Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/03/2025, 10:31

General

  • Target

    d46ffd3ea4963b654fd301d71c28b34260399430124a48b3621f78b810a13bb3.exe

  • Size

    465KB

  • MD5

    0cd0390fd623f2743323ac907ef836d3

  • SHA1

    3244dc83cb43ed423ffdc9a06fb7d34f3b5822a4

  • SHA256

    d46ffd3ea4963b654fd301d71c28b34260399430124a48b3621f78b810a13bb3

  • SHA512

    7bb67add467db8e967ed4c4515385dbf43220754a1ec6a10a3285097b8ba7a43f2b3123516e6ce59ad1fbab0d411247b060dba9f7bf521182d9eadb6ea24d661

  • SSDEEP

    6144:/RfEwvFou3njPX9ZAkvntd4ljd3rKzwN8Jlljd3njPX9ZAk3fs:/xpljP9ZtVkjpKXjtjP9Zt0

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Signatures

  • Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
  • Berbew

    Berbew is a backdoor written in C++.

  • Berbew family
  • Executes dropped EXE 64 IoCs
  • Drops file in System32 directory 64 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d46ffd3ea4963b654fd301d71c28b34260399430124a48b3621f78b810a13bb3.exe
    "C:\Users\Admin\AppData\Local\Temp\d46ffd3ea4963b654fd301d71c28b34260399430124a48b3621f78b810a13bb3.exe"
    1⤵
    • Adds autorun key to be loaded by Explorer.exe on startup
    • Suspicious use of WriteProcessMemory
    PID:3636
    • C:\Windows\SysWOW64\Kpeiioac.exe
      C:\Windows\system32\Kpeiioac.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:1468
      • C:\Windows\SysWOW64\Kmijbcpl.exe
        C:\Windows\system32\Kmijbcpl.exe
        3⤵
        • Adds autorun key to be loaded by Explorer.exe on startup
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4784
        • C:\Windows\SysWOW64\Kpgfooop.exe
          C:\Windows\system32\Kpgfooop.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1448
          • C:\Windows\SysWOW64\Klngdpdd.exe
            C:\Windows\system32\Klngdpdd.exe
            5⤵
            • Adds autorun key to be loaded by Explorer.exe on startup
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5052
            • C:\Windows\SysWOW64\Kfckahdj.exe
              C:\Windows\system32\Kfckahdj.exe
              6⤵
              • Adds autorun key to be loaded by Explorer.exe on startup
              • Executes dropped EXE
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:4640
              • C:\Windows\SysWOW64\Kplpjn32.exe
                C:\Windows\system32\Kplpjn32.exe
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:2036
                • C:\Windows\SysWOW64\Llcpoo32.exe
                  C:\Windows\system32\Llcpoo32.exe
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:4700
                  • C:\Windows\SysWOW64\Ldjhpl32.exe
                    C:\Windows\system32\Ldjhpl32.exe
                    9⤵
                    • Adds autorun key to be loaded by Explorer.exe on startup
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:1304
                    • C:\Windows\SysWOW64\Lpqiemge.exe
                      C:\Windows\system32\Lpqiemge.exe
                      10⤵
                      • Executes dropped EXE
                      • Drops file in System32 directory
                      • Suspicious use of WriteProcessMemory
                      PID:4112
                      • C:\Windows\SysWOW64\Lenamdem.exe
                        C:\Windows\system32\Lenamdem.exe
                        11⤵
                        • Adds autorun key to be loaded by Explorer.exe on startup
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        • Suspicious use of WriteProcessMemory
                        PID:4000
                        • C:\Windows\SysWOW64\Lmdina32.exe
                          C:\Windows\system32\Lmdina32.exe
                          12⤵
                          • Executes dropped EXE
                          • Modifies registry class
                          • Suspicious use of WriteProcessMemory
                          PID:2056
                          • C:\Windows\SysWOW64\Llgjjnlj.exe
                            C:\Windows\system32\Llgjjnlj.exe
                            13⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:1804
                            • C:\Windows\SysWOW64\Lbabgh32.exe
                              C:\Windows\system32\Lbabgh32.exe
                              14⤵
                              • Executes dropped EXE
                              • Suspicious use of WriteProcessMemory
                              PID:1672
                              • C:\Windows\SysWOW64\Lepncd32.exe
                                C:\Windows\system32\Lepncd32.exe
                                15⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:392
                                • C:\Windows\SysWOW64\Lmgfda32.exe
                                  C:\Windows\system32\Lmgfda32.exe
                                  16⤵
                                  • Executes dropped EXE
                                  • Drops file in System32 directory
                                  • Suspicious use of WriteProcessMemory
                                  PID:4384
                                  • C:\Windows\SysWOW64\Lpebpm32.exe
                                    C:\Windows\system32\Lpebpm32.exe
                                    17⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:2256
                                    • C:\Windows\SysWOW64\Ldanqkki.exe
                                      C:\Windows\system32\Ldanqkki.exe
                                      18⤵
                                      • Adds autorun key to be loaded by Explorer.exe on startup
                                      • Executes dropped EXE
                                      • Drops file in System32 directory
                                      • Suspicious use of WriteProcessMemory
                                      PID:3332
                                      • C:\Windows\SysWOW64\Lgokmgjm.exe
                                        C:\Windows\system32\Lgokmgjm.exe
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in System32 directory
                                        • Modifies registry class
                                        • Suspicious use of WriteProcessMemory
                                        PID:1740
                                        • C:\Windows\SysWOW64\Lebkhc32.exe
                                          C:\Windows\system32\Lebkhc32.exe
                                          20⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:5060
                                          • C:\Windows\SysWOW64\Lingibiq.exe
                                            C:\Windows\system32\Lingibiq.exe
                                            21⤵
                                            • Adds autorun key to be loaded by Explorer.exe on startup
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:2216
                                            • C:\Windows\SysWOW64\Lmiciaaj.exe
                                              C:\Windows\system32\Lmiciaaj.exe
                                              22⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              • Modifies registry class
                                              • Suspicious use of WriteProcessMemory
                                              PID:2852
                                              • C:\Windows\SysWOW64\Lllcen32.exe
                                                C:\Windows\system32\Lllcen32.exe
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in System32 directory
                                                • System Location Discovery: System Language Discovery
                                                PID:2012
                                                • C:\Windows\SysWOW64\Lphoelqn.exe
                                                  C:\Windows\system32\Lphoelqn.exe
                                                  24⤵
                                                  • Executes dropped EXE
                                                  • Drops file in System32 directory
                                                  PID:1360
                                                  • C:\Windows\SysWOW64\Mbfkbhpa.exe
                                                    C:\Windows\system32\Mbfkbhpa.exe
                                                    25⤵
                                                    • Adds autorun key to be loaded by Explorer.exe on startup
                                                    • Executes dropped EXE
                                                    • Drops file in System32 directory
                                                    • System Location Discovery: System Language Discovery
                                                    PID:4520
                                                    • C:\Windows\SysWOW64\Mgagbf32.exe
                                                      C:\Windows\system32\Mgagbf32.exe
                                                      26⤵
                                                      • Adds autorun key to be loaded by Explorer.exe on startup
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies registry class
                                                      PID:1104
                                                      • C:\Windows\SysWOW64\Medgncoe.exe
                                                        C:\Windows\system32\Medgncoe.exe
                                                        27⤵
                                                        • Adds autorun key to be loaded by Explorer.exe on startup
                                                        • Executes dropped EXE
                                                        PID:3772
                                                        • C:\Windows\SysWOW64\Mmlpoqpg.exe
                                                          C:\Windows\system32\Mmlpoqpg.exe
                                                          28⤵
                                                          • Adds autorun key to be loaded by Explorer.exe on startup
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          PID:4316
                                                          • C:\Windows\SysWOW64\Mlopkm32.exe
                                                            C:\Windows\system32\Mlopkm32.exe
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies registry class
                                                            PID:1488
                                                            • C:\Windows\SysWOW64\Mpjlklok.exe
                                                              C:\Windows\system32\Mpjlklok.exe
                                                              30⤵
                                                              • Adds autorun key to be loaded by Explorer.exe on startup
                                                              • Executes dropped EXE
                                                              • Drops file in System32 directory
                                                              • System Location Discovery: System Language Discovery
                                                              PID:3852
                                                              • C:\Windows\SysWOW64\Mdehlk32.exe
                                                                C:\Windows\system32\Mdehlk32.exe
                                                                31⤵
                                                                • Executes dropped EXE
                                                                PID:664
                                                                • C:\Windows\SysWOW64\Mchhggno.exe
                                                                  C:\Windows\system32\Mchhggno.exe
                                                                  32⤵
                                                                  • Executes dropped EXE
                                                                  • Drops file in System32 directory
                                                                  PID:3416
                                                                  • C:\Windows\SysWOW64\Megdccmb.exe
                                                                    C:\Windows\system32\Megdccmb.exe
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Modifies registry class
                                                                    PID:4036
                                                                    • C:\Windows\SysWOW64\Mibpda32.exe
                                                                      C:\Windows\system32\Mibpda32.exe
                                                                      34⤵
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Modifies registry class
                                                                      PID:4604
                                                                      • C:\Windows\SysWOW64\Mmnldp32.exe
                                                                        C:\Windows\system32\Mmnldp32.exe
                                                                        35⤵
                                                                        • Adds autorun key to be loaded by Explorer.exe on startup
                                                                        • Executes dropped EXE
                                                                        • Drops file in System32 directory
                                                                        • Modifies registry class
                                                                        PID:2780
                                                                        • C:\Windows\SysWOW64\Mplhql32.exe
                                                                          C:\Windows\system32\Mplhql32.exe
                                                                          36⤵
                                                                          • Executes dropped EXE
                                                                          • Modifies registry class
                                                                          PID:428
                                                                          • C:\Windows\SysWOW64\Mdhdajea.exe
                                                                            C:\Windows\system32\Mdhdajea.exe
                                                                            37⤵
                                                                            • Adds autorun key to be loaded by Explorer.exe on startup
                                                                            • Executes dropped EXE
                                                                            PID:3976
                                                                            • C:\Windows\SysWOW64\Mckemg32.exe
                                                                              C:\Windows\system32\Mckemg32.exe
                                                                              38⤵
                                                                              • Executes dropped EXE
                                                                              PID:2564
                                                                              • C:\Windows\SysWOW64\Mgfqmfde.exe
                                                                                C:\Windows\system32\Mgfqmfde.exe
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in System32 directory
                                                                                PID:3108
                                                                                • C:\Windows\SysWOW64\Miemjaci.exe
                                                                                  C:\Windows\system32\Miemjaci.exe
                                                                                  40⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:468
                                                                                  • C:\Windows\SysWOW64\Mmpijp32.exe
                                                                                    C:\Windows\system32\Mmpijp32.exe
                                                                                    41⤵
                                                                                    • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                    • Executes dropped EXE
                                                                                    PID:3220
                                                                                    • C:\Windows\SysWOW64\Mpoefk32.exe
                                                                                      C:\Windows\system32\Mpoefk32.exe
                                                                                      42⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:2388
                                                                                      • C:\Windows\SysWOW64\Mdjagjco.exe
                                                                                        C:\Windows\system32\Mdjagjco.exe
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:4460
                                                                                        • C:\Windows\SysWOW64\Mgimcebb.exe
                                                                                          C:\Windows\system32\Mgimcebb.exe
                                                                                          44⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:220
                                                                                          • C:\Windows\SysWOW64\Migjoaaf.exe
                                                                                            C:\Windows\system32\Migjoaaf.exe
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:3040
                                                                                            • C:\Windows\SysWOW64\Mmbfpp32.exe
                                                                                              C:\Windows\system32\Mmbfpp32.exe
                                                                                              46⤵
                                                                                              • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                              • Executes dropped EXE
                                                                                              PID:3324
                                                                                              • C:\Windows\SysWOW64\Mpablkhc.exe
                                                                                                C:\Windows\system32\Mpablkhc.exe
                                                                                                47⤵
                                                                                                • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                • Executes dropped EXE
                                                                                                PID:1544
                                                                                                • C:\Windows\SysWOW64\Mdmnlj32.exe
                                                                                                  C:\Windows\system32\Mdmnlj32.exe
                                                                                                  48⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:4824
                                                                                                  • C:\Windows\SysWOW64\Mgkjhe32.exe
                                                                                                    C:\Windows\system32\Mgkjhe32.exe
                                                                                                    49⤵
                                                                                                    • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                    • Executes dropped EXE
                                                                                                    PID:4572
                                                                                                    • C:\Windows\SysWOW64\Menjdbgj.exe
                                                                                                      C:\Windows\system32\Menjdbgj.exe
                                                                                                      50⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Drops file in System32 directory
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:788
                                                                                                      • C:\Windows\SysWOW64\Mnebeogl.exe
                                                                                                        C:\Windows\system32\Mnebeogl.exe
                                                                                                        51⤵
                                                                                                        • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                        • Executes dropped EXE
                                                                                                        PID:4688
                                                                                                        • C:\Windows\SysWOW64\Mlhbal32.exe
                                                                                                          C:\Windows\system32\Mlhbal32.exe
                                                                                                          52⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Modifies registry class
                                                                                                          PID:2824
                                                                                                          • C:\Windows\SysWOW64\Ndokbi32.exe
                                                                                                            C:\Windows\system32\Ndokbi32.exe
                                                                                                            53⤵
                                                                                                            • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in System32 directory
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:4660
                                                                                                            • C:\Windows\SysWOW64\Ncbknfed.exe
                                                                                                              C:\Windows\system32\Ncbknfed.exe
                                                                                                              54⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Drops file in System32 directory
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:2400
                                                                                                              • C:\Windows\SysWOW64\Nepgjaeg.exe
                                                                                                                C:\Windows\system32\Nepgjaeg.exe
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in System32 directory
                                                                                                                PID:1428
                                                                                                                • C:\Windows\SysWOW64\Nilcjp32.exe
                                                                                                                  C:\Windows\system32\Nilcjp32.exe
                                                                                                                  56⤵
                                                                                                                  • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Drops file in System32 directory
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Modifies registry class
                                                                                                                  PID:3956
                                                                                                                  • C:\Windows\SysWOW64\Nljofl32.exe
                                                                                                                    C:\Windows\system32\Nljofl32.exe
                                                                                                                    57⤵
                                                                                                                    • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in System32 directory
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:4452
                                                                                                                    • C:\Windows\SysWOW64\Npfkgjdn.exe
                                                                                                                      C:\Windows\system32\Npfkgjdn.exe
                                                                                                                      58⤵
                                                                                                                      • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                      • Executes dropped EXE
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Modifies registry class
                                                                                                                      PID:1048
                                                                                                                      • C:\Windows\SysWOW64\Ncdgcf32.exe
                                                                                                                        C:\Windows\system32\Ncdgcf32.exe
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Modifies registry class
                                                                                                                        PID:1296
                                                                                                                        • C:\Windows\SysWOW64\Nebdoa32.exe
                                                                                                                          C:\Windows\system32\Nebdoa32.exe
                                                                                                                          60⤵
                                                                                                                          • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                          • Executes dropped EXE
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Modifies registry class
                                                                                                                          PID:756
                                                                                                                          • C:\Windows\SysWOW64\Njnpppkn.exe
                                                                                                                            C:\Windows\system32\Njnpppkn.exe
                                                                                                                            61⤵
                                                                                                                            • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:1060
                                                                                                                            • C:\Windows\SysWOW64\Nlmllkja.exe
                                                                                                                              C:\Windows\system32\Nlmllkja.exe
                                                                                                                              62⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:2124
                                                                                                                              • C:\Windows\SysWOW64\Nphhmj32.exe
                                                                                                                                C:\Windows\system32\Nphhmj32.exe
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:5164
                                                                                                                                • C:\Windows\SysWOW64\Ncfdie32.exe
                                                                                                                                  C:\Windows\system32\Ncfdie32.exe
                                                                                                                                  64⤵
                                                                                                                                  • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:5204
                                                                                                                                  • C:\Windows\SysWOW64\Neeqea32.exe
                                                                                                                                    C:\Windows\system32\Neeqea32.exe
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Modifies registry class
                                                                                                                                    PID:5248
                                                                                                                                    • C:\Windows\SysWOW64\Njqmepik.exe
                                                                                                                                      C:\Windows\system32\Njqmepik.exe
                                                                                                                                      66⤵
                                                                                                                                      • Drops file in System32 directory
                                                                                                                                      PID:5288
                                                                                                                                      • C:\Windows\SysWOW64\Nloiakho.exe
                                                                                                                                        C:\Windows\system32\Nloiakho.exe
                                                                                                                                        67⤵
                                                                                                                                        • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                        • Drops file in System32 directory
                                                                                                                                        PID:5320
                                                                                                                                        • C:\Windows\SysWOW64\Npjebj32.exe
                                                                                                                                          C:\Windows\system32\Npjebj32.exe
                                                                                                                                          68⤵
                                                                                                                                            PID:5360
                                                                                                                                            • C:\Windows\SysWOW64\Ncianepl.exe
                                                                                                                                              C:\Windows\system32\Ncianepl.exe
                                                                                                                                              69⤵
                                                                                                                                              • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                              • Drops file in System32 directory
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:5396
                                                                                                                                              • C:\Windows\SysWOW64\Ngdmod32.exe
                                                                                                                                                C:\Windows\system32\Ngdmod32.exe
                                                                                                                                                70⤵
                                                                                                                                                  PID:5436
                                                                                                                                                  • C:\Windows\SysWOW64\Njciko32.exe
                                                                                                                                                    C:\Windows\system32\Njciko32.exe
                                                                                                                                                    71⤵
                                                                                                                                                    • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                    PID:5472
                                                                                                                                                    • C:\Windows\SysWOW64\Nnneknob.exe
                                                                                                                                                      C:\Windows\system32\Nnneknob.exe
                                                                                                                                                      72⤵
                                                                                                                                                      • Modifies registry class
                                                                                                                                                      PID:5508
                                                                                                                                                      • C:\Windows\SysWOW64\Npmagine.exe
                                                                                                                                                        C:\Windows\system32\Npmagine.exe
                                                                                                                                                        73⤵
                                                                                                                                                          PID:5544
                                                                                                                                                          • C:\Windows\SysWOW64\Ndhmhh32.exe
                                                                                                                                                            C:\Windows\system32\Ndhmhh32.exe
                                                                                                                                                            74⤵
                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:5580
                                                                                                                                                            • C:\Windows\SysWOW64\Nggjdc32.exe
                                                                                                                                                              C:\Windows\system32\Nggjdc32.exe
                                                                                                                                                              75⤵
                                                                                                                                                              • Modifies registry class
                                                                                                                                                              PID:5620
                                                                                                                                                              • C:\Windows\SysWOW64\Nfjjppmm.exe
                                                                                                                                                                C:\Windows\system32\Nfjjppmm.exe
                                                                                                                                                                76⤵
                                                                                                                                                                  PID:5668
                                                                                                                                                                  • C:\Windows\SysWOW64\Nnqbanmo.exe
                                                                                                                                                                    C:\Windows\system32\Nnqbanmo.exe
                                                                                                                                                                    77⤵
                                                                                                                                                                      PID:5704
                                                                                                                                                                      • C:\Windows\SysWOW64\Olcbmj32.exe
                                                                                                                                                                        C:\Windows\system32\Olcbmj32.exe
                                                                                                                                                                        78⤵
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:5740
                                                                                                                                                                        • C:\Windows\SysWOW64\Odkjng32.exe
                                                                                                                                                                          C:\Windows\system32\Odkjng32.exe
                                                                                                                                                                          79⤵
                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                          PID:5776
                                                                                                                                                                          • C:\Windows\SysWOW64\Ogifjcdp.exe
                                                                                                                                                                            C:\Windows\system32\Ogifjcdp.exe
                                                                                                                                                                            80⤵
                                                                                                                                                                              PID:5816
                                                                                                                                                                              • C:\Windows\SysWOW64\Ojgbfocc.exe
                                                                                                                                                                                C:\Windows\system32\Ojgbfocc.exe
                                                                                                                                                                                81⤵
                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                PID:5852
                                                                                                                                                                                • C:\Windows\SysWOW64\Oncofm32.exe
                                                                                                                                                                                  C:\Windows\system32\Oncofm32.exe
                                                                                                                                                                                  82⤵
                                                                                                                                                                                  • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                  PID:5892
                                                                                                                                                                                  • C:\Windows\SysWOW64\Opakbi32.exe
                                                                                                                                                                                    C:\Windows\system32\Opakbi32.exe
                                                                                                                                                                                    83⤵
                                                                                                                                                                                    • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:5928
                                                                                                                                                                                    • C:\Windows\SysWOW64\Odmgcgbi.exe
                                                                                                                                                                                      C:\Windows\system32\Odmgcgbi.exe
                                                                                                                                                                                      84⤵
                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                      PID:5968
                                                                                                                                                                                      • C:\Windows\SysWOW64\Ogkcpbam.exe
                                                                                                                                                                                        C:\Windows\system32\Ogkcpbam.exe
                                                                                                                                                                                        85⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:6004
                                                                                                                                                                                        • C:\Windows\SysWOW64\Ofnckp32.exe
                                                                                                                                                                                          C:\Windows\system32\Ofnckp32.exe
                                                                                                                                                                                          86⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                          PID:6052
                                                                                                                                                                                          • C:\Windows\SysWOW64\Oneklm32.exe
                                                                                                                                                                                            C:\Windows\system32\Oneklm32.exe
                                                                                                                                                                                            87⤵
                                                                                                                                                                                              PID:6088
                                                                                                                                                                                              • C:\Windows\SysWOW64\Olhlhjpd.exe
                                                                                                                                                                                                C:\Windows\system32\Olhlhjpd.exe
                                                                                                                                                                                                88⤵
                                                                                                                                                                                                  PID:6132
                                                                                                                                                                                                  • C:\Windows\SysWOW64\Opdghh32.exe
                                                                                                                                                                                                    C:\Windows\system32\Opdghh32.exe
                                                                                                                                                                                                    89⤵
                                                                                                                                                                                                      PID:2596
                                                                                                                                                                                                      • C:\Windows\SysWOW64\Ocbddc32.exe
                                                                                                                                                                                                        C:\Windows\system32\Ocbddc32.exe
                                                                                                                                                                                                        90⤵
                                                                                                                                                                                                        • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                                        PID:1908
                                                                                                                                                                                                        • C:\Windows\SysWOW64\Ognpebpj.exe
                                                                                                                                                                                                          C:\Windows\system32\Ognpebpj.exe
                                                                                                                                                                                                          91⤵
                                                                                                                                                                                                            PID:2868
                                                                                                                                                                                                            • C:\Windows\SysWOW64\Ojllan32.exe
                                                                                                                                                                                                              C:\Windows\system32\Ojllan32.exe
                                                                                                                                                                                                              92⤵
                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                              PID:2060
                                                                                                                                                                                                              • C:\Windows\SysWOW64\Onhhamgg.exe
                                                                                                                                                                                                                C:\Windows\system32\Onhhamgg.exe
                                                                                                                                                                                                                93⤵
                                                                                                                                                                                                                • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:3428
                                                                                                                                                                                                                • C:\Windows\SysWOW64\Oqfdnhfk.exe
                                                                                                                                                                                                                  C:\Windows\system32\Oqfdnhfk.exe
                                                                                                                                                                                                                  94⤵
                                                                                                                                                                                                                  • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:4568
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\Odapnf32.exe
                                                                                                                                                                                                                    C:\Windows\system32\Odapnf32.exe
                                                                                                                                                                                                                    95⤵
                                                                                                                                                                                                                      PID:5188
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\Ogpmjb32.exe
                                                                                                                                                                                                                        C:\Windows\system32\Ogpmjb32.exe
                                                                                                                                                                                                                        96⤵
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:5260
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\Ofcmfodb.exe
                                                                                                                                                                                                                          C:\Windows\system32\Ofcmfodb.exe
                                                                                                                                                                                                                          97⤵
                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                          PID:5276
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\Onjegled.exe
                                                                                                                                                                                                                            C:\Windows\system32\Onjegled.exe
                                                                                                                                                                                                                            98⤵
                                                                                                                                                                                                                            • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                                                            PID:5340
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\Olmeci32.exe
                                                                                                                                                                                                                              C:\Windows\system32\Olmeci32.exe
                                                                                                                                                                                                                              99⤵
                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                              PID:5388
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\Oddmdf32.exe
                                                                                                                                                                                                                                C:\Windows\system32\Oddmdf32.exe
                                                                                                                                                                                                                                100⤵
                                                                                                                                                                                                                                  PID:5460
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\Ocgmpccl.exe
                                                                                                                                                                                                                                    C:\Windows\system32\Ocgmpccl.exe
                                                                                                                                                                                                                                    101⤵
                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                    PID:5536
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\Ofeilobp.exe
                                                                                                                                                                                                                                      C:\Windows\system32\Ofeilobp.exe
                                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                      PID:1064
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\Ojaelm32.exe
                                                                                                                                                                                                                                        C:\Windows\system32\Ojaelm32.exe
                                                                                                                                                                                                                                        103⤵
                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                        PID:5648
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\Pmoahijl.exe
                                                                                                                                                                                                                                          C:\Windows\system32\Pmoahijl.exe
                                                                                                                                                                                                                                          104⤵
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                          PID:4940
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\Pqmjog32.exe
                                                                                                                                                                                                                                            C:\Windows\system32\Pqmjog32.exe
                                                                                                                                                                                                                                            105⤵
                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                            PID:5764
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\Pmdkch32.exe
                                                                                                                                                                                                                                              C:\Windows\system32\Pmdkch32.exe
                                                                                                                                                                                                                                              106⤵
                                                                                                                                                                                                                                                PID:5848
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\Pdkcde32.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\Pdkcde32.exe
                                                                                                                                                                                                                                                  107⤵
                                                                                                                                                                                                                                                  • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                  PID:5916
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\Pgioqq32.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\Pgioqq32.exe
                                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                    PID:5980
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\Pjhlml32.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\Pjhlml32.exe
                                                                                                                                                                                                                                                      109⤵
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:6060
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\Pmfhig32.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\Pmfhig32.exe
                                                                                                                                                                                                                                                        110⤵
                                                                                                                                                                                                                                                        • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:6116
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\Pdmpje32.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\Pdmpje32.exe
                                                                                                                                                                                                                                                          111⤵
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:820
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\Pgllfp32.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\Pgllfp32.exe
                                                                                                                                                                                                                                                            112⤵
                                                                                                                                                                                                                                                            • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                            PID:516
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\Pnfdcjkg.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\Pnfdcjkg.exe
                                                                                                                                                                                                                                                              113⤵
                                                                                                                                                                                                                                                                PID:4368
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\Pqdqof32.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\Pqdqof32.exe
                                                                                                                                                                                                                                                                  114⤵
                                                                                                                                                                                                                                                                  • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                  PID:60
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\Pgnilpah.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\Pgnilpah.exe
                                                                                                                                                                                                                                                                    115⤵
                                                                                                                                                                                                                                                                      PID:5236
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\Pjmehkqk.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\Pjmehkqk.exe
                                                                                                                                                                                                                                                                        116⤵
                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                        PID:5272
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\Qnhahj32.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\Qnhahj32.exe
                                                                                                                                                                                                                                                                          117⤵
                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                          PID:6140
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\Qdbiedpa.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\Qdbiedpa.exe
                                                                                                                                                                                                                                                                            118⤵
                                                                                                                                                                                                                                                                            • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                            PID:2016
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\Qfcfml32.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\Qfcfml32.exe
                                                                                                                                                                                                                                                                              119⤵
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:5296
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\Qqijje32.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\Qqijje32.exe
                                                                                                                                                                                                                                                                                120⤵
                                                                                                                                                                                                                                                                                • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                PID:1632
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\Qddfkd32.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\Qddfkd32.exe
                                                                                                                                                                                                                                                                                  121⤵
                                                                                                                                                                                                                                                                                  • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                                                                                                                  PID:5468
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\Qffbbldm.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\Qffbbldm.exe
                                                                                                                                                                                                                                                                                    122⤵
                                                                                                                                                                                                                                                                                    • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                                                                                                                    PID:4808
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\Anmjcieo.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\Anmjcieo.exe
                                                                                                                                                                                                                                                                                      123⤵
                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                      PID:5912
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\Adgbpc32.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\Adgbpc32.exe
                                                                                                                                                                                                                                                                                        124⤵
                                                                                                                                                                                                                                                                                          PID:6040
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\Ageolo32.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\Ageolo32.exe
                                                                                                                                                                                                                                                                                            125⤵
                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                            PID:1644
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\Ajckij32.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\Ajckij32.exe
                                                                                                                                                                                                                                                                                              126⤵
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:5660
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\Ambgef32.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\Ambgef32.exe
                                                                                                                                                                                                                                                                                                127⤵
                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                PID:5148
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\Aeiofcji.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\Aeiofcji.exe
                                                                                                                                                                                                                                                                                                  128⤵
                                                                                                                                                                                                                                                                                                  • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                  PID:5312
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\Afjlnk32.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\Afjlnk32.exe
                                                                                                                                                                                                                                                                                                    129⤵
                                                                                                                                                                                                                                                                                                    • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                                                                                                                                    PID:6128
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\Anadoi32.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\Anadoi32.exe
                                                                                                                                                                                                                                                                                                      130⤵
                                                                                                                                                                                                                                                                                                        PID:5152
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\Aeklkchg.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\Aeklkchg.exe
                                                                                                                                                                                                                                                                                                          131⤵
                                                                                                                                                                                                                                                                                                          • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                          PID:5568
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\Afmhck32.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\Afmhck32.exe
                                                                                                                                                                                                                                                                                                            132⤵
                                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                            PID:5788
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\Ajhddjfn.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\Ajhddjfn.exe
                                                                                                                                                                                                                                                                                                              133⤵
                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                              PID:6036
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\Amgapeea.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\Amgapeea.exe
                                                                                                                                                                                                                                                                                                                134⤵
                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                PID:3284
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\Aeniabfd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\Aeniabfd.exe
                                                                                                                                                                                                                                                                                                                  135⤵
                                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                  PID:5228
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\Acqimo32.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\Acqimo32.exe
                                                                                                                                                                                                                                                                                                                    136⤵
                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                    PID:2280
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\Afoeiklb.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\Afoeiklb.exe
                                                                                                                                                                                                                                                                                                                      137⤵
                                                                                                                                                                                                                                                                                                                        PID:5656
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\Anfmjhmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\Anfmjhmd.exe
                                                                                                                                                                                                                                                                                                                          138⤵
                                                                                                                                                                                                                                                                                                                          • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                          PID:3196
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\Aadifclh.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\Aadifclh.exe
                                                                                                                                                                                                                                                                                                                            139⤵
                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                            PID:6068
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\Agoabn32.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\Agoabn32.exe
                                                                                                                                                                                                                                                                                                                              140⤵
                                                                                                                                                                                                                                                                                                                              • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                                                                                                                                                              PID:3508
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\Bjmnoi32.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\Bjmnoi32.exe
                                                                                                                                                                                                                                                                                                                                141⤵
                                                                                                                                                                                                                                                                                                                                  PID:4256
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\Bmkjkd32.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\Bmkjkd32.exe
                                                                                                                                                                                                                                                                                                                                    142⤵
                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                    PID:1372
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\Bebblb32.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\Bebblb32.exe
                                                                                                                                                                                                                                                                                                                                      143⤵
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      PID:5628
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\Bcebhoii.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\Bcebhoii.exe
                                                                                                                                                                                                                                                                                                                                        144⤵
                                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                                                                        PID:5456
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\Bfdodjhm.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\Bfdodjhm.exe
                                                                                                                                                                                                                                                                                                                                          145⤵
                                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                          PID:3348
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\Bnkgeg32.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\Bnkgeg32.exe
                                                                                                                                                                                                                                                                                                                                            146⤵
                                                                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                            PID:5888
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\Beeoaapl.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\Beeoaapl.exe
                                                                                                                                                                                                                                                                                                                                              147⤵
                                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                              PID:4840
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\Bgcknmop.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\Bgcknmop.exe
                                                                                                                                                                                                                                                                                                                                                148⤵
                                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                PID:6188
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\Bjagjhnc.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\Bjagjhnc.exe
                                                                                                                                                                                                                                                                                                                                                  149⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                  PID:6224
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\Balpgb32.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\Balpgb32.exe
                                                                                                                                                                                                                                                                                                                                                    150⤵
                                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                    PID:6292
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\Bgehcmmm.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\Bgehcmmm.exe
                                                                                                                                                                                                                                                                                                                                                      151⤵
                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                      PID:6332
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\Bfhhoi32.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\Bfhhoi32.exe
                                                                                                                                                                                                                                                                                                                                                        152⤵
                                                                                                                                                                                                                                                                                                                                                          PID:6372
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\Bnpppgdj.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\Bnpppgdj.exe
                                                                                                                                                                                                                                                                                                                                                            153⤵
                                                                                                                                                                                                                                                                                                                                                              PID:6416
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\Banllbdn.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\Banllbdn.exe
                                                                                                                                                                                                                                                                                                                                                                154⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:6460
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\Bclhhnca.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\Bclhhnca.exe
                                                                                                                                                                                                                                                                                                                                                                    155⤵
                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                    PID:6508
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\Bfkedibe.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\Bfkedibe.exe
                                                                                                                                                                                                                                                                                                                                                                      156⤵
                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                      PID:6552
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\Bnbmefbg.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\Bnbmefbg.exe
                                                                                                                                                                                                                                                                                                                                                                        157⤵
                                                                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                        PID:6592
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\Bmemac32.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\Bmemac32.exe
                                                                                                                                                                                                                                                                                                                                                                          158⤵
                                                                                                                                                                                                                                                                                                                                                                          • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:6632
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\Belebq32.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\Belebq32.exe
                                                                                                                                                                                                                                                                                                                                                                            159⤵
                                                                                                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                            PID:6876
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\Cjinkg32.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\Cjinkg32.exe
                                                                                                                                                                                                                                                                                                                                                                              160⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:6920
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\Cmgjgcgo.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\Cmgjgcgo.exe
                                                                                                                                                                                                                                                                                                                                                                                  161⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:6960
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\Cabfga32.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\Cabfga32.exe
                                                                                                                                                                                                                                                                                                                                                                                      162⤵
                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                      PID:7000
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\Cdabcm32.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\Cdabcm32.exe
                                                                                                                                                                                                                                                                                                                                                                                        163⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:7040
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\Cfpnph32.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\Cfpnph32.exe
                                                                                                                                                                                                                                                                                                                                                                                            164⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:7080
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\Cjkjpgfi.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\Cjkjpgfi.exe
                                                                                                                                                                                                                                                                                                                                                                                                165⤵
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                PID:7120
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\Cmiflbel.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\Cmiflbel.exe
                                                                                                                                                                                                                                                                                                                                                                                                  166⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  PID:7160
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\Ceqnmpfo.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\Ceqnmpfo.exe
                                                                                                                                                                                                                                                                                                                                                                                                    167⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                    PID:6208
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\Cdcoim32.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\Cdcoim32.exe
                                                                                                                                                                                                                                                                                                                                                                                                      168⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                      PID:6300
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\Cjmgfgdf.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\Cjmgfgdf.exe
                                                                                                                                                                                                                                                                                                                                                                                                        169⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:6356
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\Cagobalc.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\Cagobalc.exe
                                                                                                                                                                                                                                                                                                                                                                                                            170⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:6424
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\Cdfkolkf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\Cdfkolkf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                PID:6492
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\Cfdhkhjj.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\Cfdhkhjj.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6536
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\Cnkplejl.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\Cnkplejl.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6624
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\Cajlhqjp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\Cajlhqjp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6688
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\Cffdpghg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\Cffdpghg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6756
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\Cnnlaehj.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\Cnnlaehj.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6800
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\Calhnpgn.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\Calhnpgn.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6836
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\Dhfajjoj.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\Dhfajjoj.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6860
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\Djdmffnn.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\Djdmffnn.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6904
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\Dmcibama.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\Dmcibama.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7012
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\Dhhnpjmh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\Dhhnpjmh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7128
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\Dfknkg32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\Dfknkg32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6196
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\Daqbip32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\Daqbip32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6244
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\Dhkjej32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\Dhkjej32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6432
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\Dodbbdbb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\Dodbbdbb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6544
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\Dmgbnq32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\Dmgbnq32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6664
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\Deokon32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\Deokon32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6728
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\Ddakjkqi.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\Ddakjkqi.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6780
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\Dfpgffpm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\Dfpgffpm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\Dmjocp32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\Dmjocp32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\Deagdn32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\Deagdn32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\Dhocqigp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\Dhocqigp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\Dknpmdfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\Dknpmdfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\Dmllipeg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\Dmllipeg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 6676 -s 396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6996
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6676 -ip 6676
                                                                                1⤵
                                                                                  PID:6828

                                                                                Network

                                                                                MITRE ATT&CK Enterprise v15

                                                                                Replay Monitor

                                                                                Loading Replay Monitor...

                                                                                Downloads

                                                                                • C:\Windows\SysWOW64\Balpgb32.exe

                                                                                  Filesize

                                                                                  465KB

                                                                                  MD5

                                                                                  cc352165297671484d0af6df1df63d45

                                                                                  SHA1

                                                                                  41d73d60f974fa09de3fc02634aaab3410178db9

                                                                                  SHA256

                                                                                  daa16ab494222ac0fac97a0d4e2c9f8b5bb4dccc48674a8eab409f2513463c24

                                                                                  SHA512

                                                                                  f944f8d9d2a9af4aa3ab6e26d061d395dee9198d14c51a8c8b9b8a62843811b1f8575d37d7fa63ff71403fc27f9c71f6f8c6a48bcd034af43970cbc80c0d98a2

                                                                                • C:\Windows\SysWOW64\Bgcknmop.exe

                                                                                  Filesize

                                                                                  64KB

                                                                                  MD5

                                                                                  ee110a139bd172d63e2b8f70caa751a8

                                                                                  SHA1

                                                                                  e80a94c413abff53876d4f00a0c24d8b5030ac49

                                                                                  SHA256

                                                                                  85f69919d8e37bf0d64ffd1f79730a3e8d55ad68695f935d9409cf3b938d1016

                                                                                  SHA512

                                                                                  b851157f6a4ccb477eb12fcbf3fca8e73cfd79d8aab142d5ce111683e99e6e7122d7472021ec1fce63cd47078ace427a07f68a8a1399c5eaef0c0668d380c2fe

                                                                                • C:\Windows\SysWOW64\Cdcoim32.exe

                                                                                  Filesize

                                                                                  465KB

                                                                                  MD5

                                                                                  9ef4bfd0135ca3369d5d4d29656a021b

                                                                                  SHA1

                                                                                  e931ae6c52431777429453cd41958ce376021249

                                                                                  SHA256

                                                                                  93263cbdfbe412b0a3da61a6f9dcf19c12a56b54400da4edc098596f9e20d7ed

                                                                                  SHA512

                                                                                  2b2e9df6e254d3bdf6fbe6205d40d89141871214f1d735cf5899356e619c2df8e38ca446bb0200ae2a65ec8805ded50e7e6e40492a06376b209787dac6e94e23

                                                                                • C:\Windows\SysWOW64\Dmllipeg.exe

                                                                                  Filesize

                                                                                  465KB

                                                                                  MD5

                                                                                  df5646b6afbc125c2a0d61148b9bffef

                                                                                  SHA1

                                                                                  60dc5658e0ab9e1eee08446ed41b4a76c717dd9f

                                                                                  SHA256

                                                                                  09df48d93cb63ac6d55d792665454db3db8046836f53eaa720d3ea6dafd12ef9

                                                                                  SHA512

                                                                                  8c1c83faf79a43b802835dd2167185887e3f3baee0cde19a3ca51711f6b23b13444c7eff80efc09c63ec7b5f3fb5930eda59c0c22ec3185fc239460639e9e67b

                                                                                • C:\Windows\SysWOW64\Kfckahdj.exe

                                                                                  Filesize

                                                                                  465KB

                                                                                  MD5

                                                                                  f53db15d4698405da9b7963bcea489e1

                                                                                  SHA1

                                                                                  79b01171e16544a3dbf070ccd2c4dc00bfb178f0

                                                                                  SHA256

                                                                                  eb58bf4f396764470ac2e5237a8fa932c326bcfb1cdb1f519173a50370086611

                                                                                  SHA512

                                                                                  b7fc2aeb2950c0e3e4ebc8fb0c43c81d9e4e45f48d74a4259365d46f7f680e6fc12e0a6f7c62b76737322ddaa35ef8ce17d1de43a772d234e14e707a6f123b16

                                                                                • C:\Windows\SysWOW64\Klngdpdd.exe

                                                                                  Filesize

                                                                                  465KB

                                                                                  MD5

                                                                                  0e98a74ff2c1494e9375179a95ee9057

                                                                                  SHA1

                                                                                  6f2e06fa4c47bd7b1a9e1cfbaf7eb401605f85a7

                                                                                  SHA256

                                                                                  0731a405c4af2e3ccdd73cdc37fb5e11d6587521e65fdf20aea4d34549d3da28

                                                                                  SHA512

                                                                                  258093f005ae3955bb784d58ef673e02d2c9499d5e8713f5cf6f769190aa22f42a8922a7dcc5a5bcd951298534f0e8f626ed780f9e6867460bdcaa2cce90fa66

                                                                                • C:\Windows\SysWOW64\Kmijbcpl.exe

                                                                                  Filesize

                                                                                  465KB

                                                                                  MD5

                                                                                  c94bb52a078b5d6c24299410152582e1

                                                                                  SHA1

                                                                                  0be3eb0559fde28e495e828f53f5b4fc5c726287

                                                                                  SHA256

                                                                                  3db0ffbf4f3972b288a8b0b04f408fd6c1ae46d1693491e799c6c5c86f97a8fc

                                                                                  SHA512

                                                                                  b940ac99a360f30dede5604b1947c28ba69b5de3c9d4ebe92b8032dbee30e0d35ec979a2941b3c105ec20dc9b61bb3685dbe0d715d9a71d2039ebf52e8e2308e

                                                                                • C:\Windows\SysWOW64\Kpeiioac.exe

                                                                                  Filesize

                                                                                  465KB

                                                                                  MD5

                                                                                  27343cb4b41a3a451342f599ff00ef60

                                                                                  SHA1

                                                                                  0449e71c2c34b47223d90d5277a678aa2b6fcad1

                                                                                  SHA256

                                                                                  1adef0fb2eb0312350bf76da9073ef4310a6ffc073e33ad6dc448887fca8d8f5

                                                                                  SHA512

                                                                                  31b85058ecade77eba6a3b0003392bf7257da368aaf96bea29525f2c1c1e956a450576ee22e11f3936f15456a633cc72196359b13fded30d1389c50c5bbef46b

                                                                                • C:\Windows\SysWOW64\Kpgfooop.exe

                                                                                  Filesize

                                                                                  465KB

                                                                                  MD5

                                                                                  d948310a6e76d11cd911dda92ec76359

                                                                                  SHA1

                                                                                  6910810c34d58bf720609db6909643fd75163dfb

                                                                                  SHA256

                                                                                  9b6bc094dabb33ce735f12f34489abc34df6a10a009f06dbd7da206e23f10452

                                                                                  SHA512

                                                                                  0573b247ea2936420dd97ad6c2f18125330728de7f5cbe1ee3ff1a69eaf396aade1e5c032913073e8ad61e7d0dfec1c576586134c2142417a6168409654c16ba

                                                                                • C:\Windows\SysWOW64\Kplpjn32.exe

                                                                                  Filesize

                                                                                  465KB

                                                                                  MD5

                                                                                  fc6736cbc6e990c3a2f972abab0dcd24

                                                                                  SHA1

                                                                                  8458e628cdf34f3a56a4f5052b196ced96711f40

                                                                                  SHA256

                                                                                  a2a195b15357812ed781a0a22637915a300ed20e6a0be9bfe3de0bc8efd97a4f

                                                                                  SHA512

                                                                                  92642c820b2780946cc1844479baaa958044073ee255d5ee807907bd5a0e6512fa3dd471adad6b4e65758672cb79aa46c64598801a5f887a0e9109b32ef416b1

                                                                                • C:\Windows\SysWOW64\Lbabgh32.exe

                                                                                  Filesize

                                                                                  465KB

                                                                                  MD5

                                                                                  9b0e61e8ef51e2fe85068c996a3c355c

                                                                                  SHA1

                                                                                  433b2069b58306da40d2e8c341400a7fadac9878

                                                                                  SHA256

                                                                                  5b67ee08a802695f2960bc4c8ab250e749f5f4e31987d59f61f3973a4bbfe0ed

                                                                                  SHA512

                                                                                  101592e82e91bd6133acb545607f3d33a57e0686cdf310681886dda446a9409d63f6848bd392fb55faf3d8685eefb03aafe3581f0e5034e865db3a7ce02c21d4

                                                                                • C:\Windows\SysWOW64\Ldanqkki.exe

                                                                                  Filesize

                                                                                  465KB

                                                                                  MD5

                                                                                  095bce875fdb90a454261fafd53b0744

                                                                                  SHA1

                                                                                  7c6650e6d894c81fb0203809746ac4756fa24d6a

                                                                                  SHA256

                                                                                  887a168acf44d114a93685e54b537748fd4a970ceb3ec14e9cc171939618ff0f

                                                                                  SHA512

                                                                                  49b89e762f589a6b483102c0179c364c32b7c7e0fb0bd624166acd3f4ea16d804786ac7a66da0f1b6eefc8a6f724cf19ef242361638f859dcc3d0be8d759b5e7

                                                                                • C:\Windows\SysWOW64\Ldjhpl32.exe

                                                                                  Filesize

                                                                                  465KB

                                                                                  MD5

                                                                                  18cd446de1394ac391d24442606428b3

                                                                                  SHA1

                                                                                  12270a1baf1bf403ef91d8af71d1beb6c96c7792

                                                                                  SHA256

                                                                                  ed6716b1ec2750bba9296fd6e932005667f451902f4e8908351138a8474d3a4a

                                                                                  SHA512

                                                                                  4b38c5254ba797c5245959779f162ffa2e2edcdef7b64958b04425a7ebe4e49ea6cb946975fcb7d74559a78ab1ed62c9965311850c90999edd559c7619d6aaed

                                                                                • C:\Windows\SysWOW64\Lebkhc32.exe

                                                                                  Filesize

                                                                                  465KB

                                                                                  MD5

                                                                                  52b037d5b42b6d423bcf65f4fdda0d38

                                                                                  SHA1

                                                                                  9518ac8f1346120221f6d8777a1546456bd67a68

                                                                                  SHA256

                                                                                  5a7cf485da9d06dd5b0f1927f559ee166b790126c7fb0265f193a46d53c0ccf5

                                                                                  SHA512

                                                                                  2c64c57549c3600794171f42491ae4f6cd002e150f3e00fcb75f9ebb3d8af5234923dedb9ec5f6d30fe46da46261b435d591c4a09294ea91690a6add0253d5f8

                                                                                • C:\Windows\SysWOW64\Lenamdem.exe

                                                                                  Filesize

                                                                                  465KB

                                                                                  MD5

                                                                                  1b4da4abaafad0bec068139e0cdb9e2c

                                                                                  SHA1

                                                                                  240dbb45fdc9461aefb7a4e9d9ee604f4d2c4b39

                                                                                  SHA256

                                                                                  44dcec9ccaaab6e79584abdd5e53b41348837f2380e8e3411f76b1582b996601

                                                                                  SHA512

                                                                                  8edb3497cdac9e523a3f5680c268a3168e4acbb4152d8b095c887baac89ee7e57eb58723efad393c184568fe4bb39499514f78761b1cac5d6f25fee93e9a81d4

                                                                                • C:\Windows\SysWOW64\Lepncd32.exe

                                                                                  Filesize

                                                                                  465KB

                                                                                  MD5

                                                                                  a80c355ab575d5d781dc6af72c0f29d2

                                                                                  SHA1

                                                                                  46ec6f2efc51754965a31e6532d33c2f77706253

                                                                                  SHA256

                                                                                  135166b2883eedb4709faaf03efb68ccda289fff690de81094aa8c67f5c90ad9

                                                                                  SHA512

                                                                                  408a432565e5eb335b9ba3083eaac25ce14ae65aeaa35a5ab7f4bb5d2735c932dcbc499848846394521e41beba8a993d0d4630937a11cb044ffe8c2f57801d97

                                                                                • C:\Windows\SysWOW64\Lgokmgjm.exe

                                                                                  Filesize

                                                                                  465KB

                                                                                  MD5

                                                                                  ae0cf984c8f1996f1925ad8982af1c75

                                                                                  SHA1

                                                                                  f61166acb43a2f30d001c5a7f7d7c9869e752612

                                                                                  SHA256

                                                                                  dac62c13cf96b312f70beeee457f5044cebdda4a8fcc8ce582799bdd3509b655

                                                                                  SHA512

                                                                                  1bb17111755f78fba72929a96a435f9118e66fa98898771287ab2eaa4e8877aaad7dd2f5815cff9827656d77b4de15f3fb1551996a9857bb428655079eb3fe44

                                                                                • C:\Windows\SysWOW64\Lingibiq.exe

                                                                                  Filesize

                                                                                  465KB

                                                                                  MD5

                                                                                  9c07b9c767abfe547d3fd09925fc70e7

                                                                                  SHA1

                                                                                  14575f2fd261c4fcceb0d6a9277995f6cd48a05d

                                                                                  SHA256

                                                                                  aa7a51098bf7c38fc72381c33fa7d4559d412afa2201b9821d8716b24145a1aa

                                                                                  SHA512

                                                                                  c5bdd96a50e16b20b8fc7e0b284c82684d86a69a0afae914eb26548663e26796201ad163808fb7b55be43e5e5f2bdd02fb05bf018f1ec460e1013c7e0773fb59

                                                                                • C:\Windows\SysWOW64\Llcpoo32.exe

                                                                                  Filesize

                                                                                  465KB

                                                                                  MD5

                                                                                  9b5d6e2d762e18d6b3d3640a81230c3c

                                                                                  SHA1

                                                                                  5a0b1aad5c41e7967961470bde1d8f2804784bff

                                                                                  SHA256

                                                                                  b8cda55542abc4758c267b63232fe7a35f39c98f0b2c6c302e7c283ef251fea5

                                                                                  SHA512

                                                                                  8db4b6b01489bd877d8417ec81926a3415dcad1194e15f6aebb3dfdf67fbc71ed11aa07443ac5a0ae2a76ab6f4db05b3beb56f75dd4e3e636173548d101ef42c

                                                                                • C:\Windows\SysWOW64\Llgjjnlj.exe

                                                                                  Filesize

                                                                                  465KB

                                                                                  MD5

                                                                                  5ed653e8533d6b69cab2d47b73e9b2c7

                                                                                  SHA1

                                                                                  c691930364779ac9242ce1561d5810507c6942d3

                                                                                  SHA256

                                                                                  8d869948b48efe685d454af029b29e32afc38ab44cf35dbb61f3df8d1702bd96

                                                                                  SHA512

                                                                                  0552032765d11575a00d49ce07bbf85842047776640e06a1f96e7b97ced94eac9e939bd0540c5ad80210b169768e7c84daee3db97e2453ba83b81b81fd32a8ac

                                                                                • C:\Windows\SysWOW64\Lllcen32.exe

                                                                                  Filesize

                                                                                  465KB

                                                                                  MD5

                                                                                  9ff33a8fcba766e364286b7b2ed0b7f4

                                                                                  SHA1

                                                                                  37cdc4a1e72d22ba4e0b0f102c0672b102e8a033

                                                                                  SHA256

                                                                                  14a8ba9eb2abb4049150ebe80517aa636bffd507767384a5292551a456494594

                                                                                  SHA512

                                                                                  ffc94934b3957b977d7faabb931a47d39545137daa863dfb6f03e9ce2edfb2573fb06f878db4985b37c211543fcd4cfc750066042b69b4bee2356a4a5ce084c1

                                                                                • C:\Windows\SysWOW64\Lmdina32.exe

                                                                                  Filesize

                                                                                  465KB

                                                                                  MD5

                                                                                  b7842a13d78c979e7847c66ce7c83cfe

                                                                                  SHA1

                                                                                  58ecda0d1cd72af5d686fd4c3d610cea2b1e161a

                                                                                  SHA256

                                                                                  da0003c8df7fbf11c7104757cbee5de9135bfd5c2155606df3c027fbca2674ae

                                                                                  SHA512

                                                                                  47a10003da3d0c90d575c2efa48f7dbca670a634746da02939dabfc6247d715362d948009700f6f2dc3369a519ce6d5a0e0c8ae7ba8e9353562d48c0ddfc671b

                                                                                • C:\Windows\SysWOW64\Lmgfda32.exe

                                                                                  Filesize

                                                                                  465KB

                                                                                  MD5

                                                                                  b1208c948f1d90fe1cb46b69a3eb3605

                                                                                  SHA1

                                                                                  c0204e346657f2d7ff8f940f535307c775c45600

                                                                                  SHA256

                                                                                  e73257369fdc5a2a7a4bcb6e9dadde0f4d260de835d127ec405c6e0a078bb082

                                                                                  SHA512

                                                                                  d8ac35c45a332a8c015d6ac8e859f789b1d62c0b594f6b83d2c43c630ec6ba8cc0dc100c3e50d683c58f6ae387411b1ecc3d1d3d912aff7fec64f0698e4afc59

                                                                                • C:\Windows\SysWOW64\Lmiciaaj.exe

                                                                                  Filesize

                                                                                  465KB

                                                                                  MD5

                                                                                  a15150de788635230772292f77d1d3f2

                                                                                  SHA1

                                                                                  da7b10a156b1b267f7329bfd9b04a974131b1e9e

                                                                                  SHA256

                                                                                  f5bbe66e2d06ff80d98cf24d8d3bcfaee13e9a144863592c940f272f0d7357ab

                                                                                  SHA512

                                                                                  527507e9df82608ec8ae4634ce67f02f52cc32edeca713221b2e12559e7a9e7e4aec598926f40d65fb7b32e7e24f3a7940295f91bb495045f27da69047c2557d

                                                                                • C:\Windows\SysWOW64\Lpebpm32.exe

                                                                                  Filesize

                                                                                  465KB

                                                                                  MD5

                                                                                  767edb70d42f7ae2b13d3f8091e64b74

                                                                                  SHA1

                                                                                  e0baf9dfd6df28278cbb4529a60b9d59035249fa

                                                                                  SHA256

                                                                                  01b7c39a891973d29cc3c176d8a6ec33a6a62b3201cc56fab577aa1bdda45a10

                                                                                  SHA512

                                                                                  0d5fa3b30e59c6e140fa0ef0edfa55a0f22682a1c56b677258cfc6aa2d7b3ec8ccbc090df6bf58264540c1cac1b4a46f1bf3a013efc329c892ff48bf7162c982

                                                                                • C:\Windows\SysWOW64\Lphoelqn.exe

                                                                                  Filesize

                                                                                  465KB

                                                                                  MD5

                                                                                  959661c7228947c666aef496038865c7

                                                                                  SHA1

                                                                                  af869416da78d90aa8c2d56e39292e1f73550255

                                                                                  SHA256

                                                                                  8b2e740a929deb0e07aa47d60669c5288c5a4aa8f9a7ba82810f44b211d8b2d2

                                                                                  SHA512

                                                                                  257c146c8d0b5af56a922024e5d9d5499c2e4246f617b0cf39ec23915e455d96a9a5549cdd5c8c334ebb31480abe20772593c94eb16329d8b3daaf6c4167082e

                                                                                • C:\Windows\SysWOW64\Lpqiemge.exe

                                                                                  Filesize

                                                                                  465KB

                                                                                  MD5

                                                                                  a8124f0ae1e61ddcaa3573a7a1759501

                                                                                  SHA1

                                                                                  cd7ca7d312026d6d35f3a05586354b71888ee570

                                                                                  SHA256

                                                                                  5401cf5f8e2c3e54b0be7a87679ee5ef3121766ad12f8192477d8252a17fd336

                                                                                  SHA512

                                                                                  eb570e9c6631f8bd622172474a97b40fc0b3efbce2bc2ba9e5998d5c9bd0844b0ec95fd173d76f1bbea47739a5b5b170de07a94d80eaad1eb17506de3b23ddba

                                                                                • C:\Windows\SysWOW64\Mbfkbhpa.exe

                                                                                  Filesize

                                                                                  465KB

                                                                                  MD5

                                                                                  788a295bf212babaa1a74b9d9390ef69

                                                                                  SHA1

                                                                                  73771ce7fffb2c00f0d11843765af0c9bda04cae

                                                                                  SHA256

                                                                                  19fda8a5c6eb3f2efd288e6f861b67a63cea9f55c5ed2e5677dd767c49ad20db

                                                                                  SHA512

                                                                                  8d2b2041d075ef11df7ad1a9230c8ff41fc8e93b6d4931153a749312c9b3870777a1eb75cdc2dc4dee8988f98d649fb0d9096030e9cba50d7942ed8784de08c7

                                                                                • C:\Windows\SysWOW64\Mchhggno.exe

                                                                                  Filesize

                                                                                  465KB

                                                                                  MD5

                                                                                  55673918070a3e42ddbe3ab0425857b2

                                                                                  SHA1

                                                                                  0f3ae7482d7f3202443a2bbeb4970690fc490c40

                                                                                  SHA256

                                                                                  15bd18313e35bc8fce6310be4a5271790ab3447e4036ce6ff8c3b02297952d75

                                                                                  SHA512

                                                                                  352babcf952021c1f1f371702bf0e7ac78c7955413d839d9aec652974a23f5ae4234f29abd31b1e7f2a93e0a7fcd1eb8a4627ee1312c3c0464a987bf7eb7ece7

                                                                                • C:\Windows\SysWOW64\Mdehlk32.exe

                                                                                  Filesize

                                                                                  465KB

                                                                                  MD5

                                                                                  4490e7eecbb38a64137bb28eba05adb6

                                                                                  SHA1

                                                                                  1ec22cab36a58fcf7e043ed9f096075e54f03d6c

                                                                                  SHA256

                                                                                  b4dea3fe0ffd7adaa43cc1e348e2d16f711eabb48c9430deab90c092e6f6a23c

                                                                                  SHA512

                                                                                  c2f155d66a75e749e953ff98eb63a06211261ef1727551c3421e22157531b1653103197fa0954bacf02c9a547a422ba662c4d108b83d1734de916ec94635b734

                                                                                • C:\Windows\SysWOW64\Medgncoe.exe

                                                                                  Filesize

                                                                                  465KB

                                                                                  MD5

                                                                                  84a750b65604aa0b51dec8c8f7f03539

                                                                                  SHA1

                                                                                  43396986451f8b6597ef4ef4cb8d13084d2e94e3

                                                                                  SHA256

                                                                                  dc56455f7d132dcbf8f5d8297c3696e1ae8410b6f22193196fc3df3a42198e80

                                                                                  SHA512

                                                                                  a8390289c918865e7dd7851f799855268d7a241c4a896aff801b054cd0657da0f6c4403c6a6dd9e7a0d04f7f12a4ae268ce9f22d9b15aba657b6f36b277776e0

                                                                                • C:\Windows\SysWOW64\Megdccmb.exe

                                                                                  Filesize

                                                                                  465KB

                                                                                  MD5

                                                                                  9cb1806fb615bd30126c5e81eb0d5e16

                                                                                  SHA1

                                                                                  598432b37571d50874c7860fc87981703a3be502

                                                                                  SHA256

                                                                                  7bda0f33ec09c67d42d069937e77c03aa196bb85f0a67c79b4be519e467c9a66

                                                                                  SHA512

                                                                                  6d82feb7f95f5c0e51f347ce8208c72f1513998349fc608cb2a6b010b865f2bb317f0a655b83f839349c47a8c106bc926f665eb26289dd4d193e93b4ca1c4a2b

                                                                                • C:\Windows\SysWOW64\Mgagbf32.exe

                                                                                  Filesize

                                                                                  465KB

                                                                                  MD5

                                                                                  5fe6829eda141a0b1211535937d772ed

                                                                                  SHA1

                                                                                  848fea75a3e648643476d59fba10a70177c28290

                                                                                  SHA256

                                                                                  99b88514df99848e704492c24b6f25f688c3b82996c88b7234ed2795d452868e

                                                                                  SHA512

                                                                                  362d045a011404150a7ea4450e8f60460e15950e19540a2fa275b456541bb926e263013b3dca90e5b511cf1f7072edc95b19d7651056291701a6a513cd62b921

                                                                                • C:\Windows\SysWOW64\Mlopkm32.exe

                                                                                  Filesize

                                                                                  465KB

                                                                                  MD5

                                                                                  0cbe2e40d440705953487c4a1f40dbbc

                                                                                  SHA1

                                                                                  ea9fee93dbb1e85c617bc007703e0e0f5a9f6978

                                                                                  SHA256

                                                                                  15cf5c5efef68a923b447234543ce32f0513aa6b172481f5d5edd17c1fbe2933

                                                                                  SHA512

                                                                                  7a6d471589bbf4168d05fa0ec41752c25ddded3286e4a00a6893610766d1afa09cd45a941341a529efcaacdf3810598b1240529c37dfc721cbef928b30d8aac1

                                                                                • C:\Windows\SysWOW64\Mmlpoqpg.exe

                                                                                  Filesize

                                                                                  465KB

                                                                                  MD5

                                                                                  6690fcd3110e0fc5854ecb089b2bc1c6

                                                                                  SHA1

                                                                                  d2c3cd2bdf15a61af562f43f244df67c542428b5

                                                                                  SHA256

                                                                                  4c582c9be15c132ee68b31b3d0a54f1853dba09a8ff92c4475a5692929dd03f1

                                                                                  SHA512

                                                                                  3bcfd5eba7594ab538949c0b33178748a15a76e9c1ec0fa9f0e3efc9adda9001e4e6891c547b66f019b80e2faebc3d8143e145da5975d1f16f08ac9de5683482

                                                                                • C:\Windows\SysWOW64\Mpjlklok.exe

                                                                                  Filesize

                                                                                  465KB

                                                                                  MD5

                                                                                  63c6a4bed8a584961ac872c3af531226

                                                                                  SHA1

                                                                                  274120f072c9d355dac144ed5fcfa31e4e304963

                                                                                  SHA256

                                                                                  037df78ce1ac5661f824fc2532f81b5a96c0208cd7ac88d74be3df910beaa67f

                                                                                  SHA512

                                                                                  a4a4354c5a58f5c9788fcf8e29d48a5d74a3cbc146b7ea31c4b8e6e4b78bee84ee37008e6d0fc6db8265716c2ec9339fb994d8b2a2bf6dd63c49c80feae35d6c

                                                                                • C:\Windows\SysWOW64\Pgllfp32.exe

                                                                                  Filesize

                                                                                  465KB

                                                                                  MD5

                                                                                  e2ca881b2c90fb8d0b004cd555061abd

                                                                                  SHA1

                                                                                  8b29346644a00ad2b1dae54f75f714a80302a959

                                                                                  SHA256

                                                                                  408836ea67a02b34a0d187f04b0ed1bd54c945b70a46fc94e2d97329e11be3a5

                                                                                  SHA512

                                                                                  6995d8bf99a01cf723fe4b83ce51657f4a6c8230bdd71ff1852ef86f7fd2849d02168e3e3c1819f02f9f09fca7d9d70280d2b45592a9054245a8a535e4200497

                                                                                • memory/220-324-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/392-124-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/392-626-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/468-300-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/664-245-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/756-417-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/788-359-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/1048-406-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/1104-205-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/1304-588-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/1304-65-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/1360-672-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/1360-189-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/1428-388-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/1448-1640-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/1448-556-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/1448-25-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/1468-9-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/1468-544-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/1488-229-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/1544-341-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/1632-1408-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/1672-1621-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/1672-615-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/1672-123-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/1740-645-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/1740-149-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/1804-1623-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/1804-614-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/1804-97-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/1908-1468-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/1908-589-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/2012-181-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/2012-670-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/2036-48-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/2036-576-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/2056-89-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/2056-608-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/2060-602-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/2124-428-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/2216-165-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/2216-657-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/2256-133-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/2256-633-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/2388-312-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/2564-1573-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/2564-289-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/2824-371-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/2852-664-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/2852-173-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/3220-306-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/3324-335-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/3332-639-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/3332-141-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/3416-253-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/3636-528-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/3636-0-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/3636-1-0x0000000000431000-0x0000000000432000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/3772-213-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/3852-237-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/3956-394-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/3976-283-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/4000-601-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/4000-80-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/4036-261-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/4112-595-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/4112-72-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/4316-221-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/4384-627-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/4384-125-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/4452-400-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/4460-318-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/4520-197-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/4520-1599-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/4520-678-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/4572-1550-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/4572-353-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/4604-267-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/4640-569-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/4640-40-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/4660-377-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/4688-365-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/4700-582-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/4700-61-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/4784-550-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/4784-16-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/4824-347-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/5052-562-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/5052-33-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/5060-157-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/5060-651-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/5148-1394-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/5164-434-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/5204-440-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/5320-456-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/5360-462-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/5468-1407-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/5536-658-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/5544-488-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/5580-494-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/5620-500-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/5656-1375-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/5668-506-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/5764-679-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/5776-522-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/6036-1383-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/6052-563-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/6052-1477-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/6060-1430-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/6088-570-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/6140-1414-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/6332-1346-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/6372-1345-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/6508-1338-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/6552-1337-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/6860-1292-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB

                                                                                • memory/7120-1319-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                  Filesize

                                                                                  364KB