropped EXE
        
        PID:2208
        
        C:\Windows\SysWOW64\Malgcg32.exe
        
        C:\Windows\system32\Malgcg32.exe
        42⤵
        Executes dropped EXE
        
        PID:2396
        
        C:\Windows\SysWOW64\Micoed32.exe
        
        C:\Windows\system32\Micoed32.exe
        43⤵
        Executes dropped EXE
        
        PID:3312
        
        C:\Windows\SysWOW64\Mlbkap32.exe
        
        C:\Windows\system32\Mlbkap32.exe
        44⤵
        Executes dropped EXE
        
        PID:4140
        
        C:\Windows\SysWOW64\Mnphmkji.exe
        
        C:\Windows\system32\Mnphmkji.exe
        45⤵
        Executes dropped EXE
        
        PID:404
        
        C:\Windows\SysWOW64\Maodigil.exe
        
        C:\Windows\system32\Maodigil.exe
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3576
        
        C:\Windows\SysWOW64\Mejpje32.exe
        
        C:\Windows\system32\Mejpje32.exe
        47⤵
        Executes dropped EXE
        
        PID:112
        
        C:\Windows\SysWOW64\Mhilfa32.exe
        
        C:\Windows\system32\Mhilfa32.exe
        48⤵
        Executes dropped EXE
        
        PID:4540
        
        C:\Windows\SysWOW64\Njghbl32.exe
        
        C:\Windows\system32\Njghbl32.exe
        49⤵
        Executes dropped EXE
        
        PID:4604
        
        C:\Windows\SysWOW64\Nbnpcj32.exe
        
        C:\Windows\system32\Nbnpcj32.exe
        50⤵
        Executes dropped EXE
        
        PID:3620
        
        C:\Windows\SysWOW64\Nemmoe32.exe
        
        C:\Windows\system32\Nemmoe32.exe
        51⤵
        Executes dropped EXE
        
        PID:2516
        
        C:\Windows\SysWOW64\Nihipdhl.exe
        
        C:\Windows\system32\Nihipdhl.exe
        52⤵
        Executes dropped EXE
        
        PID:2140
        
        C:\Windows\SysWOW64\Nlfelogp.exe
        
        C:\Windows\system32\Nlfelogp.exe
        53⤵
        Executes dropped EXE
        
        PID:4996
        
        C:\Windows\SysWOW64\Noeahkfc.exe
        
        C:\Windows\system32\Noeahkfc.exe
        54⤵
        Executes dropped EXE
        
        PID:3616
        
        C:\Windows\SysWOW64\Nacmdf32.exe
        
        C:\Windows\system32\Nacmdf32.exe
        55⤵
        Executes dropped EXE
        
        PID:4160
        
        C:\Windows\SysWOW64\Nijeec32.exe
        
        C:\Windows\system32\Nijeec32.exe
        56⤵
        Executes dropped EXE
        
        PID:4788
        
        C:\Windows\SysWOW64\Nliaao32.exe
        
        C:\Windows\system32\Nliaao32.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4672
        
        C:\Windows\SysWOW64\Nognnj32.exe
        
        C:\Windows\system32\Nognnj32.exe
        58⤵
        Executes dropped EXE
        
        PID:2084
        
        C:\Windows\SysWOW64\Nafjjf32.exe
        
        C:\Windows\system32\Nafjjf32.exe
        59⤵
        Executes dropped EXE
        
        PID:4680
        
        C:\Windows\SysWOW64\Neafjdkn.exe
        
        C:\Windows\system32\Neafjdkn.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1740
        
        C:\Windows\SysWOW64\Nhpbfpka.exe
        
        C:\Windows\system32\Nhpbfpka.exe
        61⤵
        Executes dropped EXE
        
        PID:4304
        
        C:\Windows\SysWOW64\Nknobkje.exe
        
        C:\Windows\system32\Nknobkje.exe
        62⤵
        Executes dropped EXE
        
        PID:4664
        
        C:\Windows\SysWOW64\Nbefdijg.exe
        
        C:\Windows\system32\Nbefdijg.exe
        63⤵
        Executes dropped EXE
        
        PID:2796
        
        C:\Windows\SysWOW64\Neccpd32.exe
        
        C:\Windows\system32\Neccpd32.exe
        64⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:476
        
        C:\Windows\SysWOW64\Nhbolp32.exe
        
        C:\Windows\system32\Nhbolp32.exe
        65⤵
        Executes dropped EXE
        
        PID:2700
        
        C:\Windows\SysWOW64\Nlnkmnah.exe
        
        C:\Windows\system32\Nlnkmnah.exe
        66⤵
        
        PID:5064
        
        C:\Windows\SysWOW64\Nefped32.exe
        
        C:\Windows\system32\Nefped32.exe
        67⤵
        
        PID:4560
        
        C:\Windows\SysWOW64\Nhdlao32.exe
        
        C:\Windows\system32\Nhdlao32.exe
        68⤵
        
        PID:2964
        
        C:\Windows\SysWOW64\Okchnk32.exe
        
        C:\Windows\system32\Okchnk32.exe
        69⤵
        
        PID:4696
        
        C:\Windows\SysWOW64\Oondnini.exe
        
        C:\Windows\system32\Oondnini.exe
        70⤵
        
        PID:2988
        
        C:\Windows\SysWOW64\Oampjeml.exe
        
        C:\Windows\system32\Oampjeml.exe
        71⤵
        
        PID:5028
        
        C:\Windows\SysWOW64\Oehlkc32.exe
        
        C:\Windows\system32\Oehlkc32.exe
        72⤵
        
        PID:208
        
        C:\Windows\SysWOW64\Ohghgodi.exe
        
        C:\Windows\system32\Ohghgodi.exe
        73⤵
        
        PID:1904
        
        C:\Windows\SysWOW64\Okedcjcm.exe
        
        C:\Windows\system32\Okedcjcm.exe
        74⤵
        
        PID:3708
        
        C:\Windows\SysWOW64\Ooqqdi32.exe
        
        C:\Windows\system32\Ooqqdi32.exe
        75⤵
        
        PID:1848
        
        C:\Windows\SysWOW64\Oaompd32.exe
        
        C:\Windows\system32\Oaompd32.exe
        76⤵
        Modifies registry class
        
        PID:4536
        
        C:\Windows\SysWOW64\Oekiqccc.exe
        
        C:\Windows\system32\Oekiqccc.exe
        77⤵
        
        PID:4824
        
        C:\Windows\SysWOW64\Ohiemobf.exe
        
        C:\Windows\system32\Ohiemobf.exe
        78⤵
        System Location Discovery: System Language Discovery
        
        PID:3496
        
        C:\Windows\SysWOW64\Okgaijaj.exe
        
        C:\Windows\system32\Okgaijaj.exe
        79⤵
        
        PID:4480
        
        C:\Windows\SysWOW64\Oocmii32.exe
        
        C:\Windows\system32\Oocmii32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4848
        
        C:\Windows\SysWOW64\Oaajed32.exe
        
        C:\Windows\system32\Oaajed32.exe
        81⤵
        
        PID:4948
        
        C:\Windows\SysWOW64\Oihagaji.exe
        
        C:\Windows\system32\Oihagaji.exe
        82⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3572
        
        C:\Windows\SysWOW64\Ohkbbn32.exe
        
        C:\Windows\system32\Ohkbbn32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4380
        
        C:\Windows\SysWOW64\Okjnnj32.exe
        
        C:\Windows\system32\Okjnnj32.exe
        84⤵
        System Location Discovery: System Language Discovery
        
        PID:2316
        
        C:\Windows\SysWOW64\Ooejohhq.exe
        
        C:\Windows\system32\Ooejohhq.exe
        85⤵
        
        PID:736
        
        C:\Windows\SysWOW64\Oadfkdgd.exe
        
        C:\Windows\system32\Oadfkdgd.exe
        86⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Oiknlagg.exe
        
        C:\Windows\system32\Oiknlagg.exe
        87⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Olijhmgj.exe
        
        C:\Windows\system32\Olijhmgj.exe
        88⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Oklkdi32.exe
        
        C:\Windows\system32\Oklkdi32.exe
        89⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Obcceg32.exe
        
        C:\Windows\system32\Obcceg32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5320
        
        C:\Windows\SysWOW64\Oafcqcea.exe
        
        C:\Windows\system32\Oafcqcea.exe
        91⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Oimkbaed.exe
        
        C:\Windows\system32\Oimkbaed.exe
        92⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Pllgnl32.exe
        
        C:\Windows\system32\Pllgnl32.exe
        93⤵
        Modifies registry class
        
        PID:5444
        
        C:\Windows\SysWOW64\Pojcjh32.exe
        
        C:\Windows\system32\Pojcjh32.exe
        94⤵
        System Location Discovery: System Language Discovery
        
        PID:5484
        
        C:\Windows\SysWOW64\Pahpfc32.exe
        
        C:\Windows\system32\Pahpfc32.exe
        95⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Piphgq32.exe
        
        C:\Windows\system32\Piphgq32.exe
        96⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Phbhcmjl.exe
        
        C:\Windows\system32\Phbhcmjl.exe
        97⤵
        System Location Discovery: System Language Discovery
        
        PID:5604
        
        C:\Windows\SysWOW64\Pkadoiip.exe
        
        C:\Windows\system32\Pkadoiip.exe
        98⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Polppg32.exe
        
        C:\Windows\system32\Polppg32.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5688
        
        C:\Windows\SysWOW64\Pakllc32.exe
        
        C:\Windows\system32\Pakllc32.exe
        100⤵
        System Location Discovery: System Language Discovery
        
        PID:5724
        
        C:\Windows\SysWOW64\Pibdmp32.exe
        
        C:\Windows\system32\Pibdmp32.exe
        101⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Plpqil32.exe
        
        C:\Windows\system32\Plpqil32.exe
        102⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Pkcadhgm.exe
        
        C:\Windows\system32\Pkcadhgm.exe
        103⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5848
        
        C:\Windows\SysWOW64\Pcjiff32.exe
        
        C:\Windows\system32\Pcjiff32.exe
        104⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Peieba32.exe
        
        C:\Windows\system32\Peieba32.exe
        105⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Phganm32.exe
        
        C:\Windows\system32\Phganm32.exe
        106⤵
        System Location Discovery: System Language Discovery
        
        PID:5968
        
        C:\Windows\SysWOW64\Plbmokop.exe
        
        C:\Windows\system32\Plbmokop.exe
        107⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Poajkgnc.exe
        
        C:\Windows\system32\Poajkgnc.exe
        108⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Papfgbmg.exe
        
        C:\Windows\system32\Papfgbmg.exe
        109⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Pekbga32.exe
        
        C:\Windows\system32\Pekbga32.exe
        110⤵
        System Location Discovery: System Language Discovery
        
        PID:6128
        
        C:\Windows\SysWOW64\Plejdkmm.exe
        
        C:\Windows\system32\Plejdkmm.exe
        111⤵
        
        PID:932
        
        C:\Windows\SysWOW64\Pkhjph32.exe
        
        C:\Windows\system32\Pkhjph32.exe
        112⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\Pcobaedj.exe
        
        C:\Windows\system32\Pcobaedj.exe
        113⤵
        
        PID:3996
        
        C:\Windows\SysWOW64\Pemomqcn.exe
        
        C:\Windows\system32\Pemomqcn.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4544
        
        C:\Windows\SysWOW64\Qhlkilba.exe
        
        C:\Windows\system32\Qhlkilba.exe
        115⤵
        
        PID:2552
        
        C:\Windows\SysWOW64\Qkjgegae.exe
        
        C:\Windows\system32\Qkjgegae.exe
        116⤵
        
        PID:4516
        
        C:\Windows\SysWOW64\Qcaofebg.exe
        
        C:\Windows\system32\Qcaofebg.exe
        117⤵
        System Location Discovery: System Language Discovery
        
        PID:5148
        
        C:\Windows\SysWOW64\Qepkbpak.exe
        
        C:\Windows\system32\Qepkbpak.exe
        118⤵
        Drops file in System32 directory
        
        PID:5228
        
        C:\Windows\SysWOW64\Qhngolpo.exe
        
        C:\Windows\system32\Qhngolpo.exe
        119⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Qkmdkgob.exe
        
        C:\Windows\system32\Qkmdkgob.exe
        120⤵
        Drops file in System32 directory
        
        PID:5348
        
        C:\Windows\SysWOW64\Qcclld32.exe
        
        C:\Windows\system32\Qcclld32.exe
        121⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\Qaflgago.exe
        
        C:\Windows\system32\Qaflgago.exe
        122⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Ajndioga.exe
        
        C:\Windows\system32\Ajndioga.exe
        123⤵
        Modifies registry class
        
        PID:5552
        
        C:\Windows\SysWOW64\Allpejfe.exe
        
        C:\Windows\system32\Allpejfe.exe
        124⤵
        
        PID:2260
        
        C:\Windows\SysWOW64\Aojlaeei.exe
        
        C:\Windows\system32\Aojlaeei.exe
        125⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Aaiimadl.exe
        
        C:\Windows\system32\Aaiimadl.exe
        126⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Ajpqnneo.exe
        
        C:\Windows\system32\Ajpqnneo.exe
        127⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Alnmjjdb.exe
        
        C:\Windows\system32\Alnmjjdb.exe
        128⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Akamff32.exe
        
        C:\Windows\system32\Akamff32.exe
        129⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Achegd32.exe
        
        C:\Windows\system32\Achegd32.exe
        130⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Afgacokc.exe
        
        C:\Windows\system32\Afgacokc.exe
        131⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Ahenokjf.exe
        
        C:\Windows\system32\Ahenokjf.exe
        132⤵
        
        PID:5036
        
        C:\Windows\SysWOW64\Akcjkfij.exe
        
        C:\Windows\system32\Akcjkfij.exe
        133⤵
        
        PID:2812
        
        C:\Windows\SysWOW64\Aoofle32.exe
        
        C:\Windows\system32\Aoofle32.exe
        134⤵
        Modifies registry class
        
        PID:4772
        
        C:\Windows\SysWOW64\Aanbhp32.exe
        
        C:\Windows\system32\Aanbhp32.exe
        135⤵
        
        PID:4448
        
        C:\Windows\SysWOW64\Ajdjin32.exe
        
        C:\Windows\system32\Ajdjin32.exe
        136⤵
        
        PID:2152
        
        C:\Windows\SysWOW64\Ahgjejhd.exe
        
        C:\Windows\system32\Ahgjejhd.exe
        137⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Akffafgg.exe
        
        C:\Windows\system32\Akffafgg.exe
        138⤵
        Drops file in System32 directory
        
        PID:2888
        
        C:\Windows\SysWOW64\Acmobchj.exe
        
        C:\Windows\system32\Acmobchj.exe
        139⤵
        System Location Discovery: System Language Discovery
        
        PID:5460
        
        C:\Windows\SysWOW64\Afkknogn.exe
        
        C:\Windows\system32\Afkknogn.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5548
        
        C:\Windows\SysWOW64\Ahjgjj32.exe
        
        C:\Windows\system32\Ahjgjj32.exe
        141⤵
        System Location Discovery: System Language Discovery
        
        PID:5632
        
        C:\Windows\SysWOW64\Akhcfe32.exe
        
        C:\Windows\system32\Akhcfe32.exe
        142⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Acokhc32.exe
        
        C:\Windows\system32\Acokhc32.exe
        143⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Bhldpj32.exe
        
        C:\Windows\system32\Bhldpj32.exe
        144⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Boflmdkk.exe
        
        C:\Windows\system32\Boflmdkk.exe
        145⤵
        Drops file in System32 directory
        
        PID:1092
        
        C:\Windows\SysWOW64\Bbdhiojo.exe
        
        C:\Windows\system32\Bbdhiojo.exe
        146⤵
        
        PID:5020
        
        C:\Windows\SysWOW64\Bjlpjm32.exe
        
        C:\Windows\system32\Bjlpjm32.exe
        147⤵
        
        PID:3296
        
        C:\Windows\SysWOW64\Bkmmaeap.exe
        
        C:\Windows\system32\Bkmmaeap.exe
        148⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Bcddcbab.exe
        
        C:\Windows\system32\Bcddcbab.exe
        149⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Bhamkipi.exe
        
        C:\Windows\system32\Bhamkipi.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5684
        
        C:\Windows\SysWOW64\Bmlilh32.exe
        
        C:\Windows\system32\Bmlilh32.exe
        151⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Bcfahbpo.exe
        
        C:\Windows\system32\Bcfahbpo.exe
        152⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Bjpjel32.exe
        
        C:\Windows\system32\Bjpjel32.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5652
        
        C:\Windows\SysWOW64\Bmofagfp.exe
        
        C:\Windows\system32\Bmofagfp.exe
        154⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Bombmcec.exe
        
        C:\Windows\system32\Bombmcec.exe
        155⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Bcinna32.exe
        
        C:\Windows\system32\Bcinna32.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4048
        
        C:\Windows\SysWOW64\Bjbfklei.exe
        
        C:\Windows\system32\Bjbfklei.exe
        157⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Bmabggdm.exe
        
        C:\Windows\system32\Bmabggdm.exe
        158⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Cbbdjm32.exe
        
        C:\Windows\system32\Cbbdjm32.exe
        159⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Cjjlkk32.exe
        
        C:\Windows\system32\Cjjlkk32.exe
        160⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Cmhigf32.exe
        
        C:\Windows\system32\Cmhigf32.exe
        161⤵
        Drops file in System32 directory
        
        PID:6096
        
        C:\Windows\SysWOW64\Cofecami.exe
        
        C:\Windows\system32\Cofecami.exe
        162⤵
        
        PID:1140
        
        C:\Windows\SysWOW64\Ccbadp32.exe
        
        C:\Windows\system32\Ccbadp32.exe
        163⤵
        
        PID:2344
        
        C:\Windows\SysWOW64\Cfqmpl32.exe
        
        C:\Windows\system32\Cfqmpl32.exe
        164⤵
        
        PID:4128
        
        C:\Windows\SysWOW64\Cmjemflb.exe
        
        C:\Windows\system32\Cmjemflb.exe
        165⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Ccdnjp32.exe
        
        C:\Windows\system32\Ccdnjp32.exe
        166⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Cfcjfk32.exe
        
        C:\Windows\system32\Cfcjfk32.exe
        167⤵
        System Location Discovery: System Language Discovery
        
        PID:5220
        
        C:\Windows\SysWOW64\Cmmbbejp.exe
        
        C:\Windows\system32\Cmmbbejp.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5288
        
        C:\Windows\SysWOW64\Ckpbnb32.exe
        
        C:\Windows\system32\Ckpbnb32.exe
        169⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Ccgjopal.exe
        
        C:\Windows\system32\Ccgjopal.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6164
        
        C:\Windows\SysWOW64\Dbjkkl32.exe
        
        C:\Windows\system32\Dbjkkl32.exe
        171⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Dmoohe32.exe
        
        C:\Windows\system32\Dmoohe32.exe
        172⤵
        Modifies registry class
        
        PID:6264
        
        C:\Windows\SysWOW64\Dpnkdq32.exe
        
        C:\Windows\system32\Dpnkdq32.exe
        173⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Dblgpl32.exe
        
        C:\Windows\system32\Dblgpl32.exe
        174⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Dkdliame.exe
        
        C:\Windows\system32\Dkdliame.exe
        175⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Dpphjp32.exe
        
        C:\Windows\system32\Dpphjp32.exe
        176⤵
        Drops file in System32 directory
        
        PID:6468
        
        C:\Windows\SysWOW64\Dfjpfj32.exe
        
        C:\Windows\system32\Dfjpfj32.exe
        177⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Dihlbf32.exe
        
        C:\Windows\system32\Dihlbf32.exe
        178⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Dmdhcddh.exe
        
        C:\Windows\system32\Dmdhcddh.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6584
        
        C:\Windows\SysWOW64\Dpbdopck.exe
        
        C:\Windows\system32\Dpbdopck.exe
        180⤵
        Drops file in System32 directory
        
        PID:6624
        
        C:\Windows\SysWOW64\Dcnqpo32.exe
        
        C:\Windows\system32\Dcnqpo32.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6672
        
        C:\Windows\SysWOW64\Dflmlj32.exe
        
        C:\Windows\system32\Dflmlj32.exe
        182⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Dikihe32.exe
        
        C:\Windows\system32\Dikihe32.exe
        183⤵
        Drops file in System32 directory
        
        PID:6752
        
        C:\Windows\SysWOW64\Dlieda32.exe
        
        C:\Windows\system32\Dlieda32.exe
        184⤵
        System Location Discovery: System Language Discovery
        
        PID:6792
        
        C:\Windows\SysWOW64\Dpdaepai.exe
        
        C:\Windows\system32\Dpdaepai.exe
        185⤵
        Drops file in System32 directory
        
        PID:6832
        
        C:\Windows\SysWOW64\Djjebh32.exe
        
        C:\Windows\system32\Djjebh32.exe
        186⤵
        Drops file in System32 directory
        
        PID:6872
        
        C:\Windows\SysWOW64\Dimenegi.exe
        
        C:\Windows\system32\Dimenegi.exe
        187⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Dlkbjqgm.exe
        
        C:\Windows\system32\Dlkbjqgm.exe
        188⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Ebejfk32.exe
        
        C:\Windows\system32\Ebejfk32.exe
        189⤵
        System Location Discovery: System Language Discovery
        
        PID:6992
        
        C:\Windows\SysWOW64\Eiobceef.exe
        
        C:\Windows\system32\Eiobceef.exe
        190⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Epikpo32.exe
        
        C:\Windows\system32\Epikpo32.exe
        191⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Ecefqnel.exe
        
        C:\Windows\system32\Ecefqnel.exe
        192⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Efccmidp.exe
        
        C:\Windows\system32\Efccmidp.exe
        193⤵
        Modifies registry class
        
        PID:7160
        
        C:\Windows\SysWOW64\Eiaoid32.exe
        
        C:\Windows\system32\Eiaoid32.exe
        194⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Eplgeokq.exe
        
        C:\Windows\system32\Eplgeokq.exe
        195⤵
        Modifies registry class
        
        PID:6260
        
        C:\Windows\SysWOW64\Ejalcgkg.exe
        
        C:\Windows\system32\Ejalcgkg.exe
        196⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Epndknin.exe
        
        C:\Windows\system32\Epndknin.exe
        197⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Efhlhh32.exe
        
        C:\Windows\system32\Efhlhh32.exe
        198⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Ejchhgid.exe
        
        C:\Windows\system32\Ejchhgid.exe
        199⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Embddb32.exe
        
        C:\Windows\system32\Embddb32.exe
        200⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Eppqqn32.exe
        
        C:\Windows\system32\Eppqqn32.exe
        201⤵
        Modifies registry class
        
        PID:6740
        
        C:\Windows\SysWOW64\Ebommi32.exe
        
        C:\Windows\system32\Ebommi32.exe
        202⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Ejfeng32.exe
        
        C:\Windows\system32\Ejfeng32.exe
        203⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Eiieicml.exe
        
        C:\Windows\system32\Eiieicml.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6944
        
        C:\Windows\SysWOW64\Fpbmfn32.exe
        
        C:\Windows\system32\Fpbmfn32.exe
        205⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Fbajbi32.exe
        
        C:\Windows\system32\Fbajbi32.exe
        206⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Fjhacf32.exe
        
        C:\Windows\system32\Fjhacf32.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7148
        
        C:\Windows\SysWOW64\Fmfnpa32.exe
        
        C:\Windows\system32\Fmfnpa32.exe
        208⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Fpejlmcf.exe
        
        C:\Windows\system32\Fpejlmcf.exe
        209⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Fdqfll32.exe
        
        C:\Windows\system32\Fdqfll32.exe
        210⤵
        Drops file in System32 directory
        
        PID:6536
        
        C:\Windows\SysWOW64\Ffobhg32.exe
        
        C:\Windows\system32\Ffobhg32.exe
        211⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Fimodc32.exe
        
        C:\Windows\system32\Fimodc32.exe
        212⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Fmikeaap.exe
        
        C:\Windows\system32\Fmikeaap.exe
        213⤵
        Modifies registry class
        
        PID:6860
        
        C:\Windows\SysWOW64\Fpggamqc.exe
        
        C:\Windows\system32\Fpggamqc.exe
        214⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Fjmkoeqi.exe
        
        C:\Windows\system32\Fjmkoeqi.exe
        215⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Fipkjb32.exe
        
        C:\Windows\system32\Fipkjb32.exe
        216⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Fpjcgm32.exe
        
        C:\Windows\system32\Fpjcgm32.exe
        217⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Fbhpch32.exe
        
        C:\Windows\system32\Fbhpch32.exe
        218⤵
        Modifies registry class
        
        PID:6664
        
        C:\Windows\SysWOW64\Ffclcgfn.exe
        
        C:\Windows\system32\Ffclcgfn.exe
        219⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Fibhpbea.exe
        
        C:\Windows\system32\Fibhpbea.exe
        220⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Flqdlnde.exe
        
        C:\Windows\system32\Flqdlnde.exe
        221⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Fdglmkeg.exe
        
        C:\Windows\system32\Fdglmkeg.exe
        222⤵
        Drops file in System32 directory
        
        PID:6932
        
        C:\Windows\SysWOW64\Fbjmhh32.exe
        
        C:\Windows\system32\Fbjmhh32.exe
        223⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Fjadje32.exe
        
        C:\Windows\system32\Fjadje32.exe
        224⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Fmpqfq32.exe
        
        C:\Windows\system32\Fmpqfq32.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6936
        
        C:\Windows\SysWOW64\Gbmingjo.exe
        
        C:\Windows\system32\Gbmingjo.exe
        226⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Gjdaodja.exe
        
        C:\Windows\system32\Gjdaodja.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7220
        
        C:\Windows\SysWOW64\Gmbmkpie.exe
        
        C:\Windows\system32\Gmbmkpie.exe
        228⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Glengm32.exe
        
        C:\Windows\system32\Glengm32.exe
        229⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Gdlfhj32.exe
        
        C:\Windows\system32\Gdlfhj32.exe
        230⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Gbofcghl.exe
        
        C:\Windows\system32\Gbofcghl.exe
        231⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Gjfnedho.exe
        
        C:\Windows\system32\Gjfnedho.exe
        232⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Gmdjapgb.exe
        
        C:\Windows\system32\Gmdjapgb.exe
        233⤵
        Modifies registry class
        
        PID:7500
        
        C:\Windows\SysWOW64\Gdobnj32.exe
        
        C:\Windows\system32\Gdobnj32.exe
        234⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Gfmojenc.exe
        
        C:\Windows\system32\Gfmojenc.exe
        235⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Gikkfqmf.exe
        
        C:\Windows\system32\Gikkfqmf.exe
        236⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Gmggfp32.exe
        
        C:\Windows\system32\Gmggfp32.exe
        237⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Gpecbk32.exe
        
        C:\Windows\system32\Gpecbk32.exe
        238⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Gdaociml.exe
        
        C:\Windows\system32\Gdaociml.exe
        239⤵
        System Location Discovery: System Language Discovery
        
        PID:7812
        
        C:\Windows\SysWOW64\Gfokoelp.exe
        
        C:\Windows\system32\Gfokoelp.exe
        240⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Gingkqkd.exe
        
        C:\Windows\system32\Gingkqkd.exe
        241⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Glldgljg.exe
        
        C:\Windows\system32\Glldgljg.exe
        242⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Gdcliikj.exe
        
        C:\Windows\system32\Gdcliikj.exe
        243⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Gbfldf32.exe
        
        C:\Windows\system32\Gbfldf32.exe
        244⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        245⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Hmlpaoaj.exe
        
        C:\Windows\system32\Hmlpaoaj.exe
        246⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Hpjmnjqn.exe
        
        C:\Windows\system32\Hpjmnjqn.exe
        247⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8180
        
        C:\Windows\SysWOW64\Hbhijepa.exe
        
        C:\Windows\system32\Hbhijepa.exe
        248⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Hkpqkcpd.exe
        
        C:\Windows\system32\Hkpqkcpd.exe
        249⤵
        Modifies registry class
        
        PID:7260
        
        C:\Windows\SysWOW64\Hmnmgnoh.exe
        
        C:\Windows\system32\Hmnmgnoh.exe
        250⤵
        Modifies registry class
        
        PID:7348
        
        C:\Windows\SysWOW64\Hdhedh32.exe
        
        C:\Windows\system32\Hdhedh32.exe
        251⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7456
        
        C:\Windows\SysWOW64\Hgfapd32.exe
        
        C:\Windows\system32\Hgfapd32.exe
        252⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Hmpjmn32.exe
        
        C:\Windows\system32\Hmpjmn32.exe
        253⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Hdjbiheb.exe
        
        C:\Windows\system32\Hdjbiheb.exe
        254⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Hkdjfb32.exe
        
        C:\Windows\system32\Hkdjfb32.exe
        255⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Hmbfbn32.exe
        
        C:\Windows\system32\Hmbfbn32.exe
        256⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Hcpojd32.exe
        
        C:\Windows\system32\Hcpojd32.exe
        257⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Hiiggoaf.exe
        
        C:\Windows\system32\Hiiggoaf.exe
        258⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8064
        
        C:\Windows\SysWOW64\Hdokdg32.exe
        
        C:\Windows\system32\Hdokdg32.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8104
        
        C:\Windows\SysWOW64\Hgmgqc32.exe
        
        C:\Windows\system32\Hgmgqc32.exe
        260⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Iljpij32.exe
        
        C:\Windows\system32\Iljpij32.exe
        261⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Idahjg32.exe
        
        C:\Windows\system32\Idahjg32.exe
        262⤵
        System Location Discovery: System Language Discovery
        
        PID:7416
        
        C:\Windows\SysWOW64\Igpdfb32.exe
        
        C:\Windows\system32\Igpdfb32.exe
        263⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7616
        
        C:\Windows\SysWOW64\Injmcmej.exe
        
        C:\Windows\system32\Injmcmej.exe
        264⤵
        Modifies registry class
        
        PID:7672
        
        C:\Windows\SysWOW64\Ilmmni32.exe
        
        C:\Windows\system32\Ilmmni32.exe
        265⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Igbalblk.exe
        
        C:\Windows\system32\Igbalblk.exe
        266⤵
        Drops file in System32 directory
        
        PID:7996
        
        C:\Windows\SysWOW64\Inlihl32.exe
        
        C:\Windows\system32\Inlihl32.exe
        267⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Iciaqc32.exe
        
        C:\Windows\system32\Iciaqc32.exe
        268⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Idhnkf32.exe
        
        C:\Windows\system32\Idhnkf32.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7492
        
        C:\Windows\SysWOW64\Icnklbmj.exe
        
        C:\Windows\system32\Icnklbmj.exe
        270⤵
        System Location Discovery: System Language Discovery
        
        PID:7684
        
        C:\Windows\SysWOW64\Jjgchm32.exe
        
        C:\Windows\system32\Jjgchm32.exe
        271⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Jcphab32.exe
        
        C:\Windows\system32\Jcphab32.exe
        272⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8168
        
        C:\Windows\SysWOW64\Jkgpbp32.exe
        
        C:\Windows\system32\Jkgpbp32.exe
        273⤵
        Drops file in System32 directory
        
        PID:7516
        
        C:\Windows\SysWOW64\Jnelok32.exe
        
        C:\Windows\system32\Jnelok32.exe
        274⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Jpdhkf32.exe
        
        C:\Windows\system32\Jpdhkf32.exe
        275⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7184
        
        C:\Windows\SysWOW64\Jcbdgb32.exe
        
        C:\Windows\system32\Jcbdgb32.exe
        276⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7748
        
        C:\Windows\SysWOW64\Jkimho32.exe
        
        C:\Windows\system32\Jkimho32.exe
        277⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Jnhidk32.exe
        
        C:\Windows\system32\Jnhidk32.exe
        278⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7496
        
        C:\Windows\SysWOW64\Jlkipgpe.exe
        
        C:\Windows\system32\Jlkipgpe.exe
        279⤵
        Modifies registry class
        
        PID:8204
        
        C:\Windows\SysWOW64\Jdaaaeqg.exe
        
        C:\Windows\system32\Jdaaaeqg.exe
        280⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Jgpmmp32.exe
        
        C:\Windows\system32\Jgpmmp32.exe
        281⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Jnjejjgh.exe
        
        C:\Windows\system32\Jnjejjgh.exe
        282⤵
        Drops file in System32 directory
        
        PID:8328
        
        C:\Windows\SysWOW64\Jqhafffk.exe
        
        C:\Windows\system32\Jqhafffk.exe
        283⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\Jgbjbp32.exe
        
        C:\Windows\system32\Jgbjbp32.exe
        284⤵
        System Location Discovery: System Language Discovery
        
        PID:8408
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        285⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\Jcikgacl.exe
        
        C:\Windows\system32\Jcikgacl.exe
        286⤵
        Drops file in System32 directory
        
        PID:8492
        
        C:\Windows\SysWOW64\Kkpbin32.exe
        
        C:\Windows\system32\Kkpbin32.exe
        287⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8532
        
        C:\Windows\SysWOW64\Knooej32.exe
        
        C:\Windows\system32\Knooej32.exe
        288⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Kqmkae32.exe
        
        C:\Windows\system32\Kqmkae32.exe
        289⤵
        System Location Discovery: System Language Discovery
        
        PID:8612
        
        C:\Windows\SysWOW64\Kggcnoic.exe
        
        C:\Windows\system32\Kggcnoic.exe
        290⤵
        Modifies registry class
        
        PID:8656
        
        C:\Windows\SysWOW64\Kjepjkhf.exe
        
        C:\Windows\system32\Kjepjkhf.exe
        291⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\Kqphfe32.exe
        
        C:\Windows\system32\Kqphfe32.exe
        292⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        293⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Kkeldnpi.exe
        
        C:\Windows\system32\Kkeldnpi.exe
        294⤵
        Drops file in System32 directory
        
        PID:8820
        
        C:\Windows\SysWOW64\Knchpiom.exe
        
        C:\Windows\system32\Knchpiom.exe
        295⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Kqbdldnq.exe
        
        C:\Windows\system32\Kqbdldnq.exe
        296⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8900
        
        C:\Windows\SysWOW64\Kcpahpmd.exe
        
        C:\Windows\system32\Kcpahpmd.exe
        297⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Kjjiej32.exe
        
        C:\Windows\system32\Kjjiej32.exe
        298⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\Knfeeimj.exe
        
        C:\Windows\system32\Knfeeimj.exe
        299⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Kqdaadln.exe
        
        C:\Windows\system32\Kqdaadln.exe
        300⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9064
        
        C:\Windows\SysWOW64\Kdpmbc32.exe
        
        C:\Windows\system32\Kdpmbc32.exe
        301⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9104
        
        C:\Windows\SysWOW64\Kgninn32.exe
        
        C:\Windows\system32\Kgninn32.exe
        302⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Kjmfjj32.exe
        
        C:\Windows\system32\Kjmfjj32.exe
        303⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Kmkbfeab.exe
        
        C:\Windows\system32\Kmkbfeab.exe
        304⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Kdbjhbbd.exe
        
        C:\Windows\system32\Kdbjhbbd.exe
        305⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Lgqfdnah.exe
        
        C:\Windows\system32\Lgqfdnah.exe
        306⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Ljobpiql.exe
        
        C:\Windows\system32\Ljobpiql.exe
        307⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8392
        
        C:\Windows\SysWOW64\Lnjnqh32.exe
        
        C:\Windows\system32\Lnjnqh32.exe
        308⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8460
        
        C:\Windows\SysWOW64\Lddgmbpb.exe
        
        C:\Windows\system32\Lddgmbpb.exe
        309⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Ljaoeini.exe
        
        C:\Windows\system32\Ljaoeini.exe
        310⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Lqkgbcff.exe
        
        C:\Windows\system32\Lqkgbcff.exe
        311⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Ldgccb32.exe
        
        C:\Windows\system32\Ldgccb32.exe
        312⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Lgepom32.exe
        
        C:\Windows\system32\Lgepom32.exe
        313⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Lkalplel.exe
        
        C:\Windows\system32\Lkalplel.exe
        314⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Lnohlgep.exe
        
        C:\Windows\system32\Lnohlgep.exe
        315⤵
        Drops file in System32 directory
        
        PID:9016
        
        C:\Windows\SysWOW64\Lqndhcdc.exe
        
        C:\Windows\system32\Lqndhcdc.exe
        316⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Ldipha32.exe
        
        C:\Windows\system32\Ldipha32.exe
        317⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Lggldm32.exe
        
        C:\Windows\system32\Lggldm32.exe
        318⤵
        Modifies registry class
        
        PID:9172
        
        C:\Windows\SysWOW64\Lkchelci.exe
        
        C:\Windows\system32\Lkchelci.exe
        319⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\Lnadagbm.exe
        
        C:\Windows\system32\Lnadagbm.exe
        320⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Lqpamb32.exe
        
        C:\Windows\system32\Lqpamb32.exe
        321⤵
        System Location Discovery: System Language Discovery
        
        PID:8400
        
        C:\Windows\SysWOW64\Lcnmin32.exe
        
        C:\Windows\system32\Lcnmin32.exe
        322⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Lgjijmin.exe
        
        C:\Windows\system32\Lgjijmin.exe
        323⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Ljhefhha.exe
        
        C:\Windows\system32\Ljhefhha.exe
        324⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8680
        
        C:\Windows\SysWOW64\Lndagg32.exe
        
        C:\Windows\system32\Lndagg32.exe
        325⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Lqbncb32.exe
        
        C:\Windows\system32\Lqbncb32.exe
        326⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8920
        
        C:\Windows\SysWOW64\Lenicahg.exe
        
        C:\Windows\system32\Lenicahg.exe
        327⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Mglfplgk.exe
        
        C:\Windows\system32\Mglfplgk.exe
        328⤵
        
        PID:9156
        
        C:\Windows\SysWOW64\Mjkblhfo.exe
        
        C:\Windows\system32\Mjkblhfo.exe
        329⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8304
        
        C:\Windows\SysWOW64\Madjhb32.exe
        
        C:\Windows\system32\Madjhb32.exe
        330⤵
        System Location Discovery: System Language Discovery
        
        PID:8444
        
        C:\Windows\SysWOW64\Mnhkbfme.exe
        
        C:\Windows\system32\Mnhkbfme.exe
        331⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Maggnali.exe
        
        C:\Windows\system32\Maggnali.exe
        332⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Mmnhcb32.exe
        
        C:\Windows\system32\Mmnhcb32.exe
        333⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\Mgclpkac.exe
        
        C:\Windows\system32\Mgclpkac.exe
        334⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Malpia32.exe
        
        C:\Windows\system32\Malpia32.exe
        335⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Mkadfj32.exe
        
        C:\Windows\system32\Mkadfj32.exe
        336⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Nclikl32.exe
        
        C:\Windows\system32\Nclikl32.exe
        337⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\Nlcalieg.exe
        
        C:\Windows\system32\Nlcalieg.exe
        338⤵
        
        PID:9288
        
        C:\Windows\SysWOW64\Njfagf32.exe
        
        C:\Windows\system32\Njfagf32.exe
        339⤵
        
        PID:9328
        
        C:\Windows\SysWOW64\Nmenca32.exe
        
        C:\Windows\system32\Nmenca32.exe
        340⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Nndjndbh.exe
        
        C:\Windows\system32\Nndjndbh.exe
        341⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Nenbjo32.exe
        
        C:\Windows\system32\Nenbjo32.exe
        342⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Nlhkgi32.exe
        
        C:\Windows\system32\Nlhkgi32.exe
        343⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\Nmigoagp.exe
        
        C:\Windows\system32\Nmigoagp.exe
        344⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9508
        
        C:\Windows\SysWOW64\Njmhhefi.exe
        
        C:\Windows\system32\Njmhhefi.exe
        345⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Ndflak32.exe
        
        C:\Windows\system32\Ndflak32.exe
        346⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\Nlmdbh32.exe
        
        C:\Windows\system32\Nlmdbh32.exe
        347⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\Najmjokc.exe
        
        C:\Windows\system32\Najmjokc.exe
        348⤵
        
        PID:9652
        
        C:\Windows\SysWOW64\Ohcegi32.exe
        
        C:\Windows\system32\Ohcegi32.exe
        349⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9692
        
        C:\Windows\SysWOW64\Oalipoiq.exe
        
        C:\Windows\system32\Oalipoiq.exe
        350⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Ojdnid32.exe
        
        C:\Windows\system32\Ojdnid32.exe
        351⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Odmbaj32.exe
        
        C:\Windows\system32\Odmbaj32.exe
        352⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Ohkkhhmh.exe
        
        C:\Windows\system32\Ohkkhhmh.exe
        353⤵
        Modifies registry class
        
        PID:9836
        
        C:\Windows\SysWOW64\Ojigdcll.exe
        
        C:\Windows\system32\Ojigdcll.exe
        354⤵
        
        PID:9872
        
        C:\Windows\SysWOW64\Ohmhmh32.exe
        
        C:\Windows\system32\Ohmhmh32.exe
        355⤵
        Drops file in System32 directory
        
        PID:9908
        
        C:\Windows\SysWOW64\Plkpcfal.exe
        
        C:\Windows\system32\Plkpcfal.exe
        356⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\Plmmif32.exe
        
        C:\Windows\system32\Plmmif32.exe
        357⤵
        System Location Discovery: System Language Discovery
        
        PID:9980
        
        C:\Windows\SysWOW64\Pdhbmh32.exe
        
        C:\Windows\system32\Pdhbmh32.exe
        358⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\Palbgl32.exe
        
        C:\Windows\system32\Palbgl32.exe
        359⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Plbfdekd.exe
        
        C:\Windows\system32\Plbfdekd.exe
        360⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Pdmkhgho.exe
        
        C:\Windows\system32\Pdmkhgho.exe
        361⤵
        System Location Discovery: System Language Discovery
        
        PID:10120
        
        C:\Windows\SysWOW64\Pkgcea32.exe
        
        C:\Windows\system32\Pkgcea32.exe
        362⤵
        Drops file in System32 directory
        
        PID:10160
        
        C:\Windows\SysWOW64\Qemhbj32.exe
        
        C:\Windows\system32\Qemhbj32.exe
        363⤵
        
        PID:10196
        
        C:\Windows\SysWOW64\Qdbdcg32.exe
        
        C:\Windows\system32\Qdbdcg32.exe
        364⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\Qklmpalf.exe
        
        C:\Windows\system32\Qklmpalf.exe
        365⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Aogiap32.exe
        
        C:\Windows\system32\Aogiap32.exe
        366⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Amjillkj.exe
        
        C:\Windows\system32\Amjillkj.exe
        367⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\Aeaanjkl.exe
        
        C:\Windows\system32\Aeaanjkl.exe
        368⤵
        System Location Discovery: System Language Discovery
        
        PID:9432
        
        C:\Windows\SysWOW64\Ahpmjejp.exe
        
        C:\Windows\system32\Ahpmjejp.exe
        369⤵
        Modifies registry class
        
        PID:9532
        
        C:\Windows\SysWOW64\Alkijdci.exe
        
        C:\Windows\system32\Alkijdci.exe
        370⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9640
        
        C:\Windows\SysWOW64\Aojefobm.exe
        
        C:\Windows\system32\Aojefobm.exe
        371⤵
        
        PID:9716
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        372⤵
        
        PID:9772
        
        C:\Windows\SysWOW64\Ahbjoe32.exe
        
        C:\Windows\system32\Ahbjoe32.exe
        373⤵
        
        PID:1144
        
        C:\Windows\SysWOW64\Aefjii32.exe
        
        C:\Windows\system32\Aefjii32.exe
        374⤵
        System Location Discovery: System Language Discovery
        
        PID:9824
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        375⤵
        System Location Discovery: System Language Discovery
        
        PID:9904
        
        C:\Windows\SysWOW64\Anclbkbp.exe
        
        C:\Windows\system32\Anclbkbp.exe
        376⤵
        Drops file in System32 directory
        
        PID:9952
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        377⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10012
        
        C:\Windows\SysWOW64\Bemqih32.exe
        
        C:\Windows\system32\Bemqih32.exe
        378⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10080
        
        C:\Windows\SysWOW64\Bnhenj32.exe
        
        C:\Windows\system32\Bnhenj32.exe
        379⤵
        
        PID:10144
        
        C:\Windows\SysWOW64\Bdbnjdfg.exe
        
        C:\Windows\system32\Bdbnjdfg.exe
        380⤵
        
        PID:10220
        
        C:\Windows\SysWOW64\Bklfgo32.exe
        
        C:\Windows\system32\Bklfgo32.exe
        381⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8364
        
        C:\Windows\SysWOW64\Bhpfqcln.exe
        
        C:\Windows\system32\Bhpfqcln.exe
        382⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9244
        
        C:\Windows\SysWOW64\Bkobmnka.exe
        
        C:\Windows\system32\Bkobmnka.exe
        383⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\Bnmoijje.exe
        
        C:\Windows\system32\Bnmoijje.exe
        384⤵
        
        PID:9680
        
        C:\Windows\SysWOW64\Bedgjgkg.exe
        
        C:\Windows\system32\Bedgjgkg.exe
        385⤵
        
        PID:3768
        
        C:\Windows\SysWOW64\Blnoga32.exe
        
        C:\Windows\system32\Blnoga32.exe
        386⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Bheplb32.exe
        
        C:\Windows\system32\Bheplb32.exe
        387⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\Coohhlpe.exe
        
        C:\Windows\system32\Coohhlpe.exe
        388⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Camddhoi.exe
        
        C:\Windows\system32\Camddhoi.exe
        389⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\Cndeii32.exe
        
        C:\Windows\system32\Cndeii32.exe
        390⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Chiigadc.exe
        
        C:\Windows\system32\Chiigadc.exe
        391⤵
        
        PID:9424
        
        C:\Windows\SysWOW64\Clgbmp32.exe
        
        C:\Windows\system32\Clgbmp32.exe
        392⤵
        System Location Discovery: System Language Discovery
        
        PID:9748
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        393⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        394⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        395⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Dhclmp32.exe
        
        C:\Windows\system32\Dhclmp32.exe
        396⤵
        Drops file in System32 directory
        
        PID:9760
        
        C:\Windows\SysWOW64\Dbkqfe32.exe
        
        C:\Windows\system32\Dbkqfe32.exe
        397⤵
        
        PID:9664
        
        C:\Windows\SysWOW64\Dmcain32.exe
        
        C:\Windows\system32\Dmcain32.exe
        398⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Dmennnni.exe
        
        C:\Windows\system32\Dmennnni.exe
        399⤵
        
        PID:10132
        
        C:\Windows\SysWOW64\Deqcbpld.exe
        
        C:\Windows\system32\Deqcbpld.exe
        400⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Enigke32.exe
        
        C:\Windows\system32\Enigke32.exe
        401⤵
        
        PID:10272
        
        C:\Windows\SysWOW64\Ebdcld32.exe
        
        C:\Windows\system32\Ebdcld32.exe
        402⤵
        
        PID:10308
        
        C:\Windows\SysWOW64\Eecphp32.exe
        
        C:\Windows\system32\Eecphp32.exe
        403⤵
        
        PID:10344
        
        C:\Windows\SysWOW64\Emjgim32.exe
        
        C:\Windows\system32\Emjgim32.exe
        404⤵
        System Location Discovery: System Language Discovery
        
        PID:10380
        
        C:\Windows\SysWOW64\Eoideh32.exe
        
        C:\Windows\system32\Eoideh32.exe
        405⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10416
        
        C:\Windows\SysWOW64\Ebgpad32.exe
        
        C:\Windows\system32\Ebgpad32.exe
        406⤵
        
        PID:10456
        
        C:\Windows\SysWOW64\Eeelnp32.exe
        
        C:\Windows\system32\Eeelnp32.exe
        407⤵
        
        PID:10492
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        408⤵
        
        PID:10532
        
        C:\Windows\SysWOW64\Efeihb32.exe
        
        C:\Windows\system32\Efeihb32.exe
        409⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10568
        
        C:\Windows\SysWOW64\Eehicoel.exe
        
        C:\Windows\system32\Eehicoel.exe
        410⤵
        System Location Discovery: System Language Discovery
        
        PID:10628
        
        C:\Windows\SysWOW64\Eicedn32.exe
        
        C:\Windows\system32\Eicedn32.exe
        411⤵
        Modifies registry class
        
        PID:10664
        
        C:\Windows\SysWOW64\Ekaapi32.exe
        
        C:\Windows\system32\Ekaapi32.exe
        412⤵
        
        PID:10700
        
        C:\Windows\SysWOW64\Eblimcdf.exe
        
        C:\Windows\system32\Eblimcdf.exe
        413⤵
        Modifies registry class
        
        PID:10736
        
        C:\Windows\SysWOW64\Eejeiocj.exe
        
        C:\Windows\system32\Eejeiocj.exe
        414⤵
        
        PID:10772
        
        C:\Windows\SysWOW64\Ekdnei32.exe
        
        C:\Windows\system32\Ekdnei32.exe
        415⤵
        
        PID:10808
        
        C:\Windows\SysWOW64\Enbjad32.exe
        
        C:\Windows\system32\Enbjad32.exe
        416⤵
        
        PID:10844
        
        C:\Windows\SysWOW64\Ebnfbcbc.exe
        
        C:\Windows\system32\Ebnfbcbc.exe
        417⤵
        
        PID:10876
        
        C:\Windows\SysWOW64\Flfkkhid.exe
        
        C:\Windows\system32\Flfkkhid.exe
        418⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\Fneggdhg.exe
        
        C:\Windows\system32\Fneggdhg.exe
        419⤵
        
        PID:10956
        
        C:\Windows\SysWOW64\Feoodn32.exe
        
        C:\Windows\system32\Feoodn32.exe
        420⤵
        
        PID:10992
        
        C:\Windows\SysWOW64\Fmfgek32.exe
        
        C:\Windows\system32\Fmfgek32.exe
        421⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:11028
        
        C:\Windows\SysWOW64\Fligqhga.exe
        
        C:\Windows\system32\Fligqhga.exe
        422⤵
        
        PID:11072
        
        C:\Windows\SysWOW64\Fbbpmb32.exe
        
        C:\Windows\system32\Fbbpmb32.exe
        423⤵
        
        PID:11116
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        424⤵
        
        PID:11152
        
        C:\Windows\SysWOW64\Fealin32.exe
        
        C:\Windows\system32\Fealin32.exe
        425⤵
        
        PID:11184
        
        C:\Windows\SysWOW64\Flkdfh32.exe
        
        C:\Windows\system32\Flkdfh32.exe
        426⤵
        
        PID:11220
        
        C:\Windows\SysWOW64\Fnipbc32.exe
        
        C:\Windows\system32\Fnipbc32.exe
        427⤵
        System Location Discovery: System Language Discovery
        
        PID:11260
        
        C:\Windows\SysWOW64\Ffqhcq32.exe
        
        C:\Windows\system32\Ffqhcq32.exe
        428⤵
        Drops file in System32 directory
        
        PID:10268
        
        C:\Windows\SysWOW64\Fiodpl32.exe
        
        C:\Windows\system32\Fiodpl32.exe
        429⤵
        Modifies registry class
        
        PID:10352
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        430⤵
        System Location Discovery: System Language Discovery
        
        PID:10440
        
        C:\Windows\SysWOW64\Fnlmhc32.exe
        
        C:\Windows\system32\Fnlmhc32.exe
        431⤵
        
        PID:10524
        
        C:\Windows\SysWOW64\Flpmagqi.exe
        
        C:\Windows\system32\Flpmagqi.exe
        432⤵
        
        PID:10564
        
        C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        433⤵
        
        PID:10672
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        434⤵
        
        PID:10724
        
        C:\Windows\SysWOW64\Gppcmeem.exe
        
        C:\Windows\system32\Gppcmeem.exe
        435⤵
        
        PID:10800
        
        C:\Windows\SysWOW64\Glgcbf32.exe
        
        C:\Windows\system32\Glgcbf32.exe
        436⤵
        Modifies registry class
        
        PID:10884
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        437⤵
        Modifies registry class
        
        PID:10928
        
        C:\Windows\SysWOW64\Geaepk32.exe
        
        C:\Windows\system32\Geaepk32.exe
        438⤵
        
        PID:10984
        
        C:\Windows\SysWOW64\Hlnjbedi.exe
        
        C:\Windows\system32\Hlnjbedi.exe
        439⤵
        
        PID:11040
        
        C:\Windows\SysWOW64\Hefnkkkj.exe
        
        C:\Windows\system32\Hefnkkkj.exe
        440⤵
        
        PID:11104
        
        C:\Windows\SysWOW64\Hoaojp32.exe
        
        C:\Windows\system32\Hoaojp32.exe
        441⤵
        
        PID:11180
        
        C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        442⤵
        
        PID:11240
        
        C:\Windows\SysWOW64\Hmdlmg32.exe
        
        C:\Windows\system32\Hmdlmg32.exe
        443⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\Ipeeobbe.exe
        
        C:\Windows\system32\Ipeeobbe.exe
        444⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Iedjmioj.exe
        
        C:\Windows\system32\Iedjmioj.exe
        445⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Imnocf32.exe
        
        C:\Windows\system32\Imnocf32.exe
        446⤵
        
        PID:10428
        
        C:\Windows\SysWOW64\Ieidhh32.exe
        
        C:\Windows\system32\Ieidhh32.exe
        447⤵
        
        PID:10520
        
        C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        448⤵
        
        PID:10696
        
        C:\Windows\SysWOW64\Jcoaglhk.exe
        
        C:\Windows\system32\Jcoaglhk.exe
        449⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10792
        
        C:\Windows\SysWOW64\Jepjhg32.exe
        
        C:\Windows\system32\Jepjhg32.exe
        450⤵
        
        PID:10912
        
        C:\Windows\SysWOW64\Jcdjbk32.exe
        
        C:\Windows\system32\Jcdjbk32.exe
        451⤵
        
        PID:11024
        
        C:\Windows\SysWOW64\Jphkkpbp.exe
        
        C:\Windows\system32\Jphkkpbp.exe
        452⤵
        Drops file in System32 directory
        
        PID:11172
        
        C:\Windows\SysWOW64\Komhll32.exe
        
        C:\Windows\system32\Komhll32.exe
        453⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Knnhjcog.exe
        
        C:\Windows\system32\Knnhjcog.exe
        454⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6432
        
        C:\Windows\SysWOW64\Kgflcifg.exe
        
        C:\Windows\system32\Kgflcifg.exe
        455⤵
        
        PID:10476
        
        C:\Windows\SysWOW64\Kflide32.exe
        
        C:\Windows\system32\Kflide32.exe
        456⤵
        System Location Discovery: System Language Discovery
        
        PID:10768
        
        C:\Windows\SysWOW64\Kodnmkap.exe
        
        C:\Windows\system32\Kodnmkap.exe
        457⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\Kpcjgnhb.exe
        
        C:\Windows\system32\Kpcjgnhb.exe
        458⤵
        
        PID:11144
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        459⤵
        
        PID:10336
        
        C:\Windows\SysWOW64\Lgbloglj.exe
        
        C:\Windows\system32\Lgbloglj.exe
        460⤵
        System Location Discovery: System Language Discovery
        
        PID:10556
        
        C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        461⤵
        System Location Discovery: System Language Discovery
        
        PID:11148
        
        C:\Windows\SysWOW64\Lmaamn32.exe
        
        C:\Windows\system32\Lmaamn32.exe
        462⤵
        
        PID:11160
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        463⤵
        
        PID:10484
        
        C:\Windows\SysWOW64\Mmfkhmdi.exe
        
        C:\Windows\system32\Mmfkhmdi.exe
        464⤵
        System Location Discovery: System Language Discovery
        
        PID:10832
        
        C:\Windows\SysWOW64\Mqdcnl32.exe
        
        C:\Windows\system32\Mqdcnl32.exe
        465⤵
        
        PID:10908
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        466⤵
        
        PID:11268
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        467⤵
        
        PID:11304
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        468⤵
        
        PID:11340
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        469⤵
        
        PID:11376
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        470⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11464
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        471⤵
        
        PID:11504
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        472⤵
        
        PID:11540
        
        C:\Windows\SysWOW64\Ngqagcag.exe
        
        C:\Windows\system32\Ngqagcag.exe
        473⤵
        
        PID:11580
        
        C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        474⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11616
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        475⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11652
        
        C:\Windows\SysWOW64\Ojfcdnjc.exe
        
        C:\Windows\system32\Ojfcdnjc.exe
        476⤵
        
        PID:11688
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        477⤵
        
        PID:11724
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        478⤵
        
        PID:11760
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        479⤵
        
        PID:11796
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        480⤵
        
        PID:11832
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        481⤵
        
        PID:11868
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        482⤵
        
        PID:11904
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        483⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:11940
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        484⤵
        System Location Discovery: System Language Discovery
        
        PID:11980
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        485⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:12016
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        486⤵
        Drops file in System32 directory
        
        PID:12052
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        487⤵
        
        PID:12088
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        488⤵
        
        PID:12128
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        489⤵
        
        PID:12164
        
        C:\Windows\SysWOW64\Aajhndkb.exe
        
        C:\Windows\system32\Aajhndkb.exe
        490⤵
        Drops file in System32 directory
        
        PID:12196
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        491⤵
        
        PID:12236
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        492⤵
        
        PID:12272
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        493⤵
        Modifies registry class
        
        PID:11292
        
        C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        494⤵
        
        PID:11364
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        495⤵
        
        PID:11408
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        496⤵
        
        PID:11424
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        497⤵
        
        PID:11488
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        498⤵
        
        PID:4300
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        499⤵
        
        PID:11640
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        500⤵
        
        PID:11696
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        501⤵
        
        PID:11744
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        502⤵
        
        PID:11816
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        503⤵
        
        PID:11888
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        504⤵
        
        PID:11952
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        505⤵
        System Location Discovery: System Language Discovery
        
        PID:12012
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        506⤵
        
        PID:12080
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        507⤵
        
        PID:12148
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        508⤵
        System Location Discovery: System Language Discovery
        
        PID:12208
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        509⤵
        
        PID:12256
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        510⤵
        
        PID:11348
        
        C:\Windows\SysWOW64\Dhdbhifj.exe
        
        C:\Windows\system32\Dhdbhifj.exe
        511⤵
        
        PID:11444
        
        C:\Windows\SysWOW64\Doagjc32.exe
        
        C:\Windows\system32\Doagjc32.exe
        512⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11548
        
        C:\Windows\SysWOW64\Enfckp32.exe
        
        C:\Windows\system32\Enfckp32.exe
        513⤵
        Drops file in System32 directory
        
        PID:11648
        
        C:\Windows\SysWOW64\Edbiniff.exe
        
        C:\Windows\system32\Edbiniff.exe
        514⤵
        
        PID:11748
        
        C:\Windows\SysWOW64\Enkmfolf.exe
        
        C:\Windows\system32\Enkmfolf.exe
        515⤵
        
        PID:11860
        
        C:\Windows\SysWOW64\Egened32.exe
        
        C:\Windows\system32\Egened32.exe
        516⤵
        
        PID:12000
        
        C:\Windows\SysWOW64\Eghkjdoa.exe
        
        C:\Windows\system32\Eghkjdoa.exe
        517⤵
        
        PID:12112
        
        C:\Windows\SysWOW64\Fdnhih32.exe
        
        C:\Windows\system32\Fdnhih32.exe
        518⤵
        Drops file in System32 directory
        
        PID:12188
        
        C:\Windows\SysWOW64\Fqeioiam.exe
        
        C:\Windows\system32\Fqeioiam.exe
        519⤵
        
        PID:11948
        
        C:\Windows\SysWOW64\Fbdehlip.exe
        
        C:\Windows\system32\Fbdehlip.exe
        520⤵
        
        PID:11496
        
        C:\Windows\SysWOW64\Fnkfmm32.exe
        
        C:\Windows\system32\Fnkfmm32.exe
        521⤵
        
        PID:11708
        
        C:\Windows\SysWOW64\Gegkpf32.exe
        
        C:\Windows\system32\Gegkpf32.exe
        522⤵
        
        PID:11932
        
        C:\Windows\SysWOW64\Gejhef32.exe
        
        C:\Windows\system32\Gejhef32.exe
        523⤵
        
        PID:11396
        
        C:\Windows\SysWOW64\Gaqhjggp.exe
        
        C:\Windows\system32\Gaqhjggp.exe
        524⤵
        
        PID:11300
        
        C:\Windows\SysWOW64\Gngeik32.exe
        
        C:\Windows\system32\Gngeik32.exe
        525⤵
        
        PID:11676
        
        C:\Windows\SysWOW64\Hahokfag.exe
        
        C:\Windows\system32\Hahokfag.exe
        526⤵
        
        PID:12072
        
        C:\Windows\SysWOW64\Hhdcmp32.exe
        
        C:\Windows\system32\Hhdcmp32.exe
        527⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:11404
        
        C:\Windows\SysWOW64\Hhfpbpdo.exe
        
        C:\Windows\system32\Hhfpbpdo.exe
        528⤵
        
        PID:12048
        
        C:\Windows\SysWOW64\Hnbeeiji.exe
        
        C:\Windows\system32\Hnbeeiji.exe
        529⤵
        
        PID:11792
        
        C:\Windows\SysWOW64\Iacngdgj.exe
        
        C:\Windows\system32\Iacngdgj.exe
        530⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12296
        
        C:\Windows\SysWOW64\Iogopi32.exe
        
        C:\Windows\system32\Iogopi32.exe
        531⤵
        
        PID:12332
        
        C:\Windows\SysWOW64\Iojkeh32.exe
        
        C:\Windows\system32\Iojkeh32.exe
        532⤵
        Modifies registry class
        
        PID:12368
        
        C:\Windows\SysWOW64\Iahgad32.exe
        
        C:\Windows\system32\Iahgad32.exe
        533⤵
        
        PID:12404
        
        C:\Windows\SysWOW64\Ibgdlg32.exe
        
        C:\Windows\system32\Ibgdlg32.exe
        534⤵
        Modifies registry class
        
        PID:12440
        
        C:\Windows\SysWOW64\Iondqhpl.exe
        
        C:\Windows\system32\Iondqhpl.exe
        535⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12476
        
        C:\Windows\SysWOW64\Jblmgf32.exe
        
        C:\Windows\system32\Jblmgf32.exe
        536⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:12512
        
        C:\Windows\SysWOW64\Jemfhacc.exe
        
        C:\Windows\system32\Jemfhacc.exe
        537⤵
        
        PID:12548
        
        C:\Windows\SysWOW64\Jikoopij.exe
        
        C:\Windows\system32\Jikoopij.exe
        538⤵
        
        PID:12588
        
        C:\Windows\SysWOW64\Jllhpkfk.exe
        
        C:\Windows\system32\Jllhpkfk.exe
        539⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12624
        
        C:\Windows\SysWOW64\Kedlip32.exe
        
        C:\Windows\system32\Kedlip32.exe
        540⤵
        
        PID:12676
        
        C:\Windows\SysWOW64\Kolabf32.exe
        
        C:\Windows\system32\Kolabf32.exe
        541⤵
        
        PID:12728
        
        C:\Windows\SysWOW64\Kibeoo32.exe
        
        C:\Windows\system32\Kibeoo32.exe
        542⤵
        
        PID:12780
        
        C:\Windows\SysWOW64\Klpakj32.exe
        
        C:\Windows\system32\Klpakj32.exe
        543⤵
        
        PID:12824
        
        C:\Windows\SysWOW64\Khgbqkhj.exe
        
        C:\Windows\system32\Khgbqkhj.exe
        544⤵
        
        PID:12860
        
        C:\Windows\SysWOW64\Kcmfnd32.exe
        
        C:\Windows\system32\Kcmfnd32.exe
        545⤵
        
        PID:12896
        
        C:\Windows\SysWOW64\Kpqggh32.exe
        
        C:\Windows\system32\Kpqggh32.exe
        546⤵
        Drops file in System32 directory
        
        PID:12932
        
        C:\Windows\SysWOW64\Khlklj32.exe
        
        C:\Windows\system32\Khlklj32.exe
        547⤵
        
        PID:12968
        
        C:\Windows\SysWOW64\Kcapicdj.exe
        
        C:\Windows\system32\Kcapicdj.exe
        548⤵
        
        PID:13012
        
        C:\Windows\SysWOW64\Lljdai32.exe
        
        C:\Windows\system32\Lljdai32.exe
        549⤵
        
        PID:13052
        
        C:\Windows\SysWOW64\Lhqefjpo.exe
        
        C:\Windows\system32\Lhqefjpo.exe
        550⤵
        
        PID:13088
        
        C:\Windows\SysWOW64\Lcfidb32.exe
        
        C:\Windows\system32\Lcfidb32.exe
        551⤵
        
        PID:13124
        
        C:\Windows\SysWOW64\Ljpaqmgb.exe
        
        C:\Windows\system32\Ljpaqmgb.exe
        552⤵
        
        PID:13168
        
        C:\Windows\SysWOW64\Lhcali32.exe
        
        C:\Windows\system32\Lhcali32.exe
        553⤵
        
        PID:13208
        
        C:\Windows\SysWOW64\Lomjicei.exe
        
        C:\Windows\system32\Lomjicei.exe
        554⤵
        Drops file in System32 directory
        
        PID:13260
        
        C:\Windows\SysWOW64\Lplfcf32.exe
        
        C:\Windows\system32\Lplfcf32.exe
        555⤵
        
        PID:13304
        
        C:\Windows\SysWOW64\Lancko32.exe
        
        C:\Windows\system32\Lancko32.exe
        556⤵
        System Location Discovery: System Language Discovery
        
        PID:12352
        
        C:\Windows\SysWOW64\Lhgkgijg.exe
        
        C:\Windows\system32\Lhgkgijg.exe
        557⤵
        
        PID:12620
        
        C:\Windows\SysWOW64\Lcmodajm.exe
        
        C:\Windows\system32\Lcmodajm.exe
        558⤵
        Drops file in System32 directory
        
        PID:12736
        
        C:\Windows\SysWOW64\Mhjhmhhd.exe
        
        C:\Windows\system32\Mhjhmhhd.exe
        559⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12844
        
        C:\Windows\SysWOW64\Mledmg32.exe
        
        C:\Windows\system32\Mledmg32.exe
        560⤵
        
        PID:252
        
        C:\Windows\SysWOW64\Mfnhfm32.exe
        
        C:\Windows\system32\Mfnhfm32.exe
        561⤵
        
        PID:13004
        
        C:\Windows\SysWOW64\Mhldbh32.exe
        
        C:\Windows\system32\Mhldbh32.exe
        562⤵
        System Location Discovery: System Language Discovery
        
        PID:13048
        
        C:\Windows\SysWOW64\Mofmobmo.exe
        
        C:\Windows\system32\Mofmobmo.exe
        563⤵
        
        PID:4060
        
        C:\Windows\SysWOW64\Mfpell32.exe
        
        C:\Windows\system32\Mfpell32.exe
        564⤵
        
        PID:4784
        
        C:\Windows\SysWOW64\Mljmhflh.exe
        
        C:\Windows\system32\Mljmhflh.exe
        565⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:548
        
        C:\Windows\SysWOW64\Mbgeqmjp.exe
        
        C:\Windows\system32\Mbgeqmjp.exe
        566⤵
        
        PID:13248
        
        C:\Windows\SysWOW64\Mhanngbl.exe
        
        C:\Windows\system32\Mhanngbl.exe
        567⤵
        
        PID:4452
        
        C:\Windows\SysWOW64\Mokfja32.exe
        
        C:\Windows\system32\Mokfja32.exe
        568⤵
        Modifies registry class
        
        PID:872
        
        C:\Windows\SysWOW64\Mfenglqf.exe
        
        C:\Windows\system32\Mfenglqf.exe
        569⤵
        Modifies registry class
        
        PID:12320
        
        C:\Windows\SysWOW64\Mhckcgpj.exe
        
        C:\Windows\system32\Mhckcgpj.exe
        570⤵
        
        PID:2072
        
        C:\Windows\SysWOW64\Nblolm32.exe
        
        C:\Windows\system32\Nblolm32.exe
        571⤵
        
        PID:12484
        
        C:\Windows\SysWOW64\Nhegig32.exe
        
        C:\Windows\system32\Nhegig32.exe
        572⤵
        Drops file in System32 directory
        
        PID:12596
        
        C:\Windows\SysWOW64\Nckkfp32.exe
        
        C:\Windows\system32\Nckkfp32.exe
        573⤵
        
        PID:4216
        
        C:\Windows\SysWOW64\Nhhdnf32.exe
        
        C:\Windows\system32\Nhhdnf32.exe
        574⤵
        
        PID:4708
        
        C:\Windows\SysWOW64\Nqoloc32.exe
        
        C:\Windows\system32\Nqoloc32.exe
        575⤵
        
        PID:12832
        
        C:\Windows\SysWOW64\Ncmhko32.exe
        
        C:\Windows\system32\Ncmhko32.exe
        576⤵
        
        PID:5104
        
        C:\Windows\SysWOW64\Nijqcf32.exe
        
        C:\Windows\system32\Nijqcf32.exe
        577⤵
        System Location Discovery: System Language Discovery
        
        PID:12960
        
        C:\Windows\SysWOW64\Nmfmde32.exe
        
        C:\Windows\system32\Nmfmde32.exe
        578⤵
        Modifies registry class
        
        PID:4868
        
        C:\Windows\SysWOW64\Nimmifgo.exe
        
        C:\Windows\system32\Nimmifgo.exe
        579⤵
        
        PID:13200
        
        C:\Windows\SysWOW64\Nbebbk32.exe
        
        C:\Windows\system32\Nbebbk32.exe
        580⤵
        
        PID:1928
        
        C:\Windows\SysWOW64\Niojoeel.exe
        
        C:\Windows\system32\Niojoeel.exe
        581⤵
        
        PID:12428
        
        C:\Windows\SysWOW64\Ooibkpmi.exe
        
        C:\Windows\system32\Ooibkpmi.exe
        582⤵
        
        PID:12532
        
        C:\Windows\SysWOW64\Oiagde32.exe
        
        C:\Windows\system32\Oiagde32.exe
        583⤵
        
        PID:12424
        
        C:\Windows\SysWOW64\Oqhoeb32.exe
        
        C:\Windows\system32\Oqhoeb32.exe
        584⤵
        
        PID:4444
        
        C:\Windows\SysWOW64\Ocgkan32.exe
        
        C:\Windows\system32\Ocgkan32.exe
        585⤵
        
        PID:3652
        
        C:\Windows\SysWOW64\Omopjcjp.exe
        
        C:\Windows\system32\Omopjcjp.exe
        586⤵
        System Location Discovery: System Language Discovery
        
        PID:4008
        
        C:\Windows\SysWOW64\Ojcpdg32.exe
        
        C:\Windows\system32\Ojcpdg32.exe
        587⤵
        
        PID:12724
        
        C:\Windows\SysWOW64\Ockdmmoj.exe
        
        C:\Windows\system32\Ockdmmoj.exe
        588⤵
        
        PID:1028
        
        C:\Windows\SysWOW64\Ofjqihnn.exe
        
        C:\Windows\system32\Ofjqihnn.exe
        589⤵
        Drops file in System32 directory
        
        PID:12880
        
        C:\Windows\SysWOW64\Omdieb32.exe
        
        C:\Windows\system32\Omdieb32.exe
        590⤵
        
        PID:404
        
        C:\Windows\SysWOW64\Ocnabm32.exe
        
        C:\Windows\system32\Ocnabm32.exe
        591⤵
        
        PID:3284
        
        C:\Windows\SysWOW64\Oikjkc32.exe
        
        C:\Windows\system32\Oikjkc32.exe
        592⤵
        
        PID:4288
        
        C:\Windows\SysWOW64\Pbcncibp.exe
        
        C:\Windows\system32\Pbcncibp.exe
        593⤵
        
        PID:3872
        
        C:\Windows\SysWOW64\Pimfpc32.exe
        
        C:\Windows\system32\Pimfpc32.exe
        594⤵
        
        PID:13076
        
        C:\Windows\SysWOW64\Pbekii32.exe
        
        C:\Windows\system32\Pbekii32.exe
        595⤵
        Drops file in System32 directory
        
        PID:13176
        
        C:\Windows\SysWOW64\Pjlcjf32.exe
        
        C:\Windows\system32\Pjlcjf32.exe
        596⤵
        
        PID:4088
        
        C:\Windows\SysWOW64\Pafkgphl.exe
        
        C:\Windows\system32\Pafkgphl.exe
        597⤵
        Drops file in System32 directory
        
        PID:2560
        
        C:\Windows\SysWOW64\Pbhgoh32.exe
        
        C:\Windows\system32\Pbhgoh32.exe
        598⤵
        
        PID:2644
        
        C:\Windows\SysWOW64\Pfccogfc.exe
        
        C:\Windows\system32\Pfccogfc.exe
        599⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4872
        
        C:\Windows\SysWOW64\Pmmlla32.exe
        
        C:\Windows\system32\Pmmlla32.exe
        600⤵
        
        PID:684
        
        C:\Windows\SysWOW64\Paihlpfi.exe
        
        C:\Windows\system32\Paihlpfi.exe
        601⤵
        
        PID:3212
        
        C:\Windows\SysWOW64\Pakdbp32.exe
        
        C:\Windows\system32\Pakdbp32.exe
        602⤵
        
        PID:3324
        
        C:\Windows\SysWOW64\Pciqnk32.exe
        
        C:\Windows\system32\Pciqnk32.exe
        603⤵
        
        PID:1584
        
        C:\Windows\SysWOW64\Pblajhje.exe
        
        C:\Windows\system32\Pblajhje.exe
        604⤵
        
        PID:2616
        
        C:\Windows\SysWOW64\Pjcikejg.exe
        
        C:\Windows\system32\Pjcikejg.exe
        605⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Pmbegqjk.exe
        
        C:\Windows\system32\Pmbegqjk.exe
        606⤵
        Drops file in System32 directory
        
        PID:4828
        
        C:\Windows\SysWOW64\Qamago32.exe
        
        C:\Windows\system32\Qamago32.exe
        607⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Qclmck32.exe
        
        C:\Windows\system32\Qclmck32.exe
        608⤵
        System Location Discovery: System Language Discovery
        
        PID:3752
        
        C:\Windows\SysWOW64\Qbonoghb.exe
        
        C:\Windows\system32\Qbonoghb.exe
        609⤵
        Drops file in System32 directory
        
        PID:980
        
        C:\Windows\SysWOW64\Qjffpe32.exe
        
        C:\Windows\system32\Qjffpe32.exe
        610⤵
        
        PID:12964
        
        C:\Windows\SysWOW64\Qcnjijoe.exe
        
        C:\Windows\system32\Qcnjijoe.exe
        611⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Qbajeg32.exe
        
        C:\Windows\system32\Qbajeg32.exe
        612⤵
        System Location Discovery: System Language Discovery
        
        PID:3068
        
        C:\Windows\SysWOW64\Amfobp32.exe
        
        C:\Windows\system32\Amfobp32.exe
        613⤵
        
        PID:3744
        
        C:\Windows\SysWOW64\Acqgojmb.exe
        
        C:\Windows\system32\Acqgojmb.exe
        614⤵
        
        PID:13084
        
        C:\Windows\SysWOW64\Ajjokd32.exe
        
        C:\Windows\system32\Ajjokd32.exe
        615⤵
        
        PID:13112
        
        C:\Windows\SysWOW64\Abfdpfaj.exe
        
        C:\Windows\system32\Abfdpfaj.exe
        616⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\Aiplmq32.exe
        
        C:\Windows\system32\Aiplmq32.exe
        617⤵
        
        PID:1800
        
        C:\Windows\SysWOW64\Adepji32.exe
        
        C:\Windows\system32\Adepji32.exe
        618⤵
        Modifies registry class
        
        PID:5160
        
        C:\Windows\SysWOW64\Amnebo32.exe
        
        C:\Windows\system32\Amnebo32.exe
        619⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Aplaoj32.exe
        
        C:\Windows\system32\Aplaoj32.exe
        620⤵
        
        PID:3636
        
        C:\Windows\SysWOW64\Ajaelc32.exe
        
        C:\Windows\system32\Ajaelc32.exe
        621⤵
        
        PID:396
        
        C:\Windows\SysWOW64\Apnndj32.exe
        
        C:\Windows\system32\Apnndj32.exe
        622⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2568
        
        C:\Windows\SysWOW64\Afhfaddk.exe
        
        C:\Windows\system32\Afhfaddk.exe
        623⤵
        
        PID:3728
        
        C:\Windows\SysWOW64\Bpqjjjjl.exe
        
        C:\Windows\system32\Bpqjjjjl.exe
        624⤵
        
        PID:12660
        
        C:\Windows\SysWOW64\Bmdkcnie.exe
        
        C:\Windows\system32\Bmdkcnie.exe
        625⤵
        
        PID:4356
        
        C:\Windows\SysWOW64\Bbaclegm.exe
        
        C:\Windows\system32\Bbaclegm.exe
        626⤵
        System Location Discovery: System Language Discovery
        
        PID:2156
        
        C:\Windows\SysWOW64\Biklho32.exe
        
        C:\Windows\system32\Biklho32.exe
        627⤵
        
        PID:12888
        
        C:\Windows\SysWOW64\Bpedeiff.exe
        
        C:\Windows\system32\Bpedeiff.exe
        628⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Bbdpad32.exe
        
        C:\Windows\system32\Bbdpad32.exe
        629⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Binhnomg.exe
        
        C:\Windows\system32\Binhnomg.exe
        630⤵
        
        PID:12656
        
        C:\Windows\SysWOW64\Bphqji32.exe
        
        C:\Windows\system32\Bphqji32.exe
        631⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Bipecnkd.exe
        
        C:\Windows\system32\Bipecnkd.exe
        632⤵
        Drops file in System32 directory
        
        PID:3868
        
        C:\Windows\SysWOW64\Bpjmph32.exe
        
        C:\Windows\system32\Bpjmph32.exe
        633⤵
        Modifies registry class
        
        PID:5588
        
        C:\Windows\SysWOW64\Bbhildae.exe
        
        C:\Windows\system32\Bbhildae.exe
        634⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Cdhffg32.exe
        
        C:\Windows\system32\Cdhffg32.exe
        635⤵
        
        PID:112
        
        C:\Windows\SysWOW64\Cienon32.exe
        
        C:\Windows\system32\Cienon32.exe
        636⤵
        
        PID:4480
        
        C:\Windows\SysWOW64\Cdjblf32.exe
        
        C:\Windows\system32\Cdjblf32.exe
        637⤵
        System Location Discovery: System Language Discovery
        
        PID:6128
        
        C:\Windows\SysWOW64\Cigkdmel.exe
        
        C:\Windows\system32\Cigkdmel.exe
        638⤵
        
        PID:388
        
        C:\Windows\SysWOW64\Cpacqg32.exe
        
        C:\Windows\system32\Cpacqg32.exe
        639⤵
        Drops file in System32 directory
        
        PID:2080
        
        C:\Windows\SysWOW64\Cdolgfbp.exe
        
        C:\Windows\system32\Cdolgfbp.exe
        640⤵
        
        PID:1820
        
        C:\Windows\SysWOW64\Cildom32.exe
        
        C:\Windows\system32\Cildom32.exe
        641⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2376
        
        C:\Windows\SysWOW64\Cacmpj32.exe
        
        C:\Windows\system32\Cacmpj32.exe
        642⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Dgpeha32.exe
        
        C:\Windows\system32\Dgpeha32.exe
        643⤵
        
        PID:3540
        
        C:\Windows\SysWOW64\Dphiaffa.exe
        
        C:\Windows\system32\Dphiaffa.exe
        644⤵
        
        PID:4680
        
        C:\Windows\SysWOW64\Ddcebe32.exe
        
        C:\Windows\system32\Ddcebe32.exe
        645⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Dahfkimd.exe
        
        C:\Windows\system32\Dahfkimd.exe
        646⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5324
        
        C:\Windows\SysWOW64\Dickplko.exe
        
        C:\Windows\system32\Dickplko.exe
        647⤵
        
        PID:2140
        
        C:\Windows\SysWOW64\Dnngpj32.exe
        
        C:\Windows\system32\Dnngpj32.exe
        648⤵
        System Location Discovery: System Language Discovery
        
        PID:2228
        
        C:\Windows\SysWOW64\Dkbgjo32.exe
        
        C:\Windows\system32\Dkbgjo32.exe
        649⤵
        Drops file in System32 directory
        
        PID:5956
        
        C:\Windows\SysWOW64\Dnqcfjae.exe
        
        C:\Windows\system32\Dnqcfjae.exe
        650⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\Ddklbd32.exe
        
        C:\Windows\system32\Ddklbd32.exe
        651⤵
        
        PID:556
        
        C:\Windows\SysWOW64\Djgdkk32.exe
        
        C:\Windows\system32\Djgdkk32.exe
        652⤵
        System Location Discovery: System Language Discovery
        
        PID:4092
        
        C:\Windows\SysWOW64\Dncpkjoc.exe
        
        C:\Windows\system32\Dncpkjoc.exe
        653⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Dcphdqmj.exe
        
        C:\Windows\system32\Dcphdqmj.exe
        654⤵
        
        PID:1556
        
        C:\Windows\SysWOW64\Ejjaqk32.exe
        
        C:\Windows\system32\Ejjaqk32.exe
        655⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\Edoencdm.exe
        
        C:\Windows\system32\Edoencdm.exe
        656⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Egnajocq.exe
        
        C:\Windows\system32\Egnajocq.exe
        657⤵
        Drops file in System32 directory
        
        PID:744
        
        C:\Windows\SysWOW64\Enhifi32.exe
        
        C:\Windows\system32\Enhifi32.exe
        658⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5648
        
        C:\Windows\SysWOW64\Egpnooan.exe
        
        C:\Windows\system32\Egpnooan.exe
        659⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Ephbhd32.exe
        
        C:\Windows\system32\Ephbhd32.exe
        660⤵
        Modifies registry class
        
        PID:5456
        
        C:\Windows\SysWOW64\Ecgodpgb.exe
        
        C:\Windows\system32\Ecgodpgb.exe
        661⤵
        Drops file in System32 directory
        
        PID:5916
        
        C:\Windows\SysWOW64\Enlcahgh.exe
        
        C:\Windows\system32\Enlcahgh.exe
        662⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Ekqckmfb.exe
        
        C:\Windows\system32\Ekqckmfb.exe
        663⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Eqmlccdi.exe
        
        C:\Windows\system32\Eqmlccdi.exe
        664⤵
        Modifies registry class
        
        PID:1020
        
        C:\Windows\SysWOW64\Fclhpo32.exe
        
        C:\Windows\system32\Fclhpo32.exe
        665⤵
        
        PID:4328
        
        C:\Windows\SysWOW64\Famhmfkl.exe
        
        C:\Windows\system32\Famhmfkl.exe
        666⤵
        Drops file in System32 directory
        
        PID:2340
        
        C:\Windows\SysWOW64\Fjhmbihg.exe
        
        C:\Windows\system32\Fjhmbihg.exe
        667⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:60
        
        C:\Windows\SysWOW64\Fdmaoahm.exe
        
        C:\Windows\system32\Fdmaoahm.exe
        668⤵
        Modifies registry class
        
        PID:13132
        
        C:\Windows\SysWOW64\Fglnkm32.exe
        
        C:\Windows\system32\Fglnkm32.exe
        669⤵
        Modifies registry class
        
        PID:5152
        
        C:\Windows\SysWOW64\Fbaahf32.exe
        
        C:\Windows\system32\Fbaahf32.exe
        670⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Fgnjqm32.exe
        
        C:\Windows\system32\Fgnjqm32.exe
        671⤵
        
        PID:224
        
        C:\Windows\SysWOW64\Fnhbmgmk.exe
        
        C:\Windows\system32\Fnhbmgmk.exe
        672⤵
        Drops file in System32 directory
        
        PID:5556
        
        C:\Windows\SysWOW64\Fdbkja32.exe
        
        C:\Windows\system32\Fdbkja32.exe
        673⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Fklcgk32.exe
        
        C:\Windows\system32\Fklcgk32.exe
        674⤵
        System Location Discovery: System Language Discovery
        
        PID:5392
        
        C:\Windows\SysWOW64\Fqikob32.exe
        
        C:\Windows\system32\Fqikob32.exe
        675⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Gbhhieao.exe
        
        C:\Windows\system32\Gbhhieao.exe
        676⤵
        
        PID:4572
        
        C:\Windows\SysWOW64\Ggepalof.exe
        
        C:\Windows\system32\Ggepalof.exe
        677⤵
        Drops file in System32 directory
        
        PID:6524
        
        C:\Windows\SysWOW64\Gdiakp32.exe
        
        C:\Windows\system32\Gdiakp32.exe
        678⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6648
        
        C:\Windows\SysWOW64\Gkcigjel.exe
        
        C:\Windows\system32\Gkcigjel.exe
        679⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Gbmadd32.exe
        
        C:\Windows\system32\Gbmadd32.exe
        680⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6968 -s 408
        681⤵
        Program crash
        
        PID:6712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 6968 -ip 6968
1⤵
PID:12760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ahbjoe32.exe

Filesize
163KB

MD5
088dbde87657f51cc8498b870d4b30c0

SHA1
08b7f91bc0bac71f93e9e350c57e20f4b6afe249

SHA256
e5f0a6d1bd18731dd3f25ac225adc1cf5b8e061abeca3497cb584a0895713505

SHA512
2ea72327d3cea16133126a2c1ec99d11ae953e2d21daab6d468f9c3bb10ca0e6643cf2e6c17ad27628272220ecd2d03b833779f1241aab806626734a6c100b1b

Download Submit
C:\Windows\SysWOW64\Ajjokd32.exe

Filesize
163KB

MD5
5b389000da61524a2e20dd30c0a3d0ff

SHA1
a0a03e77d7c4fb86ca5ebce3a93322b257c5b97c

SHA256
287cd06c74fb9fc9d57927c0f13c93065b503aaa807a7f9c933fb10457028973

SHA512
392c9f1092dbb0bcdd8fd021cf6afecf530859d0426099ae0a72aea07257959b28bc38d5dde8eb3459da0d5cbcc4a43b16e65eae4b3d6eb74be6346c3b77bc40

Download Submit
C:\Windows\SysWOW64\Alkijdci.exe

Filesize
163KB

MD5
768aa3053ee3d073e78dadd794148a61

SHA1
c5f29945ff21246e4bfedcd17f26a8c393a83168

SHA256
713acca6686032a64596c5223219b31fc3e5545876cb4f4c3d578db07980c20a

SHA512
aa731c71ab85e55c2879d74413287466a1212ece11a252b03a71d5c826b02e9b765da2440a4243f3d7de32290b7a4e3cdac44401a979db35a131d97e7ea15f00

Download Submit
C:\Windows\SysWOW64\Aplaoj32.exe

Filesize
163KB

MD5
6705c23483f99f34a07c426db76c5301

SHA1
d7eee272ec36cf095f1e668ae39ffef8d3431ece

SHA256
afaeb27a5d73eb4f4de0615e518e3fc41b3284125613bc11ce795f9307e66719

SHA512
a6f5c2a5f6992e440527849b71543523864518e5ba1fd2760316da09418705d0b21f8f192bba3f93ccf4ec2df2bd5349d74c99036f00c5a3b06e446897bda0eb

Download Submit
C:\Windows\SysWOW64\Apnndj32.exe

Filesize
163KB

MD5
59208d1c898a8b10641354397e9046c8

SHA1
838630ca837288c6611f10ccafd56e62120fea54

SHA256
c304d1ae24c3855ab0eb13ebfeb8d62c0453c4fba81127bef39397c732b70868

SHA512
9a802d5d9b6840aaacde0053f36fd4c1f086bfb3312794c3dfa23ac67fb2e4ebd1ca8c28437995593ef2ecef7c49c7f67761314cb5b64f4050103e6a9a80fd41

Download Submit
C:\Windows\SysWOW64\Baegibae.exe

Filesize
163KB

MD5
8dd16fd4e1204be9ce467f77fe5b844f

SHA1
ad90bb4c801bb2f103fb8e07de4a48e5478c37b4

SHA256
642cacab15026883ac2dfbd9a299ac7ff14217d9ba27cbb811d9d19a8e52b17d

SHA512
4808728514818173ea894c72573a37fe73fa68ddcd93ca5ecc4f1921afb6b1706780586d811b81e3526d55bdb64a8e723099e0e240538b0ce86c3343199f7dce

Download Submit
C:\Windows\SysWOW64\Bcddcbab.exe

Filesize
163KB

MD5
cca9fc3109ef87cc97e86d49011dbc48

SHA1
498dd667b4783bf2f8c1955d28cf7080098bc6c9

SHA256
7ecdaff698280f7a1c4f904e5ccbe88796b810eb88d739002e217f53ef5195f5

SHA512
c09f869df57f52dda589692e6aa43489d0cb405379481421a74507d20b45c523ef4f5f024400bb6131ae1a6ac1be0a2cac6b14ac7482e0f7215c75bf41e2d944

Download Submit
C:\Windows\SysWOW64\Bkgeainn.exe

Filesize
163KB

MD5
e7f5d0f097a0902251229f9792f668ef

SHA1
b30a08886b25b52779bc4c9d4f4f09df95962d5f

SHA256
6d30a587fc366075296b57621d8cc4c4f03034c53c5a68ba2993dfbd9d3c2e62

SHA512
9b54a67e5c3ef661dfa8501e1fa1a0d469820d07b91d08c8e9853c4455900b156b726daf67339293843a5c6fa4245b4211faef99c87365715e4b720bcd900f92

Download Submit
C:\Windows\SysWOW64\Bphqji32.exe

Filesize
163KB

MD5
653a88db28f71ff05f35c0696c97b74f

SHA1
ef8da68d7450ffeefc2caa19a7317622724d53e4

SHA256
28be233e0d2caa097a9669cc08a2a375c652bb0d176f6d674d7ae257441e8d10

SHA512
7d4ed52671c189f0671d9c686f56cfc88cb5efd42454fd342b6c8cbab6669ce0f64fb5ed5001ebd2a0159e6b832769d78804e359a110de39b653f341bf90e8db

Download Submit
C:\Windows\SysWOW64\Cacckp32.exe

Filesize
163KB

MD5
87ec516fcb5c0fa17f39e4835c8be8fe

SHA1
329c2d79a65aa5081464e7d26c636aaa4fbdc109

SHA256
aedc0a1c405a459c37f6077b648e788e6490fc608190c1171a0d2fdb87ad2dd0

SHA512
55cd5363e8d38a0076bc3d432aff28d2033f6c197e1092e704c8c38318148dbe50956f7f2e4891e061ec95f4b7ac548dc37c1f4cc46ffc0d219cbfa372e82186

Download Submit
C:\Windows\SysWOW64\Camddhoi.exe

Filesize
163KB

MD5
215d46390b0f1ece24f49c9437c2e0ba

SHA1
b27e64c8a3ebd215db590c50749fc664905b2da0

SHA256
850da719753c8c767e442289cf461f6edf36f1547a4cf217f7dfadfb6898d4b0

SHA512
ff300af0a2f7867b96a471ade267e46a37da2c5dd212cbc5e6b1e7d74530718060c0cef2fff9adbc67ea20bb6e363f9aebdac0e5e811101742048b10c89a35d4

Download Submit
C:\Windows\SysWOW64\Cdkifmjq.exe

Filesize
163KB

MD5
024a7156647a7943fbad7714b5164ed3

SHA1
57aa97c66d4038fcee78c660a6404a0af48e18e6

SHA256
7e3e1aee6e1be773af21165902c68729e166b6b4d03dbb8c1fb1ab335c4ebee4

SHA512
44beb3c97c700c13957bfdc0ee501232bdb44848086076b78df166e52ccd8df90da7efd6d04c1e56b555a01d641be3ee5181edb92d6544de73e84f3b7094c5e4

Download Submit
C:\Windows\SysWOW64\Cdolgfbp.exe

Filesize
163KB

MD5
ffc6a1bb6e594010368ef5dd9f1ce0b9

SHA1
dad4b348090dea8321c10fef60610ac2d5e77bf7

SHA256
2d8bac2e0a1780cc467d284b81f928197b4ce30d7a0373ace98dca5137f91036

SHA512
f38e82c574246483b0a39198bce182e5cf11ed22dafac47c05bcf78b4dc22bf21467647d36c7b5d30acc95659a56793b9076fc95cbe06e00e402ebdabef2d152

Download Submit
C:\Windows\SysWOW64\Cfqmpl32.exe

Filesize
163KB

MD5
19fadb97ec40e53c06df0c68cc572520

SHA1
0e4879ff09274f871e0f264e09f78ee67962cc74

SHA256
651e172d70106ea2cc9af9c95c6c2ffa7751d0eead8150584b8026af9db078e7

SHA512
dfbd9c710fe04030dd80cd66c645b4f69682126831df42ba58c2b4996b70dbfc72e3bed7efa4fcc8dd27029845ed06ffb30584627c653e08eea630e562d9cf5a

Download Submit
C:\Windows\SysWOW64\Clgbmp32.exe

Filesize
163KB

MD5
f446f3472752d17a2d37c1e11b83a14e

SHA1
1fc7cffc276f4775d8e66826d989ed0115180845

SHA256
0a9756e9d67db69628d5f5e3ae56771702574427edd9b66da86b455f5693ae12

SHA512
1ab208c7adddefa67bffea71335d47c25681bf6051bcbe3587e3d078a5d58de9cb765449fec9e30b5139664588d72e5c6287136295f3cf0428031b681c8f75ab

Download Submit
C:\Windows\SysWOW64\Dblgpl32.exe

Filesize
163KB

MD5
43b5de20e1383f5d8b530eac971d807b

SHA1
f9f1707997e393872fbd024e0a2ec1112d55f7af

SHA256
f38493b7e8dc9fa982ed1766ed67eb2b9ffe761ccab37fbaa99681948ae982e2

SHA512
01a0197604928d2f2c99b922a5a1cb9de2e8114b4e79b35282cab13d636b3f7d4cf10d10005526525e50dc8d63abd9ee6e873d985c76c0735d90f7682ff86271

Download Submit
C:\Windows\SysWOW64\Dcphdqmj.exe

Filesize
163KB

MD5
2f0cb0ea9b8ad75c6cd04a0a39c40b87

SHA1
90262257dc8c449b5df60e7a8da67f2039dac6cf

SHA256
ec27f3945c4d6f17b9468d21ccad440c31a4701d44e6a7c323098792d06fa084

SHA512
3762c92e6415711d9fdfb6190672b33331bf1060ac6bf22a88d0700149f7621f6e9aca2d4dda4ae5567f893c03db7b7d369fd2f9d282ec685bb1fede5ce986b9

Download Submit
C:\Windows\SysWOW64\Ddcebe32.exe

Filesize
163KB

MD5
be3ffe7671f481046dadd6be59c9c41e

SHA1
51f0e852bce5c8b56a67e24fd6a9519aeb0a0520

SHA256
393748a3b897f1c14d76f1b96274bfc64d8d7451ab36e85a49e0859a9b28c2a6

SHA512
8769bff5d13531d02ffb02618af5ebbeada5ca4a0bfb2fde09915f55627df21df6ca60c2da90a6e8c237cf242ce851c29b420f5ab33181143cfdf540e41df0d3

Download Submit
C:\Windows\SysWOW64\Dhdbhifj.exe

Filesize
163KB

MD5
f1ab2010b7144e6d6dded4485f3b02e4

SHA1
66a4f6e6cec4a24ad64c2642212dc009b1a90bfd

SHA256
3e29af6e00850d72028031d0b9170287be15e316fa1aaef45fea161fae155b26

SHA512
cbccb53b0f47f05ea116ff63da7b158c7cd66596f8541e318083e45ef2deabd5cfed13bf6718b31d2bf9a6d1a3769650bfd4850fa28148049389b6a2853b3b5a

Download Submit
C:\Windows\SysWOW64\Dmlkhofd.exe

Filesize
163KB

MD5
c134ef7f27d08dc56912d6a5d5a5ea56

SHA1
83ed8184061f2abfa152a93c9f6f998b68cfa545

SHA256
520d9124049de88120a5fe03e6d32e129f5f5ab4091aeaf91f1a5075e1484a6c

SHA512
803caf72116cc7021f58d1794f3eb1804a257993c1014b1b99d3929bfb9dd261948f4556c0adcdfef61fe27f87b51b0e55b72e479488834e5836f88864b47c5a

Download Submit
C:\Windows\SysWOW64\Dmoohe32.exe

Filesize
163KB

MD5
9760d68a2e21f4c46e22bdb601654161

SHA1
08563282b0eb44bb5c2ce75ca1929da6cd101bd9

SHA256
cdb06cefd08aa0269ab1cc3c75e312dc67a28827165a9b73ff3acd3903d34718

SHA512
7069e1c4740762e4119a81ecbcdffcec7cdb3f41643182d1c1dc847c0f92d20d65c2e43d8ae91bbd40fa488a0831490ff8cfc9add38a06b62fb18456dae0fc2c

Download Submit
C:\Windows\SysWOW64\Dnqcfjae.exe

Filesize
163KB

MD5
02daaf3d4662151dabf4c5b819568fdd

SHA1
94f46d7fb34d82307afe8be1c8632f68ef1a1f7d

SHA256
7ca58a0254be37914395056684f8eb6e43328869514dede2579072bfbf4318c2

SHA512
4b4f9d7c511a34e926bfe66c9b2c5f737a4fbd8e1bcacd486892d3c04e474fd8052e3a6c358794441a06bddf1b0aed0f738090d91d9a756882bab364dec9f9af

Download Submit
C:\Windows\SysWOW64\Dpdaepai.exe

Filesize
163KB

MD5
9e9bc3fe94db1591d73332472443f65b

SHA1
362aa9811a0909829ac24defba5b398531a8f262

SHA256
85039d53045877843af8f050825200f806e138088a6c37708a992a2a81e8bad7

SHA512
0ea108c4daecee36be98e8e759870ff8db390f3c0ad73a491b7371bc10dba7833a11314e2ab83ed1ea1997d1321592d5341216fa61a8c66fdd4075dc8ae4f4cf

Download Submit
C:\Windows\SysWOW64\Egened32.exe

Filesize
163KB

MD5
c7400aa6778945532dc9ba41c789271d

SHA1
436afae8e0bd3f71feaa928f17f9069d0b8f970e

SHA256
ab9a65bd3510da22bb8a2d565b7d654dd3eb98120bf9c983c897a78c55db9a7c

SHA512
fdc9fce02e82dea9e36876d1256d88169896badbce547aa26d03a48d9604e371fc7ede3d3ccc1f3e583982f7aaed13b8baab272d6517c73005545abbbf32fe47

Download Submit
C:\Windows\SysWOW64\Egnajocq.exe

Filesize
163KB

MD5
28ea4704f4a7f26fba378a9d553d49ea

SHA1
c9b78eab7f3b8e15dd391a26d1f2623f3223b316

SHA256
c1dd3874a56d817f8b6f9f7c671222fef4352246c4016ec12209486dcd029786

SHA512
2d0434850b1b34238e583cfb8cb6673cfc4d8de57654ca34969e10c204de0bb3b67c6ce0770a25d39d13bfdf1f496d45808ebe42d9d188465e97787f45af4013

Download Submit
C:\Windows\SysWOW64\Egpnooan.exe

Filesize
163KB

MD5
6407e55d4680290575c7d87bd9d176f9

SHA1
cf8faf453b3dea5b269c7475aaaddb8359f4a45d

SHA256
4a4b4f03c02aeb46360b63ce60bfbe0193e7562585032ca107d5be65296877cd

SHA512
d37e31b1739d1a114d7673c666e7d57d80876f0d5824b5450be30bba2dbdfd9c2d6f1b4e13101e88d9026161853f0fec76fa3de1c52cf7190c5f51d7a6e49795

Download Submit
C:\Windows\SysWOW64\Eicedn32.exe

Filesize
163KB

MD5
9c7d3fb202d7ef3fe48a1d3f4f6c455a

SHA1
d221fa0436590351b5c50501148aa656816fb08d

SHA256
0ef093e202db43f208aa8ca25521cab6733d6c2ec11f7bbe57602542586619d5

SHA512
874267fac48b8a6d4f69e699033925a5f28c6aa5afe291288f1e6d150919e5c4ef2d083838c8761520d980616933f92fe45ef6b6a733902b2606dafe02749b62

Download Submit
C:\Windows\SysWOW64\Ejalcgkg.exe

Filesize
163KB

MD5
cc37a6ff14c8e013785102d68f29a863

SHA1
97e743851ca4f26ac3139071748fa7da208b0750

SHA256
ba24c94afeafc2c5f73ca1ae08b0aca2350e7298a202ea2991e0e059f4ab760a

SHA512
343dc7a5164466a6e4e1cd4abebc834a86f62533483394378aa4d61a3b193829967c0aa0dd1c69735b1c60f3abb35f013f394c0fb5c60abe6c1adf6a548b5118

Download Submit
C:\Windows\SysWOW64\Ekqckmfb.exe

Filesize
163KB

MD5
21eb625885dfac1a6b02789a57092f24

SHA1
830cc39c2746b7d8a214caea2cc333922ea4766c

SHA256
b8339cd33f0f3c97217e83cff111d206b4285348ac0f3e850d4e2f897215211d

SHA512
3cd5d8259d744fdedf1719672d84c77030574b780d5d3cbd7674c357d0bd56c55d7da264ea898ed0471e925b70ddcf282105a4d4bcfa31810d5bd4bf8126676e

Download Submit
C:\Windows\SysWOW64\Enfckp32.exe

Filesize
163KB

MD5
ff7965f891180c3a3a500b631bfa3b80

SHA1
52853f0eb7246f551a14a8bc804259ffac70e62f

SHA256
536dede14c8eb0aff74563b100894a7d7291ec758088f80b72cf83dab737653c

SHA512
82b5fee91d2f4315f3d550b3c1153bc52e63fbd36e743382b06dee7f90b142a155624b7d987f3a7671e1380820820d576129851ad200351fc4ce0fa3623b996d

Download Submit
C:\Windows\SysWOW64\Famhmfkl.exe

Filesize
163KB

MD5
da99e92691b6d062fb04a9076ca4fcd6

SHA1
40806b5f78746fffbe8abaff28b83c81dd26a953

SHA256
5b5e2e21964daf757ee17956d86d0a46d454e6f92f5e6aeb5aa501a56f7ba2c8

SHA512
04fd2ae84d190f6225c1572aedb64e133a828544d1043b9fe824d9e7b2f74c34b472ad5efcac54ae6384aa593b748d1b6becb77d82bea71c805cf02c1f8203ee

Download Submit
C:\Windows\SysWOW64\Fbaahf32.exe

Filesize
163KB

MD5
d55dfb7c9858af2cd207ad9b6d4f3600

SHA1
9abf15e9514612414e37f2ac49ea0091e38a64ba

SHA256
ab4724b1f1b70fdcdeed5383a854c58e4692307ef75a27fec12e31146b4dad6c

SHA512
a8de400c372b2413f136fe14ed1dc9802be28c31bcf56595395f4fc063d560f7febd218d91bfd60891dc97e4a87638863f3ce52a945855631174878308653eea

Download Submit
C:\Windows\SysWOW64\Fbdehlip.exe

Filesize
163KB

MD5
ddbf421108fb428a085b91d0d7f0d043

SHA1
08d8ee452ff9ca6cf651590ebb6156db7d15c6e5

SHA256
9e6cfa80f8cfb7fd2b761b0ae7dd1b5f837e28164b2c7b5009472d205fb7f48d

SHA512
9dbf9e9400e500307da105184ef97122a7bfa17848d03583075f83810de7b1ad9c7416931f96681bedafd18c89581f715a42d884b930718800cf44305d93cef9

Download Submit
C:\Windows\SysWOW64\Fdnhih32.exe

Filesize
163KB

MD5
844777f3d6f58c1bcfd9af68334a689d

SHA1
c1c936debc2bdd8c20493a7c841ab5198d956578

SHA256
5e3b8c71ca77fe507761b93b7223812cbaf036018ffd9ebdd88ab81215c37535

SHA512
35994e27dc70cae3c01aa088f76df5c65f8dae73e1518e3ecdc947777f33a56f2eb8a6ef4438df7f1f365337fe9c891a67ef2de5c6dfe0030ce68ec590c1d6b0

Download Submit
C:\Windows\SysWOW64\Ffqhcq32.exe

Filesize
163KB

MD5
cf33d4ff142b39630fc16b43bd2e0bc8

SHA1
e2949b65d05558b3991fb67352f8e5686222b155

SHA256
4ac899e511f3d0b782a572d49a011bd438f6781336c675d81848e057a242302b

SHA512
02d6061c790ad8cd013cbe5a1c6a63c2d97b311de323db2bc163601a8a91eaf221d7fefe91b6a520603a7d66a6e97fab23cc0cd2e2cb749e36c10f417bf5a5c0

Download Submit
C:\Windows\SysWOW64\Fglnkm32.exe

Filesize
163KB

MD5
b5892571b7de4ebdff23698a8646e59a

SHA1
8268ff958696b62110981fcf5f4448d25bb959c8

SHA256
e53ba09b74458cc0ce0576a3432d802a380feacced8c7e4ed16c1b11bc0cbb39

SHA512
3ad58ad59059d4b48ffe6630da327dde581010e096b4784ecbd0b0c6d01c25843936db029b41069322f13aaa0efc12cd9de3efcc500bb8928f46c0283b429942

Download Submit
C:\Windows\SysWOW64\Fklcgk32.exe

Filesize
163KB

MD5
86ef2774a6d8c9c43e537762580908b9

SHA1
a50f28d1da15df57bffa4736902b304f9cf5ddbd

SHA256
34546e5bfccacde5cc059a7502c864485ce5964eac8c96df13afa27e1519c918

SHA512
ac0dd778695eaa17b3402f90456d762e98395ceccc7efd1c25e69b80ba81cebe08c545d18fcd51845a9a7abaa5a49e155dfd0af79cd436d26c28641b044cc83d

Download Submit
C:\Windows\SysWOW64\Flpmagqi.exe

Filesize
163KB

MD5
35fb52a49ef0d3c8ae39e2387f132fde

SHA1
69a223acad2706cc3731a28887fb7e4599438d82

SHA256
411c9955cf38208883b01380c1e787f8d251309a610b916298d4dbc366342cd0

SHA512
d06c6d902f21d587e5bc5f4371eb82f0d0eb6ea902501c6337659d23fa4dd12b12b8953c8d954a6735c8e4150ab5b67aeff3fb675da9423c62d6b180ec2ca17b

Download Submit
C:\Windows\SysWOW64\Fneggdhg.exe

Filesize
163KB

MD5
96b6c5148c823394ee603c4fc203e0cd

SHA1
2b52c3d0573dd22475871a6bc53a94a50a2a3b1c

SHA256
42e8e4e960ab6ae3c3c976b84acc1d6f85f7493d130f55113747c776132ff459

SHA512
8fdcf4bed0ac84a6f43c776aeb847f05fb6b1df9c9dc9a5f7a8b053bc859f7cf0722b095eabdf265b3680b6bc5b2a2f4c36f6fa4238dd24d43d53c8075e189e8

Download Submit
C:\Windows\SysWOW64\Gaqhjggp.exe

Filesize
163KB

MD5
bd1799d438bb3d4080784fd34aff8c8b

SHA1
566f2ef3be9d14d9daf0b134bcd77b7992177977

SHA256
9cc2d071189166a445d18bb5c0dc977fc82034b91278f27412f84e15694576c8

SHA512
2bf0bdc0ceb58c6ec5843160a2fe2cb724713743e8e2854c1e8abbac03ea51484b52a7db501ef571c7eab2f4667361485f00f585327ae3dd74b5054081ff3d52

Download Submit
C:\Windows\SysWOW64\Gbhhieao.exe

Filesize
163KB

MD5
9959c50cb3cf280aca11f5655963a954

SHA1
a512aa9e574626964190d863fc4f7dfb51cb98bc

SHA256
b9aab4ca591edc149c2d123ce598c6e9ee957edff12c3f707e8b151374c9e5a4

SHA512
2298379f9a4b89abf33716a052b2feb353384714a004ab71b9c02bdd58e375bd6e1345e5979201005fd23f62460415b4c48d3414914d0d2d35d0af129b95de2c

Download Submit
C:\Windows\SysWOW64\Geaepk32.exe

Filesize
163KB

MD5
0b3023f28334d2698cbd631ab7066c40

SHA1
01b834bfb50c22177a92f67167bbe5229f67099e

SHA256
451466f63d8cd7399eb3baf4ad9b56f087f98ee3d69c0423e5800e8db9366dd8

SHA512
42368a262efa38aab4eebfd7c9df785dd6fdfa0b649bdcdf7b641c5b0f3b6c0ab9ee4e8317f053498ababa538e348b0c70e0e8e0f5f987ab6634ad23a578b776

Download Submit
C:\Windows\SysWOW64\Gegkpf32.exe

Filesize
163KB

MD5
1302a99387c607e8b8bc357cd1395297

SHA1
8f5ff7677989a046963f5117e6a0f3b23d5ccdf6

SHA256
761a0b05ac38eed78bfe55deac8e4c72032940e0f3965fa0e3bc0b18a188e262

SHA512
0937e523a0abb1a8e89943ebd0b271129c1890a6a586772716d56eb80f372d9fc9d9881d24b2ae60cfce084a319491477fc8434f111a487d8a0c6a51e9279ae6

Download Submit
C:\Windows\SysWOW64\Glgcbf32.exe

Filesize
163KB

MD5
cc185366137e86f64ef9d94eaae8ddf7

SHA1
4d5c277325eb739238728640901e06ef9695528f

SHA256
a7be22ff1eb19d979fb7ad8c07821d64557bfc42b2f7dd70c2b21c8f975bb38c

SHA512
e45a0ca515b6761ee813aa9298ab0180437991471b1e331ca8b5cbbfadec50191e5e8491bd22a5ab61a8ef08250293102592fcb069d0235fabad574c192c2a23

Download Submit
C:\Windows\SysWOW64\Gnqfcbnj.exe

Filesize
163KB

MD5
bb9f06d47a45cb49ad5e9969294694f9

SHA1
637ba9c229debcf90099eeeb5fe9dec1c3cc0632

SHA256
eb09644d89eee82f453e41d54979281f3bd4baf27bb247a10f6fcc6c261b998b

SHA512
463ba3897c69c21d3b6253f59b5e4857f590f432d84695c883be995df1d9b729e32211d5ff77dd684d79704f819d662818ff8838389136df0b7f513772a7f7b4

Download Submit
C:\Windows\SysWOW64\Hahokfag.exe

Filesize
163KB

MD5
4f810917d5acd94955c35a9b0642ae96

SHA1
7c689d9847fe7e357baf26ce06f53eaac2fbeb2e

SHA256
cedbb523409d5280082996b8be6f62667c0c487802399651524b94e9f0d5138b

SHA512
52583e16a49c9e752c01c14879e3810eef4a569c91fea7892a864534e65f3eb1353f8c38613c555f160b65c52ab32c8ff40408b2c2fe56e99bb9fa147b9159c7

Download Submit
C:\Windows\SysWOW64\Hdhedh32.exe

Filesize
163KB

MD5
c73254803655eb5f81fd3c83613923c7

SHA1
34d0cc7a09822448e21a0c11c1e1c158fff05b7f

SHA256
b37d788c778a206855040164e360f0d5cd45bc31c85350d112beeea0faf071a5

SHA512
156a941e9de36b26ea73e58960bf636863022ae336cc9e842bd36be7093337c6901e496bdb6ce5a3c3eadceb4bf8e583c0a16c7b91245fbc04d0ccec42362d52

Download Submit
C:\Windows\SysWOW64\Hefnkkkj.exe

Filesize
163KB

MD5
436c9ec5c8521a82a766a11bd8d2d0f7

SHA1
777210bc629b08c4f68d3bc8bcd04f31e193d600

SHA256
03f1bbb739856ab42a2f678f162df8a8ce52127f67b678118f22d66848434b5c

SHA512
bd5007ddbc71493c40d2a3380357304984dcc060b41fc5b0912ebbcbef3603c81f5b5b647e6b7beebe0b9b0580cd183825d43ed60df393f5a0ee0e31ca6c8099

Download Submit
C:\Windows\SysWOW64\Hnbeeiji.exe

Filesize
163KB

MD5
cda6e2d99efb723c3e76f415d0331108

SHA1
f8cc7563db35028055e77264f84bfe41e9f3e15c

SHA256
3e67572f7f466ff86a89eac9de23a13bdc3ef7d14047b4ac44132ba889025575

SHA512
0a48c4535e4a8ca039a8bee59412ab856982d08c49a7e1e67a56f9f869fc7f12d8395b84bb03d2dcdc9128cbdad9b8f8c1851fab7261e01fcbefc2197aabe088

Download Submit
C:\Windows\SysWOW64\Hpjmnjqn.exe

Filesize
163KB

MD5
6a1208f341cb7db892a81819b889d269

SHA1
2599e86b857b09ebb9cc9441c64423601f0ab7e6

SHA256
425ac796fe718714b8931848810a25aa496ec3b5b72eb890abf06ca2d0872a9b

SHA512
227f4187f277c3af2f9545cf7322486a376624ec610c8d0f1f37b1c5b8642bfe3c8161e9958c2fb427959165ff7b303ae97c3ace3d9bba89cb1e2aa3d1b2038d

Download Submit
C:\Windows\SysWOW64\Hpqldc32.exe

Filesize
163KB

MD5
c60d9835d00456148c45dcf7237310a9

SHA1
39e05df36bcea4bc2e6bfb636e30f36a7d1230de

SHA256
6f94cc0f5603395b3af17675f5ed81c7f4d2a8d3233a30cf18952186d7ba6a18

SHA512
a6b748081acb48099aafbee4068c40fdfd185bac7c5ac8d016a4bea867ff078a9359dade390e20948809ada37db696775b2d044f26aa3920175415a36440b835

Download Submit
C:\Windows\SysWOW64\Ibgdlg32.exe

Filesize
163KB

MD5
f60370dc9293bd7be38b8cc5181e283e

SHA1
4843ae5de6e2f49b64ae58f5c503e11c23273f62

SHA256
5751c337afe257561b1822a66cdf612b7fccb06d5a0b68491f8e72e2755e068e

SHA512
e846bfa4f3610354766fa7f288796ad26c61207235ceefeb42c25ee44fa3ed53ce47102dbf7b5ff81507e4520d4912f1196b66c4663e2776ce964f36504ceeb4

Download Submit
C:\Windows\SysWOW64\Idhnkf32.exe

Filesize
163KB

MD5
91fa47b67be1b424887a375a44f237c8

SHA1
f1e1d49ebc183d9a4d0980a7e3d009f992a4144b

SHA256
dbebc6d312bd43a19dafee5e910b1a2f8c8c5daa44422260a3367c0bcc23c18b

SHA512
5d8bac6f16765611da0dae37396c7671b4d5dd3d8aacded9a1e290d420195a72392cc54fb697c842a1ea69ac7c8e32b9e6f91e4f2d46f53e7a3a1afafbaea38b

Download Submit
C:\Windows\SysWOW64\Ipeeobbe.exe

Filesize
163KB

MD5
65ef563afcd4bd3f8bb97c9031ba5fd3

SHA1
d46d26e20f7c776e44341dfc41574f255fa69ee3

SHA256
e6b3f79d9e376a193a52eb02a4178ab6720a2fb3158078662460222246f1c626

SHA512
c20bba861f86c3486f941d622efc01c03d9fd172bdb8a184fd861776f9c4c71b2a0c11f1cce6501d2e903d3edabdb8b18cade3a9437b0edb4fadaa8ce7ed28c1

Download Submit
C:\Windows\SysWOW64\Jcoaglhk.exe

Filesize
163KB

MD5
e5ef811b720950bd37d0527bde131e37

SHA1
835a8d69576e37b0ef5f0857b43bd44153768941

SHA256
50eadb6fc6622e9aea7c725aa97f4972b889d866a287e6257578a0987c10352a

SHA512
dc1eedf0ac732a8f59899eec5437c29884497309e97a6f6e12582a4d30b34dcca943249201a308b4de902d0ecdf45a65f72385bd29a6e97c09052b59b7e8f5b5

Download Submit
C:\Windows\SysWOW64\Jikoopij.exe

Filesize
163KB

MD5
7959191de91179ab084e222d4b4ac292

SHA1
6faee2a22e71d81ef34fb2379415e58df9dd25fb

SHA256
98173b0ed94146430bd53242f0c61c3a4e734f0c597b597466821d74e7416918

SHA512
f90f8734171b9c47d1c7d548c7b8a0fd9cda76c8a9b2d5c959559673d4556662e5283ef8983c38464e559d0c700ff37b9a8f4c96ba3d3d10c95aa4da1b89c8e7

Download Submit
C:\Windows\SysWOW64\Jjgchm32.exe

Filesize
163KB

MD5
6c19c5c8268d579ee6066586ef4d40ce

SHA1
b4b318adbbcf517b9b358a02b867c7d4e35ccf13

SHA256
764a75bf734168b28b081fdbee0ffbb98beea4925362ad4c342e7e0701e66e10

SHA512
29cf9eab2c11435ee83f23810475d37a49d017a241aee5fa814f5e24073d2229aee78897cf993188f65704d8c813ddeb4d0415c805728d38cf6099b952889252

Download Submit
C:\Windows\SysWOW64\Kbddfmgl.exe

Filesize
163KB

MD5
be87a9e54077996ebc8692625d908e80

SHA1
47a0588204abb4ddfc1a8de1d4e3f76440596673

SHA256
e2cdf0e2c5fa1e3031e353ea125c0421c4548932b5305f0796862bca0e2b55f7

SHA512
664738f95a11e5874db6d96513f9e8b385b92581b6e2c5342c3e0d461d10f84e8b72994fe841f14f5d8b6a0fba5e4d4116a0150a32ade8e1651452ffe7bbde6f

Download Submit
C:\Windows\SysWOW64\Kcapicdj.exe

Filesize
163KB

MD5
5919ead5b28eb89a326de0adf5c9a60f

SHA1
794312231f8fd39823210f45e3b5c0e008c618b8

SHA256
3d194f2f802b56259073529e7d1f226ab95bd828d84a585238a9b2886627bd78

SHA512
002c4921db7aea33a66c9e108f1811406d1c42cdd4de16d3b71c0544419fd10d01316c7d4a1872700b49f49337bc37c8276dbca9204fa28c82fbc084d39396af

Download Submit
C:\Windows\SysWOW64\Kkjlic32.exe

Filesize
163KB

MD5
934968dcfab1ee6fcd30ef3bf03fc432

SHA1
d3491120385e422af2951b09d8f7272a2325998f

SHA256
fdcaa416a1aa5b5d5abf3aa83e62e864efc7aacb0c1c40da3522edccf965675a

SHA512
dc08dc3fa4d24f10b35cbaf40ef28eb5ffec5d400d81c943b68e0b148fdece654610f814384080c19a20d3b33605532e8d2fdc917a7b4e366ca49bc3fc2d8efb

Download Submit
C:\Windows\SysWOW64\Klpakj32.exe

Filesize
163KB

MD5
30b16abb45b5f9f08b593ff3fe4d792b

SHA1
160f0f98292a35a226237b07ec7c2e4bb9a11837

SHA256
baeec08d8519b504bc8bf23e9f44a41416bb60f217a3e0919685501843cba94b

SHA512
32b0390c0cad05edcb395aca276d398d4cf9b3e85c4fb4ec46db3f40ca80bd7c7953d7c92693487528c1c23813fe6404eea97d332632125f6e6ae6d2449c056d

Download Submit
C:\Windows\SysWOW64\Lacdmh32.exe

Filesize
163KB

MD5
c5370f3515d59d2e1539932bac1d246c

SHA1
05a4dad36b18d283e695c17fcb4f5d1d9dae6638

SHA256
faadad1a180b6bd2d76fce84fd2dfdaac157171faa13cf13d37d2e13953d11ab

SHA512
4a3968cde14b55ab515f9603ef4270e4211cf3eb144290597ec716280ded2e472cd44d4af3424db0b981c4d2eb0b7a0da19d5817c167ef7c11fac0993e8a0637

Download Submit
C:\Windows\SysWOW64\Lajagj32.exe

Filesize
163KB

MD5
d3846d0633e4f6f9f4649741c37a5323

SHA1
3dc129d9693fd1e89c85943ca48f13117829e3c0

SHA256
1eaedb5cf24fbec03cfbf6acbc47281f474df53ce09a0f9622cff823f925a0be

SHA512
43d5bceff6cd5514e039079a02a9f896c7b7a79eb9c6ef517a48232bf517b020ee5dd31bdc2209c4081ecc2f99c53b183ca3f6f4d018f9abd5fdd237c75014b0

Download Submit
C:\Windows\SysWOW64\Lalnmiia.exe

Filesize
163KB

MD5
67cd3c4fe14872a15c438644ae162fb3

SHA1
631c4b126f12c5891fdf29fc7d828b5ee2599738

SHA256
0833dd8c46f78136a3aaab4a8c7544c589e6efd774967f10ba75ce4f21b3451a

SHA512
8adacaa16782eb276166cc964eeb962f6b6c1389d2701d80555e4533a38f2f21ac9b9ec537c13a941da7c2c68b401dd3ced7cd7a0523d46b448f029021512739

Download Submit
C:\Windows\SysWOW64\Lankbigo.exe

Filesize
163KB

MD5
bd15b0c02439f66a087efa0c76c1f2ae

SHA1
a70bf1667ff3ccdd370652f9cdb7c6ccfcc2578d

SHA256
d1adf0fb8400b2cc3a2be1621d07105a3fc0d71b9abfef8d005dc14a08be8613

SHA512
f5574e4165f71afdc287b1898187e85a09d9c6c680d8ae8b95031117b62144072a5d97a25e728fa56772c064581b6b04514d04ad55f18bfe59b30d92ec0ff389

Download Submit
C:\Windows\SysWOW64\Laqhhi32.exe

Filesize
163KB

MD5
4c7d892a28dbf5d11984be51c61a6cec

SHA1
94614d0f199e0f1b1e1a72bc81cda390faf14dce

SHA256
9920da83383a75cff0c6ab852fdab56a4bf82ef1425beceb9b963caa651fb3b7

SHA512
4aec57ebbca1f341af92cc58d25ccb7bb470bb89302f42871312618587729cb48dd4a2ff50caf5d365597ce78adee9cf521a9f3af44d139456682ed7970fff5b

Download Submit
C:\Windows\SysWOW64\Lbngllob.exe

Filesize
163KB

MD5
383b82d96a8ac57a4a2adfe8d06e090f

SHA1
8cc7728f37e6a514bcd1c0ec9d0ec14ba9718da3

SHA256
0d0d441e6dc6a2b21221c91e9a706364c4c15aff2f9ab1628e4d1a776143fb21

SHA512
bb0e3be25c8cc40963f17e28ae7364806b746836c4efe8dbd07710f50cf1a03c0d7ed36e1fb593e1b394a5a784931e52d8c78f22a22e01388502cf5f562e8fef

Download Submit
C:\Windows\SysWOW64\Lejgch32.exe

Filesize
163KB

MD5
b5741b12e13b4637a1f9fe9627eb487b

SHA1
2aafe63f4f800fbaf58532de456fd690c8f94643

SHA256
6a432bef42da1e6dfed52dbb2cb7b4c409d225af25406d89db7ac9121a9f1c9f

SHA512
62b42a7456a16ed5c05580e03cfdb4ecd435c5dbedecc88beb6bf6bb3e156f5bf009d0b7e939e0a4e104a960d897b10d4fba393749c0a94f1819cf76a2c44c2c

Download Submit
C:\Windows\SysWOW64\Leopnglc.exe

Filesize
163KB

MD5
32cd8f50f8fe322e220a769616ec0f8f

SHA1
ee3dce355769d87ae3ca6753a403e552bd55c71f

SHA256
f39cafdebdb830cd31929030c4b79740e2287cf4afd26ae9ba8f9df92225e4d8

SHA512
8a968cb2a41b82ef0f79c8802b579d98f812af5d941297317ca32870c58843841f6e993e789700c5d6f1eb9d9ad43204f406b447e1a09aa66837ffa5f4885434

Download Submit
C:\Windows\SysWOW64\Lfjfecno.exe

Filesize
163KB

MD5
7b13af20e1b4fe8513b18f371e0abb0d

SHA1
19b26cac7a709c31c2a64818f748474eeb03b1db

SHA256
1aee5482d08c1915ff28137169eae3173912df7db5755eca31b8ecc176ed17e9

SHA512
d7ceb622ce130338051044600f13eddf6d47a3940cf9b6f1cec47da39a682b93bb2c66eaa4d8a28b1cb1ac086b180ab986bf854ef7a42032e52db339344897a2

Download Submit
C:\Windows\SysWOW64\Lgcjdd32.exe

Filesize
163KB

MD5
e7f330db50574ad0db4a90195883194d

SHA1
0617eab8bbc98a1ca26fae5395d993703f3eed5c

SHA256
91fc5b5c3365d59be11b7ae33fec5650a43dc7844501bf3cc5bfc90445f11488

SHA512
89a8d0c0ace341abf14a3c5380957e649db57727014a5bef5d1204d0e03f6a7890424004f71e178bd274e7919f5801caa8d67e09033cd87d99a4a6704fff6ec0

Download Submit
C:\Windows\SysWOW64\Lgkpdcmi.exe

Filesize
163KB

MD5
d5ae1f0399754f82fcea8d5df14284fd

SHA1
06942dd30d4aa459d410c19b2bd1356389c75671

SHA256
b4f78273f7a59927d7e10e2f02f4f28b804a2b26b0e458f6ef397b05e50a8546

SHA512
94bbf27f30f68a38b3a9a3a68f6c26099ec6dae3cf997b122bfbbcdab68c97ee704ce036466847053a779b1b6ff4721fea62ec4b00cfc18be147065b5c552c6e

Download Submit
C:\Windows\SysWOW64\Licfngjd.exe

Filesize
163KB

MD5
d7af08bccaac60236b8b3b354317aad1

SHA1
4c4e0b62454261322db28046128376a2346db76a

SHA256
e329f2ef92b8ea07a72ea168bfbc677880fc57f8ab364db469a79e0cf53b91bc

SHA512
2d45892d82d3caebf343ed75023c0bf42c6f049e4c1b1d42597b1e3107308f75ebe78cbf9118fa78c5599a7cacadc2514b721b086728ea879ca8273493328ef3

Download Submit
C:\Windows\SysWOW64\Lieccf32.exe

Filesize
163KB

MD5
4ee4d0328efc025efc8a9ebc67f33e31

SHA1
90a65422e662415fc4588e5e3fdae196ac872e5d

SHA256
61a7d8d9ab28a7b8145969e0d105633e5a8fec4321a956485e03cbd44481bb28

SHA512
4607cdd8d2d76963f2db52eb0ae92e0ab9b51888241147f725580465e80af5485ec2f48ff973c56cc18882d1925c638db0422f30a5752dbca05909be09ba9bab

Download Submit
C:\Windows\SysWOW64\Lihpif32.exe

Filesize
163KB

MD5
962891654f926d6aaf519bdbe4cb3800

SHA1
6e3d09c58da4d84beb5563286d9d599e517814d4

SHA256
7fac983fb92ed1d2ee78a08132781198d27a62d0cbe0dffe25382d0952b8539e

SHA512
a73efcba7f0b22bd7cb90be8ec6a19502e98f1399960b3c66cba1e7e74cae658cb46f2a4820130b273af66eba133c16b8919752e07c2126eaaccd0ef3ea07908

Download Submit
C:\Windows\SysWOW64\Lijlof32.exe

Filesize
163KB

MD5
3ac61183ac83c1983f1fc112b98ffb1b

SHA1
42d33ea6b60fd8dfbff62e1f8a177ece2d21dbfb

SHA256
b9cef5b684e8b74bf10eff352cb0982844832e879682bf0ffa18b1fb9e9c4a31

SHA512
c408a48f6c923a5cc3ede3a777b3923d2d4319fb52377f9e1cccdc60583aebf770d0aff359bd47c2125e84cc2c18f1fe513c4e1ca36ba5edd940c713436a4cde

Download Submit
C:\Windows\SysWOW64\Ljbfpo32.exe

Filesize
163KB

MD5
bf147b577422851f1bc41e7d9211b56d

SHA1
c0966805006470c0d153d5c74f336a0a6e0c1a50

SHA256
adab76cb557e1f7c5e993fbaf01f7c05e2fbbbbb879ba830308fea34060f163b

SHA512
73eca6e700c5f2b94263724c43c49553b60dd33f95dba501d624607b4b7a58f33380e7de81a6d367d9707c8f5b792a7f7544faffec85a336e99837efc3cbb623

Download Submit
C:\Windows\SysWOW64\Ljgpkonp.exe

Filesize
163KB

MD5
2c2d98166ef5427dc9bfa84623059b62

SHA1
178697adea303928aa8e99d460a9d88996d466fd

SHA256
9eea65b09e7f435ba8d9a5e0343ba3b230b8579d13a6fed830f1cded039832f1

SHA512
cfacdab471a3c2d5d64e7a79908041861158235eacba7f6782414eda19f3181c56512901edd9ed98daa2e671b4cddb1b05c33a49668eacb8741755c115938d4d

Download Submit
C:\Windows\SysWOW64\Ljilqnlm.exe

Filesize
163KB

MD5
1a63a987605865012ad28c5854f23eb3

SHA1
934588819885f7e4ef06649eb62883229db6a586

SHA256
80989f085bfd4955630085360784b0b5e58ad1db1a483542e933a012b8a151a1

SHA512
cf0ea8589ca7b99c629bb926611ddb87d7ec205513250a4726e911263f693f24757489a13947d8034dcc9d004523e09830770c274e47c05fda28860c73aabda6

Download Submit
C:\Windows\SysWOW64\Ljkifn32.exe

Filesize
163KB

MD5
d47e0c1c86c52bf6ead352c2f11baf3a

SHA1
d6f1fa788b614233dda5ed3bdfdf3807502c35f9

SHA256
0182cf9c4853cb25a77200366f631d15c40862237e9fe2d521564d598a3c7492

SHA512
5956332715e0e4fbce922db971d85926c142cad5157ae0a853fa8554e6d16bbdbe0933e14cff539c4c9e0fb2fa1bb9f2c39c877cee789341d04564376a669d14

Download Submit
C:\Windows\SysWOW64\Lkabjbih.exe

Filesize
163KB

MD5
e6a906a5f4aeb123308d007a154ef32c

SHA1
b65092e0b78d48dac80dae035ffd80377432c751

SHA256
42007cab1a414c65e18929074da4777ff6b9df9b756561016b1bdf921076a566

SHA512
975f623d9e3c5e0d46d9bef7a308d3dc621941c9d7a83cf2d73277d108a572b1698655a61f64e52c8e98848a9cb314d4c736ab86df5ebe089443d6579809312e

Download Submit
C:\Windows\SysWOW64\Lldopb32.exe

Filesize
163KB

MD5
d78b9c5ff5086db9515b11bb2f8ee937

SHA1
9c286bc5ebb1bbbd8fc9a054d651400acd510f59

SHA256
3ee092909a4c7f1cf995a1bf4ecbdc3aa56797cabbc741cef4c5a150e39b2356

SHA512
f535ed5cd4875465298536fdddf466cae6726d8ff1212a1c6f939301e2e0d8908ec5aa9b9d92b794580f3e660f5a4b41e776a3bfcec0d954bd50637a94d78a69

Download Submit
C:\Windows\SysWOW64\Llhikacp.exe

Filesize
163KB

MD5
e60d0a4d2759edce3d05410735003bee

SHA1
384f757c60729d1a26eaa9c752ef9b1bc05e6239

SHA256
910d3de48e9a46675f6de02d50e3ff12efa93641d8c84074cd6e98aec4ee3fff

SHA512
e9f904465298817c1f6a9ae6240a116e16c174a777f9859d62f46c2a9cedda096798a68daec0420f60e1be705c42901ebe2719dcce5cdab8aa3663a478004d3a

Download Submit
C:\Windows\SysWOW64\Lljklo32.exe

Filesize
163KB

MD5
975e2d2738ebeb05df78adb901bea1e6

SHA1
9cd9fe6a89db1dbdb7aac655006e86798cf1d53e

SHA256
eff812fca3da373abb6ae73ae2629c7197b6697475564a4a990e78756bed45c2

SHA512
a3b205259dac6264786a786544edec76be95bbe75a594add4574dd58a368b74960e88227587a2daef2369e62a3fa59da886f03edbb00433bc5fdb33fa6cf8bfd

Download Submit
C:\Windows\SysWOW64\Lndham32.exe

Filesize
163KB

MD5
f22ce36fb69ddd5e309a36cc0a054ada

SHA1
7da19a8e8f5bebe337d971bf726d461e904d0af1

SHA256
418e3fbc2d8eed54b61e09848e984fd8923d937c9ad0f74402c7704b2ed16e3f

SHA512
74629150b6efc6ea16d7b6ae4b5f3c0a8f314719471b03e3b993df07f2c06827d584717fe0c92bae8026027cfb4b349733f96671015ca89faad0642fde27c557

Download Submit
C:\Windows\SysWOW64\Lnpofnhk.exe

Filesize
163KB

MD5
0965a804874f51b4c1a65539be5ff2a8

SHA1
48efd5242b8a2ae19586dd8ca549cc6ee3465445

SHA256
8cb44f47a6caaff40b07cb809b5d9c42ae2db82530144d7c6a2a1679a860f087

SHA512
db67e3862a0ce11a7ee6a99ff9fa814451447c8bb488706b2464c0ec642c54999767f0dd8f386bf4a00b039271a966e448e0b933c335f45deb2189c018bef757

Download Submit
C:\Windows\SysWOW64\Maeachag.exe

Filesize
163KB

MD5
a9d93a102250047d2518ecd89fbf8509

SHA1
ef9f7f3a9753f356922c7ad4346e6bb64cf76dda

SHA256
a643b5d93d64563d2912907504bfef1a1c40b20255cd94b2c6bffa4dc9ada399

SHA512
fc0ecee0e78d22b7f6be55779687a2aca049267c9eb3be7d6c2aa6cc09dcd1f9aad0166b9706f1b83f8f723292ad674e45cc4989646598158285685bae2f7b5c

Download Submit
C:\Windows\SysWOW64\Mahnhhod.exe

Filesize
163KB

MD5
351bf3bde9ae4f55a0052ed669a26431

SHA1
773694110d9ecaaf369dadeea495ac695c46c0fd

SHA256
b4bbbd2a6c8aeaddaa844f36116ef22bf7ad645d83370a6aa228946d37a17e72

SHA512
e9af150c01690072afb32af70bd269efde71aab5fd6ee4c624960284766b08bc5874b9ca3d8a53d2ec766211e34c5725d00c2781fd7d317893165f57ce215ef3

Download Submit
C:\Windows\SysWOW64\Mbbagk32.exe

Filesize
163KB

MD5
4e369f44b5b5da3d7c8fc2f9ea07450d

SHA1
48f786726d8668310f9187edf2a126deab38ecef

SHA256
7d3384b0fc63d3dab5264efc18ae9d442fd93460fc6f217771974622fd285216

SHA512
f2ed95533431bc05f43b47712306da1b5335845bda4e9b12f608714d70f636e1bbee48f26207dd6d534452e488274b768c2f495a6df5141f8f2d8b3b5aea6a0e

Download Submit
C:\Windows\SysWOW64\Mbenmk32.exe

Filesize
163KB

MD5
c29bf0f8496cb2847869f739f0d08568

SHA1
0a9d7e96d980892c466bdbcb0bfcec9dcae68bab

SHA256
113275774ae61c1cf43ef340319df6b27ffb72b27fbf8bdb61c44e47099ea851

SHA512
d7f552b7e0f301310d052fc3a5988ee3f2a9534d3303000599d8155459d7a0ffb68214c8169e7c290b5ac5c9735d985fbe2ef1f0e89dd6ee14509dcd489070ea

Download Submit
C:\Windows\SysWOW64\Mfchlbfd.exe

Filesize
163KB

MD5
64787145721dbf9213d67487ef0f79be

SHA1
95637ac6acfd785ba34204aebf862991a524290e

SHA256
aba3291c5842fff5337b5e67f3f8fa3854702f6e371b96da4c5411ccd68f88f3

SHA512
16a25a2a27c607f8614c464da5f74f2fa6cc28c20fca5462fd3823ebbbd00268dc4529090c7192b25211b6d7394dc6bc5495586848e611c08aa6ed75f1652229

Download Submit
C:\Windows\SysWOW64\Milidebi.exe

Filesize
163KB

MD5
a0a70fced09272382f496de99128e8f1

SHA1
9ab8ce709b80bef1c6ed597e2824a1c1939aa7f7

SHA256
dbde20150fef1d6b8f5e0d6079c6dbf098c110a462c6cbc38b64da62594593b1

SHA512
33b9032deab371e9c70dae78a7277876df3431c71554a4c3a9a2b0f6afb519c0abc923dae409ccfc3fbfa9c7d05314342318d9b13a943768832ab90fc566a8f1

Download Submit
C:\Windows\SysWOW64\Mjneln32.exe

Filesize
163KB

MD5
8c4597655a8937e633091ac7f05c5371

SHA1
3236becb4c2751a3ef94fe689355c1bd9c8291e2

SHA256
e794b6bebc4963369e6710a98a8c51672bdba59de5160fdd7aa5280513c407b6

SHA512
3a8449c2b71234ef3924bfdaee11632382a757ff31a76dd24a6588772f4a34f6405ed227b020313a5ae4ede95c91b433dd81f5cf90e614b53cfe127f9bc3194b

Download Submit
C:\Windows\SysWOW64\Mlkepaam.exe

Filesize
163KB

MD5
2430623af98b72fedd00e3a5371813c2

SHA1
916abd18c4abf29b7a224f5a2bc1eef312ab8c46

SHA256
f1e69d0622136cbb4e994c69b7fb3a5fdc79b3a8341e5052df7b7ea51ea21527

SHA512
5d25098c0d277c4ae7a681307ff8174999217997ffebe9da5fdc8bbadba7104f6b71f8528d245fbc589769a33e91054e9130ce7e8ec9faffb31b54d336ca0073

Download Submit
C:\Windows\SysWOW64\Nckkfp32.exe

Filesize
163KB

MD5
d0b085b23683af79aaef06cf0ba2694a

SHA1
886c4235054c9955c495c2d3ce13013fb1e881fa

SHA256
41b81925ec4e03c9a34cfa69568c4d262394cb50545b44e9b296f76b06d081ae

SHA512
5630f50216591789eb04a3b5458b2a936277d8cc24fd31b5f01aa4a9500417d5db85f1d0642446556b2b4c6040c6eb688991276f8e166e575000e5ec5802c716

Download Submit
C:\Windows\SysWOW64\Nggnadib.exe

Filesize
163KB

MD5
5b168f719acc6310c0d0febe514b191b

SHA1
f7d518c32c3a72d2ee89722106dbcb2855b2a12d

SHA256
54ba986892b9ef3a3cc8a43ec1075805f793dd296397635d57f51006f3f6d67f

SHA512
5b261a2c5959c23ef2960490933c603671691c9c68c0a4ed5cfe7d2b1445f8eff56559ca6e23976d38498c162aedb297fdcf9b8cea3c28d9cedfbd2b9e4be179

Download Submit
C:\Windows\SysWOW64\Ngqagcag.exe

Filesize
163KB

MD5
463a39976a31bde50e2fdb60804d5cb2

SHA1
ff1cda6d9370c2cd33b3b9a2e08fc5e0a244e73a

SHA256
2f8f0fe612fb055e9830cf5fac6da1fa28492fb9c7f50fc95532ae3d7e75186b

SHA512
eac684a60a0af407f67896e3c19ca2484a72bdabe60f3122ee153ba0f3a88b9d5a7880c445d6f844516e1e7c9a129c58e758cb4057e61045a67465ce9176dc02

Download Submit
C:\Windows\SysWOW64\Njmhhefi.exe

Filesize
163KB

MD5
409d72e35c62da327882ae6c69896af7

SHA1
27c7d8aaf6f5e002f6471f18d9c7ab883dd7e1e3

SHA256
a347f7d6f3cd8bcc0d991a367645f7134e2d898bcc969a2004f5138e38e7d748

SHA512
be062f2cfbeeb1856bef3068e09e69225f3d44dee166f7946c4ccdf9d0804b2aba219a234c4a9b9c7ae83521017a940ce469f3e1e1899c570ab954590c17c72a

Download Submit
C:\Windows\SysWOW64\Nlhkgi32.exe

Filesize
163KB

MD5
16ae42784c7fae8629a099a7c77c43c1

SHA1
d746e565f3dbd79a93a49e6774a905d54e6bf08e

SHA256
3b680842ac2fdec124fbfee91d854c6d4e9cc03705ce284ecf587a6ad122da96

SHA512
2e310b4b0cf62db27fcdc2d3cf9ca6678bd457d19ed138e120f96225e53fb184cf1000d0ee8ab0f59cf6417bc39ef0f9fd044099ef1ef07806aae6df2dd3e8e3

Download Submit
C:\Windows\SysWOW64\Nqbpojnp.exe

Filesize
163KB

MD5
2a83ff9d277e2ac1c222293b72edb807

SHA1
a1655a57382941e6c3d6f9fe89dd4b24c835b7d3

SHA256
b38bc5ab96d29ba4d8346c6001ea40df4ef059712b2a5242703da33b924a5af0

SHA512
0f359847c5952d5123605632aeb897c8b8a0c886e57a86945cc0f8dfeb807fffa2a8d53474e7af2ad69a9dd14f7b43020cb55675e100533203cc6d1992b4bc75

Download Submit
C:\Windows\SysWOW64\Ocgkan32.exe

Filesize
163KB

MD5
198c826f3534f88aff687cb2132ebbfb

SHA1
67e98b648d74b0ac2f941d6bfd9e64ea0d709df3

SHA256
e82e3c95bc706a15af52349185cbc925f2057f75e6130d28509d80bf4a2109f0

SHA512
658cf8a36a059ed3c5a9cf897acd988f56465fc08df9d086a24e9a974dbde1a9c845fe21602ffc0c3d6740bf64be13dc1efb2ab67dabd8a3af7b56ab1b21cfd8

Download Submit
C:\Windows\SysWOW64\Ocjoadei.exe

Filesize
163KB

MD5
766b4b2fa21c95a3421b55449cefefa9

SHA1
11b8b0a5e3aa317f2fe4acbdbf407cd021d7689c

SHA256
d8095f735189db030ed2f4d215e72522ed6a08c2e4a048d01bc69fd493e8d80a

SHA512
844469efac8c8487dc0b86e7e2747461139ed4fee3911beb0dc5e67cb22da137511c4b4fb26de7040be09d4b8bc05e5aae950e6a5efc337303597bf20aab4812

Download Submit
C:\Windows\SysWOW64\Odmbaj32.exe

Filesize
163KB

MD5
3b5be5a953b725d1653c1778923e321f

SHA1
793b2999a54fa744b56d2d89efcd6c26db470951

SHA256
5b69edd3dcd62fa51b3662d03564e3b158c3b5b7441ad07d6ba342d6d4a63911

SHA512
6a08e06438fd67c9a2b1421dee48d8c60858cb4791367956b61e813719d37545918706f51a3ca0d10c3b0cdd24ddae7c6021753a668fb6848b753745118b9e44

Download Submit
C:\Windows\SysWOW64\Ojhpimhp.exe

Filesize
163KB

MD5
8e48c4bad1ac01d4bb0d7921aca9cb50

SHA1
7835812e7743c8a800fcae7166e355bd7911486b

SHA256
47631bf513389e1fc85765efb23f77087f8756bb8961c0de3d7846c2b492229e

SHA512
ae3a1084f3885015652ef69d06f2cf840856f7a8ebbde6d6b523ee99635c1715156fa3eb169f5d90fe0676e8749feb8bdf4b19c18b9068e2b08e21f166e1cb87

Download Submit
C:\Windows\SysWOW64\Ooibkpmi.exe

Filesize
163KB

MD5
b5517d036fb7938b5ec19b86c6d1ca35

SHA1
88b1ea2a57699f76b46cbaba502ebd017a2032b1

SHA256
3272e64f01699174a0f2c68e2cabaf5c89145f3a80237fecd3b6725ae439bb5d

SHA512
4f46e93064dc6296451a42d3e7937cfebef95707f7d5b2e82c087932bb0d505f963293182c9bafc5e35ca46293f9c09386deb67713f4780d56f8d922f2131453

Download Submit
C:\Windows\SysWOW64\Pfdjinjo.exe

Filesize
163KB

MD5
4b87d5938fab822815ba11e960d2bda2

SHA1
e1efee1be7a1ade4ebd7aa18c294e5b819dacd84

SHA256
5fa8761ad6b31e32efcd98a2dfd4f3b6c2b4319fbf5a185c337e2275d4923f83

SHA512
d7838fe396a7c932aa8e2c739f5d042736c10994d58a6f75a60ee05272553d53054f6e4dcb38963bdbf67bdf83ce4a43918a89280c13b6666852b510127c13c9

Download Submit
C:\Windows\SysWOW64\Pjlcjf32.exe

Filesize
163KB

MD5
48abc2056851327311c01c1824f8359e

SHA1
420ee49dd8c35bd614a7e0c2be231edbc04ff93d

SHA256
8acafbd570a1bb5c5980d0576ef7a7115b2f8e17970f6f1ef538cc563c2f3867

SHA512
6345a43d771bc9326537291287aac0eef9da3c4810a40890e3100fb8c3c999254b7989825c1b73f678cd474c00ee70277bd688d6fe495e13844f9128405819ee

Download Submit
C:\Windows\SysWOW64\Pnmopk32.exe

Filesize
163KB

MD5
2631252d326601693bcbc1fdb991361e

SHA1
d95b824848ec79a2077f958a0e6731583665220e

SHA256
ca778158dfd508b702ad477a8db0a7b19ddae25386af50fcf70b90e238429c06

SHA512
637ec86bf1a90f5cfd239ac25266c2369fe7e2256a8330862e5c3c3fc0f4836cd0e7b3d67486121506a6cc24d057b1cf004f3b43f48849ed202ade170c1ac2a7

Download Submit
memory/112-341-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/208-485-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/404-330-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/476-438-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1076-282-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1080-631-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1080-132-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1580-140-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1580-637-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1588-576-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1588-61-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1660-45-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1660-564-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1740-415-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1888-680-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1888-196-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2044-243-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2080-164-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2080-655-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2084-403-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2140-369-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2156-276-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2208-306-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2212-235-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2392-582-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2392-65-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2396-312-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2404-619-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2420-172-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2420-661-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2492-270-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2492-3407-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2560-156-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2560-649-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2568-212-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2568-692-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2644-9-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2644-540-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2700-444-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2796-432-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2800-24-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2800-552-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2924-180-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2924-668-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2964-462-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2988-473-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3004-294-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3092-300-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3140-686-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3140-204-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3196-643-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3196-148-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3204-625-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3204-124-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3284-4993-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3312-318-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3348-101-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3348-607-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3496-517-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3616-380-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3684-674-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3684-188-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3700-85-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3700-595-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4024-109-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4024-613-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4140-324-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4212-558-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4212-33-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4232-698-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4232-220-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4244-77-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4244-588-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4356-565-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4356-60-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4388-288-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4540-347-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4540-4966-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4540-3551-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4560-456-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4572-546-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4572-16-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4604-353-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4664-426-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4672-397-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4680-409-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4732-264-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4788-391-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4824-511-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4932-528-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4932-1-0x0000000000432000-0x0000000000433000-memory.dmp

Filesize
4KB

Download
memory/4932-0-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4948-534-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4964-601-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4964-93-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5028-479-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5056-251-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5064-450-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5244-3785-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5244-3777-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5320-3846-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5320-589-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5804-662-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5872-4931-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/6024-4133-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/7416-5238-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/7496-5447-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/7516-5458-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/7608-5450-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/7684-5463-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/7912-5455-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/7976-5462-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/8204-5446-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/9400-5352-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/10484-5218-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/10944-5223-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/11348-5163-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/11932-5114-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/13052-5041-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/13260-5034-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads