berbew | b1b28e9db939bccb78bbd24cbf3050431d288514f51c93671a8fac234bd17e2b

Analysis

max time kernel
91s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2024 22:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1b28e9db939bccb78bbd24cbf3050431d288514f51c93671a8fac234bd17e2bN.exe
Size

97KB
MD5

5e053bf6b1c15452605002c5414b9ff0
SHA1

d2df6db673d4490375588f2940d15d471fbaefea
SHA256

b1b28e9db939bccb78bbd24cbf3050431d288514f51c93671a8fac234bd17e2b
SHA512

914469b5d2c45ed35ff01d84958695adb84623d36188d4e8aba5c0aca8d09128f071908c5fde41ba17e148d7f8bb48492e0a3d92f61b642540f8af41312f7fc1
SSDEEP

1536:koOUZib9MFaRHvYP8Uj+X2DVh6CGI4uq98AybfB6MHgex+Plw4OovJXeYZ6:wl5xUjS5CGfuq98ltUrPlzOwJXeK6

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kglmio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ebnfbcbc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dndnpf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cgqlcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Omgmeigd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Epikpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jjlmclqa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ohfami32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gnqfcbnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ppolhcnm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dfoiaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Meiioonj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gnepna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pccahbmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oghghb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Djjebh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahdged32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hbohpn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnmmboed.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npiiffqe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpmapodj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nccokk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qmepam32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibfnqmpf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kngkqbgl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eppjfgcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ljhnlb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddgibkpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fbhpch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Njmhhefi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jebfng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kegpifod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nlmdbh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bffcpg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eofgpikj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eciplm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hmechmip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmnhcb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njmhhefi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iibccgep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpanan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lmmolepp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aafemk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fmcjpl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbpchb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mogcihaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nncccnol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cglbhhga.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Injmcmej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dijbno32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Feoodn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jlolpq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Apodoq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aopemh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nnkpnclp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qoelkp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bnhenj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lopmii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hmbfbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkfadkgf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Npiiffqe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddgibkpc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbabigfj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Meepdp32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
3856	Coknoaic.exe
4412	Dfefkkqp.exe
2128	Dmoohe32.exe
748	Dpnkdq32.exe
2644	Dblgpl32.exe
2640	Difpmfna.exe
4872	Dpphjp32.exe
3664	Dbndfl32.exe
1164	Dihlbf32.exe
4060	Dlghoa32.exe
1848	Dbqqkkbo.exe
1500	Dflmlj32.exe
3100	Dlieda32.exe
732	Dfoiaj32.exe
2244	Djjebh32.exe
3572	Dpgnjo32.exe
3420	Epikpo32.exe
368	Efccmidp.exe
4480	Ecgcfm32.exe
4708	Efepbi32.exe
2408	Emphocjj.exe
2204	Eciplm32.exe
4332	Ejchhgid.exe
2336	Eleepoob.exe
1396	Ebommi32.exe
4704	Eiieicml.exe
1596	Fcniglmb.exe
3180	Fjhacf32.exe
412	Fpejlmcf.exe
4996	Fjjnifbl.exe
332	Fpggamqc.exe
1948	Fjmkoeqi.exe
2360	Fipkjb32.exe
4016	Fbhpch32.exe
4584	Flqdlnde.exe
1812	Fffhifdk.exe
4112	Fideeaco.exe
2940	Gpnmbl32.exe
4456	Gdjibj32.exe
1564	Gjdaodja.exe
4360	Gigaka32.exe
3648	Gpqjglii.exe
5076	Gbofcghl.exe
536	Gjfnedho.exe
980	Gmdjapgb.exe
1716	Gpcfmkff.exe
4644	Gbabigfj.exe
3504	Gkhkjd32.exe
1668	Gmggfp32.exe
1328	Gpecbk32.exe
4148	Gbdoof32.exe
4980	Gingkqkd.exe
4880	Gbfldf32.exe
1604	Gkmdecbg.exe
1552	Hmlpaoaj.exe
1056	Hdehni32.exe
4700	Hkpqkcpd.exe
4284	Hlambk32.exe
812	Hkbmqb32.exe
1272	Hmpjmn32.exe
3900	Hpofii32.exe
3476	Hkdjfb32.exe
2572	Hmbfbn32.exe
3272	Hdmoohbo.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Plbfdekd.exe	Pdkoch32.exe
File created	C:\Windows\SysWOW64\Afakoidm.dll	Ioolkncg.exe
File created	C:\Windows\SysWOW64\Nceefd32.exe	Npiiffqe.exe
File created	C:\Windows\SysWOW64\Paeelgnj.exe	Pnfiplog.exe
File opened for modification	C:\Windows\SysWOW64\Adfgdpmi.exe	Amlogfel.exe
File opened for modification	C:\Windows\SysWOW64\Dfefkkqp.exe	Coknoaic.exe
File created	C:\Windows\SysWOW64\Keldkigj.dll	Ohhnbhok.exe
File created	C:\Windows\SysWOW64\Kmhjapnj.dll	Hoobdp32.exe
File created	C:\Windows\SysWOW64\Nnhmnn32.exe	Ngndaccj.exe
File opened for modification	C:\Windows\SysWOW64\Pmlfqh32.exe	Pjmjdm32.exe
File created	C:\Windows\SysWOW64\Neqhhf32.dll	Dlieda32.exe
File opened for modification	C:\Windows\SysWOW64\Adkgje32.exe	Aamknj32.exe
File opened for modification	C:\Windows\SysWOW64\Hemdlj32.exe	Hbohpn32.exe
File created	C:\Windows\SysWOW64\Adfgdpmi.exe	Amlogfel.exe
File created	C:\Windows\SysWOW64\Hojncj32.dll	Ebnfbcbc.exe
File opened for modification	C:\Windows\SysWOW64\Feoodn32.exe	Fbpchb32.exe
File created	C:\Windows\SysWOW64\Npiiffqe.exe	Nnhmnn32.exe
File created	C:\Windows\SysWOW64\Dkqaoe32.exe	Ddgibkpc.exe
File opened for modification	C:\Windows\SysWOW64\Dkqaoe32.exe	Ddgibkpc.exe
File created	C:\Windows\SysWOW64\Hkbmqb32.exe	Hlambk32.exe
File created	C:\Windows\SysWOW64\Ggpdhj32.dll	Gbchdp32.exe
File opened for modification	C:\Windows\SysWOW64\Mmkkmc32.exe	Mjmoag32.exe
File opened for modification	C:\Windows\SysWOW64\Najmjokc.exe	Nnkpnclp.exe
File created	C:\Windows\SysWOW64\Cndeii32.exe	Clchbqoo.exe
File opened for modification	C:\Windows\SysWOW64\Npbceggm.exe	Nqpcjj32.exe
File created	C:\Windows\SysWOW64\Lngqkhda.dll	Pjbcplpe.exe
File opened for modification	C:\Windows\SysWOW64\Coknoaic.exe	b1b28e9db939bccb78bbd24cbf3050431d288514f51c93671a8fac234bd17e2bN.exe
File opened for modification	C:\Windows\SysWOW64\Icdheded.exe	Iljpij32.exe
File created	C:\Windows\SysWOW64\Gcgplk32.dll	Adfgdpmi.exe
File created	C:\Windows\SysWOW64\Ennamn32.dll	Cgqlcg32.exe
File opened for modification	C:\Windows\SysWOW64\Gpqjglii.exe	Gigaka32.exe
File created	C:\Windows\SysWOW64\Konidd32.dll	Ffceip32.exe
File created	C:\Windows\SysWOW64\Lfifmo32.dll	Dbndfl32.exe
File opened for modification	C:\Windows\SysWOW64\Fjhacf32.exe	Fcniglmb.exe
File created	C:\Windows\SysWOW64\Mdgmickl.dll	Pmoiqneg.exe
File created	C:\Windows\SysWOW64\Jhpicj32.dll	Ngqagcag.exe
File created	C:\Windows\SysWOW64\Ipoopgnf.exe	Ikbfgppo.exe
File opened for modification	C:\Windows\SysWOW64\Odoogi32.exe	Omegjomb.exe
File created	C:\Windows\SysWOW64\Edqnimdf.dll	Kncaec32.exe
File opened for modification	C:\Windows\SysWOW64\Lcdciiec.exe	Lljklo32.exe
File opened for modification	C:\Windows\SysWOW64\Akkffkhk.exe	Ahmjjoig.exe
File created	C:\Windows\SysWOW64\Qlejfm32.dll	Dbqqkkbo.exe
File created	C:\Windows\SysWOW64\Nfmifiap.dll	Fligqhga.exe
File created	C:\Windows\SysWOW64\Gaakdpkj.dll	Ohfami32.exe
File opened for modification	C:\Windows\SysWOW64\Aogiap32.exe	Qhmqdemc.exe
File created	C:\Windows\SysWOW64\Jefjbddd.dll	Jmeede32.exe
File opened for modification	C:\Windows\SysWOW64\Lfjfecno.exe	Lggejg32.exe
File created	C:\Windows\SysWOW64\Kebncn32.dll	Dblgpl32.exe
File created	C:\Windows\SysWOW64\Jkgpbp32.exe	Jpaleglc.exe
File created	C:\Windows\SysWOW64\Bemqih32.exe	Bnfihkqm.exe
File created	C:\Windows\SysWOW64\Ilmifh32.dll	Efpomccg.exe
File opened for modification	C:\Windows\SysWOW64\Joahqn32.exe	Ilcldb32.exe
File opened for modification	C:\Windows\SysWOW64\Jljbeali.exe	Jilfifme.exe
File created	C:\Windows\SysWOW64\Fopjdidn.dll	Monjjgkb.exe
File opened for modification	C:\Windows\SysWOW64\Nopfpgip.exe	Nmbjcljl.exe
File created	C:\Windows\SysWOW64\Oeddnh32.dll	Gjfnedho.exe
File created	C:\Windows\SysWOW64\Danihi32.dll	Aogiap32.exe
File opened for modification	C:\Windows\SysWOW64\Pnfiplog.exe	Pfoann32.exe
File created	C:\Windows\SysWOW64\Dahmfpap.exe	Dkndie32.exe
File opened for modification	C:\Windows\SysWOW64\Jnlbojee.exe	Jgbjbp32.exe
File created	C:\Windows\SysWOW64\Plmmif32.exe	Pecellgl.exe
File created	C:\Windows\SysWOW64\Gnepna32.exe	Gihgfk32.exe
File created	C:\Windows\SysWOW64\Mhegobpi.dll	Ilqoobdd.exe
File created	C:\Windows\SysWOW64\Dnbjkgmg.dll	Jcanll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
11572	11456	WerFault.exe	584

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcfggkac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qaqegecm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahdpjn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddgplado.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fpimlfke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bojomm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpoalo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppolhcnm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnlhncgi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hgmgqc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjmoag32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chiigadc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kcidmkpq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apaadpng.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkbmqb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lkalplel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddgibkpc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Feoodn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mfnoqc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljqhkckn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmeigg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adkgje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bebjdgmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hfcnpn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mfeeabda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adfgdpmi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Meiioonj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Alnfpcag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmgabcge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bklfgo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dijbno32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jocefm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjodla32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Icdheded.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kjmfjj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pkbjjbda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qdoacabq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gidnkkpc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hlepcdoa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adcjop32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldipha32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akepfpcl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdojjo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlcalieg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mnmmboed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gmafajfi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gmfplibd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibfnqmpf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhhiemoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkndie32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbfldf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chnbbqpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gmdjapgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Paelfmaf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Efepbi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpdgqmnb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kcmmhj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjbcplpe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocaebc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amqhbe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qdphngfl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckhecmcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkfadkgf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kofkbk32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnoimo32.dll"	Fpggamqc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dcdcmh32.dll"	Gpnmbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pgfcalbj.dll"	Qhmqdemc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Holfoqcm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eemnff32.dll"	Jebfng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cpdgqmnb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fjmkoeqi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gnqfcbnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cocjiehd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mfnoqc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjlfmfbi.dll"	Cdmfllhn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Emphocjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfojjf32.dll"	Jpdhkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jnjejjgh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mccfdmmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egljbmnm.dll"	Dnbakghm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kjjbjd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ackhdo32.dll"	Gbdoof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cqglioac.dll"	Nnbnhedj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aqhblk32.dll"	Plkpcfal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cgqlcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hkpqkcpd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nnkpnclp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pqhfnd32.dll"	Hemdlj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ieidhh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cpmapodj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okehmlqi.dll"	Mmpmnl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enjgeopm.dll"	Npepkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdijliok.dll"	Bnhenj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bohbhmfm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ciggeb32.dll"	Bffcpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cbbnpg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ffceip32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mfnoqc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Opcefi32.dll"	Ogekbb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Difpmfna.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jpdhkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihbjebjh.dll"	Phigif32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cfipef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kioghlbd.dll"	Qacameaj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Amjbbfgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gmafajfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jjpode32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Efccmidp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gigaka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mccfdmmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mmnhcb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Okkdic32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Plmmif32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kfpcoefj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mnmmboed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dahmfpap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gkhkjd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pmoiqneg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffchaq32.dll"	Aamknj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmgagk32.dll"	Mmfkhmdi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nmbjcljl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gelfeh32.dll"	Dafppp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cocjiehd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bchign32.dll"	Lmdemd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Efblbbqd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ebnfbcbc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gmfplibd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fopjdidn.dll"	Monjjgkb.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 3856	1940	b1b28e9db939bccb78bbd24cbf3050431d288514f51c93671a8fac234bd17e2bN.exe	85
PID 1940 wrote to memory of 3856	1940	b1b28e9db939bccb78bbd24cbf3050431d288514f51c93671a8fac234bd17e2bN.exe	85
PID 1940 wrote to memory of 3856	1940	b1b28e9db939bccb78bbd24cbf3050431d288514f51c93671a8fac234bd17e2bN.exe	85
PID 3856 wrote to memory of 4412	3856	Coknoaic.exe	86
PID 3856 wrote to memory of 4412	3856	Coknoaic.exe	86
PID 3856 wrote to memory of 4412	3856	Coknoaic.exe	86
PID 4412 wrote to memory of 2128	4412	Dfefkkqp.exe	87
PID 4412 wrote to memory of 2128	4412	Dfefkkqp.exe	87
PID 4412 wrote to memory of 2128	4412	Dfefkkqp.exe	87
PID 2128 wrote to memory of 748	2128	Dmoohe32.exe	88
PID 2128 wrote to memory of 748	2128	Dmoohe32.exe	88
PID 2128 wrote to memory of 748	2128	Dmoohe32.exe	88
PID 748 wrote to memory of 2644	748	Dpnkdq32.exe	89
PID 748 wrote to memory of 2644	748	Dpnkdq32.exe	89
PID 748 wrote to memory of 2644	748	Dpnkdq32.exe	89
PID 2644 wrote to memory of 2640	2644	Dblgpl32.exe	90
PID 2644 wrote to memory of 2640	2644	Dblgpl32.exe	90
PID 2644 wrote to memory of 2640	2644	Dblgpl32.exe	90
PID 2640 wrote to memory of 4872	2640	Difpmfna.exe	91
PID 2640 wrote to memory of 4872	2640	Difpmfna.exe	91
PID 2640 wrote to memory of 4872	2640	Difpmfna.exe	91
PID 4872 wrote to memory of 3664	4872	Dpphjp32.exe	92
PID 4872 wrote to memory of 3664	4872	Dpphjp32.exe	92
PID 4872 wrote to memory of 3664	4872	Dpphjp32.exe	92
PID 3664 wrote to memory of 1164	3664	Dbndfl32.exe	93
PID 3664 wrote to memory of 1164	3664	Dbndfl32.exe	93
PID 3664 wrote to memory of 1164	3664	Dbndfl32.exe	93
PID 1164 wrote to memory of 4060	1164	Dihlbf32.exe	94
PID 1164 wrote to memory of 4060	1164	Dihlbf32.exe	94
PID 1164 wrote to memory of 4060	1164	Dihlbf32.exe	94
PID 4060 wrote to memory of 1848	4060	Dlghoa32.exe	95
PID 4060 wrote to memory of 1848	4060	Dlghoa32.exe	95
PID 4060 wrote to memory of 1848	4060	Dlghoa32.exe	95
PID 1848 wrote to memory of 1500	1848	Dbqqkkbo.exe	96
PID 1848 wrote to memory of 1500	1848	Dbqqkkbo.exe	96
PID 1848 wrote to memory of 1500	1848	Dbqqkkbo.exe	96
PID 1500 wrote to memory of 3100	1500	Dflmlj32.exe	97
PID 1500 wrote to memory of 3100	1500	Dflmlj32.exe	97
PID 1500 wrote to memory of 3100	1500	Dflmlj32.exe	97
PID 3100 wrote to memory of 732	3100	Dlieda32.exe	98
PID 3100 wrote to memory of 732	3100	Dlieda32.exe	98
PID 3100 wrote to memory of 732	3100	Dlieda32.exe	98
PID 732 wrote to memory of 2244	732	Dfoiaj32.exe	99
PID 732 wrote to memory of 2244	732	Dfoiaj32.exe	99
PID 732 wrote to memory of 2244	732	Dfoiaj32.exe	99
PID 2244 wrote to memory of 3572	2244	Djjebh32.exe	100
PID 2244 wrote to memory of 3572	2244	Djjebh32.exe	100
PID 2244 wrote to memory of 3572	2244	Djjebh32.exe	100
PID 3572 wrote to memory of 3420	3572	Dpgnjo32.exe	101
PID 3572 wrote to memory of 3420	3572	Dpgnjo32.exe	101
PID 3572 wrote to memory of 3420	3572	Dpgnjo32.exe	101
PID 3420 wrote to memory of 368	3420	Epikpo32.exe	102
PID 3420 wrote to memory of 368	3420	Epikpo32.exe	102
PID 3420 wrote to memory of 368	3420	Epikpo32.exe	102
PID 368 wrote to memory of 4480	368	Efccmidp.exe	103
PID 368 wrote to memory of 4480	368	Efccmidp.exe	103
PID 368 wrote to memory of 4480	368	Efccmidp.exe	103
PID 4480 wrote to memory of 4708	4480	Ecgcfm32.exe	104
PID 4480 wrote to memory of 4708	4480	Ecgcfm32.exe	104
PID 4480 wrote to memory of 4708	4480	Ecgcfm32.exe	104
PID 4708 wrote to memory of 2408	4708	Efepbi32.exe	105
PID 4708 wrote to memory of 2408	4708	Efepbi32.exe	105
PID 4708 wrote to memory of 2408	4708	Efepbi32.exe	105
PID 2408 wrote to memory of 2204	2408	Emphocjj.exe	106

C:\Users\Admin\AppData\Local\Temp\b1b28e9db939bccb78bbd24cbf3050431d288514f51c93671a8fac234bd17e2bN.exe
"C:\Users\Admin\AppData\Local\Temp\b1b28e9db939bccb78bbd24cbf3050431d288514f51c93671a8fac234bd17e2bN.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\Coknoaic.exe
  C:\Windows\system32\Coknoaic.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3856
- - C:\Windows\SysWOW64\Dfefkkqp.exe
    C:\Windows\system32\Dfefkkqp.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4412
  - - C:\Windows\SysWOW64\Dmoohe32.exe
      C:\Windows\system32\Dmoohe32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2128
    - - C:\Windows\SysWOW64\Dpnkdq32.exe
        
        C:\Windows\system32\Dpnkdq32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:748
      - C:\Windows\SysWOW64\Dblgpl32.exe
        
        C:\Windows\system32\Dblgpl32.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2644
        
        C:\Windows\SysWOW64\Difpmfna.exe
        
        C:\Windows\system32\Difpmfna.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2640
        
        C:\Windows\SysWOW64\Dpphjp32.exe
        
        C:\Windows\system32\Dpphjp32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4872
        
        C:\Windows\SysWOW64\Dbndfl32.exe
        
        C:\Windows\system32\Dbndfl32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3664
        
        C:\Windows\SysWOW64\Dihlbf32.exe
        
        C:\Windows\system32\Dihlbf32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1164
        
        C:\Windows\SysWOW64\Dlghoa32.exe
        
        C:\Windows\system32\Dlghoa32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4060
        
        C:\Windows\SysWOW64\Dbqqkkbo.exe
        
        C:\Windows\system32\Dbqqkkbo.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1848
        
        C:\Windows\SysWOW64\Dflmlj32.exe
        
        C:\Windows\system32\Dflmlj32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1500
        
        C:\Windows\SysWOW64\Dlieda32.exe
        
        C:\Windows\system32\Dlieda32.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3100
        
        C:\Windows\SysWOW64\Dfoiaj32.exe
        
        C:\Windows\system32\Dfoiaj32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:732
        
        C:\Windows\SysWOW64\Djjebh32.exe
        
        C:\Windows\system32\Djjebh32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2244
        
        C:\Windows\SysWOW64\Dpgnjo32.exe
        
        C:\Windows\system32\Dpgnjo32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3572
        
        C:\Windows\SysWOW64\Epikpo32.exe
        
        C:\Windows\system32\Epikpo32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3420
        
        C:\Windows\SysWOW64\Efccmidp.exe
        
        C:\Windows\system32\Efccmidp.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:368
        
        C:\Windows\SysWOW64\Ecgcfm32.exe
        
        C:\Windows\system32\Ecgcfm32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4480
        
        C:\Windows\SysWOW64\Efepbi32.exe
        
        C:\Windows\system32\Efepbi32.exe
        21⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4708
        
        C:\Windows\SysWOW64\Emphocjj.exe
        
        C:\Windows\system32\Emphocjj.exe
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2408
        
        C:\Windows\SysWOW64\Eciplm32.exe
        
        C:\Windows\system32\Eciplm32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2204
        
        C:\Windows\SysWOW64\Ejchhgid.exe
        
        C:\Windows\system32\Ejchhgid.exe
        24⤵
        Executes dropped EXE
        
        PID:4332
        
        C:\Windows\SysWOW64\Eleepoob.exe
        
        C:\Windows\system32\Eleepoob.exe
        25⤵
        Executes dropped EXE
        
        PID:2336
        
        C:\Windows\SysWOW64\Ebommi32.exe
        
        C:\Windows\system32\Ebommi32.exe
        26⤵
        Executes dropped EXE
        
        PID:1396
        
        C:\Windows\SysWOW64\Eiieicml.exe
        
        C:\Windows\system32\Eiieicml.exe
        27⤵
        Executes dropped EXE
        
        PID:4704
        
        C:\Windows\SysWOW64\Fcniglmb.exe
        
        C:\Windows\system32\Fcniglmb.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1596
        
        C:\Windows\SysWOW64\Fjhacf32.exe
        
        C:\Windows\system32\Fjhacf32.exe
        29⤵
        Executes dropped EXE
        
        PID:3180
        
        C:\Windows\SysWOW64\Fpejlmcf.exe
        
        C:\Windows\system32\Fpejlmcf.exe
        30⤵
        Executes dropped EXE
        
        PID:412
        
        C:\Windows\SysWOW64\Fjjnifbl.exe
        
        C:\Windows\system32\Fjjnifbl.exe
        31⤵
        Executes dropped EXE
        
        PID:4996
        
        C:\Windows\SysWOW64\Fpggamqc.exe
        
        C:\Windows\system32\Fpggamqc.exe
        32⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:332
        
        C:\Windows\SysWOW64\Fjmkoeqi.exe
        
        C:\Windows\system32\Fjmkoeqi.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1948
        
        C:\Windows\SysWOW64\Fipkjb32.exe
        
        C:\Windows\system32\Fipkjb32.exe
        34⤵
        Executes dropped EXE
        
        PID:2360
        
        C:\Windows\SysWOW64\Fbhpch32.exe
        
        C:\Windows\system32\Fbhpch32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4016
        
        C:\Windows\SysWOW64\Flqdlnde.exe
        
        C:\Windows\system32\Flqdlnde.exe
        36⤵
        Executes dropped EXE
        
        PID:4584
        
        C:\Windows\SysWOW64\Fffhifdk.exe
        
        C:\Windows\system32\Fffhifdk.exe
        37⤵
        Executes dropped EXE
        
        PID:1812
        
        C:\Windows\SysWOW64\Fideeaco.exe
        
        C:\Windows\system32\Fideeaco.exe
        38⤵
        Executes dropped EXE
        
        PID:4112
        
        C:\Windows\SysWOW64\Gpnmbl32.exe
        
        C:\Windows\system32\Gpnmbl32.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2940
        
        C:\Windows\SysWOW64\Gdjibj32.exe
        
        C:\Windows\system32\Gdjibj32.exe
        40⤵
        Executes dropped EXE
        
        PID:4456
        
        C:\Windows\SysWOW64\Gjdaodja.exe
        
        C:\Windows\system32\Gjdaodja.exe
        41⤵
        Executes dropped EXE
        
        PID:1564
        
        C:\Windows\SysWOW64\Gigaka32.exe
        
        C:\Windows\system32\Gigaka32.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4360
        
        C:\Windows\SysWOW64\Gpqjglii.exe
        
        C:\Windows\system32\Gpqjglii.exe
        43⤵
        Executes dropped EXE
        
        PID:3648
        
        C:\Windows\SysWOW64\Gbofcghl.exe
        
        C:\Windows\system32\Gbofcghl.exe
        44⤵
        Executes dropped EXE
        
        PID:5076
        
        C:\Windows\SysWOW64\Gjfnedho.exe
        
        C:\Windows\system32\Gjfnedho.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:536
        
        C:\Windows\SysWOW64\Gmdjapgb.exe
        
        C:\Windows\system32\Gmdjapgb.exe
        46⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:980
        
        C:\Windows\SysWOW64\Gpcfmkff.exe
        
        C:\Windows\system32\Gpcfmkff.exe
        47⤵
        Executes dropped EXE
        
        PID:1716
        
        C:\Windows\SysWOW64\Gbabigfj.exe
        
        C:\Windows\system32\Gbabigfj.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4644
        
        C:\Windows\SysWOW64\Gkhkjd32.exe
        
        C:\Windows\system32\Gkhkjd32.exe
        49⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3504
        
        C:\Windows\SysWOW64\Gmggfp32.exe
        
        C:\Windows\system32\Gmggfp32.exe
        50⤵
        Executes dropped EXE
        
        PID:1668
        
        C:\Windows\SysWOW64\Gpecbk32.exe
        
        C:\Windows\system32\Gpecbk32.exe
        51⤵
        Executes dropped EXE
        
        PID:1328
        
        C:\Windows\SysWOW64\Gbdoof32.exe
        
        C:\Windows\system32\Gbdoof32.exe
        52⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4148
        
        C:\Windows\SysWOW64\Gingkqkd.exe
        
        C:\Windows\system32\Gingkqkd.exe
        53⤵
        Executes dropped EXE
        
        PID:4980
        
        C:\Windows\SysWOW64\Gbfldf32.exe
        
        C:\Windows\system32\Gbfldf32.exe
        54⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4880
        
        C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        55⤵
        Executes dropped EXE
        
        PID:1604
        
        C:\Windows\SysWOW64\Hmlpaoaj.exe
        
        C:\Windows\system32\Hmlpaoaj.exe
        56⤵
        Executes dropped EXE
        
        PID:1552
        
        C:\Windows\SysWOW64\Hdehni32.exe
        
        C:\Windows\system32\Hdehni32.exe
        57⤵
        Executes dropped EXE
        
        PID:1056
        
        C:\Windows\SysWOW64\Hkpqkcpd.exe
        
        C:\Windows\system32\Hkpqkcpd.exe
        58⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4700
        
        C:\Windows\SysWOW64\Hlambk32.exe
        
        C:\Windows\system32\Hlambk32.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4284
        
        C:\Windows\SysWOW64\Hkbmqb32.exe
        
        C:\Windows\system32\Hkbmqb32.exe
        60⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:812
        
        C:\Windows\SysWOW64\Hmpjmn32.exe
        
        C:\Windows\system32\Hmpjmn32.exe
        61⤵
        Executes dropped EXE
        
        PID:1272
        
        C:\Windows\SysWOW64\Hpofii32.exe
        
        C:\Windows\system32\Hpofii32.exe
        62⤵
        Executes dropped EXE
        
        PID:3900
        
        C:\Windows\SysWOW64\Hkdjfb32.exe
        
        C:\Windows\system32\Hkdjfb32.exe
        63⤵
        Executes dropped EXE
        
        PID:3476
        
        C:\Windows\SysWOW64\Hmbfbn32.exe
        
        C:\Windows\system32\Hmbfbn32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2572
        
        C:\Windows\SysWOW64\Hdmoohbo.exe
        
        C:\Windows\system32\Hdmoohbo.exe
        65⤵
        Executes dropped EXE
        
        PID:3272
        
        C:\Windows\SysWOW64\Hkfglb32.exe
        
        C:\Windows\system32\Hkfglb32.exe
        66⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\Hmechmip.exe
        
        C:\Windows\system32\Hmechmip.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2416
        
        C:\Windows\SysWOW64\Hpcodihc.exe
        
        C:\Windows\system32\Hpcodihc.exe
        68⤵
        
        PID:2400
        
        C:\Windows\SysWOW64\Hgmgqc32.exe
        
        C:\Windows\system32\Hgmgqc32.exe
        69⤵
        System Location Discovery: System Language Discovery
        
        PID:4352
        
        C:\Windows\SysWOW64\Iljpij32.exe
        
        C:\Windows\system32\Iljpij32.exe
        70⤵
        Drops file in System32 directory
        
        PID:1828
        
        C:\Windows\SysWOW64\Icdheded.exe
        
        C:\Windows\system32\Icdheded.exe
        71⤵
        System Location Discovery: System Language Discovery
        
        PID:2568
        
        C:\Windows\SysWOW64\Ikkpgafg.exe
        
        C:\Windows\system32\Ikkpgafg.exe
        72⤵
        
        PID:2092
        
        C:\Windows\SysWOW64\Injmcmej.exe
        
        C:\Windows\system32\Injmcmej.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4144
        
        C:\Windows\SysWOW64\Icfekc32.exe
        
        C:\Windows\system32\Icfekc32.exe
        74⤵
        
        PID:4720
        
        C:\Windows\SysWOW64\Inlihl32.exe
        
        C:\Windows\system32\Inlihl32.exe
        75⤵
        
        PID:3640
        
        C:\Windows\SysWOW64\Ikpjbq32.exe
        
        C:\Windows\system32\Ikpjbq32.exe
        76⤵
        
        PID:4788
        
        C:\Windows\SysWOW64\Innfnl32.exe
        
        C:\Windows\system32\Innfnl32.exe
        77⤵
        
        PID:4308
        
        C:\Windows\SysWOW64\Ikbfgppo.exe
        
        C:\Windows\system32\Ikbfgppo.exe
        78⤵
        Drops file in System32 directory
        
        PID:2952
        
        C:\Windows\SysWOW64\Ipoopgnf.exe
        
        C:\Windows\system32\Ipoopgnf.exe
        79⤵
        
        PID:3668
        
        C:\Windows\SysWOW64\Igigla32.exe
        
        C:\Windows\system32\Igigla32.exe
        80⤵
        
        PID:2884
        
        C:\Windows\SysWOW64\Jjgchm32.exe
        
        C:\Windows\system32\Jjgchm32.exe
        81⤵
        
        PID:3564
        
        C:\Windows\SysWOW64\Jpaleglc.exe
        
        C:\Windows\system32\Jpaleglc.exe
        82⤵
        Drops file in System32 directory
        
        PID:3524
        
        C:\Windows\SysWOW64\Jkgpbp32.exe
        
        C:\Windows\system32\Jkgpbp32.exe
        83⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\Jpdhkf32.exe
        
        C:\Windows\system32\Jpdhkf32.exe
        84⤵
        Modifies registry class
        
        PID:4272
        
        C:\Windows\SysWOW64\Jjlmclqa.exe
        
        C:\Windows\system32\Jjlmclqa.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4740
        
        C:\Windows\SysWOW64\Jpfepf32.exe
        
        C:\Windows\system32\Jpfepf32.exe
        86⤵
        
        PID:4552
        
        C:\Windows\SysWOW64\Jklinohd.exe
        
        C:\Windows\system32\Jklinohd.exe
        87⤵
        
        PID:1292
        
        C:\Windows\SysWOW64\Jnjejjgh.exe
        
        C:\Windows\system32\Jnjejjgh.exe
        88⤵
        Modifies registry class
        
        PID:4632
        
        C:\Windows\SysWOW64\Jgbjbp32.exe
        
        C:\Windows\system32\Jgbjbp32.exe
        89⤵
        Drops file in System32 directory
        
        PID:1004
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        90⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\Jqknkedi.exe
        
        C:\Windows\system32\Jqknkedi.exe
        91⤵
        
        PID:2000
        
        C:\Windows\SysWOW64\Jcikgacl.exe
        
        C:\Windows\system32\Jcikgacl.exe
        92⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\Kjccdkki.exe
        
        C:\Windows\system32\Kjccdkki.exe
        93⤵
        
        PID:2448
        
        C:\Windows\SysWOW64\Kmaopfjm.exe
        
        C:\Windows\system32\Kmaopfjm.exe
        94⤵
        
        PID:712
        
        C:\Windows\SysWOW64\Kclgmq32.exe
        
        C:\Windows\system32\Kclgmq32.exe
        95⤵
        
        PID:1752
        
        C:\Windows\SysWOW64\Knalji32.exe
        
        C:\Windows\system32\Knalji32.exe
        96⤵
        
        PID:4000
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        97⤵
        
        PID:4864
        
        C:\Windows\SysWOW64\Kkeldnpi.exe
        
        C:\Windows\system32\Kkeldnpi.exe
        98⤵
        
        PID:836
        
        C:\Windows\SysWOW64\Kqbdldnq.exe
        
        C:\Windows\system32\Kqbdldnq.exe
        99⤵
        
        PID:2512
        
        C:\Windows\SysWOW64\Kglmio32.exe
        
        C:\Windows\system32\Kglmio32.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2428
        
        C:\Windows\SysWOW64\Kqdaadln.exe
        
        C:\Windows\system32\Kqdaadln.exe
        101⤵
        
        PID:3580
        
        C:\Windows\SysWOW64\Kjmfjj32.exe
        
        C:\Windows\system32\Kjmfjj32.exe
        102⤵
        System Location Discovery: System Language Discovery
        
        PID:2388
        
        C:\Windows\SysWOW64\Kqfngd32.exe
        
        C:\Windows\system32\Kqfngd32.exe
        103⤵
        
        PID:3512
        
        C:\Windows\SysWOW64\Lgqfdnah.exe
        
        C:\Windows\system32\Lgqfdnah.exe
        104⤵
        
        PID:2456
        
        C:\Windows\SysWOW64\Ljobpiql.exe
        
        C:\Windows\system32\Ljobpiql.exe
        105⤵
        
        PID:316
        
        C:\Windows\SysWOW64\Lmmolepp.exe
        
        C:\Windows\system32\Lmmolepp.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2996
        
        C:\Windows\SysWOW64\Lqikmc32.exe
        
        C:\Windows\system32\Lqikmc32.exe
        107⤵
        
        PID:5056
        
        C:\Windows\SysWOW64\Lknojl32.exe
        
        C:\Windows\system32\Lknojl32.exe
        108⤵
        
        PID:2108
        
        C:\Windows\SysWOW64\Lnmkfh32.exe
        
        C:\Windows\system32\Lnmkfh32.exe
        109⤵
        
        PID:3892
        
        C:\Windows\SysWOW64\Ldgccb32.exe
        
        C:\Windows\system32\Ldgccb32.exe
        110⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\Lkalplel.exe
        
        C:\Windows\system32\Lkalplel.exe
        111⤵
        System Location Discovery: System Language Discovery
        
        PID:1776
        
        C:\Windows\SysWOW64\Ljclki32.exe
        
        C:\Windows\system32\Ljclki32.exe
        112⤵
        
        PID:4344
        
        C:\Windows\SysWOW64\Lqndhcdc.exe
        
        C:\Windows\system32\Lqndhcdc.exe
        113⤵
        
        PID:2612
        
        C:\Windows\SysWOW64\Ldipha32.exe
        
        C:\Windows\system32\Ldipha32.exe
        114⤵
        System Location Discovery: System Language Discovery
        
        PID:1488
        
        C:\Windows\SysWOW64\Ljfhqh32.exe
        
        C:\Windows\system32\Ljfhqh32.exe
        115⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\Lmdemd32.exe
        
        C:\Windows\system32\Lmdemd32.exe
        116⤵
        Modifies registry class
        
        PID:2844
        
        C:\Windows\SysWOW64\Lcnmin32.exe
        
        C:\Windows\system32\Lcnmin32.exe
        117⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Lgjijmin.exe
        
        C:\Windows\system32\Lgjijmin.exe
        118⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Lmgabcge.exe
        
        C:\Windows\system32\Lmgabcge.exe
        119⤵
        System Location Discovery: System Language Discovery
        
        PID:5240
        
        C:\Windows\SysWOW64\Mcqjon32.exe
        
        C:\Windows\system32\Mcqjon32.exe
        120⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Mglfplgk.exe
        
        C:\Windows\system32\Mglfplgk.exe
        121⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Mnfnlf32.exe
        
        C:\Windows\system32\Mnfnlf32.exe
        122⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Mccfdmmo.exe
        
        C:\Windows\system32\Mccfdmmo.exe
        123⤵
        Modifies registry class
        
        PID:5416
        
        C:\Windows\SysWOW64\Mjmoag32.exe
        
        C:\Windows\system32\Mjmoag32.exe
        124⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5460
        
        C:\Windows\SysWOW64\Mmkkmc32.exe
        
        C:\Windows\system32\Mmkkmc32.exe
        125⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Mcecjmkl.exe
        
        C:\Windows\system32\Mcecjmkl.exe
        126⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Mkmkkjko.exe
        
        C:\Windows\system32\Mkmkkjko.exe
        127⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Mmnhcb32.exe
        
        C:\Windows\system32\Mmnhcb32.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5632
        
        C:\Windows\SysWOW64\Meepdp32.exe
        
        C:\Windows\system32\Meepdp32.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5676
        
        C:\Windows\SysWOW64\Mgclpkac.exe
        
        C:\Windows\system32\Mgclpkac.exe
        130⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Mnmdme32.exe
        
        C:\Windows\system32\Mnmdme32.exe
        131⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Megljppl.exe
        
        C:\Windows\system32\Megljppl.exe
        132⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Mcjmel32.exe
        
        C:\Windows\system32\Mcjmel32.exe
        133⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Mkadfj32.exe
        
        C:\Windows\system32\Mkadfj32.exe
        134⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Mmbanbmg.exe
        
        C:\Windows\system32\Mmbanbmg.exe
        135⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Meiioonj.exe
        
        C:\Windows\system32\Meiioonj.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5984
        
        C:\Windows\SysWOW64\Nlcalieg.exe
        
        C:\Windows\system32\Nlcalieg.exe
        137⤵
        System Location Discovery: System Language Discovery
        
        PID:6028
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        138⤵
        Modifies registry class
        
        PID:6072
        
        C:\Windows\SysWOW64\Napjdpcn.exe
        
        C:\Windows\system32\Napjdpcn.exe
        139⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Ngjbaj32.exe
        
        C:\Windows\system32\Ngjbaj32.exe
        140⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Nndjndbh.exe
        
        C:\Windows\system32\Nndjndbh.exe
        141⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Nabfjpak.exe
        
        C:\Windows\system32\Nabfjpak.exe
        142⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Nhmofj32.exe
        
        C:\Windows\system32\Nhmofj32.exe
        143⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Nlhkgi32.exe
        
        C:\Windows\system32\Nlhkgi32.exe
        144⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Nmigoagp.exe
        
        C:\Windows\system32\Nmigoagp.exe
        145⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Nccokk32.exe
        
        C:\Windows\system32\Nccokk32.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5572
        
        C:\Windows\SysWOW64\Njmhhefi.exe
        
        C:\Windows\system32\Njmhhefi.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5640
        
        C:\Windows\SysWOW64\Nmlddqem.exe
        
        C:\Windows\system32\Nmlddqem.exe
        148⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Ndflak32.exe
        
        C:\Windows\system32\Ndflak32.exe
        149⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Nlmdbh32.exe
        
        C:\Windows\system32\Nlmdbh32.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5836
        
        C:\Windows\SysWOW64\Nnkpnclp.exe
        
        C:\Windows\system32\Nnkpnclp.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5916
        
        C:\Windows\SysWOW64\Najmjokc.exe
        
        C:\Windows\system32\Najmjokc.exe
        152⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Ohcegi32.exe
        
        C:\Windows\system32\Ohcegi32.exe
        153⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Ojbacd32.exe
        
        C:\Windows\system32\Ojbacd32.exe
        154⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Oalipoiq.exe
        
        C:\Windows\system32\Oalipoiq.exe
        155⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Ohfami32.exe
        
        C:\Windows\system32\Ohfami32.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5304
        
        C:\Windows\SysWOW64\Ojdnid32.exe
        
        C:\Windows\system32\Ojdnid32.exe
        157⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Oanfen32.exe
        
        C:\Windows\system32\Oanfen32.exe
        158⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Ohhnbhok.exe
        
        C:\Windows\system32\Ohhnbhok.exe
        159⤵
        Drops file in System32 directory
        
        PID:5648
        
        C:\Windows\SysWOW64\Ojgjndno.exe
        
        C:\Windows\system32\Ojgjndno.exe
        160⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Omegjomb.exe
        
        C:\Windows\system32\Omegjomb.exe
        161⤵
        Drops file in System32 directory
        
        PID:5864
        
        C:\Windows\SysWOW64\Odoogi32.exe
        
        C:\Windows\system32\Odoogi32.exe
        162⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Ohkkhhmh.exe
        
        C:\Windows\system32\Ohkkhhmh.exe
        163⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Oodcdb32.exe
        
        C:\Windows\system32\Oodcdb32.exe
        164⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Oeokal32.exe
        
        C:\Windows\system32\Oeokal32.exe
        165⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Olicnfco.exe
        
        C:\Windows\system32\Olicnfco.exe
        166⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Okkdic32.exe
        
        C:\Windows\system32\Okkdic32.exe
        167⤵
        Modifies registry class
        
        PID:5684
        
        C:\Windows\SysWOW64\Paelfmaf.exe
        
        C:\Windows\system32\Paelfmaf.exe
        168⤵
        System Location Discovery: System Language Discovery
        
        PID:5840
        
        C:\Windows\SysWOW64\Phodcg32.exe
        
        C:\Windows\system32\Phodcg32.exe
        169⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Plkpcfal.exe
        
        C:\Windows\system32\Plkpcfal.exe
        170⤵
        Modifies registry class
        
        PID:5208
        
        C:\Windows\SysWOW64\Pmlmkn32.exe
        
        C:\Windows\system32\Pmlmkn32.exe
        171⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Pecellgl.exe
        
        C:\Windows\system32\Pecellgl.exe
        172⤵
        Drops file in System32 directory
        
        PID:5712
        
        C:\Windows\SysWOW64\Plmmif32.exe
        
        C:\Windows\system32\Plmmif32.exe
        173⤵
        Modifies registry class
        
        PID:6004
        
        C:\Windows\SysWOW64\Pmoiqneg.exe
        
        C:\Windows\system32\Pmoiqneg.exe
        174⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5272
        
        C:\Windows\SysWOW64\Pefabkej.exe
        
        C:\Windows\system32\Pefabkej.exe
        175⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Phdnngdn.exe
        
        C:\Windows\system32\Phdnngdn.exe
        176⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Pkbjjbda.exe
        
        C:\Windows\system32\Pkbjjbda.exe
        177⤵
        System Location Discovery: System Language Discovery
        
        PID:5932
        
        C:\Windows\SysWOW64\Palbgl32.exe
        
        C:\Windows\system32\Palbgl32.exe
        178⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Pdkoch32.exe
        
        C:\Windows\system32\Pdkoch32.exe
        179⤵
        Drops file in System32 directory
        
        PID:6148
        
        C:\Windows\SysWOW64\Plbfdekd.exe
        
        C:\Windows\system32\Plbfdekd.exe
        180⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Pmcclm32.exe
        
        C:\Windows\system32\Pmcclm32.exe
        181⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Pdmkhgho.exe
        
        C:\Windows\system32\Pdmkhgho.exe
        182⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Phigif32.exe
        
        C:\Windows\system32\Phigif32.exe
        183⤵
        Modifies registry class
        
        PID:6336
        
        C:\Windows\SysWOW64\Pldcjeia.exe
        
        C:\Windows\system32\Pldcjeia.exe
        184⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Qmepam32.exe
        
        C:\Windows\system32\Qmepam32.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6424
        
        C:\Windows\SysWOW64\Qdphngfl.exe
        
        C:\Windows\system32\Qdphngfl.exe
        186⤵
        System Location Discovery: System Language Discovery
        
        PID:6464
        
        C:\Windows\SysWOW64\Qoelkp32.exe
        
        C:\Windows\system32\Qoelkp32.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6508
        
        C:\Windows\SysWOW64\Qeodhjmo.exe
        
        C:\Windows\system32\Qeodhjmo.exe
        188⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Qhmqdemc.exe
        
        C:\Windows\system32\Qhmqdemc.exe
        189⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6596
        
        C:\Windows\SysWOW64\Aogiap32.exe
        
        C:\Windows\system32\Aogiap32.exe
        190⤵
        Drops file in System32 directory
        
        PID:6644
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6688
        
        C:\Windows\SysWOW64\Addaif32.exe
        
        C:\Windows\system32\Addaif32.exe
        192⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Aknifq32.exe
        
        C:\Windows\system32\Aknifq32.exe
        193⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        194⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Aahbbkaq.exe
        
        C:\Windows\system32\Aahbbkaq.exe
        195⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Alnfpcag.exe
        
        C:\Windows\system32\Alnfpcag.exe
        196⤵
        System Location Discovery: System Language Discovery
        
        PID:6908
        
        C:\Windows\SysWOW64\Aolblopj.exe
        
        C:\Windows\system32\Aolblopj.exe
        197⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Aajohjon.exe
        
        C:\Windows\system32\Aajohjon.exe
        198⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Ahdged32.exe
        
        C:\Windows\system32\Ahdged32.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7040
        
        C:\Windows\SysWOW64\Aonoao32.exe
        
        C:\Windows\system32\Aonoao32.exe
        200⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Aamknj32.exe
        
        C:\Windows\system32\Aamknj32.exe
        201⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7128
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        202⤵
        System Location Discovery: System Language Discovery
        
        PID:6092
        
        C:\Windows\SysWOW64\Akepfpcl.exe
        
        C:\Windows\system32\Akepfpcl.exe
        203⤵
        System Location Discovery: System Language Discovery
        
        PID:6196
        
        C:\Windows\SysWOW64\Aoalgn32.exe
        
        C:\Windows\system32\Aoalgn32.exe
        204⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Aekddhcb.exe
        
        C:\Windows\system32\Aekddhcb.exe
        205⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Ahippdbe.exe
        
        C:\Windows\system32\Ahippdbe.exe
        206⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Bnfihkqm.exe
        
        C:\Windows\system32\Bnfihkqm.exe
        207⤵
        Drops file in System32 directory
        
        PID:6472
        
        C:\Windows\SysWOW64\Bemqih32.exe
        
        C:\Windows\system32\Bemqih32.exe
        208⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Bdpaeehj.exe
        
        C:\Windows\system32\Bdpaeehj.exe
        209⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Bnhenj32.exe
        
        C:\Windows\system32\Bnhenj32.exe
        210⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6680
        
        C:\Windows\SysWOW64\Bdbnjdfg.exe
        
        C:\Windows\system32\Bdbnjdfg.exe
        211⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Bklfgo32.exe
        
        C:\Windows\system32\Bklfgo32.exe
        212⤵
        System Location Discovery: System Language Discovery
        
        PID:6828
        
        C:\Windows\SysWOW64\Bohbhmfm.exe
        
        C:\Windows\system32\Bohbhmfm.exe
        213⤵
        Modifies registry class
        
        PID:6880
        
        C:\Windows\SysWOW64\Bebjdgmj.exe
        
        C:\Windows\system32\Bebjdgmj.exe
        214⤵
        System Location Discovery: System Language Discovery
        
        PID:6948
        
        C:\Windows\SysWOW64\Bllbaa32.exe
        
        C:\Windows\system32\Bllbaa32.exe
        215⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Bojomm32.exe
        
        C:\Windows\system32\Bojomm32.exe
        216⤵
        System Location Discovery: System Language Discovery
        
        PID:7092
        
        C:\Windows\SysWOW64\Bedgjgkg.exe
        
        C:\Windows\system32\Bedgjgkg.exe
        217⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Bhbcfbjk.exe
        
        C:\Windows\system32\Bhbcfbjk.exe
        218⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Bkaobnio.exe
        
        C:\Windows\system32\Bkaobnio.exe
        219⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Bffcpg32.exe
        
        C:\Windows\system32\Bffcpg32.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6420
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        221⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Coohhlpe.exe
        
        C:\Windows\system32\Coohhlpe.exe
        222⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Cnahdi32.exe
        
        C:\Windows\system32\Cnahdi32.exe
        223⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Cfipef32.exe
        
        C:\Windows\system32\Cfipef32.exe
        224⤵
        Modifies registry class
        
        PID:6848
        
        C:\Windows\SysWOW64\Clchbqoo.exe
        
        C:\Windows\system32\Clchbqoo.exe
        225⤵
        Drops file in System32 directory
        
        PID:6968
        
        C:\Windows\SysWOW64\Cndeii32.exe
        
        C:\Windows\system32\Cndeii32.exe
        226⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Cfkmkf32.exe
        
        C:\Windows\system32\Cfkmkf32.exe
        227⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Chiigadc.exe
        
        C:\Windows\system32\Chiigadc.exe
        228⤵
        System Location Discovery: System Language Discovery
        
        PID:6356
        
        C:\Windows\SysWOW64\Ckhecmcf.exe
        
        C:\Windows\system32\Ckhecmcf.exe
        229⤵
        System Location Discovery: System Language Discovery
        
        PID:6520
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        230⤵
        Modifies registry class
        
        PID:6696
        
        C:\Windows\SysWOW64\Clgbmp32.exe
        
        C:\Windows\system32\Clgbmp32.exe
        231⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        232⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        233⤵
        System Location Discovery: System Language Discovery
        
        PID:6188
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        234⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Cfbcke32.exe
        
        C:\Windows\system32\Cfbcke32.exe
        235⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        236⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Dnmhpg32.exe
        
        C:\Windows\system32\Dnmhpg32.exe
        237⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Ddgplado.exe
        
        C:\Windows\system32\Ddgplado.exe
        238⤵
        System Location Discovery: System Language Discovery
        
        PID:6876
        
        C:\Windows\SysWOW64\Dkahilkl.exe
        
        C:\Windows\system32\Dkahilkl.exe
        239⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        240⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Ddjmba32.exe
        
        C:\Windows\system32\Ddjmba32.exe
        241⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Dkceokii.exe
        
        C:\Windows\system32\Dkceokii.exe
        242⤵
        
        PID:3528
        
        C:\Windows\SysWOW64\Dnbakghm.exe
        
        C:\Windows\system32\Dnbakghm.exe
        243⤵
        Modifies registry class
        
        PID:7176
        
        C:\Windows\SysWOW64\Dfiildio.exe
        
        C:\Windows\system32\Dfiildio.exe
        244⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Dkfadkgf.exe
        
        C:\Windows\system32\Dkfadkgf.exe
        245⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7272
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        246⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7320
        
        C:\Windows\SysWOW64\Dijbno32.exe
        
        C:\Windows\system32\Dijbno32.exe
        247⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7364
        
        C:\Windows\SysWOW64\Dkhnjk32.exe
        
        C:\Windows\system32\Dkhnjk32.exe
        248⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        249⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Ekkkoj32.exe
        
        C:\Windows\system32\Ekkkoj32.exe
        250⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Eofgpikj.exe
        
        C:\Windows\system32\Eofgpikj.exe
        251⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7560
        
        C:\Windows\SysWOW64\Efpomccg.exe
        
        C:\Windows\system32\Efpomccg.exe
        252⤵
        Drops file in System32 directory
        
        PID:7608
        
        C:\Windows\SysWOW64\Emjgim32.exe
        
        C:\Windows\system32\Emjgim32.exe
        253⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Enkdaepb.exe
        
        C:\Windows\system32\Enkdaepb.exe
        254⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        255⤵
        Modifies registry class
        
        PID:7744
        
        C:\Windows\SysWOW64\Eiahnnph.exe
        
        C:\Windows\system32\Eiahnnph.exe
        256⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Ekodjiol.exe
        
        C:\Windows\system32\Ekodjiol.exe
        257⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        258⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Eehicoel.exe
        
        C:\Windows\system32\Eehicoel.exe
        259⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Enpmld32.exe
        
        C:\Windows\system32\Enpmld32.exe
        260⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Eejeiocj.exe
        
        C:\Windows\system32\Eejeiocj.exe
        261⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Emanjldl.exe
        
        C:\Windows\system32\Emanjldl.exe
        262⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        263⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8120
        
        C:\Windows\SysWOW64\Ebnfbcbc.exe
        
        C:\Windows\system32\Ebnfbcbc.exe
        264⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6728
        
        C:\Windows\SysWOW64\Felbnn32.exe
        
        C:\Windows\system32\Felbnn32.exe
        265⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Fmcjpl32.exe
        
        C:\Windows\system32\Fmcjpl32.exe
        266⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7292
        
        C:\Windows\SysWOW64\Fbpchb32.exe
        
        C:\Windows\system32\Fbpchb32.exe
        267⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7360
        
        C:\Windows\SysWOW64\Feoodn32.exe
        
        C:\Windows\system32\Feoodn32.exe
        268⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7428
        
        C:\Windows\SysWOW64\Fligqhga.exe
        
        C:\Windows\system32\Fligqhga.exe
        269⤵
        Drops file in System32 directory
        
        PID:7508
        
        C:\Windows\SysWOW64\Fbbpmb32.exe
        
        C:\Windows\system32\Fbbpmb32.exe
        270⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Fimhjl32.exe
        
        C:\Windows\system32\Fimhjl32.exe
        271⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Fpgpgfmh.exe
        
        C:\Windows\system32\Fpgpgfmh.exe
        272⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        273⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Fiodpl32.exe
        
        C:\Windows\system32\Fiodpl32.exe
        274⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Fpimlfke.exe
        
        C:\Windows\system32\Fpimlfke.exe
        275⤵
        System Location Discovery: System Language Discovery
        
        PID:7920
        
        C:\Windows\SysWOW64\Ffceip32.exe
        
        C:\Windows\system32\Ffceip32.exe
        276⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7988
        
        C:\Windows\SysWOW64\Fiaael32.exe
        
        C:\Windows\system32\Fiaael32.exe
        277⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Flpmagqi.exe
        
        C:\Windows\system32\Flpmagqi.exe
        278⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Fbjena32.exe
        
        C:\Windows\system32\Fbjena32.exe
        279⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Gidnkkpc.exe
        
        C:\Windows\system32\Gidnkkpc.exe
        280⤵
        System Location Discovery: System Language Discovery
        
        PID:7308
        
        C:\Windows\SysWOW64\Glbjggof.exe
        
        C:\Windows\system32\Glbjggof.exe
        281⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        282⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7504
        
        C:\Windows\SysWOW64\Gfhndpol.exe
        
        C:\Windows\system32\Gfhndpol.exe
        283⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        284⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7712
        
        C:\Windows\SysWOW64\Gncchb32.exe
        
        C:\Windows\system32\Gncchb32.exe
        285⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        286⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Gihgfk32.exe
        
        C:\Windows\system32\Gihgfk32.exe
        287⤵
        Drops file in System32 directory
        
        PID:8020
        
        C:\Windows\SysWOW64\Gnepna32.exe
        
        C:\Windows\system32\Gnepna32.exe
        288⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8104
        
        C:\Windows\SysWOW64\Gflhoo32.exe
        
        C:\Windows\system32\Gflhoo32.exe
        289⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        290⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7432
        
        C:\Windows\SysWOW64\Goglcahb.exe
        
        C:\Windows\system32\Goglcahb.exe
        291⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Gbchdp32.exe
        
        C:\Windows\system32\Gbchdp32.exe
        292⤵
        Drops file in System32 directory
        
        PID:7488
        
        C:\Windows\SysWOW64\Geaepk32.exe
        
        C:\Windows\system32\Geaepk32.exe
        293⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Gpgind32.exe
        
        C:\Windows\system32\Gpgind32.exe
        294⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        295⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Hipmfjee.exe
        
        C:\Windows\system32\Hipmfjee.exe
        296⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Holfoqcm.exe
        
        C:\Windows\system32\Holfoqcm.exe
        297⤵
        Modifies registry class
        
        PID:7780
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        298⤵
        System Location Discovery: System Language Discovery
        
        PID:8016
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        299⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Hoobdp32.exe
        
        C:\Windows\system32\Hoobdp32.exe
        300⤵
        Drops file in System32 directory
        
        PID:7752
        
        C:\Windows\SysWOW64\Hffken32.exe
        
        C:\Windows\system32\Hffken32.exe
        301⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Hlbcnd32.exe
        
        C:\Windows\system32\Hlbcnd32.exe
        302⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Hoaojp32.exe
        
        C:\Windows\system32\Hoaojp32.exe
        303⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        304⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Hlepcdoa.exe
        
        C:\Windows\system32\Hlepcdoa.exe
        305⤵
        System Location Discovery: System Language Discovery
        
        PID:7628
        
        C:\Windows\SysWOW64\Hbohpn32.exe
        
        C:\Windows\system32\Hbohpn32.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7240
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        307⤵
        Modifies registry class
        
        PID:8232
        
        C:\Windows\SysWOW64\Hpchib32.exe
        
        C:\Windows\system32\Hpchib32.exe
        308⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Ifmqfm32.exe
        
        C:\Windows\system32\Ifmqfm32.exe
        309⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Iikmbh32.exe
        
        C:\Windows\system32\Iikmbh32.exe
        310⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\Iliinc32.exe
        
        C:\Windows\system32\Iliinc32.exe
        311⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Ibcaknbi.exe
        
        C:\Windows\system32\Ibcaknbi.exe
        312⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        313⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Iojbpo32.exe
        
        C:\Windows\system32\Iojbpo32.exe
        314⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Ibfnqmpf.exe
        
        C:\Windows\system32\Ibfnqmpf.exe
        315⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8596
        
        C:\Windows\SysWOW64\Imkbnf32.exe
        
        C:\Windows\system32\Imkbnf32.exe
        316⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Ipjoja32.exe
        
        C:\Windows\system32\Ipjoja32.exe
        317⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Ibhkfm32.exe
        
        C:\Windows\system32\Ibhkfm32.exe
        318⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Iibccgep.exe
        
        C:\Windows\system32\Iibccgep.exe
        319⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8772
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        320⤵
        Drops file in System32 directory
        
        PID:8808
        
        C:\Windows\SysWOW64\Ioolkncg.exe
        
        C:\Windows\system32\Ioolkncg.exe
        321⤵
        Drops file in System32 directory
        
        PID:8860
        
        C:\Windows\SysWOW64\Ieidhh32.exe
        
        C:\Windows\system32\Ieidhh32.exe
        322⤵
        Modifies registry class
        
        PID:8904
        
        C:\Windows\SysWOW64\Ilcldb32.exe
        
        C:\Windows\system32\Ilcldb32.exe
        323⤵
        Drops file in System32 directory
        
        PID:8948
        
        C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        324⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\Jekqmhia.exe
        
        C:\Windows\system32\Jekqmhia.exe
        325⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        326⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Jocefm32.exe
        
        C:\Windows\system32\Jocefm32.exe
        327⤵
        System Location Discovery: System Language Discovery
        
        PID:9124
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        328⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Jmeede32.exe
        
        C:\Windows\system32\Jmeede32.exe
        329⤵
        Drops file in System32 directory
        
        PID:9212
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        330⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Jcanll32.exe
        
        C:\Windows\system32\Jcanll32.exe
        331⤵
        Drops file in System32 directory
        
        PID:8332
        
        C:\Windows\SysWOW64\Jilfifme.exe
        
        C:\Windows\system32\Jilfifme.exe
        332⤵
        Drops file in System32 directory
        
        PID:8404
        
        C:\Windows\SysWOW64\Jljbeali.exe
        
        C:\Windows\system32\Jljbeali.exe
        333⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\Jcdjbk32.exe
        
        C:\Windows\system32\Jcdjbk32.exe
        334⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        335⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8616
        
        C:\Windows\SysWOW64\Jniood32.exe
        
        C:\Windows\system32\Jniood32.exe
        336⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Jokkgl32.exe
        
        C:\Windows\system32\Jokkgl32.exe
        337⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        338⤵
        System Location Discovery: System Language Discovery
        
        PID:8804
        
        C:\Windows\SysWOW64\Jjpode32.exe
        
        C:\Windows\system32\Jjpode32.exe
        339⤵
        Modifies registry class
        
        PID:8896
        
        C:\Windows\SysWOW64\Jlolpq32.exe
        
        C:\Windows\system32\Jlolpq32.exe
        340⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8964
        
        C:\Windows\SysWOW64\Kcidmkpq.exe
        
        C:\Windows\system32\Kcidmkpq.exe
        341⤵
        System Location Discovery: System Language Discovery
        
        PID:9032
        
        C:\Windows\SysWOW64\Kegpifod.exe
        
        C:\Windows\system32\Kegpifod.exe
        342⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9112
        
        C:\Windows\SysWOW64\Kjblje32.exe
        
        C:\Windows\system32\Kjblje32.exe
        343⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Kpmdfonj.exe
        
        C:\Windows\system32\Kpmdfonj.exe
        344⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        345⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        346⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Kpoalo32.exe
        
        C:\Windows\system32\Kpoalo32.exe
        347⤵
        System Location Discovery: System Language Discovery
        
        PID:8572
        
        C:\Windows\SysWOW64\Kcmmhj32.exe
        
        C:\Windows\system32\Kcmmhj32.exe
        348⤵
        System Location Discovery: System Language Discovery
        
        PID:8680
        
        C:\Windows\SysWOW64\Kjgeedch.exe
        
        C:\Windows\system32\Kjgeedch.exe
        349⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        350⤵
        Drops file in System32 directory
        
        PID:8888
        
        C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        351⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Kpanan32.exe
        
        C:\Windows\system32\Kpanan32.exe
        352⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9132
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        353⤵
        Modifies registry class
        
        PID:8240
        
        C:\Windows\SysWOW64\Klhnfo32.exe
        
        C:\Windows\system32\Klhnfo32.exe
        354⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Kofkbk32.exe
        
        C:\Windows\system32\Kofkbk32.exe
        355⤵
        System Location Discovery: System Language Discovery
        
        PID:8592
        
        C:\Windows\SysWOW64\Kfpcoefj.exe
        
        C:\Windows\system32\Kfpcoefj.exe
        356⤵
        Modifies registry class
        
        PID:8768
        
        C:\Windows\SysWOW64\Kngkqbgl.exe
        
        C:\Windows\system32\Kngkqbgl.exe
        357⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8940
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        358⤵
        Drops file in System32 directory
        
        PID:9088
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        359⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        360⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Lcgpni32.exe
        
        C:\Windows\system32\Lcgpni32.exe
        361⤵
        
        PID:8816
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        362⤵
        System Location Discovery: System Language Discovery
        
        PID:9108
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        363⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        364⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        365⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Lnoaaaad.exe
        
        C:\Windows\system32\Lnoaaaad.exe
        366⤵
        
        PID:9028
        
        C:\Windows\SysWOW64\Lopmii32.exe
        
        C:\Windows\system32\Lopmii32.exe
        367⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8796
        
        C:\Windows\SysWOW64\Lggejg32.exe
        
        C:\Windows\system32\Lggejg32.exe
        368⤵
        Drops file in System32 directory
        
        PID:8312
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        369⤵
        
        PID:9244
        
        C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        370⤵
        
        PID:9288
        
        C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        371⤵
        
        PID:9332
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        372⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9376
        
        C:\Windows\SysWOW64\Mmfkhmdi.exe
        
        C:\Windows\system32\Mmfkhmdi.exe
        373⤵
        Modifies registry class
        
        PID:9420
        
        C:\Windows\SysWOW64\Mcpcdg32.exe
        
        C:\Windows\system32\Mcpcdg32.exe
        374⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\Mfnoqc32.exe
        
        C:\Windows\system32\Mfnoqc32.exe
        375⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9512
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        376⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Mogcihaj.exe
        
        C:\Windows\system32\Mogcihaj.exe
        377⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9600
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        378⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Mjlhgaqp.exe
        
        C:\Windows\system32\Mjlhgaqp.exe
        379⤵
        
        PID:9684
        
        C:\Windows\SysWOW64\Mqfpckhm.exe
        
        C:\Windows\system32\Mqfpckhm.exe
        380⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Mcelpggq.exe
        
        C:\Windows\system32\Mcelpggq.exe
        381⤵
        
        PID:9772
        
        C:\Windows\SysWOW64\Mjodla32.exe
        
        C:\Windows\system32\Mjodla32.exe
        382⤵
        System Location Discovery: System Language Discovery
        
        PID:9816
        
        C:\Windows\SysWOW64\Mnjqmpgg.exe
        
        C:\Windows\system32\Mnjqmpgg.exe
        383⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        384⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        385⤵
        System Location Discovery: System Language Discovery
        
        PID:9948
        
        C:\Windows\SysWOW64\Mnmmboed.exe
        
        C:\Windows\system32\Mnmmboed.exe
        386⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9992
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        387⤵
        Modifies registry class
        
        PID:10036
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        388⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10080
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        389⤵
        
        PID:10124
        
        C:\Windows\SysWOW64\Nmbjcljl.exe
        
        C:\Windows\system32\Nmbjcljl.exe
        390⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10168
        
        C:\Windows\SysWOW64\Nopfpgip.exe
        
        C:\Windows\system32\Nopfpgip.exe
        391⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        392⤵
        
        PID:9236
        
        C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        393⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Nqpcjj32.exe
        
        C:\Windows\system32\Nqpcjj32.exe
        394⤵
        Drops file in System32 directory
        
        PID:9360
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        395⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\Nncccnol.exe
        
        C:\Windows\system32\Nncccnol.exe
        396⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9520
        
        C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        397⤵
        Modifies registry class
        
        PID:9584
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        398⤵
        
        PID:9660
        
        C:\Windows\SysWOW64\Nnfpinmi.exe
        
        C:\Windows\system32\Nnfpinmi.exe
        399⤵
        
        PID:9724
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        400⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\Ngndaccj.exe
        
        C:\Windows\system32\Ngndaccj.exe
        401⤵
        Drops file in System32 directory
        
        PID:9856
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        402⤵
        Drops file in System32 directory
        
        PID:9932
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        403⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10000
        
        C:\Windows\SysWOW64\Nceefd32.exe
        
        C:\Windows\system32\Nceefd32.exe
        404⤵
        
        PID:10064
        
        C:\Windows\SysWOW64\Ngqagcag.exe
        
        C:\Windows\system32\Ngqagcag.exe
        405⤵
        Drops file in System32 directory
        
        PID:10136
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        406⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        407⤵
        
        PID:9284
        
        C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        408⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        409⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Ompfej32.exe
        
        C:\Windows\system32\Ompfej32.exe
        410⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Ogekbb32.exe
        
        C:\Windows\system32\Ogekbb32.exe
        411⤵
        Modifies registry class
        
        PID:9700
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        412⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Ombcji32.exe
        
        C:\Windows\system32\Ombcji32.exe
        413⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        414⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\Oghghb32.exe
        
        C:\Windows\system32\Oghghb32.exe
        415⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10120
        
        C:\Windows\SysWOW64\Onapdl32.exe
        
        C:\Windows\system32\Onapdl32.exe
        416⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\Opclldhj.exe
        
        C:\Windows\system32\Opclldhj.exe
        417⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        418⤵
        
        PID:9596
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        419⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        420⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9940
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        421⤵
        System Location Discovery: System Language Discovery
        
        PID:10116
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        422⤵
        Drops file in System32 directory
        
        PID:9300
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        423⤵
        Drops file in System32 directory
        
        PID:9572
        
        C:\Windows\SysWOW64\Paeelgnj.exe
        
        C:\Windows\system32\Paeelgnj.exe
        424⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        425⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10108
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        426⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\Pjmjdm32.exe
        
        C:\Windows\system32\Pjmjdm32.exe
        427⤵
        Drops file in System32 directory
        
        PID:9988
        
        C:\Windows\SysWOW64\Pmlfqh32.exe
        
        C:\Windows\system32\Pmlfqh32.exe
        428⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        429⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        430⤵
        
        PID:10132
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        431⤵
        
        PID:10248
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        432⤵
        
        PID:10292
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        433⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:10336
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        434⤵
        
        PID:10380
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        435⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:10424
        
        C:\Windows\SysWOW64\Phfcipoo.exe
        
        C:\Windows\system32\Phfcipoo.exe
        436⤵
        
        PID:10468
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        437⤵
        
        PID:10512
        
        C:\Windows\SysWOW64\Panhbfep.exe
        
        C:\Windows\system32\Panhbfep.exe
        438⤵
        
        PID:10552
        
        C:\Windows\SysWOW64\Pdmdnadc.exe
        
        C:\Windows\system32\Pdmdnadc.exe
        439⤵
        
        PID:10596
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        440⤵
        
        PID:10640
        
        C:\Windows\SysWOW64\Qmeigg32.exe
        
        C:\Windows\system32\Qmeigg32.exe
        441⤵
        System Location Discovery: System Language Discovery
        
        PID:10684
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        442⤵
        System Location Discovery: System Language Discovery
        
        PID:10732
        
        C:\Windows\SysWOW64\Qdoacabq.exe
        
        C:\Windows\system32\Qdoacabq.exe
        443⤵
        System Location Discovery: System Language Discovery
        
        PID:10776
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        444⤵
        
        PID:10820
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        445⤵
        Modifies registry class
        
        PID:10864
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        446⤵
        Drops file in System32 directory
        
        PID:10908
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        447⤵
        
        PID:10952
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        448⤵
        Modifies registry class
        
        PID:10996
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        449⤵
        System Location Discovery: System Language Discovery
        
        PID:11040
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        450⤵
        
        PID:11084
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        451⤵
        Drops file in System32 directory
        
        PID:11128
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        452⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:11172
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        453⤵
        
        PID:11216
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        454⤵
        
        PID:11260
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        455⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        456⤵
        System Location Discovery: System Language Discovery
        
        PID:10352
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        457⤵
        System Location Discovery: System Language Discovery
        
        PID:10416
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        458⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10492
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        459⤵
        
        PID:10560
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        460⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10624
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        461⤵
        System Location Discovery: System Language Discovery
        
        PID:10696
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        462⤵
        System Location Discovery: System Language Discovery
        
        PID:10768
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        463⤵
        
        PID:10840
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        464⤵
        
        PID:10904
        
        C:\Windows\SysWOW64\Bdojjo32.exe
        
        C:\Windows\system32\Bdojjo32.exe
        465⤵
        System Location Discovery: System Language Discovery
        
        PID:10992
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        466⤵
        
        PID:11048
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        467⤵
        
        PID:11116
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        468⤵
        
        PID:11184
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        469⤵
        
        PID:11252
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        470⤵
        
        PID:10324
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        471⤵
        
        PID:10412
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        472⤵
        
        PID:10536
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        473⤵
        
        PID:10628
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        474⤵
        System Location Discovery: System Language Discovery
        
        PID:10760
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        475⤵
        
        PID:10856
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        476⤵
        
        PID:10960
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        477⤵
        
        PID:11068
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        478⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11168
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        479⤵
        
        PID:10268
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        480⤵
        
        PID:10396
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        481⤵
        
        PID:10604
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        482⤵
        
        PID:10740
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        483⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        484⤵
        
        PID:11096
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        485⤵
        Modifies registry class
        
        PID:9784
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        486⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10500
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        487⤵
        Modifies registry class
        
        PID:10720
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        488⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:11036
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        489⤵
        
        PID:10312
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        490⤵
        
        PID:10712
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        491⤵
        
        PID:11136
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        492⤵
        
        PID:4348
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        493⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:10544
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        494⤵
        
        PID:10304
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        495⤵
        Modifies registry class
        
        PID:10636
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        496⤵
        
        PID:11288
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        497⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:11336
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        498⤵
        Modifies registry class
        
        PID:11384
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        499⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:11420
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        500⤵
        
        PID:11456
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11456 -s 424
        501⤵
        Program crash
        
        PID:11572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 11456 -ip 11456
1⤵
PID:11512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Adcjop32.exe

Filesize
97KB

MD5
6442432e638812a88418f1b380a80820

SHA1
cb7d3300bc21e7141534e0bdb05a8db8ed4bb7f6

SHA256
1f1625a4e24efe04406c05668e52a5673217d6563c6a46d458e6e9717a520840

SHA512
0d0a8c6063526f28406728c753e6ffffb21a705a48d621bcbb0b596a496c7a33d40c209fe676e8a318bce139206d7f3426b7ef9abd4ef5a9233216506cace700

Download Submit
C:\Windows\SysWOW64\Aekddhcb.exe

Filesize
97KB

MD5
f642ed5acd8760333309c36fdceca462

SHA1
aed3ef871144f4e361b97506b2a2b0a9f226b4a5

SHA256
1e208d78c995d8b1a4a62b820ef4dd59d783e639b3cf5cf54a4f83a2537142cd

SHA512
96c143603a2036e464b5d197b1726b135f91d282018348b083ce94627f73e4905327c1c6294c5365a8024ae1cd379b73c84c6f3f3d96bcfa896f3d2713b1abb0

Download Submit
C:\Windows\SysWOW64\Ahdged32.exe

Filesize
97KB

MD5
7211e1ef0369917242183b1ecd319cee

SHA1
4c35023e9c6fc99c90c23bd8bb79c1345766e2e9

SHA256
8fdc56e3c79624a6267fe6e9be96e96b5be92522656cf2028fdbb9b155a5c7f5

SHA512
94e2a558210df545b5e0f99daa8f60d1cd481f552e37a909aa022e881e4771d693b1ceca614c68dfcd4340138ebae791af322dc72fbeb56c8b15b96127a7ec71

Download Submit
C:\Windows\SysWOW64\Aknifq32.exe

Filesize
97KB

MD5
fa4e86ac665965061a7a66bc6b66021d

SHA1
48ed331f13f24f5bad41a8cedb36c005386c61a5

SHA256
09ea75bd89dc80022cf07a0b338e0c1f32abcccc578e439a401a66825f756c3e

SHA512
f2b5c4e0ea500edb122765733de4aa4687ce6e52b1a41263d5e5e123001485a1803659388b0449e62d4e1b5fd6b1c33e1d8e6699761f7b97fc4544d12e57c5e0

Download Submit
C:\Windows\SysWOW64\Akpoaj32.exe

Filesize
97KB

MD5
e294f16b9b19ab2bf193ebbd9d7e869c

SHA1
224b2b0ac3b5bc1f5b47df3f025fcd04c77dfa90

SHA256
3bce4ec72866520210979ab881605311f9c462a5e2aafced9ef778bff47ddac4

SHA512
6720e34f1c8372bd5427c5190de5a64a49c0fb17a02f403e7cff77c80f57b556b4f6111dc8f25073bbbe715a4b8ea233312f85ce491b5170b33f7376e01a67fb

Download Submit
C:\Windows\SysWOW64\Alnfpcag.exe

Filesize
97KB

MD5
76454538e61b5f1d4c4cc75d8662f22e

SHA1
e4180308265b071dbce336e0e4820b752d034997

SHA256
24b9cdc8c1e28e58ae4e2adbab6a78ebb5c75c8abbaa009d345812aa64885e5f

SHA512
b3c9bca809f9f0bf50497ff58ca9097be3050bee702e8adfa2f8adf6599c8ed2e5b60a1762ba0546c6f3b1d33e336bf33395bcfcb15cbeba1f9ff92b98166fab

Download Submit
C:\Windows\SysWOW64\Amqhbe32.exe

Filesize
97KB

MD5
9f3121ca88e1c2941c8febc86554e6c5

SHA1
1274fa7e5688b2b516fef8cc3867f0c84fba1a5b

SHA256
aba0acbef5fa9e4102ed796457352297024c8d4b0b75d1ce3302f32f1e9e1ca5

SHA512
f1578f4a677c366a2ab62289864f52305342d82b28e6590857304ea072ac119779e64e596e83742110c6625fd6531765b11f99d506c5e9a5e07a517a1abff3cb

Download Submit
C:\Windows\SysWOW64\Bacjdbch.exe

Filesize
97KB

MD5
626d30d95cf125b592da52d77260118d

SHA1
4e464873a7de1e9cf5303ca01a2126b69132a26d

SHA256
436810acc7b208690a5762ac24170e6d5f832ad8e1d67c4e3caa54dd8dacfaaf

SHA512
4c730415ea0f8e07d36330f549807753b0d097fab1f2193c5ecd2508d1656e09feaf2af31c7ee46a94a2d7f6445d9ccb4ae4c8a00a1d06b1e0fadb6f2f31032c

Download Submit
C:\Windows\SysWOW64\Bdfpkm32.exe

Filesize
97KB

MD5
57b7bbe85d26076b39fa495f48d8847a

SHA1
a0e14d76e8c8291b2933d5f46b3027c34a57dc74

SHA256
0c7a210ccb9adc952fd923acb0d1092f39d3bfb1e277c89142c39851a5ed02ed

SHA512
53e06362b6a104605f5f4bc7cc82e63cdbf461afd232e09713edcb2d6c63fbda5ed6ac4e7660e77d5d412a4c66682ad95ab183ea119658a82bd7cb78e4828bc5

Download Submit
C:\Windows\SysWOW64\Bdpaeehj.exe

Filesize
97KB

MD5
538b3f5a1f536ca815233c54f427da4a

SHA1
07f36d0044c98dc8cc2a1d7168c30020cefaaf07

SHA256
770042896604a1896b60ec26565da9b22f37bb71173b15dcf681f8385f7de37a

SHA512
a07fe4204b849b66a454d044a25b9007ba2bc4925390fb1dfaeb06a9a5282dbf33be422d41708e61282a5577cbf92e67da48777b3d00de2bbdabf4073ad96568

Download Submit
C:\Windows\SysWOW64\Bedgjgkg.exe

Filesize
97KB

MD5
cc93866e958e3d53e0d05145f8a89517

SHA1
015a0b2c7990107a48216b39ccf6ec49b2ca8a49

SHA256
f589a422fcfaab9c84b17f8273cb1b207d574a2b95d695fa12e06aa81cd03ad9

SHA512
991a893c4ae58a3ca72dbe21c9e24f81384d18978c5d9d14245bac8f5c96ff2fcad88b10af594a54053d5df5e041f0391fcbbb8220739ffd24e462209e8fd525

Download Submit
C:\Windows\SysWOW64\Bhhiemoj.exe

Filesize
97KB

MD5
36ee6cdbb4412b0ffef331f9a065b060

SHA1
3ab98538e505ec98db7a673b4aee3f4892874074

SHA256
4699a7f199ac2bc0220678cbcce8aef1dfccfbd70dd155870c7af33fa33fc792

SHA512
0d90ca67c70f3827210899296dcfbadd9c05bcf35f74ff4243c221899a1164d97b8fbbd8b93f130bf10432d93846b26f8520b7c409dd4ea326f0b45d4847d959

Download Submit
C:\Windows\SysWOW64\Bhpofl32.exe

Filesize
97KB

MD5
1d6e8b0933c1d7470dbbf6e56e420fa2

SHA1
a05bc084ea25eaf06f9ba05deaf551514f2f13db

SHA256
6c5c85d89d2d64fac3703d87c6421d7bd0c4cb8a4a20df179153b6f821dc319f

SHA512
2c37e136fbeab9d1aa423e81604a5ffbf058b2f26b5cb3d7310a6734edad5e8cd973e472df8cc93f0bbeee2234795925823ddb5701eb1338075a57510869f8c2

Download Submit
C:\Windows\SysWOW64\Bkaobnio.exe

Filesize
97KB

MD5
72e5adcb5fceb00b91c0a39b7859e368

SHA1
e242a146ce70f215314c95bc5ed3b5dcf44cd29f

SHA256
dcd91543efc270f2ff98134a388858115eba0169f072d3c7d1d2b3adfe588bc8

SHA512
af10d50e33d70ae173124a1ce59228e912e2f5307873bd77d12c3db27b9fa14baf95f6b3007e89a8d95f4928f544584fda33f284e2b3ed61e68021451cc5f787

Download Submit
C:\Windows\SysWOW64\Bllbaa32.exe

Filesize
97KB

MD5
e896012ab3c7fb76076629d3b24dd0b5

SHA1
56a6709eb14036c7ce38f10a5bf8dcd33a47bab1

SHA256
0e45ece5bdddaeb5b65d86fa5d3ec4ceb9be77515143da9409ba32236d47f070

SHA512
3e3248894b0c48c658a2b24398147cc19c24fe15a60ef5dd1388c961655e3780a0a4068658cbe0a07baac4e7c7877c91f36d4f876b3005bcfdc0a8c2c4c76db1

Download Submit
C:\Windows\SysWOW64\Bnfihkqm.exe

Filesize
97KB

MD5
fcf9b1040361744412df17803a9d2560

SHA1
456cd238364ccde11ef1cf6d970b7791e6390cd0

SHA256
8298ab1586babe57b2e9300579e06ff85c4ddfb29a67ac3493e6d67454f21a49

SHA512
9b76978ac932e2d0040def4bad8b188a9a1fea549985f485c5f9e3775611cf2772e704bb201add5353ed59fc012b928f9f2a4d77092d6bfe3ffb90fc6d1946a3

Download Submit
C:\Windows\SysWOW64\Bobabg32.exe

Filesize
97KB

MD5
20ea6e4b9bba60c5fabb887541cec408

SHA1
87b8ff86b29e783f31a9f67f129f6152f29727f2

SHA256
3307c23403d1c803b3a666c0ded8941e47481862da2fe35960c4aa3599f0ffc3

SHA512
6b5c16fcfaa6fc328a29467d8174549d893831e15269295b63a3dce96798ef22b830b16a5ff026378a4c63b219f05a7e2b593171c96f2d502816cafbc98d8e2e

Download Submit
C:\Windows\SysWOW64\Cacckp32.exe

Filesize
97KB

MD5
e0c148b1ee53a3d2ef43fd06539eb69b

SHA1
e9f93ebba9d4030a0d9cfe44fb443951e355d560

SHA256
d771f44794e7499e97df32056e67dad7d97b194733fb3886db4ca70b755de58e

SHA512
83244596a1a548a0d0c3a379f8774c1c2ac10bcb9992d40a3c8cc79d5a756e2ca44d5c17383cd2978a63e7d74e2f14a1def1a3431f1ae4b5f21f6a3761a95e87

Download Submit
C:\Windows\SysWOW64\Clchbqoo.exe

Filesize
97KB

MD5
d18403ffbbf6d7c75cdabf9c4edefcba

SHA1
49f0e55a2ba13f808e710c5def3bd809f810a85d

SHA256
d3562df361f6d8c859f95f6f56887e2db5abfb6353f46387a8302907d8ff9c15

SHA512
2b45a714d066f322cbdc386448ee91c1cf95ed1af0496fa472a117cfe8edf5e71d4138f9424d1541d365039698a7839a3d27f407571efd3daec6421355fb428b

Download Submit
C:\Windows\SysWOW64\Clgbmp32.exe

Filesize
97KB

MD5
439dc09056018a23ea561d3c935ccd11

SHA1
c64ea50fa507c4f1bc7b2940b046430766c72fe8

SHA256
d6f539a15ec6a0406dade61c2866574505af4184928f723b369cc4da0dec6061

SHA512
b9b5fb9a69c1858364c0b9b9e574995e5868e692401f823e0d66122ae223f784756c21d4861379989e9f8d3e2661261f1ec18c1b19375522da6704e6c359aaa8

Download Submit
C:\Windows\SysWOW64\Cncnob32.exe

Filesize
97KB

MD5
9a76687e5cf018e8a669c08b1472548f

SHA1
e3febd503b62b65b3b82202069214af657cc646e

SHA256
2cce479f283eabfbf4a205b9f85e8306880d5340d0de2ef5387849e146a517f9

SHA512
7f84820f176a074d5c8f9d80a72afb6f16857e20fc948a988c2566ea70a8b0dbfeb21ceeb37ea30b01d7659bf3ed00d1a2e13d88f5f558d830b304d29b06f226

Download Submit
C:\Windows\SysWOW64\Cohkokgj.exe

Filesize
97KB

MD5
94ce03398df61ecbba5e09ce48046db6

SHA1
1023b458b8f06ee5e732ffbf092cb1039d38a839

SHA256
5606793eed4fbf323b49b4efa58d302a2b53eacd522b373cb2f04b8510e7fb55

SHA512
a4657e5f096e1c9e8ed1ef1c16a5f8910778f2ef4d8cb312b045c676f9dac5c3fcfa13f674d7790dcb32758ef30e79545ac2a6f19c8b81460dc61c0d5184c896

Download Submit
C:\Windows\SysWOW64\Coknoaic.exe

Filesize
97KB

MD5
29f07fcfdd3e87b8560ee452df1c1cc4

SHA1
cd1fccbaf2257a5bbb2c6de0a6dc39a311d243ba

SHA256
279aefdeb5c10786312174fecc1121664f71d43b0e6c437d89800c69faca7b66

SHA512
43232e648f2c03eaaf490f34ca94735e33e74c88d07a3f38a42fdeafda44e0b037152ecd2998288d29b85d4bbf921b68cc988d34afe42d972ebbe1f0b5c7437f

Download Submit
C:\Windows\SysWOW64\Cpdgqmnb.exe

Filesize
97KB

MD5
059dc5d63274d09484f74b852fc95d65

SHA1
872f4985869e411c685836950fa3b15cf8e9b310

SHA256
eec372300e1662f3bfe74d56098e0d7346078719ea888ea6d822763dca5e5df6

SHA512
e100cdbf23dc2ffd0c8307cbab06e37df70da4db75a8b7aa93f5cd5e59a6510cb6fb51f40ac51f83a09405453204ed9979f3f0b326919bd206bebd4ef7be2623

Download Submit
C:\Windows\SysWOW64\Cpmapodj.exe

Filesize
97KB

MD5
bbc7e19c6bd5a5bf517f228968b3bb20

SHA1
425e7a1ff98942088ed43c2bbe790410aa524be5

SHA256
07bb5b3d4e34818a884afc3a9a8601271b16ca3696e3d9aa297a7b32643831a1

SHA512
96488448cc220a70df34a7e50541ce52fcd801664b2e7f9a650d42b8d1dd03e5ee729c5aeb2c84da4d548dde40d98f547ec3085489d7bcb610f24f2197e1c9f9

Download Submit
C:\Windows\SysWOW64\Dafppp32.exe

Filesize
97KB

MD5
cad8f9dacdbace928c53af6e59e98499

SHA1
2f34cc413076d21c9887cb6b1572e727d58070af

SHA256
4627af62ae0fa725d917090f8bb96990d3b5dcd68d3711c770a2ab87c1d6f3ad

SHA512
9387ee1e0eefefc4b8842de1b8bd4688aa67cffa680fa2461696a2476b777b01d738b681754977803ffb9c23d21fbe1cca0fb06d4ec74b2b6c9d4dabda164ffc

Download Submit
C:\Windows\SysWOW64\Dbbffdlq.exe

Filesize
97KB

MD5
319d3d5c82b8ec52deee3801bfcad2af

SHA1
bf6070ce47c5aa0eaa3847ed785bfdd4e6b052fa

SHA256
5dde69338c04b263717a8fd24120536cdab0c05c1590906a1ef9519ae2895f79

SHA512
542475c846b35448ac7a554dcbb2418f0f8740043e1dbf7aab515a8a0e9a29eae4366c5991f8eee8f9418f0a73fabf305257ee83dbd17b7ac66c1b8fc2b92440

Download Submit
C:\Windows\SysWOW64\Dblgpl32.exe

Filesize
97KB

MD5
3a73e2fd1ba55de7f6b1edd8b4df8985

SHA1
4706e58ba8b3403c3f1e273fe22494bcacfe7910

SHA256
44a19e35ba99510300bee189886a4158f619abdbd55608c8ee3cd9ecb3cd3ed6

SHA512
42d8557039ec90bd40b95cce75690840d3d66c0e692f63fdfae3d9633b419879031db748db6b263e4e7cb1efa4c866c60f04d7c0ce04524b691f511c31518db5

Download Submit
C:\Windows\SysWOW64\Dbndfl32.exe

Filesize
97KB

MD5
2f4e500d653b964dfd4d1a9874a53c05

SHA1
620f64996551bcf75753bbe1bbac85e48a478c72

SHA256
44bd301071606ededd4f91673fa220b1450f3eb8db54d33af0f01949bdd1f0e8

SHA512
8843b72715fc38deeef01d577414479beaaf46e1e6c0ade97d0f244cfba313f123320b0b7ba3741f406dc4c60cda316dde9e03878e2e5c8729d63bdc5be99045

Download Submit
C:\Windows\SysWOW64\Dbqqkkbo.exe

Filesize
97KB

MD5
8bb55ad0c9a334b01689bdae1804ca79

SHA1
9a97a3a0a4c8f0c9675af3cff7cbd73c83e62993

SHA256
dbe1ac06d54f298813cabeb6d5a5e0232c29b997d50b1192e249b5f151f3140e

SHA512
5927ad8afebee9587365f00c84250711fa655eed72bb8c3997ea67c9bce7153ed063fe1c343518b4fbec465776495669304ab6a7c5ff38e517e80e58a5f4152f

Download Submit
C:\Windows\SysWOW64\Ddgibkpc.exe

Filesize
97KB

MD5
753d45bbd8254b802e4b2c972a7f48e5

SHA1
29cd7dfa71e45c742dcd3fece62d632de7da378e

SHA256
026f1a396fc6cf6de4389f376caa0bfe28133cfaa3bf061ddf629acbaa7dcc12

SHA512
03c17936f1a0657da9401a90e46c3bba6f60436a6ca484c4116cb250ddf196cb1aa2924fafbcef33fa3b723c097095059eda7d042f0738df7a9a4a35151af376

Download Submit
C:\Windows\SysWOW64\Dfefkkqp.exe

Filesize
97KB

MD5
3583e5f1e6472a5124cda1c749fd74e4

SHA1
a60f4a7c70eaae211799adb6a422f91fc57a06a4

SHA256
8be5b1ca19d057ca40154ee0d05ed5cd8b2fafc00cbcefde26f23c75759cfd2e

SHA512
e758e374bbc82adc8851e889b634266a6087b06738671b318fc58d2cad5c68f5691b766e2bb76507e74bcc2c8cabdced00fd28a5585daba386b79b239eda9267

Download Submit
C:\Windows\SysWOW64\Dflmlj32.exe

Filesize
97KB

MD5
4660db873130c8114d591496215540ff

SHA1
8eae3e68c19a6cf98284071f50e9437292365902

SHA256
58d045a89f27fb1a2129ee715dad1b33610a1105061c8f89ff2ad70482f133eb

SHA512
803d4b5fab44fb278864f71e272e1b028353e34b885bf651afe6793f4f8368d82e6515aff985af2bb0e2395f3a932d4486f344ec65854a8b2686a71b3b626e83

Download Submit
C:\Windows\SysWOW64\Dfoiaj32.exe

Filesize
97KB

MD5
0a08ae3ede436f999b3c068256af7b2d

SHA1
4866b6f80b6ef55ef29907e4c56d553e671192a9

SHA256
41c8060f536f63fae8fb226d961a658056e37b9055aaf9be2ee2c57718de5d00

SHA512
19eebd677a298c883ac351bcb418f43627583ce3c4e3bf7a25e837083af1a5b61f9b9b8d7e3fd6184e823759347332eaa923f88d4cc4bc887e43c5ba3d64c81f

Download Submit
C:\Windows\SysWOW64\Difpmfna.exe

Filesize
97KB

MD5
1bdbdb4cddfa24ac59a06fee446886f5

SHA1
dda66c2741ea61042a7238b4125b66f9383076a7

SHA256
25d2d13e68aa5d61d960d3a787a289959a9b9275c7286d89e4418979ca4e62ee

SHA512
06325248966ad3114a6b418f59f371b75c70c9d7e8d7026179ed7bf0af724ae28314670731c04311aaafb3db66b7f0c355ca75abd7dce3ec6ee8f467cac750bb

Download Submit
C:\Windows\SysWOW64\Dihlbf32.exe

Filesize
97KB

MD5
683764c5ea5973e2f5c6eba1493831c0

SHA1
0316388f8b9966a80c1935e1fca5cd18bf6ca6b3

SHA256
3ddbdc5d65d088d9a1c6fd3d50ce0ee15e309267a5b5662db7f32668b6db3a71

SHA512
35455883175e1f765482546bd9fd325c21cec3067824e9025bae26f1d6ec3090eb85282f73b543aae789fe08fd867299445a4193c7b3af1fc42f4990d74e2bfa

Download Submit
C:\Windows\SysWOW64\Dijbno32.exe

Filesize
64KB

MD5
fc83dea53d840bdbb1becb2419ffb902

SHA1
37c03683c01170483a82e0f527bd462b726ef8b7

SHA256
d0c4e80c4ecaf301702e6141e901c636d7707a494deebef7fa8de73c12f7689d

SHA512
12cbde7cc450fc042fe92361ab7453316c53187373ca72befb7df60e36ba26baedab7ca07662b7e8254bca054ee716b195fdca2a6acda6bdfd1e61cb1016e6d5

Download Submit
C:\Windows\SysWOW64\Djjebh32.exe

Filesize
97KB

MD5
fde0d4f5adbe4036c3e24cbfff08ef57

SHA1
2e35fd78cdeb8f8e1ebfd316639e0bb7c2daac89

SHA256
db0d22fa64bbec564e922bfde7bf02ad14a048c9dcc86e6354d5a3702e9f7192

SHA512
f12a1fc162fea6c77ce22cc2673f6e37d6d587c743252daf6a5dd7c52caf390738668b2576ba67e76bfe42de65e449bc76d9d0f74c70cf5faa5efa930a01442b

Download Submit
C:\Windows\SysWOW64\Dlghoa32.exe

Filesize
97KB

MD5
d144a92bca7a4f29aa8f2eb45d08c362

SHA1
1547bb6cc083c324d6a44f33ec17d1e4432004ac

SHA256
eca406d3ec03c0ab71afc58e98c0ce6f757facd06de5abaac56e653c66c71994

SHA512
ec1a3d816925cca525b6815067cb45c48d48ec65f2c985d626f77abe7f9d015a395b2e65e377d9ed1e9dd8c287e0221a450d6d011391a849986d7a14a4367144

Download Submit
C:\Windows\SysWOW64\Dlieda32.exe

Filesize
97KB

MD5
62bc6ad890b50c55528844ab108006d3

SHA1
03635c06c86e5a7489492e4d21f008c7b00f5926

SHA256
3e1b76b66d76d4327bbdb68c4da618ff9e36e55c1c593f679ee0bf8ed4e20e44

SHA512
1611f95664610415cb2420455eada1bed48be87e7605341ab36aa94ac57df9b10a0b8663f53accfb8af124f96cc800cca310907b4d963265f701c0c86939fac6

Download Submit
C:\Windows\SysWOW64\Dmoohe32.exe

Filesize
97KB

MD5
e650e971ea8ff53cbc6fa1553f9e33b2

SHA1
ab9207935086b5a52cec5ff3e2ea0a9c216bf3d3

SHA256
421c49a516871ae7442e0e627d72c1053b5e07614aa1aea7e8a00bba054c990c

SHA512
3b2fb87f9dfebf39b16c41f6c00631fe477559d50ecae31a3987119429882282440fce5424dfc5d02d3d39c357c713b851784abeaeb5b3fc014f27d651dabee8

Download Submit
C:\Windows\SysWOW64\Dpgnjo32.exe

Filesize
97KB

MD5
43d492b4d67c15b15bec971dcb0f4048

SHA1
eb203945a09e67c562528527d651781786ab8c95

SHA256
4e1fd8d4fb260a939bdf6337bbc24f28a525572477abf79cd6c7beb95a6f245f

SHA512
d15a77e8a3eb5d30455ff82a04e4e407b52bf9193390d80c793fcff47be0d48c12afd309e1418123a299dcf841cc5c5c70cdb1ab9355ffe8f278067b3bac5899

Download Submit
C:\Windows\SysWOW64\Dpnkdq32.exe

Filesize
97KB

MD5
00df169c02f305ac87ff0b274ec84256

SHA1
f1cc339a52df5831c0663be291aef931ebc23c3d

SHA256
0dde136bfb40f72db829be82f80331ae2bd8908e0a3ffb6041be7691ccfaa66a

SHA512
3921200b7f1e8501429bc82c00f26f256fb74402ff8c7cb65800e49ec291f35e37c0e796f5addd12d99cee09fb64163eded1ecbb23d50032ce8174bbaa188ddb

Download Submit
C:\Windows\SysWOW64\Dpphjp32.exe

Filesize
97KB

MD5
72520170769e1d3d807b557b737eded1

SHA1
0c7ad231ee4c34cccaf2291415602c36ccfee4de

SHA256
68b5848e1992fc869240b0cc39dc819e76759441291c65bf6b22b47626fee758

SHA512
c85616bb04a5485ca931a6fd3de450ffd7548f779da80d2a6aab2063db4cef3424fa47e1d903529597a95b6e9997ad13540ea1ecc4618d003797085bd780e909

Download Submit
C:\Windows\SysWOW64\Ebommi32.exe

Filesize
97KB

MD5
14b27b3f7b6446f4229fa9c2d21e4f20

SHA1
9f20917b0664a88ba6737f39b199f1c660252620

SHA256
acbfed6f747e44e046c58e487e174b3a3156a2b7c19a0f19670179a4c5c7accb

SHA512
ec2acaa6e6a0068161f50b9bc98e7b9de0eddb26eb673905ac7070597d6412cd140607b100c207872ccd1f4bc7166b0074ba654fc3d8aaa79a2d8b1de9a3c956

Download Submit
C:\Windows\SysWOW64\Ecgcfm32.exe

Filesize
97KB

MD5
1a57d2de79327d7efe20bf7303e90fc3

SHA1
beb634f5297e6f12f7798b32b25fd8da5928abcb

SHA256
0bb15164d7f7a5a0f100d5cf478c07ffa763e164922d5275faee193b9b77fa6c

SHA512
514706c4ce505bd5d7d7564080588a5e8ec471cf23df6deb996a1c18536c2200ec57a570fa0401f2d611510e6eea845d457331b96c1abe37c6c49e6664203fa8

Download Submit
C:\Windows\SysWOW64\Eciplm32.exe

Filesize
97KB

MD5
45733988086cf1c8c7d2a02d1175d711

SHA1
67730d929978735c44d2628e880a120cd57febd7

SHA256
cf435c3acda0c7fcf03533782daff155f5356bed0f0df1190446f2d09c564b87

SHA512
194626931c83975d0e65f30e501c229a884d5adcd15980f8a59294ce29c57eab690637d4148fa086fea76b11ba94ada1fdeeb0a43e1baf8774beb4f89d62d34f

Download Submit
C:\Windows\SysWOW64\Efccmidp.exe

Filesize
97KB

MD5
56022db66a07e54f97ab2f7ea4d72965

SHA1
e6fa72b5f1991a4ba70b75dbeddf6e191aba08e6

SHA256
7c5745fe350900369fc0697b395421730789d1714de610a42a28f1c92993bc16

SHA512
d4032ee611c7790ad96ae0b6ba2cbcb7be8f7a0c3d72d20ba452ed30aa24fa925f3a258713a82f31b8d9f442fff0c67cc0f239e4f9630fc27d1f73c1eb684cc6

Download Submit
C:\Windows\SysWOW64\Efepbi32.exe

Filesize
97KB

MD5
e72843471c73723a3429885c5a68b87f

SHA1
3b000bbc7cdc06bba8b54ae0361a8699c20a0a18

SHA256
7fb53257d25924f811b0b611c3630ff7a8dfd0b5dfd29a568167dc25e88fc6fa

SHA512
e38c118992bd2b4a707f9c3c2c663cf0af005301490767934603552e6a6710253652d93d1b15adcf9f657edb67898a57842ea9715ed488bc99f00ecc9a206502

Download Submit
C:\Windows\SysWOW64\Eiieicml.exe

Filesize
97KB

MD5
9c5c24c2f2c8015b3f75af3c5d087094

SHA1
a77cc49899b416d9551f8c1aa534eec12edcff1f

SHA256
7b2ac3bd005f37fa0eab3a98e1c26f75430e5b07a6de63b915a3ce01c9c78e6b

SHA512
bd9decf23577ffe2cef1822238bfa758d962a11f6304d99d3bf199029e106bf53b0646fdc17414fdd3d0a2daa331dc311f7590987422105854cc6927c086a314

Download Submit
C:\Windows\SysWOW64\Ejchhgid.exe

Filesize
97KB

MD5
88de03d70bf04cd16ff8184125501007

SHA1
1bd28594d6a37c90b86161417b2ee09ecbdf33d0

SHA256
8cd7b1297737a9e19bfc5d419b19e7af6aa9678cbeb48b1fc91bb76a80b1328c

SHA512
972d37fa1193f7976ecf0f998cd2238fd81fed9a96acc111e4661df474664a24e7494b523153e0c667d794a5043357e43aad2618c51c0eceec466928aaf0aeab

Download Submit
C:\Windows\SysWOW64\Eleepoob.exe

Filesize
97KB

MD5
f3f3ee26cd5ecd2d1e8c8390146d0ef3

SHA1
26ed0fcd40c0fe477dbed11b4c776eccc2093c5f

SHA256
285657f300743236ddfa35ceae9aca7dc9e4481455136fdb031236b692ab89cb

SHA512
dacfe46c0e58c31392521299e43d244a2790b05400dc60e33f1c23de16e78599612dd92b69ead1c2bf6d310c2ee41a3927c5529a6f1f25454571bc04b26be189

Download Submit
C:\Windows\SysWOW64\Emjgim32.exe

Filesize
97KB

MD5
0983dfc553fa92028a8c4ae2dd98b3af

SHA1
6aacbe534e4da04fa945e0eb388a823370fae7e2

SHA256
7cc973dd307e7e2c51a5a651c3d8c72d65bf7970062f9bfc0ddcad302a1763b9

SHA512
98ea0f4e35a9a8e700c4d4e087b7673e592a9a573dcaba2ccfb5f6fbda27f9d6a4a0b8c0d04b55bf62a0d5d50b5288ba1768cf6c68ff33089eb2d42a0bd30916

Download Submit
C:\Windows\SysWOW64\Emphocjj.exe

Filesize
97KB

MD5
a3954cc385052c3c1d787d2a1cb5b004

SHA1
e573169187d46c7df7fcd508c59fa5a254ae7f00

SHA256
a1c04a86f31e9abda4e956d24fa2e10f408ec0a16691f82a46959251021142d0

SHA512
e802def1c270d3d0b0c1a528bbccb923484f7142783179216c3a659bfda5deb4b599bf44b734e5fb1f9299c6aef41ae7e376d221d9baa073e3ed6edc57352989

Download Submit
C:\Windows\SysWOW64\Eokqkh32.exe

Filesize
97KB

MD5
2bf8211ef2fa76fe568ccb86d556517a

SHA1
156072e931d9370e342bf07024924e87315d846d

SHA256
dd68556a8ec4076c18c1a197cca19d88fd5a26973e1b6609d957dcc05de4ac9a

SHA512
db349a6fd6b6e64765c40c3bd1c080b91cbafbf433b2c43fde47f828638d763e0c25f21a2353c66fd8ef6a1dd9648cc35ff8475d7fb60c13f1944a8c8c82f584

Download Submit
C:\Windows\SysWOW64\Epikpo32.exe

Filesize
97KB

MD5
9c129fdf5e4e7af3cf111ca91684657d

SHA1
adf7a65a596cc13d0c307b07237ac130e1291fff

SHA256
2c3835d35fd7b31f7e5f7d83203e2086c0284f9c043caca27d3a847cfb0e48a0

SHA512
1b2c6cf8d4cc084d36f83d0bea67a0dcb809466d61d405f3a82674682e33e434f88f7369309e2c9f732f5c0930d2d7a0ec2e4a43403cfb80be142a4af5598c41

Download Submit
C:\Windows\SysWOW64\Fbpchb32.exe

Filesize
97KB

MD5
dfc6f3d9c5d2702b278de8a710578f22

SHA1
82cc8399285bfbea1447dbc55871d943009ecf2f

SHA256
39d5b0d0ac7667548c7e097df8e1934f453abececd460ec22665141022d174e2

SHA512
f6a97e76e4ad44128810bc9a46960d4013071c1b814ab368ddf7d103fba94c78d1753fd78a0f8b9df1cc79903e7425f71e52782e44566af666533022c48e91d5

Download Submit
C:\Windows\SysWOW64\Fcniglmb.exe

Filesize
97KB

MD5
5931390c31416e1cb421715c03d1c5cf

SHA1
df7a77c415dc2e9de443f340c9e411d1d658344e

SHA256
0ff50eec6076447d35a75824a64582d904cbc7800b5671ff2a23a4d65772b065

SHA512
c56399cb1d94821ff70d5248ff58e19cc4bd6fd2f12da2a4dd125d9fcccbb67504679ed7e41093d2107bdfa9dd79af17b3091bf1c76c17c2256a813640648c96

Download Submit
C:\Windows\SysWOW64\Felbnn32.exe

Filesize
97KB

MD5
8b5373c356073f481c2698e777917340

SHA1
f06d1151c9c4cce57c1f714bf587f6c62ade7a9f

SHA256
1ebe8e8aa440963bf4a66afeecb5d27e39daf266d3b4bb1e8490b9840f2aa544

SHA512
f233a980b17c6ac165abdf2314c1ae891f355cbbd8a013779ad35f9028c962ba24f634d9522f1996b54dfcc3e26824db7bc7e39da4db69e973e8ee02ee221b03

Download Submit
C:\Windows\SysWOW64\Fimhjl32.exe

Filesize
97KB

MD5
6fd27c5002c0a483a693ff0578f55c4b

SHA1
d4f68db00d02adc77473736aae8a6720f7b398b4

SHA256
55e8f6b5bb5aef9b290b7e432085db7d15d494fddefd915d04fafbc6d024adde

SHA512
36f2741974463cc0c134c77e6f0eb2b3b15ece5d13c3847ce68a2198bfa0e772c0e641070943cdf7139499392206554637b8e284e93bd4a623c1a7f5137da16d

Download Submit
C:\Windows\SysWOW64\Fjhacf32.exe

Filesize
97KB

MD5
0dd9066b9ec5f1db45d79c92d3d27644

SHA1
2b234e00a0267308b6fbcd37231ec8584824a2c6

SHA256
4aca8783ba31630369da267f72950fc0549940b0b827419394e5836ee346a423

SHA512
23358d3dc1ca67943ba5a70ab9eb13da80494fdcf7b3273a24ee41e0419cd4052b7910ee9c4535932a5753c5aa1d934702af96c753ce0ed6589f6c676a9cd2c2

Download Submit
C:\Windows\SysWOW64\Fjjnifbl.exe

Filesize
97KB

MD5
da2fb4ede9e536efacc9569be3f939cf

SHA1
d0e5538e33201f37a0b8697cc53ec93202bca883

SHA256
27e2450f536e81dd44faf87a5fcc7d52626f134cb9944c4d61685dd301ddb498

SHA512
9bc63797533a6656730847b2f11238926ea47b9dd762be7a7b3824c7bd244d1e6cb45a812cfac2c4f38419f4e652c8b0c8eafcbba2c31cac4528965afb101356

Download Submit
C:\Windows\SysWOW64\Fjmkoeqi.exe

Filesize
97KB

MD5
b3f5050935a62c24205bd32337321597

SHA1
0fba422e5253b6fbb503723b8d5d3263a72cb79b

SHA256
c0c4c05c8fb48b17ba9dd7afd268b357c7e8334f12deca0f3cdead05bcb4cd33

SHA512
dbd97d3961ff8dd2484e675aee17e3076e01b25ace0c8d4b25c61ea83cb0f0b560423c8a478b2cfc9c0f1bc8a3e7dae42ed5a7b97474ad724dc1942d026729dd

Download Submit
C:\Windows\SysWOW64\Flpmagqi.exe

Filesize
97KB

MD5
469ccaa9ee0ef93e0fd27d7a3f1f0855

SHA1
163e1fe4508154dbe7b673d261713be7877c0b31

SHA256
48d5545258b4950d1c1c9808dbcc42b6f5795dca3fcdc878288ba990503c26ec

SHA512
88b1ce6710f055f720753b409c3d56df59b9335b3b68b24f02ae4cc629e513862cd43f89cbdc2da7c4f50cd370f287a37bd9b45f1cefcb872217a55d5ce1e606

Download Submit
C:\Windows\SysWOW64\Fpejlmcf.exe

Filesize
97KB

MD5
6f3026322597b8d0d8e89b66c6cffe7a

SHA1
b5b8ed738f37e87fc1ad58fd5ce692e190e243f7

SHA256
499d50b924a9ecd2fafa2cc3ea21849a34f7757315284cf10c2af7d3f5e19fe3

SHA512
48c9ea26f672f744784f47672c85eaa1ca9923bcc91bb171bf14fce8afe6e22c26b5f7d87b425f93b91f76ff6880af0959211cda8f357e78db8b81c4581a7c4a

Download Submit
C:\Windows\SysWOW64\Fpggamqc.exe

Filesize
97KB

MD5
e7324a708055882ff9e5f6530d1b8de1

SHA1
9301727473c7a6db2b2f4e7a8d0e8ceb87f7815c

SHA256
4bc6f1ffb8a897c8c750f121bf4322220bfdc4b0c3254d62c4da290d790275b6

SHA512
3edf9c0c10ab6ea36ea665ed31bc73d0666be09bad346d13376e79064e2bee31017756e7208159e5429a356266bdc85b62740c129f0057628209b5c5d2f16f07

Download Submit
C:\Windows\SysWOW64\Gbabigfj.exe

Filesize
97KB

MD5
0bd064af49cef0780c4f0812aa142877

SHA1
0856a2be36722f0e24bd02b04139db578e968d39

SHA256
c63eda8808e11771dd74015d3bb7d1d7b173229e0cf7814c08bffa9b1442b73c

SHA512
75e9b5433847eadaa050af46b5a3786d9092f3d8ab2a1ee67215c5f953fe2dceae38f115e1588b55240c4d0ead7e9b46c9b6ff2ba7b2f0957a9a47e48c4ab415

Download Submit
C:\Windows\SysWOW64\Gbfldf32.exe

Filesize
97KB

MD5
1e1b54acda078ceac3e8f6855076a21a

SHA1
d12e0c84ae02c1c22d6ca12fc23ebcc82ea71319

SHA256
72af8a93e9ed3028b8cda768fb36a9925193381a774a47058d013c40a36c7ca6

SHA512
03a968a04ee877b8aeb2b8e59792e099b2fef91f5fa178aff012b17b2160f61eedd07f953a8a502a747038b8e08b79d7ec9c3cfe00bd9aae08a894260d7ec1b5

Download Submit
C:\Windows\SysWOW64\Glbjggof.exe

Filesize
97KB

MD5
38ee4ccbae2bf701f5030184f544f5fe

SHA1
448443d3e79e7962139e2f08e3b24b18e3a24afe

SHA256
f211f3444c96ede5948a082c412d4b5603c429081bf3006f954fa911ca3518ab

SHA512
d4de3c0ec5765b9faf55613ee5356cf069c6a899d379df53ce6194fc5cc2c43e19378111ac5651923231e0fc05bda57df957a26c92dc91574506eff691aea883

Download Submit
C:\Windows\SysWOW64\Gmafajfi.exe

Filesize
97KB

MD5
0e18d232df65676a373206e623f3d2f5

SHA1
bbe81dd10dcc848a60e3b83996092c3c3c346b97

SHA256
8bc2cf7e77d838ad54fc9c15d6f1929d87225ec10a64a0d93cf7c8fad53621a8

SHA512
6be3b346e8658bc8fe234f7f2ffe9d59b5195af800609d3e1851b43a7f61e4fbdb2ad8ad9334748f3df9ee3e305a83e3e6bd20780b4dbe28a268340c6a647a93

Download Submit
C:\Windows\SysWOW64\Gnepna32.exe

Filesize
97KB

MD5
d5df52768347b09db1e18d04d0c0cd89

SHA1
37a73c80fc01cf5350fb7344d3027646886c4d11

SHA256
4f987249d375bfd22986366033c647bd17f8be2a1d8a2f1f1eeac59cef815541

SHA512
a58baf7ee165eb085710ec66885ce24e996a2c2815863e82b4b62dd10b56c8f82479c86690b236518920a0bbd151bfddb1e026dca603f9e05aa280d1fefea7a7

Download Submit
C:\Windows\SysWOW64\Gpgind32.exe

Filesize
97KB

MD5
1030f9076e4617051bb4f840ab923497

SHA1
78a1c5908b99177e949ccdb7af9ddf0bc5188bc6

SHA256
a1ab11ea42a311dbf723f7530db01bd102bf92128013a59f3afd292608a9d6db

SHA512
db84d007b6ea1b3b9a0d4afea2247958eb5b7a1e70bec418674da7dae01eb799c1bf42726d27d2f77872affa4b7febb077222249122e9e9d2086c17a5253f1b1

Download Submit
C:\Windows\SysWOW64\Hipmfjee.exe

Filesize
97KB

MD5
0747adcc9f49b915068f67b295404fcf

SHA1
82dfe5177fa8d333794d11273d320c674b92d688

SHA256
e6d52bec4ed0234ac3788b6845f830be4c4e797d9508336531bd2433322174b2

SHA512
04a1ed501d5b74b8824641101766fc92d2aba534c6fc46a0d53e14888856134228e2f187ed906350f8af45df31865ee00c08751429dfdacd9fa8a065a5074298

Download Submit
C:\Windows\SysWOW64\Hkbmqb32.exe

Filesize
97KB

MD5
8d2e1e4746045afd79d0b17466208fd4

SHA1
1e8112b88e689649045abe5dc72b65fb4698fa6b

SHA256
c0909b76c02866b97c0f15c6114488dde0fbe2a6674da40323f9830f81736546

SHA512
49a524f1000e19ed3196b97ce8b6a14c937532a5e2352f83faf46b945eff813b3f6aa56aad277022eb2e752723f0a5404f4b1fee77f93abbdf308a9fc4010ae1

Download Submit
C:\Windows\SysWOW64\Hkdjfb32.exe

Filesize
97KB

MD5
90df79e12f60b4de6be09bb712077f67

SHA1
9a3156004ae535dbbd3d7eb2ffef48ebf295be92

SHA256
2deb239ef408a6abc09bb4e16c649e6ca6802aabaeb410171b6167a8a64461ff

SHA512
18f63a300599e80f71e2d3eb589bd31c0aeda0433ef3bd11fe89bc13e0fe5a762575a804c2ee1245e9e1a1002a5b086ef57d8f58146aaf1c4423cfed8e0e3acd

Download Submit
C:\Windows\SysWOW64\Hkpqkcpd.exe

Filesize
97KB

MD5
292c9fe8390b723ed8a40c1de968202a

SHA1
2f398c93c994ad049686117ff03cbcbf3caa775f

SHA256
14f354d3515b643d7402ff39a1bb5110e942d5b06eee292527e903322e5e9b5c

SHA512
c9ce3d29b9222617411b83c21f61fc49ae901514ec80f267bd4518e67d2a3c42e58acc354b0416c948437f9ec851ac67e17bcbff17f99c12eeabe7fc68006281

Download Submit
C:\Windows\SysWOW64\Hmlpaoaj.exe

Filesize
97KB

MD5
ba3c76af8c66bede3909a0c45cce027c

SHA1
5ef6b139a486d1d02dc5c761a9e77134831bb1b7

SHA256
bbbaeeece60445dce248b08d537b7bcde692594ed8ce9c91d3429f2b99cf9064

SHA512
61a2ccdd2bb0d7c8a10c1c2fd752d9e6902fe1add444ddeab85cbd50ae3fd66f368474d229185d88c25ce9ab8a2029782e44f80f2d9364ffa803d1d9463809c7

Download Submit
C:\Windows\SysWOW64\Hoaojp32.exe

Filesize
97KB

MD5
798595db1a3567306986d2639040e964

SHA1
4d600a1b6afc25a7166ba4b308c120f15a3a54db

SHA256
e4c80bc974233e63efa28e2e26a1840c521daff32ac0572042edd7ac6ab29141

SHA512
4419922505dae5cfb4881375952c7afebf2e79af0b1efdaa38992a632edc213503be55384e35d8d201f541cc4b775acffc135d1a3cb9b95345267f224f0f9eae

Download Submit
C:\Windows\SysWOW64\Hoobdp32.exe

Filesize
97KB

MD5
614ff5cb84b80e9127ac8fb71d404f5a

SHA1
5c67b161160a1288c4f80aad098d07c66d229e0f

SHA256
fe3566452134bae3acf4f9273dfddec1e8414cd4062607e5dfd5dfabd8783d07

SHA512
ff5d2edbe76fec3822d5bae1799b5d0759331e73b176b839ed4a22ba051cf7de8fb47132c0e3a1ae2919aead9b2ce7ed15ce2019b55401bfb82ace8d5b9827f6

Download Submit
C:\Windows\SysWOW64\Hpchib32.exe

Filesize
97KB

MD5
f0f56b1cb4ef19252a2bb5d92de03bc6

SHA1
6df7d596fe39cfb3d3b8bc9f50ca6ed48c58ec85

SHA256
70c97f56d59bf5daea4129f603315a94601ddb048d1416a5d78d83625a7235e3

SHA512
f07ef6e14ef5326de192f82c6f1460a09a908aaacb9f9e660f40347a38da91531b0d917e1f63e393cbd406e129651e01dac8a7812af92737b21ff98a8cf01b29

Download Submit
C:\Windows\SysWOW64\Ibcaknbi.exe

Filesize
97KB

MD5
9a164632f898e7f5d18049f4f8738f0d

SHA1
86bd2d90339ad505437fd510a8aae5448d172828

SHA256
f5ad3e0e9ec534fac3d60bee816770e838a29b848f08193283f945d3dff6ef05

SHA512
c9eda34acf566ae39a945c005b898186d7cb3dab5f42357a8dfb247b6eb567b6b25b161a9df060dad759b3df5b1f7f85d213168e6f52db4a9193cf2f0fb64c18

Download Submit
C:\Windows\SysWOW64\Icfekc32.exe

Filesize
97KB

MD5
944ec2e77882c3da14de8e4b278e9bf5

SHA1
ef627443ec29779847314022f87a1f7f44e3f44d

SHA256
86e7856a6596e97f23b4a360de2558324e0a4898b220d6b9441184e5cfcea960

SHA512
78afcdfd425fd8c1d0d9ec32f7c1cf923e5ddbaf5e1f81fde0d2221a7f954543a85a33746bf090872007a16dfb69524e629c1093e8fba6caf82320b82ffaa0e0

Download Submit
C:\Windows\SysWOW64\Ieidhh32.exe

Filesize
97KB

MD5
8eacc132d88b13a53a62ed3fed2f9906

SHA1
c94f357a22dc567d3c5986de9f3022201d8a8560

SHA256
0a063ed401ce9aed26bc6b5408287849f3205fdaa4ba44bfe9984c2452870183

SHA512
bac7c2941b0f6a1152a84155ed06b8f765c2479e7097660b3176b1cdb7d8ad76965978b0da6f94546694c2307826276ffe4428846829d2c87827ae0f80b18e1d

Download Submit
C:\Windows\SysWOW64\Iibccgep.exe

Filesize
97KB

MD5
04c526d7e868029180cbba08d181f6c1

SHA1
6be1550f2405af71c02177283473b19a8768da0f

SHA256
31e06bf3dc5c3ac1a5bb5f201b9f1609f044f6e654a5ea9d13b9b1505ca09ade

SHA512
910c0fd00f04b493cc8fd901bb09998d8457071be4c46f6d09b02e48e0c99c91ece720cdd47d12e967ce3f6179800ad78bfce020d7c125ff8d310b040196ea25

Download Submit
C:\Windows\SysWOW64\Ikbfgppo.exe

Filesize
97KB

MD5
4fbfaff24084be240b6476c0f7852571

SHA1
f9882860313ff7c2ea52581d08dd8fb125524628

SHA256
d24edd8da866c7ccb59fa74086e34a5061835cb1c3b6497c8e6cb64b5b25a5ef

SHA512
f5df6ef24ab65068fffb21226f1dfa426e277db4949742c19a33186a83bbce2cc424a801ad9bbb2b51f79b36ba205eca5fb18028db278c75b9cb45f0b92205a9

Download Submit
C:\Windows\SysWOW64\Ikkpgafg.exe

Filesize
97KB

MD5
59404b9c1fdc08330a9bf2463f58be30

SHA1
57ef0d166c6ea08d693ba053182deae1d4836de8

SHA256
82c2d97d63ba9af3c734922ecdad9f1ad2b6f8ea0480d86a4daff896290d94e8

SHA512
e789f3ca8ffe008f53c7772ae9ee545a56b265f5dc2963ede066c87c28c2c5f51c8506ad008c361c8e05a2d3a7fd4045463566bb82a04d86c2bc7cd8b558b076

Download Submit
C:\Windows\SysWOW64\Iljpij32.exe

Filesize
97KB

MD5
695de2be4bf0f2971d230664a37ceef4

SHA1
4b47524af6bf4bbf08078b310806aad01076d434

SHA256
4db463d44944d536af6d449c46e198fd6aafb8680365509f7a4d6db7f5eb2c86

SHA512
709e5f4a3db09debad55c42cda50b2cae99cfd735b4bcd4922c8244dc550ddaa4a968976e2d7fde6b99432025541c06c13a37e4521678c26697f6dd8ad545277

Download Submit
C:\Windows\SysWOW64\Imkbnf32.exe

Filesize
97KB

MD5
1a1da7a08595f3a9a36d45f5f02bdd94

SHA1
31bbe0a6301bfe75154509e6ea16cf825bb17b8e

SHA256
17d382974c0494b55d7ff19c010b55ba1360ee4316da6019fd5978e9514f17ed

SHA512
494166a1d199ec013c00de49d7e7dfa7b3298bab6d3c7d6f5ea3f73edd256e0de10265d90fee7f4145b351649ed133f71e2fe47614f62be1a7a7af27acb715f8

Download Submit
C:\Windows\SysWOW64\Iojbpo32.exe

Filesize
97KB

MD5
cdadb89d706b17630263376853e6227d

SHA1
42ab3c101815471c5a96f851907d1f57d97ac9f9

SHA256
7be4776bdbda2c5240f7396405cbc2c3e4f3efa8966b30a63aa2eca3e9bbf9bd

SHA512
31f66a6c3c00b54b5d7769b60831a5b00f2482e04bdd61591386f4b35e1faa481996a8c046cfcd90c7b3091215b9c78cd0e4ac8a6f6d3a445f5526b0993fb9fb

Download Submit
C:\Windows\SysWOW64\Jcanll32.exe

Filesize
97KB

MD5
e2f3702414fff0b8df999ff9bdf8c7c3

SHA1
4bb4103ba48a0cdb6789cab57faf69694ae0350d

SHA256
37dc376053c546f84931a86f71e89955ee152b4e217ab5015941396c71ad2e1b

SHA512
850e68b22e3c504e8a10bd8a32f0bd7529016ee7c3a4dec8f1228296c0f2023e286ab57965a3ef3eeb024c3bfc0daefdeb8ebc5fcdabd0a1a5e6be30717998d1

Download Submit
C:\Windows\SysWOW64\Jekqmhia.exe

Filesize
97KB

MD5
6334e4adedae27e7af650a7f7f337778

SHA1
2aea6f30dbac02f3bca4c9d2815e5bee49f95dee

SHA256
0a9f3a662ddd4dab85fcd84808e27d8f0b3da80142359e6197d894efa2afacfe

SHA512
fa62a293b49f679bb9d0af64c4b362a648c7aeab1b5bf8a78ac0ba7fda4edecdacaf3043ddb9a6cfc1e22356319b31c1f4285298c10d5a9fb327abdc065f62b9

Download Submit
C:\Windows\SysWOW64\Jfhepbll.dll

Filesize
7KB

MD5
addd284420abdb1b544e4412b88852eb

SHA1
fd398799f3dda6b5e9d12cb09aca895cfabb9027

SHA256
797198a9fee6f0b71f18af1a609c343b1a2327f09ab19599dfb2f67f2ba83c1b

SHA512
23556b1af6684b4940a0590cadf5a009868b36cbfd67733f33314f766f5d4124dac3363eb902b43d62d64ac465261a5fbe80ce2c9e6e6d7193a93fa7e54a6d4b

Download Submit
C:\Windows\SysWOW64\Jgbjbp32.exe

Filesize
97KB

MD5
9dc830f1ddba988dd5e4af2c44d0715b

SHA1
34861b5d1bfad81c5d7bf55b60c391f6ef64350b

SHA256
2b1b55905fe73dcba322258034d0bd87b3b58d74dc8e97af1c6f75c609c3c4b9

SHA512
71eba2b659d581d5162d3ee64033a378f07ac0dabfb05830c5f07cf6fce618c1214de004a56116444fc7eff80e581cd668ffacc238e9dd617885c23a7a23b96d

Download Submit
C:\Windows\SysWOW64\Jjpode32.exe

Filesize
97KB

MD5
103a7f21aa29f849b11f88d8ccce25e4

SHA1
ca734709184abae2419491913f9d720882bd22d4

SHA256
edd11ddde9f7224d447fdc817edbe70f6be218347b3a189c8fb5df9bd5be8391

SHA512
1081c210c5224172c77701147bfe96a4838e9f1dfd9d939f8545d40397b6c13912d46c254214b3a580e61be86a9ee68d2a68fa8abf1dec7f6fb1dae92d9d0fce

Download Submit
C:\Windows\SysWOW64\Jpfepf32.exe

Filesize
97KB

MD5
ac2a7dda00bd71571f5f2bed78138c39

SHA1
893924979673c6e95495d8fe519498c854773a0b

SHA256
70d4082f14e90cb13440288209882859a43046e27ae1d58cae1dfd64662e5d0b

SHA512
b8e7b6dc16ee27dcd24fbe32fc04d9de6f9159e98d9368f7ff136701ec160324eacd34fefde8f14573d496f0724c13f4243ca4574f7ce72b8a5bb8c8b61577ab

Download Submit
C:\Windows\SysWOW64\Kcidmkpq.exe

Filesize
97KB

MD5
21958d1c6dbf1d8020681631f3654c0f

SHA1
f2fb5e59ac48b40a8756acf23b42f6c1b5f81775

SHA256
3ec12a749c2da3a625708974af28caba39e358d77f2922d8df3a3994a89f0ba1

SHA512
2e197d002c8b679561d6ca9a65283a2262b88eac512b55d89a16020c9f4d92535f31ecef22e2461a85703be2440c1dc51c0bc044dada8beae2be4ce5dc6c32f0

Download Submit
C:\Windows\SysWOW64\Kdkdgchl.exe

Filesize
97KB

MD5
6a554655e7ad51030af746748f27ae4f

SHA1
5a67b094fac3a1c5a1c1ac248d8769ddd72adbcd

SHA256
0fb2579cb1e94d56646801ed5e63f16332d8e83f24befea987c90ce9d6816ef9

SHA512
8e1c867ca9dca4f576de181b3f099bf63bc452cc0d9c8852a73e2de53e7cdbdb412b9fe05efd4132e96842561b26127a4cee16c58337d766cc9300133e6b0bd4

Download Submit
C:\Windows\SysWOW64\Kglmio32.exe

Filesize
97KB

MD5
dae88d1fea1240505071729f1946cbcb

SHA1
d413248e4f17a204461445e78d370c817cd56f04

SHA256
0cb10e7a49e7de20b15f3d66357436ef47a5afafc4a2ac5f825dc2bf32e184eb

SHA512
70b72173324d2a6d061bb27acac2466c8d914d4bf8afaef0b314b1238cfbe1cbc9dabf0edc538a693bf7b78b3718979f370f3c87a5445319239341afc3ea187b

Download Submit
C:\Windows\SysWOW64\Kjccdkki.exe

Filesize
97KB

MD5
c531f67b93ef66d6e28166280d1cdc60

SHA1
cdc724aad91d0d9bee50bbc456a22fcb096d4814

SHA256
4cb80f7910841d9cacf563b885af93a853f11d990300b42983ecf0173fe9a85a

SHA512
0e12f564fa8aa29363f9ba4299454215ed53d84ca824b067201e1b4c936f38870ed41911babf38bd00ee412b1f4571fa7b9d039b3d982d0f21457f5e892c63ed

Download Submit
C:\Windows\SysWOW64\Kjeiodek.exe

Filesize
97KB

MD5
264411e23cda606a3a283384b6efd839

SHA1
28d9196c27f912f83dabc019ba976ca92e28b657

SHA256
f139c62dfb63c23cef41fbc95e2791c4b046bb396db3fc7c15e2ddbb003cf491

SHA512
0b882c669e671f562c6b70be4102e313f5110cc3846cd5bc7db18ac4e6622b1fa464b41716fbf931032f9898166d7d69098ac74eb341e6802c97bc2bed627fca

Download Submit
C:\Windows\SysWOW64\Kjjbjd32.exe

Filesize
97KB

MD5
2861c800110a5e49c224df04e0a936d9

SHA1
ab215321e93ec85ac15dd12ba589bde05ec5b6fd

SHA256
0af8c4a5f7e35b9d38025871bd6e6ade84d7a32663a4aa36f81f2eced437d988

SHA512
729adad06ce7a2f721b132e952c8c146c7b2ac79c542a5768e304482b30bee8d40a8700f21f63d9ecc6167b7198f72b69322ff04cbf24b946fde587cedcbb17c

Download Submit
C:\Windows\SysWOW64\Kofkbk32.exe

Filesize
97KB

MD5
4c201d010bad535ebc3240136c8452a0

SHA1
5d73a2637b41257d2a32d3c6ca80148a51fa1d30

SHA256
df224491de0e301d5fd05feabe5d3c73df852247db4bc5b459d53760da74ebac

SHA512
39c5c0c0fc8dce5d3deae7ba18110a5320d36d162c3c273295957943b536dc747d91d0d826b74f128337768366cb50614c56c9538815bff031229b1908df871a

Download Submit
C:\Windows\SysWOW64\Kpmdfonj.exe

Filesize
97KB

MD5
77716a741cf58f1f460777bff6d5e540

SHA1
1f69940a6ae3ed62825059b69402ba1de1b7f333

SHA256
255d204378619c633a298d84ddd7480d0a6eef2581006510b6004ec55b24ad1b

SHA512
1c65da1a8b9446f0248d2a1e0fc02d30636390657f5b0b52287c2fc693be3c60b24d8289bbe3f4a4cccacd59541a09e5935c3f7bf0b8cf82034c2a57213d36e3

Download Submit
C:\Windows\SysWOW64\Kqfngd32.exe

Filesize
97KB

MD5
fab28cebfe36c834e5e635f1c495dfc5

SHA1
c39b5cb0f3ac0214eaf11cd487f2f86150c5821e

SHA256
ae916330c02f39b3d309604d5ca223f85a2655a4804bfc11a7bc1e0fd99b36f9

SHA512
d6661a591091a0f32bed33e770775c8d59364cb99e029c3167010ac26f6f496ae82928ea9cf92dfb476f140e556044887c0b0b4096b80dbe2729d330254938db

Download Submit
C:\Windows\SysWOW64\Lcdciiec.exe

Filesize
97KB

MD5
1a364fed93ffa44478816aa7b9a4f4bb

SHA1
cddf45929859a4c6268de8f4098ec979aa998b9a

SHA256
035afeaae336bf294da90b8b4874e39927c693c4100f814a463b18708946f520

SHA512
d4a2347916281139fc4a69ec40b058afe3c8c596a59562ac87f4e5e7d2c427f3ab6904d032d39f6ef10c1f235f956a69a153a200c5d8b7905f9e90d4e151c3f0

Download Submit
C:\Windows\SysWOW64\Ldgccb32.exe

Filesize
97KB

MD5
b20416ab7dd6633ff48a45f5c019c32e

SHA1
429b8a1afe5661588aaf41548ccadcbab0870f5a

SHA256
c18bdc1a62b61acc0b6a7a5a5bc85f3ad18eb0efe7050e784c3a171b786ea58d

SHA512
37a3e9a35e2360fab426808631544d8f3d0850e09c796da5bf0756e3b27d69cb000f6691a90c862bf5e73f5c95e3cd9bb78b04488603387737da5e905fd09942

Download Submit
C:\Windows\SysWOW64\Lggejg32.exe

Filesize
97KB

MD5
4c0579947789ee2ea0758b565e576775

SHA1
31e4413218785cac618a2178993c16dc3aae6d8f

SHA256
6e13cbfa47fe476bacf989a8220304a058178ccfa8c4a29cfb797e6ca4c09b21

SHA512
a977c4a6e179b2d8196e3be6e7d599b5e6834a2fccb61b57aa238ec424dc73bc19b82f9f420208136cb1dc9c2491fb9441110f172d45465cea379e6b42bdadd3

Download Submit
C:\Windows\SysWOW64\Ljfhqh32.exe

Filesize
97KB

MD5
a519f4f417e200e8a9148a06e15a921b

SHA1
649098f66e714353eb08a2abeb99685ecc9fe2dc

SHA256
5754cbdb83386e81f39b622dbfe3c6ef87335bc71e3245ce58c49144b47b4ba3

SHA512
924944863813bdcf061ff4a949066c02cfccaa65c14cda46f53a0ee4c7098c9e94c419cc50344f982e1f2ff496f56ae8ec67568679e8e17c798ce56b0df74ce0

Download Submit
C:\Windows\SysWOW64\Ljhnlb32.exe

Filesize
97KB

MD5
38e88358654056d0bca7dab680dc73b6

SHA1
95f932905713a53a9579c55d4f69ac73fcd30be5

SHA256
9373a146e6b6728df82f7df482560a99e7dd2d0d15b646eac46fc7e330dc0c3d

SHA512
cbf5a0a2b670d5eaeefd0c5799bf79cd379896c668c60f52b2eff2b3a4cae6af47a01f53269a95e802f1107bfc759bace08f229be68d9fe2707e99d4cffad7e4

Download Submit
C:\Windows\SysWOW64\Ljqhkckn.exe

Filesize
97KB

MD5
7422c15adc6405538275e0bc90a3a5e0

SHA1
de7d3ffe907fc7131ca20250f0a42a48882e0063

SHA256
2c6c26b11a55952c786718ffc500bb4d525c41dcd8adcdc7d68d918dfb98dc58

SHA512
86f33995d7b20982b1ec423d45e8742319bf42942bf911d4b66945a99a5d295700472a32e1d05f7eb7d95c9dbcece3efd8a9be66599fddf00710dd8fcaf626ca

Download Submit
C:\Windows\SysWOW64\Lmdnbn32.exe

Filesize
97KB

MD5
b8a2749070eb9e4eb63a12846c63851b

SHA1
c73b43951ca107439b782f6417e7e0810de572d5

SHA256
e40f541bd5de78274fb8ab5d4b99ff89cad3563a68c2c01ffcbc5e5013f56c9b

SHA512
550f7d7e6e0820dce5a31d477d695a7b9494d3021192cde664a11416bef1e87558169aba4184815293967b6f96dca713ba1e6dd7eb27a5767b5522446e66c05e

Download Submit
C:\Windows\SysWOW64\Lmgabcge.exe

Filesize
97KB

MD5
7b16491202181b26748e0ba141ab3d8f

SHA1
a824fb977e1683f3be0e69d46f039006ded276fc

SHA256
3d1550d6e79efbb0ab997abe09a0d767443ae25907ad1663800e1866d37f87a5

SHA512
16fad07bdb28a3d05721e3d2023a865bb845e6a4fd68af8b931fda46831c2c318bcba140b0cc561530fdfc9fcf0f19a0687b7ab4ed19402d1385764237fe3261

Download Submit
C:\Windows\SysWOW64\Lqikmc32.exe

Filesize
97KB

MD5
2c168b36cd708be8c489abb720309fff

SHA1
250c314b0c12281f2ac296ec9b74cf2465d4a16e

SHA256
a7a43aece9a8496b3040e1a526c2235569f781d7b4226787f8620b6b36cfbe13

SHA512
fa0c839ee92446a0c311bc42f1d0b83091e5a5d8725b35fe30a552f61bdb4ca3edaa8c119302c9e7093a4141610cabf4adb7908f8752501fbbeb8d5ad62049df

Download Submit
C:\Windows\SysWOW64\Lqndhcdc.exe

Filesize
97KB

MD5
30896fa814d5b5630fd31f855b36c368

SHA1
e70a30b5e1919c0616a1c9632de3b1f2dbadade1

SHA256
9a29866e0bf5702bc911a44810d34336d3c31a8c846b59909556093007f62f53

SHA512
2b4faacb866499188e6a594f55aae206afab56a5b93ad7e75f16fb10194a50ffd537d384d6e7cbb74ae259b168bf83e7957a3c5ebccad541c48e2205e0dacea1

Download Submit
C:\Windows\SysWOW64\Mcbpjg32.exe

Filesize
97KB

MD5
24e0affe93be59cf17c6900b7b09252d

SHA1
30dd12803522b02629bbb0de8b42f6974d2c380f

SHA256
70359c1dc288c2265c90ad4381e0bff1921ce978296778403d72eb74583651cb

SHA512
c1e53e0910c679cb87003c1a0bb65340832ed02f9af9fc181d50a63f3e71e22130ec7f170b0b7e9afc801d4ebb0d9cdb0e4f8c6ebb5b45be6c5cb1d6263b9da9

Download Submit
C:\Windows\SysWOW64\Mccfdmmo.exe

Filesize
97KB

MD5
10e2b6f98954567b989ae2ed9427fbee

SHA1
ef3ed09d734bdf32f4a18e30185695a2b3cdec05

SHA256
6009a45a0867156d14902baa3a45d12a5b0648dd74c23fa0b80f1f821b44590e

SHA512
4ba10a5691669c7766b609b2d69823ab47bb720cb2eb1cd32fe3b780639ae34a9ae5029dcfe6f538503817f8ec03ce92e16c866c5dd29b66f5c9a9baf8584ae1

Download Submit
C:\Windows\SysWOW64\Mgeakekd.exe

Filesize
97KB

MD5
4f620889d192382adc0947d9359a1c7f

SHA1
56ec3c9ab794fdeeaf06beb0bd327fe5fcf6191f

SHA256
65ba073ac53990467cd4f040391a2e69f77319a0debccc4bfb397defc3507957

SHA512
0ff2d5839e5787f49a51528a82c49abf31b56136ebc4232bb6331e2cabe8448517f76b9512de716a3bf430a140d8422b2a0bfc41a63f8a32836fb4fbe511abef

Download Submit
C:\Windows\SysWOW64\Mjlhgaqp.exe

Filesize
97KB

MD5
c493af94c4def5ef056c2be7aad42d10

SHA1
596b2649223ddc74fcb1cb58a68596a7e2243470

SHA256
37f8655454ad38cc0d4954e5ec62b92048e7574e399b8991a23fecc0aa48d772

SHA512
bc2fc80cf2b14d7cfd3d9f018dc6ad9dfac59adde9281207580c5537243a3f9cdb23dec9223070a26fec49ad96ce581e7cd116639b70cf0087671143582c2d44

Download Submit
C:\Windows\SysWOW64\Mjodla32.exe

Filesize
97KB

MD5
14ea0c1e132df87cb5a0edf20357ddff

SHA1
dc6393149c0debcbd8b62bc5e318675e56332a19

SHA256
bb856221578918e4f320ce86757b9e1ab94fa38f5dbb10d1a4bf8e176d2b91b3

SHA512
27e70e9c8270c3823882f2354a1154815a823351556a48475c7a6b67c33f205aab051743ea13a99cf73599a145f0f29e20b78c64f24fc053b896e9cab4417a5d

Download Submit
C:\Windows\SysWOW64\Mkadfj32.exe

Filesize
97KB

MD5
f7ada4e808c46c2edae560533865488b

SHA1
4d19681dd22b6b74333071c17151c6c5b12616c0

SHA256
7ba03c3858b5c86c3d6522e919a4d9080f30aba7f8e8b9f198efe448c05ab748

SHA512
e06c92e9903214c6425163cfbd07c27cecab3f3dae7576e826364a545b0df3b917dc782c6531d992582a29051045e0c55163c23cc22d69b7c2df3dc64f742a0f

Download Submit
C:\Windows\SysWOW64\Mnmdme32.exe

Filesize
97KB

MD5
f1d440bac3ef4cba0c86e05d2ee5e646

SHA1
56177226f258115fa05380139bfa6134363d1187

SHA256
e7743f7a50fe61469c339386ae60b32bcffb1e9d4c4ce7e0e7b089b4da66d7db

SHA512
c45960280c293921228c42bca41bc8c2d451a51cb40adbcda44ad8c8b46d77572599bfd267eb0f2c1022ecf8561bd2aa9c5abb27c7423eaacd3f15a242200842

Download Submit
C:\Windows\SysWOW64\Mokmdh32.exe

Filesize
97KB

MD5
ba0087ce5a0913997b6fd248e68ee887

SHA1
db261a5061441d049fce08fac6dd452c7848f776

SHA256
15aab9e3d851d4d20eab45fbc2a5d2d4605f8d5c9b87a1f6f8570feb3d921202

SHA512
e8ba488a94ac765e4fdaaeafc269e4641be8d177bf7bdcaace8f8d8d2c5c4372d4d1ac0bbd6846becba87a219adeb0f412b1ed4e50a3d7a9f0a706c46173dfd5

Download Submit
C:\Windows\SysWOW64\Nccokk32.exe

Filesize
97KB

MD5
a65e7ffbae880d0240e9ff420db942f9

SHA1
7d25d10cc05e08969769d135c4c575bd0e7e3bb8

SHA256
fda813f0ce1539e8da20c2b9f775d29009f62f5cbdbcd729536e02ab34b973b1

SHA512
412094f0b9cf5e2939ed0f7cf73b88f502a9b37ff5b533037e9bc9909e089d4d552b4e2e4b89151b645cb467c281e2d599be7e788a9c759cf15a3331a549fecc

Download Submit
C:\Windows\SysWOW64\Nfohgqlg.exe

Filesize
97KB

MD5
08f785248741079c3fb64226615ebc3b

SHA1
1d87d1feace87c4e0e1539750e6783869075d6dc

SHA256
40f248ec94de9aecb93ea766a7f416ce829ba7ee57d8521df7cac3adb4f66b2c

SHA512
a41c50ef8bd56564badad513c1219f248ac5ad85c4dad262ac27143455485b2e006fa214e57a3e49d33741850ac9d0c9802a50177a1ea79891de6a970b199a2a

Download Submit
C:\Windows\SysWOW64\Ngjbaj32.exe

Filesize
97KB

MD5
d145e4ccdeb6395bf8221049246875e3

SHA1
a611ac45eebd1279993b8af3eb906a3cd25d9351

SHA256
d14079bc2a6e9ec483767b7afad2c7b8bcbe147945ea621c242de1fe2c29b04f

SHA512
fa508a06a77e892f6f5cc25e53b0d5ba8de684e7586d7d58d033300f383739cc2d281381edae8541ed67d39b1b7a944186d9029a02947ba45606fa35157d266e

Download Submit
C:\Windows\SysWOW64\Ngndaccj.exe

Filesize
97KB

MD5
3b31b989cc033466f1b1d8f460a33e08

SHA1
8cb369e524e0a219e24ff179365d9469b95d4c52

SHA256
041dde0b1c098102408119c797c712e4bbd1bcc74600e253abdb030cc2111476

SHA512
d3ce4a8dcd29834b03968ea0e0b70646135bfa35279c695850f2f3124d0acf58d7b720c7b6c002f5c8b7bbaccf5791682d89d11ebaf6186d8dbe019d62dbbb6b

Download Submit
C:\Windows\SysWOW64\Ngqagcag.exe

Filesize
97KB

MD5
69e9cd20c03a7ad0a763a3db38cc5552

SHA1
0caeb761165934902a31784ea32d0627ba8dec5a

SHA256
787e27ec6011d4707ba915e43f400e35b06f1b76c8c1d771d2763ad7794fc366

SHA512
88f2aa3f6bfddf9607c6e19b357d32ce8c1d461d3e1f0c3d49cb5e95b5982987f1d0aede2a23d0206442ede73f36c1657dff23ea1395b83243c2901768453f77

Download Submit
C:\Windows\SysWOW64\Nhmofj32.exe

Filesize
97KB

MD5
fa8e159099e8c1732b75744929b33acb

SHA1
caf840a1baa8ecbdadbb2f9e357839582cb5d777

SHA256
9f155f3e5e5d321f0f775db38d252972ea0b0aa140a0147fb63dd69b15d270a8

SHA512
ac8d6498467e009830bf70515788c3412c7a65dab39ed085ff556f85fc4efdae4bfc85026fabb7333ab86e3a696ae01bd8d0651d8a827d22c99ab6847e8b26b1

Download Submit
C:\Windows\SysWOW64\Nlcalieg.exe

Filesize
97KB

MD5
2a1a44676aea179a39cc26c666df08c0

SHA1
a94cf5513fcd5d155f704de27c80c17e022b9d2b

SHA256
368a7309f1daaf4fa83a774c3b82ddec5714a4926c121fa3f6505180db561278

SHA512
722475cbd38fe60163b9767ba36ca6e0b959291c37a00c269e57433e43c676760910863f1b75955b69031725d8d7b0a981d3c879174f07a3ae5c8c35a70da5d5

Download Submit
C:\Windows\SysWOW64\Nmlddqem.exe

Filesize
97KB

MD5
f315e8e7a2e6edd611adb243be9fe145

SHA1
a5a86b05811ed7bc47030f3b06cf80f9b094d0ff

SHA256
edc5bec75eba0687a7fd1b5bacd7c1d8aee0c113f5e88a1ab95c5dd0accf9681

SHA512
258b1659b4f989625f9f76b2a22691de73a76764f21434c31e0f8f7185f0a50b258f70056050156deec3363607c8eb195c7e05befcdb1fa25be4df9fe7879ecd

Download Submit
C:\Windows\SysWOW64\Oanfen32.exe

Filesize
97KB

MD5
e4b1e3c55d72c3a130f52ea7ba27a364

SHA1
189809bfa6112df709bb505203c301029bb1908f

SHA256
af7c30e206abaf89d477af6545b40f6aa385afef8e807a9623ffc68b63fb8208

SHA512
b780acd74df8ce6e212c89b9ba2058f93a299347bedd3e204906adcd1e35e65f634a78c5f3492e35cf7b1ccf86875a77b8f99efdcf767eab75a0e39599904a26

Download Submit
C:\Windows\SysWOW64\Ogekbb32.exe

Filesize
97KB

MD5
810bbc7c2787732334fec49257db1da4

SHA1
75d4602beab9639f3ab15fef4c9fae42ab0afbad

SHA256
7336568ce401a8e37ea21c7c8b4858951c563230c861022b59d3d38d5cbafacc

SHA512
f5e50d33ffb50b60707df6fb8a7d9456063388c17129369c60754c4d8a4b132f4ec7f3a32a92af7259ea2d48cd9e0d02cd444c9c2acce63126990d26be0490a2

Download Submit
C:\Windows\SysWOW64\Ojbacd32.exe

Filesize
97KB

MD5
73ffdf6d36b0a66f51a87b6fb167ef6b

SHA1
d9cb77bd92a877790bcdab207b65d51fb469ee89

SHA256
6dd0222b3a3fa20708498989073041ac52e88005acf6a2e1c0288eca68eca8cf

SHA512
32033b7eb2f7cfba35e246b9678fa83db8435a43dc5677c639f3307a04379f568212039feebff456fc4495e00c4f6e9621e24131648e7f79dad8435908227981

Download Submit
C:\Windows\SysWOW64\Omegjomb.exe

Filesize
97KB

MD5
b5501c2ec3e83b8f162c5e4d9db0e348

SHA1
5196259ab202ab0d2c849fd99ea0049e6e276aec

SHA256
ea1da87d260875a68e8c0c057c37c5e29d425d76e93956eb929fd4ebc3c045c0

SHA512
a6bbf4ef6a7c24e3301a9480e95778cf1e96347f544514ea7ce9cbb69812152e5f2cf8d6f413ec19689a41990b0104542e361f739a6b6d36d2039265b0917bbe

Download Submit
C:\Windows\SysWOW64\Onapdl32.exe

Filesize
97KB

MD5
1f3607ba8e5433b1523bb5b8b6470797

SHA1
832bb52d4b77f44ccb192ff03daa9f36e9af1ea7

SHA256
caf548035ff7fce989eeab14152fab387661064387241b1b1fcd975800ac508f

SHA512
07fc3cad271ef069090aab97721f8f654beb3b3e85957c2878e07936eb93d474dff12a567c9a7a68050a398ca981c80973002b57bb9569bdd03e00aeca72ff1a

Download Submit
C:\Windows\SysWOW64\Oodcdb32.exe

Filesize
97KB

MD5
cb6c21f920947e6d4f9698c8e859615b

SHA1
21c79c1bf3df56c6c4e89d20f9271bd87ccaad4f

SHA256
8e6be0e43ae0cb264aab18e4ea0f19482d7dc7d2103f9b9723e7c93f29e680fc

SHA512
5a8e4a39a115255ba6a7d6889cfc30ec652a47e675d6e861729539cf6ddff4d25cbb3cc5479a95c417ab1e756e46b66111565782a6a049e1b9fbaf51d3c309d0

Download Submit
C:\Windows\SysWOW64\Oplfkeob.exe

Filesize
97KB

MD5
4aa61aa31f305d9c90d9808800842770

SHA1
00dbf969f382a288a17d9d1558fa77e6f5cc8e49

SHA256
d7170e305d794387294eb705f334b66167b7591a90bd55335ff5a93545ab9c08

SHA512
c6e56d56ff7262dc69020a79e963741616b326084d2ee17af630ca619909bda52d24096c3cb3dbce65730aef8e7abc7c0aac9a5fd545786dddd9165091ff6648

Download Submit
C:\Windows\SysWOW64\Paelfmaf.exe

Filesize
97KB

MD5
8a3269b0a3823797eab0901ff9f658b4

SHA1
32f1ab3fe0f35b4bfea82bbc7da1979cc9790557

SHA256
af00dd1fad2a69deb9259cc7717a021e63e4c7da15d3e46dc5823ae3a97d2f7d

SHA512
aefd71ddfc911569957aeec76bc0825dc8e717e6d8bb50f613a862de5ad506b180d2179237286c3b76aecded62f49b1006e49b2feffba04f45eab813fd332444

Download Submit
C:\Windows\SysWOW64\Palbgl32.exe

Filesize
97KB

MD5
ee600ddda73d5d1054aa38dc35741253

SHA1
6e16f6898f068424f782e6843b3346ba313e7083

SHA256
e753aa1965b6402cc7e275d8b29496de7453529aba285e2693a40965a5db5896

SHA512
80bb1ae77c30b8c23731e6e250aad81f518814998bebb394bc1c38cba1a44e2df919e748cf922705ce1c127a4c7c0bfd538d8968e2c2a6e711504272845adfb9

Download Submit
C:\Windows\SysWOW64\Panhbfep.exe

Filesize
97KB

MD5
9218b916900643e09a37887a908854f2

SHA1
2ca62ae47fd14673275de187380bce379d2fcacf

SHA256
2b5b960862a9e42dc011223c7bcb3e28889778aaeff558d9ef2746c3c6253f22

SHA512
34cd20c93aadd62f50c2038c37901347a30866c1c94f194c28c7c53443d5745334b259fef395b3a3b3f0e66becfcf817b7b58111c9f372237500d25a9b3c20df

Download Submit
C:\Windows\SysWOW64\Pdhkcb32.exe

Filesize
97KB

MD5
aa73a79a8dc9ac5de2beb4909dbcf325

SHA1
aabe075de33ce85db283bea8b163dccbe54d8b4f

SHA256
56a92a206226434cf03e1884ddd203336d9d36792b527c93748cfa6c70d59188

SHA512
868dcee1bfd3a029a65e8380f2aa871d1eb860a0b2ed934627426dc298bde02bef4676e7c3bc45341c4a3062a638913fe8659b1a2f41e06c6c533f57f2b1aeaf

Download Submit
C:\Windows\SysWOW64\Pefabkej.exe

Filesize
64KB

MD5
8178da4946921f427ad10edccb63332a

SHA1
0af35185b00e955f8b2a694318eaf309cae3ce3b

SHA256
59c513b6807261e3bcd14472fc4c7c5380bc80d6396560eb53857988a5bd0be6

SHA512
eb6365f1f635cb262abf1b465f64126b042b865f8b8bb5438b9c5b28cfe720d88538e4a3eb0bdb02bdae4f267e10d00298b50ffc849fcef3cb1e6629299a18af

Download Submit
C:\Windows\SysWOW64\Pfoann32.exe

Filesize
97KB

MD5
88927b959862a21b86f46d495b84c022

SHA1
54aa8d21cbb22775cca53ef4891f7ba19bb08feb

SHA256
3b2eb68db3e37ae46feddcf0900f40587f51c2c5193f41e9a874c68a128b1173

SHA512
2a7ba7ffcb37c0e22b7be8d332269a4df17b53fcca2b3f6195d52e15d78a7f44b14d86737b5392a93ba6cba3bd073318317a98d5d491377f821cb5edaca13cfe

Download Submit
C:\Windows\SysWOW64\Phajna32.exe

Filesize
97KB

MD5
6f153116f6293240e9883c700114dc4d

SHA1
f61053376f52f755caf6f38e72869619a66753c5

SHA256
cb9717022403e84e6d202a9a8129f5f4c85fe1d18b3d56c23462e3ad8b549194

SHA512
4763165e694e898c12147fcd798cb0967b3b8a9756e924451b6f3e518de112014e6339ddb12838f8058c87b2152140a8663e4bef2e620d2509427bb325dbb106

Download Submit
C:\Windows\SysWOW64\Plbfdekd.exe

Filesize
97KB

MD5
913ebbfef67b30f429c4a0186bd4c0a8

SHA1
9a9d17e3fe9cb0929cd3b2b7f57e331d23b42e08

SHA256
c60fdc41650dec1af107023a9f71fc38f5df0a36945b958157a69a74498067c8

SHA512
a31b1182bef05256dbcbc59a8f8a4c95a5193e0360e4491e021d5da0660bad659fa6e5c8108b17e2555a28033f7ffc2f678a05b29a13bd34a5f653a15b4a3b3f

Download Submit
C:\Windows\SysWOW64\Plmmif32.exe

Filesize
97KB

MD5
25d3ec439d14f1d956c2f44b31ada40e

SHA1
5ce2378fe8bc126b0a6bcd7bb69ac7860b0cde03

SHA256
1a29b09d52228e24fa8818039c9f862d143dfca459e73c8edb9c4dfc1cce0a51

SHA512
56126a8c7b49cf9469ea100874c4eb6283f588c662f3276e84bc12380755842c46190e65f54a89b1723df0ff56e4e7ff014d27fc4cb58aa69b3f17787608932f

Download Submit
C:\Windows\SysWOW64\Pmcclm32.exe

Filesize
97KB

MD5
36656f27ce337109fbad2d26d3459ec3

SHA1
130356b03e74c34a2276061a1444f90e5a7cbfdf

SHA256
6787e0aef7071fc7406070e0e1b291614dce18e425140ec81aff857b07da9b8f

SHA512
e426ae61ed10a38741b272533d370d7f5064e3845a6c8fff24d68c003bc600bc6b9156dbfc66a1e40fbcde4347e98682f45fcbb2bad83b625728ff69cb8b6c4d

Download Submit
C:\Windows\SysWOW64\Pmlmkn32.exe

Filesize
97KB

MD5
6be0696045cf40570fecf1b041b5d416

SHA1
252ed647a3f4b6d0b6219eddd2789cfdb8d3034b

SHA256
1109f4bd40691f2a2bf26384048ccd9c98e65d68f094e5c753aa7c13a1478d72

SHA512
ae512411ab63b086e91a7a7c6b7313c39f2f4b7be07d243dbaa204192eeba9dd248921beddb398e371001c61b894b4df633eb1b7c8096e0b509c74ccf2cee919

Download Submit
C:\Windows\SysWOW64\Qacameaj.exe

Filesize
97KB

MD5
daae01385214845063756b987a8e7833

SHA1
86a944d599e6d2474c7db0f40ee9ae0b3d62a69d

SHA256
d586cafe6203e7305d8e3ccd4c887b5689d0350a8c1d2f72dc5c51b351a7a682

SHA512
6c74018fa27bd003207e2cc5980b1411dd037f23552684b8cb6dd41c497bfa35f67fd2d18165484b6d20deb8ff5b8a144feeb69b34f84e03dbc7270e12292a72

Download Submit
C:\Windows\SysWOW64\Qdphngfl.exe

Filesize
97KB

MD5
49fb5496cb4d50f9b1060c0176e72d92

SHA1
f1d4d1e0748827956fd497d4d871748ca2e0f8d7

SHA256
d42d7b61f46bd9159fb2babed7d1819efd231ccd2fa61f6a5bb017a959a575a5

SHA512
7d2d28a3251c8ff35b990357f39b284fc00b343732600c8740c24f3bf1cce20f9038f8c760f81ea3ab7ab0160468a526e8feb1fc5fc6554edca3686cb92c9ac4

Download Submit
C:\Windows\SysWOW64\Qhmqdemc.exe

Filesize
97KB

MD5
de03ee96afaaa1edabd6098d07e2ab0c

SHA1
742e88d1e79c10aff7472bfd8d3c0ad1f13606b8

SHA256
aad4831ea8e994724f16afe9e240fe6c243e9369e919f40b566ffcd7798ca9c2

SHA512
00a8def9df8378d56abc743b5485b736fbf2d723197ca716e6c17423da78163308ab09ff561125db0777e119be78ad9572c667771ab0c1895205859675a5ac7c

Download Submit
C:\Windows\SysWOW64\Qmeigg32.exe

Filesize
97KB

MD5
7ee65eec60c2cf01728e7651903ed1b5

SHA1
c96b1d0070b066d786a5ee77ecea7e63f5c3bf64

SHA256
27f9148209f4402850cca3d427d89e0400a8e6fbbf3bb8076325e001a3d08375

SHA512
3babdb98e17f89dadaf67bcd54a0f0018f3371a7ea1b7a1ae97cce222e034516046956891f14529a762991f9521fa4a41716e9eaa94c4e5fcff74f44cb17264a

Download Submit
memory/332-247-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/368-143-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/412-231-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/536-328-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/732-112-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/748-31-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/748-572-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/812-418-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/980-338-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1056-400-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1164-71-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1272-424-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1292-587-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1328-364-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1396-199-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1500-95-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1552-394-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1564-304-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1592-559-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1596-215-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1604-388-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1668-358-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1716-340-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1812-280-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1828-478-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1848-88-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1940-544-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1940-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1948-255-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2092-490-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2128-23-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2128-565-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2204-176-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2244-119-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2336-191-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2360-262-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2400-466-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2408-167-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2416-460-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2568-484-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2572-442-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2640-586-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2640-47-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2644-579-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2644-39-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2884-538-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2940-292-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2952-526-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3100-103-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3180-223-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3272-448-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3420-135-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3476-436-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3504-352-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3524-552-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3564-549-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3572-127-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3640-508-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3648-316-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3664-63-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3668-532-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3856-551-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3856-7-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3900-430-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4016-268-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4060-79-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4112-286-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4144-496-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4148-370-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4272-566-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4284-412-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4308-520-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4332-183-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4352-472-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4360-310-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4412-15-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4412-558-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4456-298-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4480-151-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4552-580-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4584-274-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4632-594-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4644-346-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4700-406-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4704-207-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4708-159-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4720-502-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4740-573-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4788-514-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4872-55-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4872-593-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4880-382-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4892-454-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4980-376-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4996-239-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5076-326-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/11384-3498-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/11420-3497-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/11456-3496-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads