berbew | 71677fb1fc34eabae1f7563da0e96a5aefbb796c0dcc35f8789a79af07df8d63

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2024 06:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

71677fb1fc34eabae1f7563da0e96a5aefbb796c0dcc35f8789a79af07df8d63.exe
Size

81KB
MD5

806e69ac8a771475935a6fa7fdb4e151
SHA1

5c3d80e26bfba3e1eeaad1674ab5f96732a918d1
SHA256

71677fb1fc34eabae1f7563da0e96a5aefbb796c0dcc35f8789a79af07df8d63
SHA512

d6276b4878cd431ff03677ee9b7b03cbca531538f3b3b39927b8e3b4006d74dddd0e305e27ed06e15fc3a852c0513ef4327282776fbe1420fb4fd8cbbe568a73
SSDEEP

1536:B8nibp2M/Q3VqftAurcVuf0h3TuDcKx5J+k7m4LO++/+1m6KadhYxU33HX0o:enibp2M/NjrGuS3T8xek/LrCimBaH8Ur

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://master-x.com/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://crutop.ru/index.php

http://kaspersky.ru/index.php

http://color-bank.ru/index.php

http://adult-empire.com/index.php

http://virus-list.com/index.php

http://trojan.ru/index.php

http://xware.cjb.net/index.htm

http://konfiskat.org/index.htm

http://parex-bank.ru/index.htm

http://fethard.biz/index.htm

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Cajjjk32.exeOanokhdb.exeDqbcbkab.exeIamamcop.exeKlbnajqc.exeOmopjcjp.exeGihpkd32.exeIlibdmgp.exeNiojoeel.exePbcncibp.exeBmladm32.exeCkpamabg.exeAkblfj32.exeEqiibjlj.exeFgoakc32.exeJppnpjel.exeMablfnne.exeNjjdho32.exeEqgmmk32.exeMcoljagj.exeObjkmkjj.exeGegkpf32.exeMqjbddpl.exePmblagmf.exeKeifdpif.exeBpedeiff.exeNadleilm.exeEhlhih32.exeMapppn32.exeBdlfjh32.exeIhbponja.exeLpjjmg32.exeNqoloc32.exeOiagde32.exePjjfdfbb.exeEnhpao32.exePbjddh32.exePffgom32.exeCdkifmjq.exeIpkdek32.exeDknnoofg.exeMpclce32.exeMlljnf32.exePcbkml32.exeEiekog32.exeHnphoj32.exeOjqcnhkl.exeOjcpdg32.exeBkmeha32.exePmlfqh32.exeDhdbhifj.exeAfhfaddk.exeCkebcg32.exeDhikci32.exeMokfja32.exeOoibkpmi.exeEohmkb32.exeNfihbk32.exeOcdnln32.exeQbonoghb.exeCalfpk32.exePfdjinjo.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cajjjk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oanokhdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dqbcbkab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iamamcop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klbnajqc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Omopjcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gihpkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilibdmgp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Niojoeel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbcncibp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmladm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckpamabg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Akblfj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eqiibjlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fgoakc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jppnpjel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mablfnne.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njjdho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eqgmmk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcoljagj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Objkmkjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gegkpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gegkpf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mqjbddpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmblagmf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Keifdpif.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bpedeiff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nadleilm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ehlhih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mapppn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdlfjh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ihbponja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpjjmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nqoloc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oiagde32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjjfdfbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Enhpao32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbjddh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pffgom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdkifmjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipkdek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dknnoofg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpclce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mlljnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcbkml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eiekog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hnphoj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojqcnhkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojcpdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bkmeha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmlfqh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhdbhifj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afhfaddk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckebcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhikci32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mokfja32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ooibkpmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pbcncibp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eohmkb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nfihbk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocdnln32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qbonoghb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Calfpk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfdjinjo.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

Processes:

Nmdgikhi.exeNcnofeof.exeNmfcok32.exeNqbpojnp.exeNjjdho32.exeNadleilm.exeNfaemp32.exeNagiji32.exeNgqagcag.exeOmnjojpo.exeOgcnmc32.exeOnmfimga.exeOakbehfe.exeOfhknodl.exeOanokhdb.exeOghghb32.exeOnapdl32.exeOaplqh32.exeOjhpimhp.exeOndljl32.exeOcaebc32.exePfoann32.exePmiikh32.exePpgegd32.exePfandnla.exePjmjdm32.exePmlfqh32.exePagbaglh.exePfdjinjo.exePaiogf32.exePdhkcb32.exePffgom32.exePalklf32.exePhfcipoo.exePmblagmf.exePpahmb32.exeQjfmkk32.exeQaqegecm.exeQhjmdp32.exeQacameaj.exeAhmjjoig.exeAmjbbfgo.exeAfbgkl32.exeAdfgdpmi.exeAajhndkb.exeAdhdjpjf.exeAkblfj32.exeAmqhbe32.exeAkdilipp.exeAaoaic32.exeBobabg32.exeBpdnjple.exeBkibgh32.exeBmhocd32.exeBmjkic32.exeBddcenpi.exeBgbpaipl.exeBoihcf32.exeBahdob32.exeBgelgi32.exeBnoddcef.exeCdimqm32.exeCnaaib32.exeCponen32.exe

pid	process
752	Nmdgikhi.exe
1176	Ncnofeof.exe
1576	Nmfcok32.exe
4592	Nqbpojnp.exe
4464	Njjdho32.exe
2016	Nadleilm.exe
3672	Nfaemp32.exe
2980	Nagiji32.exe
4984	Ngqagcag.exe
1504	Omnjojpo.exe
5076	Ogcnmc32.exe
2840	Onmfimga.exe
2124	Oakbehfe.exe
4964	Ofhknodl.exe
556	Oanokhdb.exe
2304	Oghghb32.exe
2816	Onapdl32.exe
2240	Oaplqh32.exe
3640	Ojhpimhp.exe
372	Ondljl32.exe
4128	Ocaebc32.exe
2360	Pfoann32.exe
876	Pmiikh32.exe
4872	Ppgegd32.exe
4568	Pfandnla.exe
1096	Pjmjdm32.exe
4968	Pmlfqh32.exe
928	Pagbaglh.exe
3132	Pfdjinjo.exe
3484	Paiogf32.exe
3688	Pdhkcb32.exe
2296	Pffgom32.exe
2844	Palklf32.exe
2724	Phfcipoo.exe
2884	Pmblagmf.exe
4352	Ppahmb32.exe
2992	Qjfmkk32.exe
1392	Qaqegecm.exe
2424	Qhjmdp32.exe
2904	Qacameaj.exe
2060	Ahmjjoig.exe
2188	Amjbbfgo.exe
2116	Afbgkl32.exe
1792	Adfgdpmi.exe
5088	Aajhndkb.exe
4368	Adhdjpjf.exe
3252	Akblfj32.exe
2920	Amqhbe32.exe
5104	Akdilipp.exe
4244	Aaoaic32.exe
3644	Bobabg32.exe
2292	Bpdnjple.exe
368	Bkibgh32.exe
808	Bmhocd32.exe
1384	Bmjkic32.exe
956	Bddcenpi.exe
4776	Bgbpaipl.exe
4664	Boihcf32.exe
2028	Bahdob32.exe
2908	Bgelgi32.exe
1720	Bnoddcef.exe
1620	Cdimqm32.exe
4840	Cnaaib32.exe
4344	Cponen32.exe

Drops file in System32 directory 64 IoCs

Processes:

Pmiikh32.exeFiqjke32.exeMqjbddpl.exeOjqcnhkl.exeIiopca32.exeKhiofk32.exeOonlfo32.exeOpbean32.exeAmqhbe32.exeEomffaag.exeFgoakc32.exeHejqldci.exeAdfgdpmi.exeAdgmoigj.exeDknnoofg.exeBfmolc32.exePpahmb32.exeQacameaj.exeBddcenpi.exeMhjhmhhd.exeCaageq32.exeCdbpgl32.exeIhpcinld.exeOckdmmoj.exeNadleilm.exeOnmfimga.exePjmjdm32.exePalklf32.exeBfolacnc.exeDkkaiphj.exeNmdgikhi.exeFqppci32.exeKemooo32.exeLakfeodm.exeJllhpkfk.exeLepleocn.exeDoccpcja.exeHppeim32.exeIhbponja.exeNmfcok32.exeOanokhdb.exeDkekjdck.exeHhfpbpdo.exeNmjfodne.exePpdbgncl.exeAdhdjpjf.exeBahdob32.exeEiekog32.exeFgmdec32.exeCajjjk32.exeCiihjmcj.exeQapnmopa.exeHnnljj32.exeMfenglqf.exeNbnlaldg.exeNimmifgo.exePagbaglh.exeKamjda32.exeEhlhih32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Ppgegd32.exe	Pmiikh32.exe
File opened for modification	C:\Windows\SysWOW64\Gegkpf32.exe	Fiqjke32.exe
File created	C:\Windows\SysWOW64\Alapqh32.dll	Mqjbddpl.exe
File opened for modification	C:\Windows\SysWOW64\Omopjcjp.exe	Ojqcnhkl.exe
File created	C:\Windows\SysWOW64\Ihbponja.exe	Iiopca32.exe
File created	C:\Windows\SysWOW64\Kocgbend.exe	Khiofk32.exe
File created	C:\Windows\SysWOW64\Ofgdcipq.exe	Oonlfo32.exe
File opened for modification	C:\Windows\SysWOW64\Obqanjdb.exe	Opbean32.exe
File created	C:\Windows\SysWOW64\Qkhnbpne.dll	Amqhbe32.exe
File created	C:\Windows\SysWOW64\Ebkbbmqj.exe	Eomffaag.exe
File created	C:\Windows\SysWOW64\Nnckgmik.dll	Fgoakc32.exe
File created	C:\Windows\SysWOW64\Gifffn32.dll	Hejqldci.exe
File created	C:\Windows\SysWOW64\Bmijpchc.dll	Adfgdpmi.exe
File created	C:\Windows\SysWOW64\Njonjm32.dll	Adgmoigj.exe
File created	C:\Windows\SysWOW64\Qahlom32.dll	Dknnoofg.exe
File opened for modification	C:\Windows\SysWOW64\Bmggingc.exe	Bfmolc32.exe
File opened for modification	C:\Windows\SysWOW64\Qjfmkk32.exe	Ppahmb32.exe
File created	C:\Windows\SysWOW64\Kioghlbd.dll	Qacameaj.exe
File created	C:\Windows\SysWOW64\Bgbpaipl.exe	Bddcenpi.exe
File opened for modification	C:\Windows\SysWOW64\Mcoljagj.exe	Mhjhmhhd.exe
File opened for modification	C:\Windows\SysWOW64\Ckjknfnh.exe	Caageq32.exe
File opened for modification	C:\Windows\SysWOW64\Cgqlcg32.exe	Cdbpgl32.exe
File created	C:\Windows\SysWOW64\Aglmllpq.dll	Ihpcinld.exe
File created	C:\Windows\SysWOW64\Bfmpaf32.dll	Ockdmmoj.exe
File created	C:\Windows\SysWOW64\Nfaemp32.exe	Nadleilm.exe
File opened for modification	C:\Windows\SysWOW64\Oakbehfe.exe	Onmfimga.exe
File opened for modification	C:\Windows\SysWOW64\Pmlfqh32.exe	Pjmjdm32.exe
File opened for modification	C:\Windows\SysWOW64\Phfcipoo.exe	Palklf32.exe
File opened for modification	C:\Windows\SysWOW64\Bkkhbb32.exe	Bfolacnc.exe
File created	C:\Windows\SysWOW64\Mnokmd32.dll	Dkkaiphj.exe
File opened for modification	C:\Windows\SysWOW64\Ncnofeof.exe	Nmdgikhi.exe
File created	C:\Windows\SysWOW64\Lhpapf32.dll	Fqppci32.exe
File created	C:\Windows\SysWOW64\Khlklj32.exe	Kemooo32.exe
File created	C:\Windows\SysWOW64\Legben32.exe	Lakfeodm.exe
File created	C:\Windows\SysWOW64\Kiphjo32.exe	Jllhpkfk.exe
File created	C:\Windows\SysWOW64\Debbff32.dll	Lepleocn.exe
File created	C:\Windows\SysWOW64\Jeegfibg.dll	Doccpcja.exe
File created	C:\Windows\SysWOW64\Ddlnnc32.dll	Hppeim32.exe
File created	C:\Windows\SysWOW64\Mmmncpmp.dll	Iiopca32.exe
File opened for modification	C:\Windows\SysWOW64\Ipihpkkd.exe	Ihbponja.exe
File created	C:\Windows\SysWOW64\Nmiadaea.dll	Nmfcok32.exe
File created	C:\Windows\SysWOW64\Ojenek32.dll	Oanokhdb.exe
File created	C:\Windows\SysWOW64\Cmmdfp32.dll	Dkekjdck.exe
File created	C:\Windows\SysWOW64\Hnphoj32.exe	Hhfpbpdo.exe
File created	C:\Windows\SysWOW64\Ooibkpmi.exe	Nmjfodne.exe
File created	C:\Windows\SysWOW64\Bmgjnl32.dll	Ppdbgncl.exe
File created	C:\Windows\SysWOW64\Dapgni32.dll	Adhdjpjf.exe
File created	C:\Windows\SysWOW64\Bgelgi32.exe	Bahdob32.exe
File created	C:\Windows\SysWOW64\Fgcpfdbd.dll	Eomffaag.exe
File opened for modification	C:\Windows\SysWOW64\Ekcgkb32.exe	Eiekog32.exe
File created	C:\Windows\SysWOW64\Fgoakc32.exe	Fgmdec32.exe
File created	C:\Windows\SysWOW64\Pnlhmpgg.dll	Cajjjk32.exe
File opened for modification	C:\Windows\SysWOW64\Caqpkjcl.exe	Ciihjmcj.exe
File opened for modification	C:\Windows\SysWOW64\Qbajeg32.exe	Qapnmopa.exe
File created	C:\Windows\SysWOW64\Pjmmpa32.dll	Hnnljj32.exe
File created	C:\Windows\SysWOW64\Mqjbddpl.exe	Mfenglqf.exe
File created	C:\Windows\SysWOW64\Nfihbk32.exe	Nbnlaldg.exe
File created	C:\Windows\SysWOW64\Ncbafoge.exe	Nimmifgo.exe
File created	C:\Windows\SysWOW64\Daeifj32.exe	Dkkaiphj.exe
File created	C:\Windows\SysWOW64\Jnfpnk32.dll	Pagbaglh.exe
File created	C:\Windows\SysWOW64\Jgddkelm.dll	Bahdob32.exe
File created	C:\Windows\SysWOW64\Pcmdgodo.dll	Caageq32.exe
File created	C:\Windows\SysWOW64\Keifdpif.exe	Kamjda32.exe
File created	C:\Windows\SysWOW64\Enhpao32.exe	Ehlhih32.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

8088 4416 WerFault.exe Diqnjl32.exe

pid	pid_target	process	target process
8088	4416	WerFault.exe	Diqnjl32.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Adhdjpjf.exeIimcma32.exeDknnoofg.exeCdbpgl32.exeEdgbii32.exeIhpcinld.exeNcmhko32.exeDdcebe32.exeLplfcf32.exeMbgeqmjp.exeCcppmc32.exeDaeifj32.exePbcncibp.exeAfockelf.exeDqbcbkab.exeGegkpf32.exeHnnljj32.exeLjpaqmgb.exeObgohklm.exeOonlfo32.exeCgklmacf.exeBmhocd32.exeEkcgkb32.exeIiopca32.exeIhbponja.exeMhjhmhhd.exePmlfqh32.exeMcoljagj.exeCibain32.exeQhjmdp32.exeLpjjmg32.exeQiiflaoo.exeOcaebc32.exeJikoopij.exeLegben32.exeIbegfglj.exeJlikkkhn.exeKeifdpif.exeAdjjeieh.exeOgcnmc32.exeCdkifmjq.exeOiagde32.exeCkpamabg.exeEojiqb32.exeHnibokbd.exeHnphoj32.exeNmjfodne.exePbjddh32.exePmiikh32.exeAmjbbfgo.exeBoihcf32.exeBmladm32.exe71677fb1fc34eabae1f7563da0e96a5aefbb796c0dcc35f8789a79af07df8d63.exePagbaglh.exeOmfekbdh.exePmbegqjk.exeFiqjke32.exeKhiofk32.exeJppnpjel.exeNbnlaldg.exePmblagmf.exeQjfmkk32.exeCkjknfnh.exeEqiibjlj.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adhdjpjf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iimcma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dknnoofg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdbpgl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Edgbii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ihpcinld.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncmhko32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddcebe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lplfcf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mbgeqmjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ccppmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daeifj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pbcncibp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afockelf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dqbcbkab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gegkpf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hnnljj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljpaqmgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Obgohklm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oonlfo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgklmacf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmhocd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ekcgkb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iiopca32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ihbponja.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mhjhmhhd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmlfqh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcoljagj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cibain32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qhjmdp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpjjmg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qiiflaoo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocaebc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jikoopij.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Legben32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibegfglj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlikkkhn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keifdpif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adjjeieh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogcnmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdkifmjq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oiagde32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckpamabg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eojiqb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hnibokbd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hnphoj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmjfodne.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pbjddh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmiikh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amjbbfgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Boihcf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmladm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	71677fb1fc34eabae1f7563da0e96a5aefbb796c0dcc35f8789a79af07df8d63.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pagbaglh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Omfekbdh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmbegqjk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fiqjke32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khiofk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jppnpjel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nbnlaldg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmblagmf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qjfmkk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckjknfnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eqiibjlj.exe

Modifies registry class 64 IoCs

Processes:

Cdimqm32.exeFgmdec32.exeGlfmgp32.exeIhkjno32.exeIacngdgj.exeJlbejloe.exeKheekkjl.exeNqmojd32.exePmmlla32.exeCcppmc32.exeDhdbhifj.exeEomffaag.exeJemfhacc.exeJlikkkhn.exeNqoloc32.exeNcmhko32.exeOiagde32.exeAfockelf.exeCalfpk32.exePfandnla.exeEhlhih32.exeOjcpdg32.exeNjjdho32.exePmiikh32.exeDkekjdck.exeLpjjmg32.exeMfpell32.exeMjlalkmd.exeApggckbf.exeBkkhbb32.exeBpjmph32.exeDaeifj32.exeNcnofeof.exeNmfcok32.exeQacameaj.exeAaoaic32.exeEqiibjlj.exeIimcma32.exeAhmjjoig.exeCnhgjaml.exeIamamcop.exeMlhqcgnk.exeAkdilipp.exeMablfnne.exeCkidcpjl.exeAkblfj32.exeHhimhobl.exeIhdldn32.exeLojmcdgl.exeDkkaiphj.exeOgcnmc32.exeAdhdjpjf.exeIialhaad.exeKofdhd32.exePfccogfc.exeNqbpojnp.exeOakbehfe.exeOfhknodl.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdimqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fgmdec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ceknlgnl.dll"	Glfmgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ihkjno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Deocpk32.dll"	Iacngdgj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jlbejloe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjmkmfbo.dll"	Kheekkjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nqmojd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmmlla32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ccppmc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhdbhifj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgcpfdbd.dll"	Eomffaag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jemfhacc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jlikkkhn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fanmld32.dll"	Nqoloc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncmhko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oiagde32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Afockelf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Calfpk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pfandnla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ieppioao.dll"	Ehlhih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njlmnj32.dll"	Ihkjno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ojcpdg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njjdho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eopjfnlo.dll"	Pmiikh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dkekjdck.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lpjjmg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mfpell32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mjlalkmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Apggckbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bkkhbb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Labnlj32.dll"	Bpjmph32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Daeifj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofkhpmpa.dll"	Ncnofeof.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nmfcok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qacameaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aaoaic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhdbhifj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ehlhih32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eqiibjlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iimcma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eepmqdbn.dll"	Ahmjjoig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnhgjaml.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iamamcop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mlhqcgnk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbcolk32.dll"	Calfpk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phlepppi.dll"	Akdilipp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mablfnne.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ckidcpjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Akblfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlofiddl.dll"	Hhimhobl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Goniok32.dll"	Ihdldn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lojmcdgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnokmd32.dll"	Dkkaiphj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ogcnmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dapgni32.dll"	Adhdjpjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iialhaad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kofdhd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mfpell32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfgbakef.dll"	Pfccogfc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nqbpojnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifomef32.dll"	Oakbehfe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ofhknodl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eegcnaoo.dll"	Eqiibjlj.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

71677fb1fc34eabae1f7563da0e96a5aefbb796c0dcc35f8789a79af07df8d63.exeNmdgikhi.exeNcnofeof.exeNmfcok32.exeNqbpojnp.exeNjjdho32.exeNadleilm.exeNfaemp32.exeNagiji32.exeNgqagcag.exeOmnjojpo.exeOgcnmc32.exeOnmfimga.exeOakbehfe.exeOfhknodl.exeOanokhdb.exeOghghb32.exeOnapdl32.exeOaplqh32.exeOjhpimhp.exeOndljl32.exeOcaebc32.exe

description	pid	process	target process
PID 2880 wrote to memory of 752	2880	71677fb1fc34eabae1f7563da0e96a5aefbb796c0dcc35f8789a79af07df8d63.exe	Nmdgikhi.exe
PID 2880 wrote to memory of 752	2880	71677fb1fc34eabae1f7563da0e96a5aefbb796c0dcc35f8789a79af07df8d63.exe	Nmdgikhi.exe
PID 2880 wrote to memory of 752	2880	71677fb1fc34eabae1f7563da0e96a5aefbb796c0dcc35f8789a79af07df8d63.exe	Nmdgikhi.exe
PID 752 wrote to memory of 1176	752	Nmdgikhi.exe	Ncnofeof.exe
PID 752 wrote to memory of 1176	752	Nmdgikhi.exe	Ncnofeof.exe
PID 752 wrote to memory of 1176	752	Nmdgikhi.exe	Ncnofeof.exe
PID 1176 wrote to memory of 1576	1176	Ncnofeof.exe	Nmfcok32.exe
PID 1176 wrote to memory of 1576	1176	Ncnofeof.exe	Nmfcok32.exe
PID 1176 wrote to memory of 1576	1176	Ncnofeof.exe	Nmfcok32.exe
PID 1576 wrote to memory of 4592	1576	Nmfcok32.exe	Nqbpojnp.exe
PID 1576 wrote to memory of 4592	1576	Nmfcok32.exe	Nqbpojnp.exe
PID 1576 wrote to memory of 4592	1576	Nmfcok32.exe	Nqbpojnp.exe
PID 4592 wrote to memory of 4464	4592	Nqbpojnp.exe	Njjdho32.exe
PID 4592 wrote to memory of 4464	4592	Nqbpojnp.exe	Njjdho32.exe
PID 4592 wrote to memory of 4464	4592	Nqbpojnp.exe	Njjdho32.exe
PID 4464 wrote to memory of 2016	4464	Njjdho32.exe	Nadleilm.exe
PID 4464 wrote to memory of 2016	4464	Njjdho32.exe	Nadleilm.exe
PID 4464 wrote to memory of 2016	4464	Njjdho32.exe	Nadleilm.exe
PID 2016 wrote to memory of 3672	2016	Nadleilm.exe	Nfaemp32.exe
PID 2016 wrote to memory of 3672	2016	Nadleilm.exe	Nfaemp32.exe
PID 2016 wrote to memory of 3672	2016	Nadleilm.exe	Nfaemp32.exe
PID 3672 wrote to memory of 2980	3672	Nfaemp32.exe	Nagiji32.exe
PID 3672 wrote to memory of 2980	3672	Nfaemp32.exe	Nagiji32.exe
PID 3672 wrote to memory of 2980	3672	Nfaemp32.exe	Nagiji32.exe
PID 2980 wrote to memory of 4984	2980	Nagiji32.exe	Ngqagcag.exe
PID 2980 wrote to memory of 4984	2980	Nagiji32.exe	Ngqagcag.exe
PID 2980 wrote to memory of 4984	2980	Nagiji32.exe	Ngqagcag.exe
PID 4984 wrote to memory of 1504	4984	Ngqagcag.exe	Omnjojpo.exe
PID 4984 wrote to memory of 1504	4984	Ngqagcag.exe	Omnjojpo.exe
PID 4984 wrote to memory of 1504	4984	Ngqagcag.exe	Omnjojpo.exe
PID 1504 wrote to memory of 5076	1504	Omnjojpo.exe	Ogcnmc32.exe
PID 1504 wrote to memory of 5076	1504	Omnjojpo.exe	Ogcnmc32.exe
PID 1504 wrote to memory of 5076	1504	Omnjojpo.exe	Ogcnmc32.exe
PID 5076 wrote to memory of 2840	5076	Ogcnmc32.exe	Onmfimga.exe
PID 5076 wrote to memory of 2840	5076	Ogcnmc32.exe	Onmfimga.exe
PID 5076 wrote to memory of 2840	5076	Ogcnmc32.exe	Onmfimga.exe
PID 2840 wrote to memory of 2124	2840	Onmfimga.exe	Oakbehfe.exe
PID 2840 wrote to memory of 2124	2840	Onmfimga.exe	Oakbehfe.exe
PID 2840 wrote to memory of 2124	2840	Onmfimga.exe	Oakbehfe.exe
PID 2124 wrote to memory of 4964	2124	Oakbehfe.exe	Ofhknodl.exe
PID 2124 wrote to memory of 4964	2124	Oakbehfe.exe	Ofhknodl.exe
PID 2124 wrote to memory of 4964	2124	Oakbehfe.exe	Ofhknodl.exe
PID 4964 wrote to memory of 556	4964	Ofhknodl.exe	Oanokhdb.exe
PID 4964 wrote to memory of 556	4964	Ofhknodl.exe	Oanokhdb.exe
PID 4964 wrote to memory of 556	4964	Ofhknodl.exe	Oanokhdb.exe
PID 556 wrote to memory of 2304	556	Oanokhdb.exe	Oghghb32.exe
PID 556 wrote to memory of 2304	556	Oanokhdb.exe	Oghghb32.exe
PID 556 wrote to memory of 2304	556	Oanokhdb.exe	Oghghb32.exe
PID 2304 wrote to memory of 2816	2304	Oghghb32.exe	Onapdl32.exe
PID 2304 wrote to memory of 2816	2304	Oghghb32.exe	Onapdl32.exe
PID 2304 wrote to memory of 2816	2304	Oghghb32.exe	Onapdl32.exe
PID 2816 wrote to memory of 2240	2816	Onapdl32.exe	Oaplqh32.exe
PID 2816 wrote to memory of 2240	2816	Onapdl32.exe	Oaplqh32.exe
PID 2816 wrote to memory of 2240	2816	Onapdl32.exe	Oaplqh32.exe
PID 2240 wrote to memory of 3640	2240	Oaplqh32.exe	Ojhpimhp.exe
PID 2240 wrote to memory of 3640	2240	Oaplqh32.exe	Ojhpimhp.exe
PID 2240 wrote to memory of 3640	2240	Oaplqh32.exe	Ojhpimhp.exe
PID 3640 wrote to memory of 372	3640	Ojhpimhp.exe	Ondljl32.exe
PID 3640 wrote to memory of 372	3640	Ojhpimhp.exe	Ondljl32.exe
PID 3640 wrote to memory of 372	3640	Ojhpimhp.exe	Ondljl32.exe
PID 372 wrote to memory of 4128	372	Ondljl32.exe	Ocaebc32.exe
PID 372 wrote to memory of 4128	372	Ondljl32.exe	Ocaebc32.exe
PID 372 wrote to memory of 4128	372	Ondljl32.exe	Ocaebc32.exe
PID 4128 wrote to memory of 2360	4128	Ocaebc32.exe	Pfoann32.exe

C:\Users\Admin\AppData\Local\Temp\71677fb1fc34eabae1f7563da0e96a5aefbb796c0dcc35f8789a79af07df8d63.exe
"C:\Users\Admin\AppData\Local\Temp\71677fb1fc34eabae1f7563da0e96a5aefbb796c0dcc35f8789a79af07df8d63.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\SysWOW64\Nmdgikhi.exe
  C:\Windows\system32\Nmdgikhi.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:752
- - C:\Windows\SysWOW64\Ncnofeof.exe
    C:\Windows\system32\Ncnofeof.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1176
  - - C:\Windows\SysWOW64\Nmfcok32.exe
      C:\Windows\system32\Nmfcok32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1576
    - - C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4592
      - C:\Windows\SysWOW64\Njjdho32.exe
        
        C:\Windows\system32\Njjdho32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4464
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2016
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3672
        
        C:\Windows\SysWOW64\Nagiji32.exe
        
        C:\Windows\system32\Nagiji32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2980
        
        C:\Windows\SysWOW64\Ngqagcag.exe
        
        C:\Windows\system32\Ngqagcag.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4984
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1504
        
        C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5076
        
        C:\Windows\SysWOW64\Onmfimga.exe
        
        C:\Windows\system32\Onmfimga.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2840
        
        C:\Windows\SysWOW64\Oakbehfe.exe
        
        C:\Windows\system32\Oakbehfe.exe
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2124
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4964
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:556
        
        C:\Windows\SysWOW64\Oghghb32.exe
        
        C:\Windows\system32\Oghghb32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2304
        
        C:\Windows\SysWOW64\Onapdl32.exe
        
        C:\Windows\system32\Onapdl32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2816
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2240
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3640
        
        C:\Windows\SysWOW64\Ondljl32.exe
        
        C:\Windows\system32\Ondljl32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:372
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4128
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        23⤵
        Executes dropped EXE
        
        PID:2360
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:876
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        25⤵
        Executes dropped EXE
        
        PID:4872
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4568
        
        C:\Windows\SysWOW64\Pjmjdm32.exe
        
        C:\Windows\system32\Pjmjdm32.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1096
        
        C:\Windows\SysWOW64\Pmlfqh32.exe
        
        C:\Windows\system32\Pmlfqh32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4968
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:928
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3132
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        31⤵
        Executes dropped EXE
        
        PID:3484
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        32⤵
        Executes dropped EXE
        
        PID:3688
        
        C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2296
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2844
        
        C:\Windows\SysWOW64\Phfcipoo.exe
        
        C:\Windows\system32\Phfcipoo.exe
        35⤵
        Executes dropped EXE
        
        PID:2724
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2884
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4352
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        38⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2992
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        39⤵
        Executes dropped EXE
        
        PID:1392
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        40⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2424
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2904
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        42⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2060
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        43⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2188
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        44⤵
        Executes dropped EXE
        
        PID:2116
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1792
        
        C:\Windows\SysWOW64\Aajhndkb.exe
        
        C:\Windows\system32\Aajhndkb.exe
        46⤵
        Executes dropped EXE
        
        PID:5088
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4368
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3252
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2920
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5104
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        51⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4244
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        52⤵
        Executes dropped EXE
        
        PID:3644
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        53⤵
        Executes dropped EXE
        
        PID:2292
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        54⤵
        Executes dropped EXE
        
        PID:368
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        55⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:808
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        56⤵
        Executes dropped EXE
        
        PID:1384
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:956
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        58⤵
        Executes dropped EXE
        
        PID:4776
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        59⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4664
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2028
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        61⤵
        Executes dropped EXE
        
        PID:2908
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        62⤵
        Executes dropped EXE
        
        PID:1720
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1620
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        64⤵
        Executes dropped EXE
        
        PID:4840
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        65⤵
        Executes dropped EXE
        
        PID:4344
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3896
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4528
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        68⤵
        
        PID:1872
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        69⤵
        Drops file in System32 directory
        
        PID:1876
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        70⤵
        System Location Discovery: System Language Discovery
        
        PID:2608
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        71⤵
        Modifies registry class
        
        PID:432
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        72⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1864
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        73⤵
        
        PID:2848
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        74⤵
        
        PID:212
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        75⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\Dhdbhifj.exe
        
        C:\Windows\system32\Dhdbhifj.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4216
        
        C:\Windows\SysWOW64\Dkekjdck.exe
        
        C:\Windows\system32\Dkekjdck.exe
        77⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:692
        
        C:\Windows\SysWOW64\Dqbcbkab.exe
        
        C:\Windows\system32\Dqbcbkab.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1056
        
        C:\Windows\SysWOW64\Dhikci32.exe
        
        C:\Windows\system32\Dhikci32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4992
        
        C:\Windows\SysWOW64\Doccpcja.exe
        
        C:\Windows\system32\Doccpcja.exe
        80⤵
        Drops file in System32 directory
        
        PID:1372
        
        C:\Windows\SysWOW64\Enfckp32.exe
        
        C:\Windows\system32\Enfckp32.exe
        81⤵
        
        PID:1208
        
        C:\Windows\SysWOW64\Ehlhih32.exe
        
        C:\Windows\system32\Ehlhih32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:380
        
        C:\Windows\SysWOW64\Enhpao32.exe
        
        C:\Windows\system32\Enhpao32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3976
        
        C:\Windows\SysWOW64\Eqgmmk32.exe
        
        C:\Windows\system32\Eqgmmk32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1680
        
        C:\Windows\SysWOW64\Eohmkb32.exe
        
        C:\Windows\system32\Eohmkb32.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:940
        
        C:\Windows\SysWOW64\Eqiibjlj.exe
        
        C:\Windows\system32\Eqiibjlj.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2860
        
        C:\Windows\SysWOW64\Eojiqb32.exe
        
        C:\Windows\system32\Eojiqb32.exe
        87⤵
        System Location Discovery: System Language Discovery
        
        PID:1428
        
        C:\Windows\SysWOW64\Edgbii32.exe
        
        C:\Windows\system32\Edgbii32.exe
        88⤵
        System Location Discovery: System Language Discovery
        
        PID:2248
        
        C:\Windows\SysWOW64\Eomffaag.exe
        
        C:\Windows\system32\Eomffaag.exe
        89⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4136
        
        C:\Windows\SysWOW64\Ebkbbmqj.exe
        
        C:\Windows\system32\Ebkbbmqj.exe
        90⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\Eiekog32.exe
        
        C:\Windows\system32\Eiekog32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3596
        
        C:\Windows\SysWOW64\Ekcgkb32.exe
        
        C:\Windows\system32\Ekcgkb32.exe
        92⤵
        System Location Discovery: System Language Discovery
        
        PID:4780
        
        C:\Windows\SysWOW64\Fqppci32.exe
        
        C:\Windows\system32\Fqppci32.exe
        93⤵
        Drops file in System32 directory
        
        PID:3480
        
        C:\Windows\SysWOW64\Fndpmndl.exe
        
        C:\Windows\system32\Fndpmndl.exe
        94⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\Fgmdec32.exe
        
        C:\Windows\system32\Fgmdec32.exe
        95⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3968
        
        C:\Windows\SysWOW64\Fgoakc32.exe
        
        C:\Windows\system32\Fgoakc32.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1888
        
        C:\Windows\SysWOW64\Finnef32.exe
        
        C:\Windows\system32\Finnef32.exe
        97⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Fiqjke32.exe
        
        C:\Windows\system32\Fiqjke32.exe
        98⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5172
        
        C:\Windows\SysWOW64\Gegkpf32.exe
        
        C:\Windows\system32\Gegkpf32.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5216
        
        C:\Windows\SysWOW64\Gghdaa32.exe
        
        C:\Windows\system32\Gghdaa32.exe
        100⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Gihpkd32.exe
        
        C:\Windows\system32\Gihpkd32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5304
        
        C:\Windows\SysWOW64\Glfmgp32.exe
        
        C:\Windows\system32\Glfmgp32.exe
        102⤵
        Modifies registry class
        
        PID:5348
        
        C:\Windows\SysWOW64\Gaebef32.exe
        
        C:\Windows\system32\Gaebef32.exe
        103⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Hnibokbd.exe
        
        C:\Windows\system32\Hnibokbd.exe
        104⤵
        System Location Discovery: System Language Discovery
        
        PID:5436
        
        C:\Windows\SysWOW64\Hhaggp32.exe
        
        C:\Windows\system32\Hhaggp32.exe
        105⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Hnnljj32.exe
        
        C:\Windows\system32\Hnnljj32.exe
        106⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5524
        
        C:\Windows\SysWOW64\Hhfpbpdo.exe
        
        C:\Windows\system32\Hhfpbpdo.exe
        107⤵
        Drops file in System32 directory
        
        PID:5564
        
        C:\Windows\SysWOW64\Hnphoj32.exe
        
        C:\Windows\system32\Hnphoj32.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5604
        
        C:\Windows\SysWOW64\Hejqldci.exe
        
        C:\Windows\system32\Hejqldci.exe
        109⤵
        Drops file in System32 directory
        
        PID:5644
        
        C:\Windows\SysWOW64\Hhimhobl.exe
        
        C:\Windows\system32\Hhimhobl.exe
        110⤵
        Modifies registry class
        
        PID:5688
        
        C:\Windows\SysWOW64\Hppeim32.exe
        
        C:\Windows\system32\Hppeim32.exe
        111⤵
        Drops file in System32 directory
        
        PID:5732
        
        C:\Windows\SysWOW64\Hemmac32.exe
        
        C:\Windows\system32\Hemmac32.exe
        112⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Ihkjno32.exe
        
        C:\Windows\system32\Ihkjno32.exe
        113⤵
        Modifies registry class
        
        PID:5816
        
        C:\Windows\SysWOW64\Inebjihf.exe
        
        C:\Windows\system32\Inebjihf.exe
        114⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Iacngdgj.exe
        
        C:\Windows\system32\Iacngdgj.exe
        115⤵
        Modifies registry class
        
        PID:5904
        
        C:\Windows\SysWOW64\Ilibdmgp.exe
        
        C:\Windows\system32\Ilibdmgp.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5952
        
        C:\Windows\SysWOW64\Ipdndloi.exe
        
        C:\Windows\system32\Ipdndloi.exe
        117⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Iimcma32.exe
        
        C:\Windows\system32\Iimcma32.exe
        118⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6040
        
        C:\Windows\SysWOW64\Ihpcinld.exe
        
        C:\Windows\system32\Ihpcinld.exe
        119⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6084
        
        C:\Windows\SysWOW64\Ibegfglj.exe
        
        C:\Windows\system32\Ibegfglj.exe
        120⤵
        System Location Discovery: System Language Discovery
        
        PID:6128
        
        C:\Windows\SysWOW64\Iiopca32.exe
        
        C:\Windows\system32\Iiopca32.exe
        121⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5160
        
        C:\Windows\SysWOW64\Ihbponja.exe
        
        C:\Windows\system32\Ihbponja.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5228
        
        C:\Windows\SysWOW64\Ipihpkkd.exe
        
        C:\Windows\system32\Ipihpkkd.exe
        123⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Iialhaad.exe
        
        C:\Windows\system32\Iialhaad.exe
        124⤵
        Modifies registry class
        
        PID:5356
        
        C:\Windows\SysWOW64\Ihdldn32.exe
        
        C:\Windows\system32\Ihdldn32.exe
        125⤵
        Modifies registry class
        
        PID:5432
        
        C:\Windows\SysWOW64\Ipkdek32.exe
        
        C:\Windows\system32\Ipkdek32.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5508
        
        C:\Windows\SysWOW64\Iamamcop.exe
        
        C:\Windows\system32\Iamamcop.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5548
        
        C:\Windows\SysWOW64\Jhgiim32.exe
        
        C:\Windows\system32\Jhgiim32.exe
        128⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Jlbejloe.exe
        
        C:\Windows\system32\Jlbejloe.exe
        129⤵
        Modifies registry class
        
        PID:5760
        
        C:\Windows\SysWOW64\Jblmgf32.exe
        
        C:\Windows\system32\Jblmgf32.exe
        130⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Jhifomdj.exe
        
        C:\Windows\system32\Jhifomdj.exe
        131⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Jppnpjel.exe
        
        C:\Windows\system32\Jppnpjel.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6036
        
        C:\Windows\SysWOW64\Jemfhacc.exe
        
        C:\Windows\system32\Jemfhacc.exe
        133⤵
        Modifies registry class
        
        PID:6116
        
        C:\Windows\SysWOW64\Jlgoek32.exe
        
        C:\Windows\system32\Jlgoek32.exe
        134⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Jeocna32.exe
        
        C:\Windows\system32\Jeocna32.exe
        135⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Jikoopij.exe
        
        C:\Windows\system32\Jikoopij.exe
        136⤵
        System Location Discovery: System Language Discovery
        
        PID:5404
        
        C:\Windows\SysWOW64\Jlikkkhn.exe
        
        C:\Windows\system32\Jlikkkhn.exe
        137⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5492
        
        C:\Windows\SysWOW64\Jimldogg.exe
        
        C:\Windows\system32\Jimldogg.exe
        138⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Jllhpkfk.exe
        
        C:\Windows\system32\Jllhpkfk.exe
        139⤵
        Drops file in System32 directory
        
        PID:5744
        
        C:\Windows\SysWOW64\Kiphjo32.exe
        
        C:\Windows\system32\Kiphjo32.exe
        140⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Kefiopki.exe
        
        C:\Windows\system32\Kefiopki.exe
        141⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Kheekkjl.exe
        
        C:\Windows\system32\Kheekkjl.exe
        142⤵
        Modifies registry class
        
        PID:6140
        
        C:\Windows\SysWOW64\Kamjda32.exe
        
        C:\Windows\system32\Kamjda32.exe
        143⤵
        Drops file in System32 directory
        
        PID:6004
        
        C:\Windows\SysWOW64\Keifdpif.exe
        
        C:\Windows\system32\Keifdpif.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5316
        
        C:\Windows\SysWOW64\Klbnajqc.exe
        
        C:\Windows\system32\Klbnajqc.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5340
        
        C:\Windows\SysWOW64\Kcmfnd32.exe
        
        C:\Windows\system32\Kcmfnd32.exe
        146⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Khiofk32.exe
        
        C:\Windows\system32\Khiofk32.exe
        147⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5868
        
        C:\Windows\SysWOW64\Kocgbend.exe
        
        C:\Windows\system32\Kocgbend.exe
        148⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Kemooo32.exe
        
        C:\Windows\system32\Kemooo32.exe
        149⤵
        Drops file in System32 directory
        
        PID:5200
        
        C:\Windows\SysWOW64\Khlklj32.exe
        
        C:\Windows\system32\Khlklj32.exe
        150⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Kofdhd32.exe
        
        C:\Windows\system32\Kofdhd32.exe
        151⤵
        Modifies registry class
        
        PID:5572
        
        C:\Windows\SysWOW64\Lepleocn.exe
        
        C:\Windows\system32\Lepleocn.exe
        152⤵
        Drops file in System32 directory
        
        PID:5872
        
        C:\Windows\SysWOW64\Likhem32.exe
        
        C:\Windows\system32\Likhem32.exe
        153⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Lohqnd32.exe
        
        C:\Windows\system32\Lohqnd32.exe
        154⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Lebijnak.exe
        
        C:\Windows\system32\Lebijnak.exe
        155⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Lllagh32.exe
        
        C:\Windows\system32\Lllagh32.exe
        156⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Lojmcdgl.exe
        
        C:\Windows\system32\Lojmcdgl.exe
        157⤵
        Modifies registry class
        
        PID:6096
        
        C:\Windows\SysWOW64\Ljpaqmgb.exe
        
        C:\Windows\system32\Ljpaqmgb.exe
        158⤵
        System Location Discovery: System Language Discovery
        
        PID:6148
        
        C:\Windows\SysWOW64\Lpjjmg32.exe
        
        C:\Windows\system32\Lpjjmg32.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6192
        
        C:\Windows\SysWOW64\Lakfeodm.exe
        
        C:\Windows\system32\Lakfeodm.exe
        160⤵
        Drops file in System32 directory
        
        PID:6236
        
        C:\Windows\SysWOW64\Legben32.exe
        
        C:\Windows\system32\Legben32.exe
        161⤵
        System Location Discovery: System Language Discovery
        
        PID:6276
        
        C:\Windows\SysWOW64\Lplfcf32.exe
        
        C:\Windows\system32\Lplfcf32.exe
        162⤵
        System Location Discovery: System Language Discovery
        
        PID:6320
        
        C:\Windows\SysWOW64\Lckboblp.exe
        
        C:\Windows\system32\Lckboblp.exe
        163⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Ljdkll32.exe
        
        C:\Windows\system32\Ljdkll32.exe
        164⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Lpochfji.exe
        
        C:\Windows\system32\Lpochfji.exe
        165⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Loacdc32.exe
        
        C:\Windows\system32\Loacdc32.exe
        166⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Mapppn32.exe
        
        C:\Windows\system32\Mapppn32.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6540
        
        C:\Windows\SysWOW64\Mhjhmhhd.exe
        
        C:\Windows\system32\Mhjhmhhd.exe
        168⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6584
        
        C:\Windows\SysWOW64\Mcoljagj.exe
        
        C:\Windows\system32\Mcoljagj.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6628
        
        C:\Windows\SysWOW64\Mablfnne.exe
        
        C:\Windows\system32\Mablfnne.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6672
        
        C:\Windows\SysWOW64\Mlhqcgnk.exe
        
        C:\Windows\system32\Mlhqcgnk.exe
        171⤵
        Modifies registry class
        
        PID:6720
        
        C:\Windows\SysWOW64\Mpclce32.exe
        
        C:\Windows\system32\Mpclce32.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6764
        
        C:\Windows\SysWOW64\Mfpell32.exe
        
        C:\Windows\system32\Mfpell32.exe
        173⤵
        Modifies registry class
        
        PID:6808
        
        C:\Windows\SysWOW64\Mjlalkmd.exe
        
        C:\Windows\system32\Mjlalkmd.exe
        174⤵
        Modifies registry class
        
        PID:6852
        
        C:\Windows\SysWOW64\Mpeiie32.exe
        
        C:\Windows\system32\Mpeiie32.exe
        175⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Mbgeqmjp.exe
        
        C:\Windows\system32\Mbgeqmjp.exe
        176⤵
        System Location Discovery: System Language Discovery
        
        PID:6940
        
        C:\Windows\SysWOW64\Mjnnbk32.exe
        
        C:\Windows\system32\Mjnnbk32.exe
        177⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Mlljnf32.exe
        
        C:\Windows\system32\Mlljnf32.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7028
        
        C:\Windows\SysWOW64\Mokfja32.exe
        
        C:\Windows\system32\Mokfja32.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7072
        
        C:\Windows\SysWOW64\Mfenglqf.exe
        
        C:\Windows\system32\Mfenglqf.exe
        180⤵
        Drops file in System32 directory
        
        PID:7116
        
        C:\Windows\SysWOW64\Mqjbddpl.exe
        
        C:\Windows\system32\Mqjbddpl.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7164
        
        C:\Windows\SysWOW64\Njbgmjgl.exe
        
        C:\Windows\system32\Njbgmjgl.exe
        182⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Nqmojd32.exe
        
        C:\Windows\system32\Nqmojd32.exe
        183⤵
        Modifies registry class
        
        PID:6260
        
        C:\Windows\SysWOW64\Nbnlaldg.exe
        
        C:\Windows\system32\Nbnlaldg.exe
        184⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6348
        
        C:\Windows\SysWOW64\Nfihbk32.exe
        
        C:\Windows\system32\Nfihbk32.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6416
        
        C:\Windows\SysWOW64\Nqoloc32.exe
        
        C:\Windows\system32\Nqoloc32.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6480
        
        C:\Windows\SysWOW64\Ncmhko32.exe
        
        C:\Windows\system32\Ncmhko32.exe
        187⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6552
        
        C:\Windows\SysWOW64\Nfldgk32.exe
        
        C:\Windows\system32\Nfldgk32.exe
        188⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Nodiqp32.exe
        
        C:\Windows\system32\Nodiqp32.exe
        189⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Nimmifgo.exe
        
        C:\Windows\system32\Nimmifgo.exe
        190⤵
        Drops file in System32 directory
        
        PID:7100
        
        C:\Windows\SysWOW64\Ncbafoge.exe
        
        C:\Windows\system32\Ncbafoge.exe
        191⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Nbebbk32.exe
        
        C:\Windows\system32\Nbebbk32.exe
        192⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Niojoeel.exe
        
        C:\Windows\system32\Niojoeel.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6380
        
        C:\Windows\SysWOW64\Nmjfodne.exe
        
        C:\Windows\system32\Nmjfodne.exe
        194⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6548
        
        C:\Windows\SysWOW64\Ooibkpmi.exe
        
        C:\Windows\system32\Ooibkpmi.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6680
        
        C:\Windows\SysWOW64\Ocdnln32.exe
        
        C:\Windows\system32\Ocdnln32.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6744
        
        C:\Windows\SysWOW64\Obgohklm.exe
        
        C:\Windows\system32\Obgohklm.exe
        197⤵
        System Location Discovery: System Language Discovery
        
        PID:6864
        
        C:\Windows\SysWOW64\Oiagde32.exe
        
        C:\Windows\system32\Oiagde32.exe
        198⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6868
        
        C:\Windows\SysWOW64\Oqhoeb32.exe
        
        C:\Windows\system32\Oqhoeb32.exe
        199⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Ookoaokf.exe
        
        C:\Windows\system32\Ookoaokf.exe
        200⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Objkmkjj.exe
        
        C:\Windows\system32\Objkmkjj.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6532
        
        C:\Windows\SysWOW64\Ojqcnhkl.exe
        
        C:\Windows\system32\Ojqcnhkl.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6652
        
        C:\Windows\SysWOW64\Omopjcjp.exe
        
        C:\Windows\system32\Omopjcjp.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6820
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        204⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7084
        
        C:\Windows\SysWOW64\Ofgdcipq.exe
        
        C:\Windows\system32\Ofgdcipq.exe
        205⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Ojcpdg32.exe
        
        C:\Windows\system32\Ojcpdg32.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6848
        
        C:\Windows\SysWOW64\Oophlo32.exe
        
        C:\Windows\system32\Oophlo32.exe
        207⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Ockdmmoj.exe
        
        C:\Windows\system32\Ockdmmoj.exe
        208⤵
        Drops file in System32 directory
        
        PID:6592
        
        C:\Windows\SysWOW64\Ojemig32.exe
        
        C:\Windows\system32\Ojemig32.exe
        209⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Omdieb32.exe
        
        C:\Windows\system32\Omdieb32.exe
        210⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Opbean32.exe
        
        C:\Windows\system32\Opbean32.exe
        211⤵
        Drops file in System32 directory
        
        PID:6428
        
        C:\Windows\SysWOW64\Obqanjdb.exe
        
        C:\Windows\system32\Obqanjdb.exe
        212⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Oflmnh32.exe
        
        C:\Windows\system32\Oflmnh32.exe
        213⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Omfekbdh.exe
        
        C:\Windows\system32\Omfekbdh.exe
        214⤵
        System Location Discovery: System Language Discovery
        
        PID:7252
        
        C:\Windows\SysWOW64\Ppdbgncl.exe
        
        C:\Windows\system32\Ppdbgncl.exe
        215⤵
        Drops file in System32 directory
        
        PID:7300
        
        C:\Windows\SysWOW64\Pbcncibp.exe
        
        C:\Windows\system32\Pbcncibp.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7352
        
        C:\Windows\SysWOW64\Pjjfdfbb.exe
        
        C:\Windows\system32\Pjjfdfbb.exe
        217⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7400
        
        C:\Windows\SysWOW64\Pimfpc32.exe
        
        C:\Windows\system32\Pimfpc32.exe
        218⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\Padnaq32.exe
        
        C:\Windows\system32\Padnaq32.exe
        219⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\Pcbkml32.exe
        
        C:\Windows\system32\Pcbkml32.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7548
        
        C:\Windows\SysWOW64\Pfccogfc.exe
        
        C:\Windows\system32\Pfccogfc.exe
        221⤵
        Modifies registry class
        
        PID:7600
        
        C:\Windows\SysWOW64\Pmmlla32.exe
        
        C:\Windows\system32\Pmmlla32.exe
        222⤵
        Modifies registry class
        
        PID:7652
        
        C:\Windows\SysWOW64\Pbjddh32.exe
        
        C:\Windows\system32\Pbjddh32.exe
        223⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7700
        
        C:\Windows\SysWOW64\Pmbegqjk.exe
        
        C:\Windows\system32\Pmbegqjk.exe
        224⤵
        System Location Discovery: System Language Discovery
        
        PID:7752
        
        C:\Windows\SysWOW64\Qbonoghb.exe
        
        C:\Windows\system32\Qbonoghb.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7796
        
        C:\Windows\SysWOW64\Qiiflaoo.exe
        
        C:\Windows\system32\Qiiflaoo.exe
        226⤵
        System Location Discovery: System Language Discovery
        
        PID:7840
        
        C:\Windows\SysWOW64\Qapnmopa.exe
        
        C:\Windows\system32\Qapnmopa.exe
        227⤵
        Drops file in System32 directory
        
        PID:7884
        
        C:\Windows\SysWOW64\Qbajeg32.exe
        
        C:\Windows\system32\Qbajeg32.exe
        228⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Qikbaaml.exe
        
        C:\Windows\system32\Qikbaaml.exe
        229⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Afockelf.exe
        
        C:\Windows\system32\Afockelf.exe
        230⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8020
        
        C:\Windows\SysWOW64\Aimogakj.exe
        
        C:\Windows\system32\Aimogakj.exe
        231⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Apggckbf.exe
        
        C:\Windows\system32\Apggckbf.exe
        232⤵
        Modifies registry class
        
        PID:8108
        
        C:\Windows\SysWOW64\Aiplmq32.exe
        
        C:\Windows\system32\Aiplmq32.exe
        233⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Ajohfcpj.exe
        
        C:\Windows\system32\Ajohfcpj.exe
        234⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Adgmoigj.exe
        
        C:\Windows\system32\Adgmoigj.exe
        235⤵
        Drops file in System32 directory
        
        PID:7228
        
        C:\Windows\SysWOW64\Ampaho32.exe
        
        C:\Windows\system32\Ampaho32.exe
        236⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Aalmimfd.exe
        
        C:\Windows\system32\Aalmimfd.exe
        237⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Adjjeieh.exe
        
        C:\Windows\system32\Adjjeieh.exe
        238⤵
        System Location Discovery: System Language Discovery
        
        PID:7436
        
        C:\Windows\SysWOW64\Afhfaddk.exe
        
        C:\Windows\system32\Afhfaddk.exe
        239⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7472
        
        C:\Windows\SysWOW64\Bdlfjh32.exe
        
        C:\Windows\system32\Bdlfjh32.exe
        240⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7512
        
        C:\Windows\SysWOW64\Bpcgpihi.exe
        
        C:\Windows\system32\Bpcgpihi.exe
        241⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Bfmolc32.exe
        
        C:\Windows\system32\Bfmolc32.exe
        242⤵
        Drops file in System32 directory
        
        PID:7644
        
        C:\Windows\SysWOW64\Bmggingc.exe
        
        C:\Windows\system32\Bmggingc.exe
        243⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Bpedeiff.exe
        
        C:\Windows\system32\Bpedeiff.exe
        244⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7780
        
        C:\Windows\SysWOW64\Bfolacnc.exe
        
        C:\Windows\system32\Bfolacnc.exe
        245⤵
        Drops file in System32 directory
        
        PID:7848
        
        C:\Windows\SysWOW64\Bkkhbb32.exe
        
        C:\Windows\system32\Bkkhbb32.exe
        246⤵
        Modifies registry class
        
        PID:7916
        
        C:\Windows\SysWOW64\Bphqji32.exe
        
        C:\Windows\system32\Bphqji32.exe
        247⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Bkmeha32.exe
        
        C:\Windows\system32\Bkmeha32.exe
        248⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8052
        
        C:\Windows\SysWOW64\Bmladm32.exe
        
        C:\Windows\system32\Bmladm32.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8128
        
        C:\Windows\SysWOW64\Bpjmph32.exe
        
        C:\Windows\system32\Bpjmph32.exe
        250⤵
        Modifies registry class
        
        PID:6692
        
        C:\Windows\SysWOW64\Ckpamabg.exe
        
        C:\Windows\system32\Ckpamabg.exe
        251⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7276
        
        C:\Windows\SysWOW64\Cibain32.exe
        
        C:\Windows\system32\Cibain32.exe
        252⤵
        System Location Discovery: System Language Discovery
        
        PID:7388
        
        C:\Windows\SysWOW64\Cajjjk32.exe
        
        C:\Windows\system32\Cajjjk32.exe
        253⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7220
        
        C:\Windows\SysWOW64\Cdhffg32.exe
        
        C:\Windows\system32\Cdhffg32.exe
        254⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\Calfpk32.exe
        
        C:\Windows\system32\Calfpk32.exe
        255⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7640
        
        C:\Windows\SysWOW64\Ccmcgcmp.exe
        
        C:\Windows\system32\Ccmcgcmp.exe
        256⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Ckdkhq32.exe
        
        C:\Windows\system32\Ckdkhq32.exe
        257⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Cancekeo.exe
        
        C:\Windows\system32\Cancekeo.exe
        258⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Cpacqg32.exe
        
        C:\Windows\system32\Cpacqg32.exe
        259⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Ccppmc32.exe
        
        C:\Windows\system32\Ccppmc32.exe
        260⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8180
        
        C:\Windows\SysWOW64\Cgklmacf.exe
        
        C:\Windows\system32\Cgklmacf.exe
        261⤵
        System Location Discovery: System Language Discovery
        
        PID:7316
        
        C:\Windows\SysWOW64\Ciihjmcj.exe
        
        C:\Windows\system32\Ciihjmcj.exe
        262⤵
        Drops file in System32 directory
        
        PID:7212
        
        C:\Windows\SysWOW64\Caqpkjcl.exe
        
        C:\Windows\system32\Caqpkjcl.exe
        263⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Ckidcpjl.exe
        
        C:\Windows\system32\Ckidcpjl.exe
        264⤵
        Modifies registry class
        
        PID:7764
        
        C:\Windows\SysWOW64\Dkkaiphj.exe
        
        C:\Windows\system32\Dkkaiphj.exe
        265⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7936
        
        C:\Windows\SysWOW64\Daeifj32.exe
        
        C:\Windows\system32\Daeifj32.exe
        266⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8032
        
        C:\Windows\SysWOW64\Ddcebe32.exe
        
        C:\Windows\system32\Ddcebe32.exe
        267⤵
        System Location Discovery: System Language Discovery
        
        PID:7292
        
        C:\Windows\SysWOW64\Dknnoofg.exe
        
        C:\Windows\system32\Dknnoofg.exe
        268⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7524
        
        C:\Windows\SysWOW64\Diqnjl32.exe
        
        C:\Windows\system32\Diqnjl32.exe
        269⤵
        
        PID:4416
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4416 -s 400
        270⤵
        Program crash
        
        PID:8088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4416 -ip 4416
1⤵
PID:6704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Adgmoigj.exe

Filesize
81KB

MD5
bb3d2fc348cc3af8b96971d29cfdd543

SHA1
b8ae601152732655a2bf0d020ea68155653de59d

SHA256
2a7ff0d1fe2b5729c1d1b27498a75812989163881a717c9b30ff3600dd5bf2e8

SHA512
c76c2b382e7b8eea5c9dc68cc3aa79e681bb60c05b822eae4fa9a24add468274cc92e862ed5a29a1cf4f5bf420456983477e94d4689cee98f8bd3c7ff42cb031

Download Submit
C:\Windows\SysWOW64\Adhdjpjf.exe

Filesize
81KB

MD5
5d1d3bd670c4272180edca414996ec3c

SHA1
c0fa6a9e013d814d9e2321732f6677c5121fe8b4

SHA256
4ba6c79b53bbff61c0335762ce19c5af1134871c059122a432e68e0fe3416dbf

SHA512
d0353c82f03e6ddfd298679a93cf17f94581a312a863f0efd6133c4b9a0500f9d18914b3306451f25de291fe2119b2f0d8535b837c5a669fbf80cfc7cfc64bf4

Download Submit
C:\Windows\SysWOW64\Ahmjjoig.exe

Filesize
81KB

MD5
764d69a84b0913b6d7c2ad6721f5ee86

SHA1
b1dc2fba9d2eba97fcc819e64ae77a57eafb4f39

SHA256
18163e049d28ff873e2b0bfc6e553db037ae49174f840c410e75cfd5d835d689

SHA512
76b57c76f3ba667d01acc7cb567dbe207b447c038470d64d567cdbf5fa1c06b12fbc24d6864783d44e5751a1ed83f56f01c4a9aa86ca06bd27d06b10155e12d2

Download Submit
C:\Windows\SysWOW64\Aiplmq32.exe

Filesize
81KB

MD5
c32610bf56ec133bb7406df24ef28b73

SHA1
587dbb457dc8f4514849209c6216e876c52ffb95

SHA256
ceb9c5d94ffdffecda20042a4a11fc3b3a42cfd85cd9ed6a8bd5a55715c3c961

SHA512
b4623f4459d2250d4682659d2940dff47bd6c7ff774e6e1ad65a478e2657f884306417dd3f3431c36c064a3b24cc8759850a74aa7589d9c7472f7d07dc55fb25

Download Submit
C:\Windows\SysWOW64\Amqhbe32.exe

Filesize
81KB

MD5
1a4e3dea64f129969c8a2c89b36cd075

SHA1
c1855b00eb1b61305a872bd852c61e98c372152b

SHA256
0716ddfd452fc6b1ced651e26b8bef2dd7075a837cea59dca8d55a1eb613e9f2

SHA512
a81c7ecdb12d596683d9bc5c4bde61148e1f9099f7d530072ed2b283b398c9a45eaf738e02a8ac682f94a7d9c6f3e130df65a72cb5d2ba97b104fb221e69038f

Download Submit
C:\Windows\SysWOW64\Bdlfjh32.exe

Filesize
81KB

MD5
06299a14407a654c18faaa2795286ed5

SHA1
1852da7032718c2ebea9afe2468fd7db717ff713

SHA256
1b4413c0957f214503fff2ecb3daad370c4ebfe9d89fcaeb80bb89c442796057

SHA512
2e7cd0adb8549ec23de074675375e53c3c4a8153d2e2158c10b9eb8ca21af6eb5f17bdbdb487e9536208a1d47f4cc295e7df7790abaf84b69d14e0561f8fd3be

Download Submit
C:\Windows\SysWOW64\Bgelgi32.exe

Filesize
81KB

MD5
6cee5fb3eeb4d784c3cfe46d21bfe579

SHA1
acae449d0f3f0b37015a3b3588590dd77193e876

SHA256
7075ffec2d4b609e54680d65725d937adc200a84fbcc73dac1f6b1b4fa3e7fe7

SHA512
df6c2fd5833bfb658554172a93124072ca07b8dd12a46cd93376e09fd6e79c4de67975d4205272a25a78e9ff296c7c4ae0429d38cd75c13b330c62dc56a4e098

Download Submit
C:\Windows\SysWOW64\Bkmeha32.exe

Filesize
81KB

MD5
ee0d8b0a4a7cfc5590ecaa5e93010587

SHA1
c01ad329144b69287058c8bcdda9d6eeee4123c9

SHA256
40beaebcc6f7efbe0aac9d0d095040ac0364e14bee53a4ce0ea41f8dca76623c

SHA512
0300073fa4c92fdf1682e5e03471b3a9866a7bdafc4a48744e12356fc92280bdcc636e25a5db0ca490089b74b5841576aa7157d0d7ad01c252ce4e841ed38187

Download Submit
C:\Windows\SysWOW64\Calfpk32.exe

Filesize
81KB

MD5
227630ccf7c25baf90dada46e609c8a4

SHA1
78f59f19170b9f735fd2bb634f8df3dff8aa8afe

SHA256
4fd89c8b4c29ee4e7186cc1c43b5acae83289bef45fbd4f91f90e4d8cd25d8be

SHA512
b81f203249485309863170b9a82f9e2c41544aa3cf3a3a5ddf1c14f1ed4e639fa96318776224f30daa0d72e7cb8d1d5cb69f9eb1d868bca029e03435559c5303

Download Submit
C:\Windows\SysWOW64\Caqpkjcl.exe

Filesize
81KB

MD5
ec846e23fa75d07b650dab0bdd3c234b

SHA1
d7a10d8e65d34c695b01cfe33d49a7a9a5591a6b

SHA256
3c7c9e21b57b0aba9893a7d01d900c4cf45565934b9e5cbf71779a1c2a363370

SHA512
c5b19e71ab05f69198e3bb8b81eb3b0eb85ca93737f4b5f2cd7cb45319107654a0ee2ca7cecd771ef9ca45ee529cb938a7969c4300bcce916e965937cdb74cb4

Download Submit
C:\Windows\SysWOW64\Cgqlcg32.exe

Filesize
81KB

MD5
02fb1af041bcc20828eef5b650f8953d

SHA1
31d71c3fcd37cf12b8240a5628418766e6d70424

SHA256
ac6a0f4d4a0ee0862868924019d992cd34f41b4c2a8541ef2266ed5155112900

SHA512
88f4f881d7641937687d7c9cb076e6d8a433d5d0efb1e4d486b9350f0bb9236a650727f6c937b00fa320d0bdf5cec707b0ca8ce45111c13cae68d9f23850a69d

Download Submit
C:\Windows\SysWOW64\Daeifj32.exe

Filesize
81KB

MD5
87d7438f0c580618b65d616605d7094e

SHA1
c4a1f8cde788bd0541a3ee25843da3862c9f1b7e

SHA256
c93422ffefc0b8d277ca38bf552b367ac231cdf714e6eadf7937a5c3235eb896

SHA512
565d585732d0a709c43b456f132c936b5fb3ed1d15f95e9e8cc2e77b32a5223515df7394a6a99b84a2e9416069af46ca95ed63c55ab1549d1e9070bdcbdf1bb2

Download Submit
C:\Windows\SysWOW64\Dhdbhifj.exe

Filesize
81KB

MD5
d2ed8f388a17337a363700b249dfb059

SHA1
800fe55190da510d369c12a9ff1cd7abad1bf891

SHA256
dff4c5339bf3e9a9019836ca86602a638d6556bbde250a23f5dea9c3163111b9

SHA512
2bae023073ac846ebe620d0568e05a93374d30a74a69602ef19982221fd41580048e6841073e8ba8e80c610fc01763cb71dfbe84f36d0079f8a9947baedf866f

Download Submit
C:\Windows\SysWOW64\Eiekog32.exe

Filesize
81KB

MD5
7b3f74d88f0e2dd9919a650b9de15ea6

SHA1
e338a30d81441188d086d43dae91c2529b193225

SHA256
e28db6bf1aa48f0437a5bf241d664a790ac51a4c335415cf90b3175149d8b1be

SHA512
504991303a7ecf0cbcbbb05d06e6b1f63f12433138b33c7584461d33f01b7ac57ccb023399f2c83aa764d4750b0344d1d939b0fc7c05d87c0fa75c280f9737fe

Download Submit
C:\Windows\SysWOW64\Eohmkb32.exe

Filesize
81KB

MD5
4e12b0038a409ef1cf0cc7006e8e94f7

SHA1
fce4a213ba070272cdc2454243c6a7552cad489c

SHA256
ac886949b7fda36517d7665ec0e28fc4b64a19547d1864fc0c776c875cee2d21

SHA512
ad937939a004b8674c5ab9098f91669d9f042ad415d18d08753f91e42b45f3d6a2e1c03014b0135dafc8f0e764d7452057d2e11ee30c00f977a5cfd51dcb190e

Download Submit
C:\Windows\SysWOW64\Fiqjke32.exe

Filesize
81KB

MD5
3299fe03e6b43f76c3f512ff2f65fb5a

SHA1
67a65b2cf1eba2ef317b535be1999a56975a82f8

SHA256
bc1857c1c6380cc7fc3068d9512a8d1cb88fc8802549f92844c3c5e380cd8fca

SHA512
81a6e7cc7b139ec1342f24e19a6052fad9d48298ccf15c0fc8f26cd9d495ebff403c1fa78d6f2a4f204c12e760cf4cf9fa6f77b203e6df7e10533e6acdd5822b

Download Submit
C:\Windows\SysWOW64\Gaebef32.exe

Filesize
81KB

MD5
5472d9cad55435477167ab4b1d8d8d58

SHA1
58fbd41d2581c5398bf2eea5a6a92e28562b9976

SHA256
d1d85b5868064d232664092d5c0d23596b6e966e3e05d9b439bf207c02b301d7

SHA512
19d6d56d0c1532428bc28669f4305131ac1a54464bbf1194772a5c099cf2b6fb29c4057971504f8f97157d2cedd31b5bcb4fe9fda4a7d7685b0b8315b862e142

Download Submit
C:\Windows\SysWOW64\Gihpkd32.exe

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\SysWOW64\Hemmac32.exe

Filesize
81KB

MD5
67cd03b671073f835883a3845a993944

SHA1
32fb40c3d3fc333182cf528614df38a7a634ddd8

SHA256
036ed07638c5755a38494ac932df940f092c54c7dcf919f33e209b87a93b7ca2

SHA512
2939c93c9f551c203e16418a7e2100ecf76f1d10e9f8f3a5250c098e6ca539f1d09b23d062561e1325b76cb9484757491d1b7e70e396cf61f4da9789f32b6ed8

Download Submit
C:\Windows\SysWOW64\Hhfpbpdo.exe

Filesize
81KB

MD5
961d078f68d7f83907b09ef46c349063

SHA1
5fc31fb9c90fda122ca50bb380aab1158011bb9b

SHA256
ded67abc34400f972e0fe2e6b4a36f2bb6c287255f4e70ffeb01ecb3d15ee398

SHA512
b921e2fbe9f095c5aaeb7409cdf1416064a1f504c8ac5064341fe534c601595d5f0f858a9979de95964908378d7bbf3937604617aff182cc1d0c400f1e130c47

Download Submit
C:\Windows\SysWOW64\Inebjihf.exe

Filesize
81KB

MD5
dc55d2cc9d2c26d00e7a34c8196f1106

SHA1
d215587df7e650e1ceb1ff88d61cae66a0987684

SHA256
4b165ccea714722267262d29582209e1fd73eb953c204f4558e1d8bb29d684d0

SHA512
45c68612f4bf3bb361fdf31d2f74e7f5deb5015771d5c19b61568bc216984fde1968a224b8f80c599969d3050c3233db7fceb59c5e19e03f2c67835d8883ff26

Download Submit
C:\Windows\SysWOW64\Jppnpjel.exe

Filesize
64KB

MD5
18e549131dd0224c966fcf423bee93e9

SHA1
78dfe7484ef7e19e5480a08a28102ec7f28df501

SHA256
09c8640f907ace0480191793b0286667a15c47e4164c51f595b0f0cfafe0c06b

SHA512
16ba9fea1e06fe35070c4060bfed2df80812837c68645418314383f9aca1fac70b26c0ca30cbe4d15a585097ee2890dbd5374708277d787fc06a5125dd0c9fae

Download Submit
C:\Windows\SysWOW64\Kamjda32.exe

Filesize
81KB

MD5
ce5f764507f010b5de1808e439bb24dc

SHA1
57648560bc8dc450a7a4db3962e4b4a0006b1efb

SHA256
a0606c56a8c3b96ea651177ea02b0141fd8c8b82b0e8894e3bb68319cdc4af03

SHA512
a1e5d0c845629ba841d420faac117e5054434e06eb6b41cf1988fbf801c0e8c3f9bd15dcd9ab64cc1d91ef33bd38f414681a6689c43a524502b5b8b55525798d

Download Submit
C:\Windows\SysWOW64\Kcmfnd32.exe

Filesize
81KB

MD5
b84fd892b36cbb75bc52b3265c92b437

SHA1
ff0a0529667195581c18949c1a37c72256f99fb3

SHA256
bc33b355251c524093275e46145a2791095fca50052c7c0537239cf38be1a65b

SHA512
f3f5ba9bba788cde57860e09e62d54d20efae39364f8903d38f81a610cff6e76682a29db23b22cde00f4fe5611905a0803a762657273534d281684658dd4ae17

Download Submit
C:\Windows\SysWOW64\Kefiopki.exe

Filesize
81KB

MD5
c9da9326582b937dee379a3a7590f4e4

SHA1
2b65637d68d89d3d08ccdb78e7a4ced7f35d371e

SHA256
392003b9b2b37b179ab2ac843741cadb225e6f89792c7df434542544661e727a

SHA512
ec5586f81aef0f5eefec66156444f85d367695448d086ba2877ae53e5f49fccde6bc6d4b65d44e837ab29b685058d303808d822dcbea8d945e053fbd43be578e

Download Submit
C:\Windows\SysWOW64\Khlklj32.exe

Filesize
81KB

MD5
7f91cd78ad17467e56c60c6f6200116b

SHA1
017539589e7de8d19488fe86d7112f479aafd7f1

SHA256
c1c7f00c8ac03ced78209362f17416e9c636711ca12c9e4d359b28117feefbaa

SHA512
59bca20a7baedf339264afdc9972ff14a75147d925f6277b69d7a18a4b13c2e40c8f242075cc06bfe27f7c95e695958a5b917ef826d7ee3a52f381d172fb782c

Download Submit
C:\Windows\SysWOW64\Lepleocn.exe

Filesize
81KB

MD5
9b7e690e81af9c522291b206b7bc2a4e

SHA1
1be6c122c0a67ff8e5d44508bee94ad2b6183821

SHA256
f19ca146c511d5edcc7180d7d0dd2dd403ac5c00c997b0026a934dd70e9e7957

SHA512
1bd61a636718c15443fce9d349bc4fb44f119e54e3a029cb4fd764caeb4aa4941619679f86fbcf8794aa54cc39af2d0f68a894c9782ebe4d991d34a522b0d073

Download Submit
C:\Windows\SysWOW64\Ljdkll32.exe

Filesize
81KB

MD5
1b07d853363979befd302750cb3f85e0

SHA1
e0cb86b6d8e8dcb91de7d34008357a1b156832eb

SHA256
9d9832378d92515d36c10ac210cd01515a8087e54a1fbaf9189813dd6e29bc97

SHA512
bd17ed7f2a0a553a101d3c430dbea6605ae60d3540775446318290829cdce9e47d2ef8601b7f8c73f5988fd168b75a6ca1af38ecf71a63127017a576ccbf9ac3

Download Submit
C:\Windows\SysWOW64\Lohqnd32.exe

Filesize
81KB

MD5
e38411a31b0e78694ab52226a5d56005

SHA1
725344ac407dac4ce5ee8e5033ee1dbcd4b868d9

SHA256
00149fbd2efde2640dc3809b9f41027c74b79456859751a43bcf42009d512481

SHA512
54f27aebcce24218f2371e55d22d955b11adec64b63d84d7630193f6fda2b912db7874184762cdb5a2f65207f9a3b954e4eda5d81d421e7332b52b97bdc6d978

Download Submit
C:\Windows\SysWOW64\Lpjjmg32.exe

Filesize
81KB

MD5
09b4fa4e43923896951b6ef8598123cd

SHA1
4a46a667d01508493356af37487ad8d3c6e41f6e

SHA256
1f0cc414b0ef6e75fc54a0075d90fd99df88216ac578383438016b30b89e6836

SHA512
2abec5a29bff850944eb8ffbfce369307f8af40f2bd2f05682605735c060a9a7a88700a8c7905fdbd5463b8d37c62fd1877331b9befe13bc9faf6c910042588b

Download Submit
C:\Windows\SysWOW64\Lplfcf32.exe

Filesize
81KB

MD5
6cb88a2a0e838e95b770a98f309c341a

SHA1
ae78af7a628dafbbd977bdbb8bfbac1120d927d6

SHA256
df8fded79fd7db1b61ac0aa6e461cc330a03b69c15df04d01ca74a5bb8883e0c

SHA512
8606698d030771f39ab70d2ebf3f42ed94ffeff377f510ac62643a5b70b543ecbc5d964a848fe01a945e990f0d92177ee30bfef9327159ec50c8fadac951fa5f

Download Submit
C:\Windows\SysWOW64\Mfpell32.exe

Filesize
81KB

MD5
97eb571028ec78379629faaa2abb9aee

SHA1
05cdc99c20e4e9bca35cce06508ac31d54c9b32e

SHA256
ba3811c289e04c7701a0baf1c7d01307b9c361dccab449b45c217cc635c5afd9

SHA512
dd9187dc6fbc82f158f2acc33f880442fb7a48e107dcacd98881cbdc3225b2d1b3166c537f7e114625c8288ff18c96cc756d4cb6e72039edf9f34fe1f92ca1c8

Download Submit
C:\Windows\SysWOW64\Mhjhmhhd.exe

Filesize
81KB

MD5
a716c807117188b997a2bc4e85d892b3

SHA1
8b67bec0976ce780374babb54dddf9b380d7e023

SHA256
1d47f156af27a6978a0a5a9c3ff0f04232176b61006e362d363f676251d10373

SHA512
5d0c425cbd08b65710531db03d9d6d250448ac68fc82f1c459ec9add12c757594d281da39e44069b8c56264a78a11cebd538612df8792d7a576053e571a5be9b

Download Submit
C:\Windows\SysWOW64\Mjnnbk32.exe

Filesize
81KB

MD5
55c32e581eecf98ddb7e8afae3fdc5a2

SHA1
992a280fa91ad159d01b855b197a8816630a175b

SHA256
bcb8a4c1cd5e7868c381b9516475f4e2130a683a153f24dfba51c8419fc6c302

SHA512
828800b959c99c8db007c7fad858f39b4b5e2bb7d3641ab5bf66741ccf932f3eb73b444eddfbafd2d9dbfb6c1774c55c0d7f487700b890dd2e0f02ee268efdf8

Download Submit
C:\Windows\SysWOW64\Nadleilm.exe

Filesize
81KB

MD5
134f40a2d08f272bad59d25b5ee52b4d

SHA1
2ae298faded5fddfe6f0c45b089dad0dae4852e7

SHA256
394184e5a258db40c3f7608ad6b907e82cea7d3bc3db2ac9f36f50647ea89532

SHA512
fa769111c51d0f696021f19e66fe475b025c43017ae54a0acfbc741b3a24a77c8ac7b34eff3c461a03352d9cd3ddc3a2d4ff837fa68d81a2bf68392783e7aac3

Download Submit
C:\Windows\SysWOW64\Nagiji32.exe

Filesize
81KB

MD5
bd12cbb9e7a8fb1ac3e9ce4d824659fd

SHA1
94b14295fe3a327505a29740b5a084590c79237b

SHA256
9e90a42f10022163f007f84de9f7e474cefeff6819159fd94ebfacd4edbef4be

SHA512
82c606f5069a1bced70a18d2f9b1315a87ee6efc6a583e84b9c8933afd6395f378acd066ae7ff215ab38ad63f25ba3892ac22af0b8b537051c9345213e522946

Download Submit
C:\Windows\SysWOW64\Nbebbk32.exe

Filesize
81KB

MD5
79a53e4bea7c1ecca8e3535a756fc4d7

SHA1
ed2e4859c848eadb2800b0b4bc4a6cec859c9b6b

SHA256
e41f70faf212f33e2536d15cfd834bab1bb3950d01b8ae68934ef22f7756bdab

SHA512
54d109cc430c139b9e5d9fc9fea90377ec1f433f07f9d2f3aee6fa44d5fd3f785efc41697816f7d1a84dc0bf1b073e8d65e70a1618c7c5e5b28a30c88fdba992

Download Submit
C:\Windows\SysWOW64\Ncnofeof.exe

Filesize
81KB

MD5
c3958c61b1415dec595d545c2076a93b

SHA1
4dfad8e4fa6c992535bca9dc3acc8899674475d5

SHA256
ad198572017606f546e5172cf8f71f076fcee76f8ea243a842f768a0db2f4303

SHA512
8302f0d23d62fb34f668a5a25ae86cdcc4a52df897c1bf74be94b04cd264541f9e86b0362a018f9706381265a1afadb2b9bcc6fd15873578f4aaacb7de9335d6

Download Submit
C:\Windows\SysWOW64\Nfaemp32.exe

Filesize
81KB

MD5
2b8a2fcbb338053752638b6eada11def

SHA1
8e29fcba71a27d80e4c0e7008751af3664f46f55

SHA256
2266a4761c8bf95e2f862258b37404336da9ef15eaca042764ada9298467ff79

SHA512
c9909a459d75ff3e0706ce6b2f9b59ed874a8db8c394c419c75c70df45618843b457127f389d89629cb5cdb6df577b9827e1c89cf2c18da5578a2db202ce182d

Download Submit
C:\Windows\SysWOW64\Nfldgk32.exe

Filesize
81KB

MD5
535d63bdcd7d98464a30dc5d3e0e0cbb

SHA1
bc97e0f21fc0366c561b1b594b2abe1e227a3450

SHA256
2e6e4e00f3d83ae3794a4984da57e33801ab6c50066777176d636243a61863af

SHA512
fa0bb751a088dd8f513d3df3ead17edfc7c965018439980de316750e79dc9ba9531dc7c761fe286307457f36131b3fdc96bc9c3fee01de241e674d51b6f413c5

Download Submit
C:\Windows\SysWOW64\Ngqagcag.exe

Filesize
81KB

MD5
11d73865392f1b31ec7ccbcb318a03d2

SHA1
c656049ee870b7023dcf7200e2587272224b770d

SHA256
99d3c4068b81e68db86e4fbaf1770106b2389d76ec7a8223372c057e86af55f8

SHA512
97931c025352a4dd69046448655fd618442ee4324086bae372aee09fcb4ad64f4b0e390095367af5ba631692e6bbe9c5cb5408a509c6c34ae807016967f274f2

Download Submit
C:\Windows\SysWOW64\Nimmifgo.exe

Filesize
81KB

MD5
b50a216f34382f19907caf767beb735a

SHA1
3438eb158a98c686a4286d393bc899c531ed6a02

SHA256
729f6a6d103eebfbdd42185089b949b16c28204b907981e3ef42887878b5a186

SHA512
daf574377a82a004071f6680db8cac665a6c5ac8c8dbabf1df069e6a170893bc02645673ef3254503f3de2b3b332c8f28a41914284bc9364c12bbc6c81d9e48c

Download Submit
C:\Windows\SysWOW64\Njbgmjgl.exe

Filesize
81KB

MD5
69ba48a530b4cffaab15c981ca3729a8

SHA1
e5b6a4617a3fa5ff61dbffd9ea556fa8ab3cf242

SHA256
e3102a649e85766c429cff0da205241c0965f2a1b4bfc59a73f6ba2d7cec3796

SHA512
77b92cc2fad7f3eaaa056656ed2a86f092ccd1e46cdb36cd4696cef07fff034878466ac83fda692a017e2568436ae3ad989b7a5d3bbb571eca92915940d0523d

Download Submit
C:\Windows\SysWOW64\Njjdho32.exe

Filesize
81KB

MD5
06f4e82d695ae9b1aa878dc9169c1303

SHA1
60f56dbddac0dc57d414629c63e25a2806e6ab15

SHA256
c9b49068c271ab556d1a3c66563bfcab20b4e7cd83b99790cbed67239c3b8aab

SHA512
348a70bfd9b2cde0d3256775df63ea64be4996640908be84682802b1f0680ac89f2823ab35c217b5e1456ee61400648709462684f9a850dcdaff44422dff0e4b

Download Submit
C:\Windows\SysWOW64\Nmdgikhi.exe

Filesize
81KB

MD5
bd9fbc9112e3f974ce10d8f3e4046da3

SHA1
5de7f16f30a675deeebf28e0d61db488c734d562

SHA256
3940bde37046088a51de2072abc0139c901bccc43f58b1c2a1be97bf06a80867

SHA512
c33ec14acf4cdb9b0d91382aa8927c86498e4c4ff84a48da089fa58f7b6cef042740666cf9376118d31a7d3085b405c9023fc282d14a3d0bd88d897f0cd38666

Download Submit
C:\Windows\SysWOW64\Nmfcok32.exe

Filesize
81KB

MD5
a25dada7c4c72a3268e9b8ee7c0540db

SHA1
1049674e06bcd50aca78881f6f7b445f5c599b8f

SHA256
12a813199400fedc1d1617885632e0bc3e0ac5d2bb9d5ead059d689916f49832

SHA512
661262ae3e0b84a5045bcd243786ef8d8f7348c2627fa4c37eff0c64330b0a52989f9743ea537f8a05e43df547468436ae42706a28989584d15aa85a0b70b1e0

Download Submit
C:\Windows\SysWOW64\Nqbpojnp.exe

Filesize
81KB

MD5
4e6e315e1a5f6972044c1fe747f76f2d

SHA1
ccff06f32b4ecd38072f16653261e21f5d9886f7

SHA256
2075de4dff73e3dac3f36c89bbe665fb581042129ad19922fe18c0965aa75de1

SHA512
54f9009c3855a433ee0448337e6163b9a92d61668a2e322d6973ca5dbd747d40b827673522fd0ade76b2b62e56e5a9baa5d8cb25bb0e6673bed3e1a7bcd24ed7

Download Submit
C:\Windows\SysWOW64\Oakbehfe.exe

Filesize
81KB

MD5
7d1ff47113065996c2ea92447af2a21c

SHA1
9b5838371f4ddc88e4a2661ef6d80c217aee4eb0

SHA256
a301d09b0d755b10aa45d7abe7b7ba7cb389320e4d6fef6ce3824088041723b2

SHA512
97bd387a9a8db0ce80addaf694221f8101ee5583de48a70c1fc077e7494370d8d9855760a6357b36b409469fa2fb97073fb5ef7d9b87d3f57e29bf012445ff8a

Download Submit
C:\Windows\SysWOW64\Oanokhdb.exe

Filesize
81KB

MD5
7b4d1ffb4686ea8521e8d5672e771240

SHA1
ada6c18659abcfa5b34edf7f4db029c49b71578b

SHA256
5a60bb5969f14775aa83faa8438f935852e7ea2cd8e7c5cc1ecc6afca93dffc3

SHA512
e1c557af50a164d4842a764ec04ce7430bfb080f36fecb809cc900c87fb489912e1b3bed97fae490ffcd04cc2b94874894f73e12ec0279fc2771e20f2aab69dd

Download Submit
C:\Windows\SysWOW64\Oaplqh32.exe

Filesize
81KB

MD5
45c4812cf770732ec076821ce8562eeb

SHA1
fe26509bfd91c554c25853c721fe0d7212ec8d8b

SHA256
a89f3318bbbc3b2ad39f9c8f21e443fa64336f40651908d326e50ebcc2971848

SHA512
86626caf58021301b9b6a27e5a56bc422c546ba78d68bc0f4ebc5446c60998a788784b156db3c60bb6480e1bbb067a9aa1e42ba0bdd9ece692bfdd3db7b28280

Download Submit
C:\Windows\SysWOW64\Ocaebc32.exe

Filesize
81KB

MD5
355ca58d3c91eab9bfe71efc4531a70e

SHA1
21e8e88023536a3297d34b30d752a35c6b146566

SHA256
8768fda1d8426c44b7ce9fc7a1486c0bb36341bfb00b98e2bd55e33c720e0639

SHA512
f4607dfd66528546f3a68b36dfe257d9e650140f0378db679e897e785e4f647c0a350e19f6047442e082d2c2888364810b0f94b62c1761f0b3ff82f6a0deb954

Download Submit
C:\Windows\SysWOW64\Ockdmmoj.exe

Filesize
81KB

MD5
466380899e3286514ee18d45fc33be6e

SHA1
7fa316dcc429f686bd7cefcfa3d15699c8d7d1d0

SHA256
8c727b7c537931ffc61eb3598d1dd6e6bbab9e34f83030d93b29e9f7a5373cd0

SHA512
bbadc3f1a0a3e7444deb43bcec0e333c3df08bb0075c37c30ff0a1f3135cb62d1298f7b6cb1bea03d3d5ae7f7a3ac670b0169172221378a76e13060964bd2375

Download Submit
C:\Windows\SysWOW64\Ofhknodl.exe

Filesize
81KB

MD5
401a78452fe72476e70f8981de8058b7

SHA1
9f7bd94432f270439e0f2ea56a3cca97ec3eaa09

SHA256
4d0880d55d3fc5b15850a97cc46b11cdb10fae46f6602da9a3058d67405b7973

SHA512
a84996aaba3cd68bd12db72cabc5d8894bf07c9af3183ef1e4a294d4efcbd0b438f59d30bc669d37205e3f59dbf128722168bd756b02911d8969046ecaacd861

Download Submit
C:\Windows\SysWOW64\Ogcnmc32.exe

Filesize
81KB

MD5
426a093e5f381f81577a546eb08bdb66

SHA1
c9751c87e64e7839ab8c6e9f3d61da29c542587c

SHA256
1eff3bc3aaba021cc13ab29813c10b6d94b7e701f2c31fafa2c1a3e4de2e6011

SHA512
51265057c6759c15b0680b83255eb0bb5fdf53e5f815cfe97c18f5e519650d15839d2a3a0da087ae510c815b2ba80510a780ba7bbd149534381ae4ba1f50cb30

Download Submit
C:\Windows\SysWOW64\Oghghb32.exe

Filesize
81KB

MD5
56ca3a578954357ffa52c7eea121e59e

SHA1
f9480ae46134cd7aded76677c759a3b9e9989147

SHA256
f923283825533d3dd14feb48392dd80b5b3130b1a0ec924e29cc0972ed9542f4

SHA512
0cc3a679e3dc6f272932f9dca6f655b4d818ccae002a2836c20e5e0b0ab4b933ce42a5763c94278a38788284a4a8dbc4ff62173d86ae050aa11de16b955fd684

Download Submit
C:\Windows\SysWOW64\Ojhpimhp.exe

Filesize
81KB

MD5
04f6de262cd760007f246bcfd8b4cf23

SHA1
0e2cf53d5cb5b41a2b4a9f3bf29166ef0aea611c

SHA256
06626fb6c4cff5d841de6eba0a703479fe78917a67f2d6183660ffd7ca56c369

SHA512
f6cc552c36825697e864da468fd98e313156e42c909b29c75f3ccd7f0b42e061fa3c1514076a188f25a1be3907b617f92d05881e3b2cd1605d1139f305552da6

Download Submit
C:\Windows\SysWOW64\Omnjojpo.exe

Filesize
81KB

MD5
45c6219ceee42be2b99a55ca502fbab4

SHA1
2452cacd83e46da772d02d9dd385d56cd519e5c4

SHA256
9d317429e3e21fe32552e43c876e6658f42c8ce90750a77fa8df5572512585d9

SHA512
4ec58794138cdf363c9e6f52304f38ac74ba6deb5fc7c686d66c49192badc2e3ba43c58cbf92eaeadd50a5e62684bb4deddb0d4d20e0f4b90c5d61bfe27b24a5

Download Submit
C:\Windows\SysWOW64\Onapdl32.exe

Filesize
81KB

MD5
0a36cd66cb87bb6fe112523cb8d51330

SHA1
eb848505546745179c002b897d068123c86a5bb0

SHA256
36be5d042f6483b9dfba4d329179607c31fd5e0d505acc0121d920af038a8d34

SHA512
2f21d980da2e43338e20e958b9ac1cbdf12c90de824df1d39f19e622729e9003841736977fac810ab12a521b1d9a642dd187a27927b4c52c8d72db8cb819f33f

Download Submit
C:\Windows\SysWOW64\Ondljl32.exe

Filesize
81KB

MD5
9c23d4a4f6b120038184a5346a60b6ea

SHA1
16f9ea72475c679cc0d76b48ede57df62073662c

SHA256
3aed32cf352fb7a8fb010a02dcf3cbb533b4ece54e851b6e9ef1056442f7a81a

SHA512
964d26b91e65a89cd905a03dcbd1bd8a6bfe0444a7013f69ed99a08decb8beb8878362898afadb8b130094d404e9d246e9fea300ac3536485325bec3052d9cb9

Download Submit
C:\Windows\SysWOW64\Onmfimga.exe

Filesize
81KB

MD5
54760fe608b8716fef7bb50345f4acf5

SHA1
dae48b54b35c33e03ca96fb89b8a80e8c9466c2c

SHA256
b7cbb152851bb59c3ede49272e290d18067863b19176be2e9fed2b85cfee3c70

SHA512
61ad4c7f4109434596597bb0e90e02019acf1fa827681b783305d5f90c01e44f996497d78ca76d23a91f533e15400e1da1d26bc856a6d5fda7c3c6cce47b0806

Download Submit
C:\Windows\SysWOW64\Pagbaglh.exe

Filesize
81KB

MD5
5b75377d4bf2f24a47ca0b012d7a4884

SHA1
452299fc1a552048109ad52d494748263bd11a69

SHA256
0c016657a19b33fa3936a5cb3b1da239496b9810efafb435a57c08559b97e2e1

SHA512
84abbdbfb1e9aab06fe45e564c39898a17cc20a5505e3964920261a0c9f5dee135648b66fc38172f409834ef65c29104ad12a944ef9faf377079d0bb1d7b2bdb

Download Submit
C:\Windows\SysWOW64\Paiogf32.exe

Filesize
81KB

MD5
f1e2b6898e3998e2d0182c345696c70f

SHA1
df3cce603263faabe24abe07210da7808783138d

SHA256
5f6d56d6bd5c97458cf3cf111b3ae4b734b6227f2668f79c3a2b41869404b9e0

SHA512
001f2caee571903647978e94fa635c1cd38db1f3407dabce4e5486760bfbd14cbec3ed2fcfedee3ba8eb129fc1d0c442057831ed45df524f29ce778a22aa9146

Download Submit
C:\Windows\SysWOW64\Pdhkcb32.exe

Filesize
81KB

MD5
2d25efe6576f1d2086cf73da786c0e71

SHA1
a97cee9393fea779154168f9f585e909a2d365fb

SHA256
789f9be6661a2f3aceb7a37fdca8249bf67e96bfc5536c287b4730fafe92c420

SHA512
eacdd944ffda69b157069ba90e5997359bb7e9cc3c3f1117ae3042c6947a545be807fc8187d741606ca2d260a675371db4b1c63efa2aed90c59fbe38f147b048

Download Submit
C:\Windows\SysWOW64\Pfandnla.exe

Filesize
81KB

MD5
45fe6344390cba7ceee71685dbad4d50

SHA1
d1d97bf74c44a1cce9dd45a6465256088c7d3826

SHA256
c3823e33d64781b0493ed1ed0b7708c44cced845454a4f4767c8e7ef01e21df9

SHA512
152e3f185589a183bc71c99fc371d57a83dd3d0330a694dffcd004d0f1b667730f0b709ae569547aa1537c519e817ae5b6e7732cdcbf5190bc6047f2cb00a097

Download Submit
C:\Windows\SysWOW64\Pfdjinjo.exe

Filesize
81KB

MD5
660ba372de020c253e65cbbef8d1082d

SHA1
2f1ed8e5d0ad1d25afd1f4091f69cc70caadb446

SHA256
fc18f6e323509efc5d165f6ac1892da050cb381c5e286d36609ab8dd9be28e94

SHA512
e3e9e7fcb4e2d88b6ba71b6d04a5f9f133e228a34a374ea4c5e9e028155800c2ee761e480d39f26da0e3323061babd91befe61ab3fee9679eceee87213033fe5

Download Submit
C:\Windows\SysWOW64\Pffgom32.exe

Filesize
81KB

MD5
bc7dd6a1c194b36f428f05d2f0052185

SHA1
b061a99d00e5791a9602d6b954884b3398c02d97

SHA256
4781fbc04b7528f17e938d3e6edc802edccf69cfa81d7db9065a05f129e0cfed

SHA512
dc1b2023371d9eb8c1d4a65a1d7c4c102ff605d6576eed77b2b7c7e45c17a370f01d9a07a738fb2e852a1c7345a87f29c30adf95104b559defe240573e01954f

Download Submit
C:\Windows\SysWOW64\Pfoann32.exe

Filesize
81KB

MD5
435aa7676ee5752403e8e58cfbab972a

SHA1
8884b858177403e1ee90fa45251cc8e56ea246a0

SHA256
0c9430f18e83421c6e2fbdb658feb86358a0ff044c7844a2385f27b522c4e4c8

SHA512
5559edeee0b6f766eb4d0d7e72b4953e02c96be81e4fbe61b1cfc5db19ebe80ac71de5634fd9ce789875e2d2bc084616a1259fb7cd3221149dd6d54f20d51458

Download Submit
C:\Windows\SysWOW64\Pjmjdm32.exe

Filesize
81KB

MD5
ad02ce599a9e78aeec74f0ae09b3fa3f

SHA1
e0125d6fbe46cddbdaf078574ca56c95e375bd41

SHA256
fc98a7275cdca34cc0b33e6fbad310df23b84fce0cf4d5ba4a9eaaf4c8fc007b

SHA512
dc17af21f64de9f5ccad42d96e14c3d9ba5007871af35b73f57816380f99668185accb82a22194b5c19176a81a7713645604477c3a5ef84522071af86552fc5a

Download Submit
C:\Windows\SysWOW64\Pmiikh32.exe

Filesize
81KB

MD5
897655bb1f886d1f260583e2cfcdde03

SHA1
014155abc8bf07d28438a04160a7d31e570caa8b

SHA256
5c7adb91248ddd4405962466f8f8976a96ae202d560f4277ac5c269a682a724d

SHA512
0e1661c24220196ef2e7bf582724193a1f831a2348cae97229208dcf653f873a2852ee44590892be1fb812da3ca9687f751c9f5fa1e84df5f157c1fee3fda465

Download Submit
C:\Windows\SysWOW64\Pmlfqh32.exe

Filesize
81KB

MD5
b27e56c48f3a9b9a4eda5bee9a69f096

SHA1
baf9c1f40336dfcd76721a5ccc2bdf133b010033

SHA256
f232ea8782a9eac51a86db1afe1e43edc3c8798c50faee1c7c414b484d91f8cf

SHA512
669f9d8d441803c79e35fa477be9765537cdd6d07292035060963a67ec2fc528c125d5a5b05cbc03035e5aba8ba0177387f0643c3bb6ff0ee81a07141ffa84cc

Download Submit
C:\Windows\SysWOW64\Pmmlla32.exe

Filesize
81KB

MD5
8462fbc7226dee1672ebf7b6e448040f

SHA1
ce5c49e3a534e301a36f0af579bcb4d082e48314

SHA256
e3d48fa1318b2fc8358dd577106fe54db79be88b57433e9ee364ad2cd938a8c7

SHA512
a532f11088c3c5d6eb645c7b95d15ea95fb5a502eb550f0b877a7d3eb4bddfef366c259080a2182d2865f7df9fe95b05e4c451ae74be2811dad3fdad127777fc

Download Submit
C:\Windows\SysWOW64\Ppahmb32.exe

Filesize
81KB

MD5
c13e68da67d3e8c36767096997804185

SHA1
042dc98aad6d46a5be26bbb71f69392e6356a1ca

SHA256
1d881a18e0003883750bf83e9279a05f052a584583b2001c31541e9c7234aa41

SHA512
20af118c462766f0316b7aa78c7e7ca46d3486ad1009f2c6eae3ee92aad7f665f8741348e1aaefb884020c597d284a928f48c48e18b81c0430972c5e3af68c55

Download Submit
C:\Windows\SysWOW64\Ppgegd32.exe

Filesize
81KB

MD5
35590c5924578bda438ce05448209902

SHA1
5927567a03f01b4c6f67d97e0363748a7afe5aa0

SHA256
5a92edc98f116e99512df865b345b78a015f36106c1194a649ce0293047aebdd

SHA512
c576369a2b33d9c76b96e78ff1657b58ded35c3a65830a88c95795aa833ace9a713dd7f34d077357e94f292d9dbfa2dcdab03e70c8749088f5a256ed70312ecd

Download Submit
memory/212-503-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/368-383-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/372-161-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/380-553-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/432-485-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/556-121-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/692-521-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/752-9-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/752-552-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/808-389-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/876-184-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/928-224-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/940-574-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/956-401-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1056-527-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1072-509-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1096-213-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1176-559-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1176-16-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1208-550-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1372-544-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1384-395-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1392-293-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1428-588-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1504-80-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1576-566-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1576-25-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1620-437-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1680-567-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1720-431-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1792-329-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1864-491-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1872-467-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1876-473-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2016-587-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2016-48-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2028-419-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2060-311-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2116-323-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2124-104-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2188-317-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2240-145-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2292-377-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2296-257-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2304-128-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2360-176-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2424-299-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2608-479-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2724-269-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2816-141-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2840-96-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2844-263-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2848-497-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2860-581-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2880-543-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2880-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2880-1-0x0000000000432000-0x0000000000433000-memory.dmp

Filesize
4KB

Download
memory/2884-275-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2904-305-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2908-425-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2920-353-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2980-65-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2992-287-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3132-233-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3252-347-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3484-245-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3640-152-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3644-371-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3672-56-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3672-594-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3688-249-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3896-455-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3976-560-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4128-169-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4216-515-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4244-365-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4344-449-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4352-281-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4368-341-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4464-40-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4464-580-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4528-461-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4568-205-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4592-573-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4592-33-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4664-417-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4776-411-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4840-443-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4872-192-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4964-112-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4968-222-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4984-72-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4992-533-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5076-88-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5088-335-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5104-359-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/7640-1912-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/7644-1936-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download