berbew | fc28cb9c3eb559586545f8c1314ebc18abd42a527eadc1acc91e50313da506c3

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
27-09-2024 03:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc28cb9c3eb559586545f8c1314ebc18abd42a527eadc1acc91e50313da506c3.exe
Size

97KB
MD5

e58cd94428e65573358469c82e7f3fe1
SHA1

34e6e6251d3f20fe5bd6f032f071970f583d2324
SHA256

fc28cb9c3eb559586545f8c1314ebc18abd42a527eadc1acc91e50313da506c3
SHA512

ed318d79c4ef2a54ddf155fa9db5b34092acc58fafd834b6e1e77460076971cfb4b8a5066d49f2d3b146bff6cdcd66857d0de5b8b0622cba8017a3720bb31416
SSDEEP

1536:rxIOp2gyZbYbCSVfScz+JHfSDySuhiMjw1tJy4esvJXeYZ6:abp9IoczFDHb1tJytMJXeK6

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekjded32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eklajcmc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fooclapd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgbefe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ppahmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aggpfkjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgkiaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdbpgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kcmfnd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pqbala32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajmladbl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekimjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nfnamjhk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dncpkjoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Paihlpfi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ppolhcnm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnaaib32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Caojpaij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dafppp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nqaiecjd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocjoadei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gegkpf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iiopca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Opbean32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpjfgf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Knqepc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdmmeo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mlljnf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjpjgj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cgiohbfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Edeeci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jbccge32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kcapicdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aoioli32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cocjiehd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnfkdb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpkmal32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebaplnie.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmidnm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hldiinke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jhkbdmbg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmjmekgn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Moipoh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmdgikhi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aagkhd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bgkiaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bajqda32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nagiji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Apodoq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iogopi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Keifdpif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dnljkk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njgqhicg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmfmde32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ppgomnai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lfeljd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Offnhpfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bobabg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kibeoo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ljbnfleo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmkofa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncnofeof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ngqagcag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnfkdb32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Executes dropped EXE 64 IoCs

pid	Process
4196	Klahfp32.exe
980	Kgflcifg.exe
3936	Knqepc32.exe
1076	Kpoalo32.exe
3616	Kflide32.exe
2576	Kncaec32.exe
1360	Kodnmkap.exe
3312	Kfnfjehl.exe
3060	Klhnfo32.exe
2156	Kcbfcigf.exe
2696	Kjlopc32.exe
3736	Lcdciiec.exe
3776	Ljnlecmp.exe
4812	Lokdnjkg.exe
3208	Lfeljd32.exe
4412	Llodgnja.exe
4744	Lcimdh32.exe
948	Lfgipd32.exe
2164	Lmaamn32.exe
3204	Lckiihok.exe
4808	Lfjfecno.exe
1600	Lmdnbn32.exe
1812	Lqojclne.exe
664	Lgibpf32.exe
1556	Mmfkhmdi.exe
1152	Mfnoqc32.exe
2192	Mnegbp32.exe
2364	Mogcihaj.exe
4888	Mfqlfb32.exe
3812	Moipoh32.exe
2676	Mjodla32.exe
1220	Mmmqhl32.exe
4492	Mgbefe32.exe
4568	Mnmmboed.exe
3480	Mqkiok32.exe
4088	Mfhbga32.exe
2052	Nnojho32.exe
1336	Nfjola32.exe
4644	Nmdgikhi.exe
3108	Nqpcjj32.exe
788	Ncnofeof.exe
4896	Nflkbanj.exe
1364	Nmfcok32.exe
1692	Npepkf32.exe
2784	Nfohgqlg.exe
320	Nadleilm.exe
3544	Ngndaccj.exe
840	Nnhmnn32.exe
1636	Nagiji32.exe
3612	Ngqagcag.exe
372	Onkidm32.exe
3144	Oplfkeob.exe
556	Offnhpfo.exe
1128	Ojajin32.exe
4880	Ompfej32.exe
1880	Ocjoadei.exe
3304	Ojdgnn32.exe
4504	Oclkgccf.exe
1648	Ofkgcobj.exe
4376	Oaplqh32.exe
652	Ocohmc32.exe
1144	Ojhpimhp.exe
1892	Opeiadfg.exe
3876	Pfoann32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ookoaokf.exe	Ocdnln32.exe
File created	C:\Windows\SysWOW64\Hejeak32.dll	Pmkofa32.exe
File created	C:\Windows\SysWOW64\Aadghn32.exe	Amikgpcc.exe
File created	C:\Windows\SysWOW64\Hpkdfd32.dll	Oikjkc32.exe
File opened for modification	C:\Windows\SysWOW64\Lcimdh32.exe	Llodgnja.exe
File created	C:\Windows\SysWOW64\Ahfmpnql.exe	Apodoq32.exe
File created	C:\Windows\SysWOW64\Cepjip32.dll	Dgeenfog.exe
File opened for modification	C:\Windows\SysWOW64\Njgqhicg.exe	Nbphglbe.exe
File opened for modification	C:\Windows\SysWOW64\Fbplml32.exe	Fndpmndl.exe
File opened for modification	C:\Windows\SysWOW64\Qfmfefni.exe	Qcnjijoe.exe
File created	C:\Windows\SysWOW64\Apjdikqd.exe	Amkhmoap.exe
File created	C:\Windows\SysWOW64\Hiciojhd.dll	Kidben32.exe
File created	C:\Windows\SysWOW64\Mmdaih32.dll	Kemooo32.exe
File opened for modification	C:\Windows\SysWOW64\Dnqcfjae.exe	Dkbgjo32.exe
File opened for modification	C:\Windows\SysWOW64\Lmdnbn32.exe	Lfjfecno.exe
File created	C:\Windows\SysWOW64\Ekppjn32.dll	Dpiplm32.exe
File opened for modification	C:\Windows\SysWOW64\Ehndnh32.exe	Ebdlangb.exe
File opened for modification	C:\Windows\SysWOW64\Jpgdai32.exe	Jbccge32.exe
File created	C:\Windows\SysWOW64\Mfhbga32.exe	Mqkiok32.exe
File created	C:\Windows\SysWOW64\Keiifian.dll	Qhhpop32.exe
File created	C:\Windows\SysWOW64\Dnkdmlfj.dll	Adfgdpmi.exe
File opened for modification	C:\Windows\SysWOW64\Kemooo32.exe	Kocgbend.exe
File opened for modification	C:\Windows\SysWOW64\Nagiji32.exe	Nnhmnn32.exe
File created	C:\Windows\SysWOW64\Biafno32.dll	Chnlgjlb.exe
File created	C:\Windows\SysWOW64\Knqepc32.exe	Kgflcifg.exe
File created	C:\Windows\SysWOW64\Lhaiafem.dll	Ejlnfjbd.exe
File created	C:\Windows\SysWOW64\Nqgnfcmm.dll	Eojiqb32.exe
File opened for modification	C:\Windows\SysWOW64\Hpkknmgd.exe	Hiacacpg.exe
File opened for modification	C:\Windows\SysWOW64\Ppikbm32.exe	Pmkofa32.exe
File created	C:\Windows\SysWOW64\Ngcglo32.dll	Jhkbdmbg.exe
File opened for modification	C:\Windows\SysWOW64\Pmpolgoi.exe	Pffgom32.exe
File created	C:\Windows\SysWOW64\Baegibae.exe	Bogkmgba.exe
File created	C:\Windows\SysWOW64\Cbqfhb32.dll	Lindkm32.exe
File created	C:\Windows\SysWOW64\Pqbala32.exe	Oikjkc32.exe
File created	C:\Windows\SysWOW64\Cajdjn32.dll	Knqepc32.exe
File created	C:\Windows\SysWOW64\Chnlgjlb.exe	Cdbpgl32.exe
File opened for modification	C:\Windows\SysWOW64\Gaqhjggp.exe	Gpolbo32.exe
File created	C:\Windows\SysWOW64\Oiccje32.exe	Ookoaokf.exe
File opened for modification	C:\Windows\SysWOW64\Cdaile32.exe	Cacmpj32.exe
File opened for modification	C:\Windows\SysWOW64\Adjjeieh.exe	Aalmimfd.exe
File created	C:\Windows\SysWOW64\Nflkbanj.exe	Ncnofeof.exe
File opened for modification	C:\Windows\SysWOW64\Pdhkcb32.exe	Pmnbfhal.exe
File created	C:\Windows\SysWOW64\Enfqikef.dll	Pmblagmf.exe
File opened for modification	C:\Windows\SysWOW64\Dpkmal32.exe	Dahmfpap.exe
File created	C:\Windows\SysWOW64\Keoaokpd.dll	Hnbeeiji.exe
File created	C:\Windows\SysWOW64\Bigpblgh.dll	Cdaile32.exe
File created	C:\Windows\SysWOW64\Dnhpfk32.dll	Dncpkjoc.exe
File opened for modification	C:\Windows\SysWOW64\Mnmmboed.exe	Mgbefe32.exe
File created	C:\Windows\SysWOW64\Nnahhegq.dll	Oaplqh32.exe
File opened for modification	C:\Windows\SysWOW64\Iondqhpl.exe	Iialhaad.exe
File created	C:\Windows\SysWOW64\Lnpckhnk.dll	Noblkqca.exe
File created	C:\Windows\SysWOW64\Ppgomnai.exe	Pimfpc32.exe
File created	C:\Windows\SysWOW64\Pafpga32.dll	Qpbnhl32.exe
File opened for modification	C:\Windows\SysWOW64\Bpdnjple.exe	Bobabg32.exe
File created	C:\Windows\SysWOW64\Dhbebj32.exe	Dpkmal32.exe
File opened for modification	C:\Windows\SysWOW64\Eiekog32.exe	Ebkbbmqj.exe
File created	C:\Windows\SysWOW64\Fooclapd.exe	Eiekog32.exe
File opened for modification	C:\Windows\SysWOW64\Omalpc32.exe	Ofgdcipq.exe
File created	C:\Windows\SysWOW64\Ljkgblln.dll	Ekimjn32.exe
File created	C:\Windows\SysWOW64\Kdmpmdpj.dll	Kgflcifg.exe
File created	C:\Windows\SysWOW64\Jencdebl.dll	Lgibpf32.exe
File created	C:\Windows\SysWOW64\Mmlmhc32.dll	Caojpaij.exe
File opened for modification	C:\Windows\SysWOW64\Jbepme32.exe	Jpgdai32.exe
File created	C:\Windows\SysWOW64\Mjodla32.exe	Moipoh32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9240	9672	WerFault.exe	480

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gpdennml.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kcapicdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lhenai32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpcpfg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahaceo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amqhbe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mfhbga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oaplqh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdmmeo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Giljfddl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klggli32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qpbnhl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmaamn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mnegbp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kolabf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kocgbend.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njljch32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ockdmmoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppikbm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qcnjijoe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ebaplnie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jldbpl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opbean32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eiekog32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbbajjlp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdpcal32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cogddd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iondqhpl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lljdai32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adjjeieh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akkffkhk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dolmodpi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Boihcf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hbihjifh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kibeoo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mapppn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pbhgoh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fdpnda32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mfnoqc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npepkf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Enkmfolf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kgflcifg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lfeljd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iogopi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Enlcahgh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngndaccj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpkmal32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qjiipk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgpcliao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dnajppda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hehdfdek.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jbccge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gddgpqbe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kfnfjehl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfjola32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iialhaad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lcfidb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aadghn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfaigclq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dajbaika.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnojho32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onkidm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmphaaln.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ciihjmcj.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofkhpmpa.dll"	Nflkbanj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Njgqhicg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bmidnm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fjhmbihg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkfoeejd.dll"	Ocohmc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gpaihooo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mcoljagj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cgfbbb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ppikbm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dcibca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mnmmboed.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cdbpgl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ebkbbmqj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fiqjke32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kpnjah32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mohidbkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbbnpn32.dll"	Mohidbkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fdmaoahm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lgibpf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pjdpelnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dahceqce.dll"	Gejhef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jggocdgo.dll"	Hlblcn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Iolhkh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pbhgoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Edaaccbj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mfhbga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bgkiaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ebkbbmqj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocfgbfdm.dll"	Figgdg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hnbeeiji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cgfbbb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Chiblk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cgnomg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gegkpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qglobbdg.dll"	Iondqhpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Laiimcij.dll"	Loacdc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aoioli32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gnnccl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ilfennic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kekbjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anafep32.dll"	Mcoljagj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Knqepc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lfjfecno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Oplfkeob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chbfoaba.dll"	Hbenoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bdmmeo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ddnobj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Joekag32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Paihlpfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npgqep32.dll"	Egkddo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lfjfecno.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pmnbfhal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pdjgha32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mapppn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Noblkqca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jnblgj32.dll"	Cgiohbfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fohhdm32.dll"	Cildom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mgbefe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Npepkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idknpoad.dll"	Iogopi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Njljch32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pmkofa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kemooo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofjljj32.dll"	Eqmlccdi.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 4196	4060	fc28cb9c3eb559586545f8c1314ebc18abd42a527eadc1acc91e50313da506c3.exe	84
PID 4060 wrote to memory of 4196	4060	fc28cb9c3eb559586545f8c1314ebc18abd42a527eadc1acc91e50313da506c3.exe	84
PID 4060 wrote to memory of 4196	4060	fc28cb9c3eb559586545f8c1314ebc18abd42a527eadc1acc91e50313da506c3.exe	84
PID 4196 wrote to memory of 980	4196	Klahfp32.exe	85
PID 4196 wrote to memory of 980	4196	Klahfp32.exe	85
PID 4196 wrote to memory of 980	4196	Klahfp32.exe	85
PID 980 wrote to memory of 3936	980	Kgflcifg.exe	86
PID 980 wrote to memory of 3936	980	Kgflcifg.exe	86
PID 980 wrote to memory of 3936	980	Kgflcifg.exe	86
PID 3936 wrote to memory of 1076	3936	Knqepc32.exe	87
PID 3936 wrote to memory of 1076	3936	Knqepc32.exe	87
PID 3936 wrote to memory of 1076	3936	Knqepc32.exe	87
PID 1076 wrote to memory of 3616	1076	Kpoalo32.exe	88
PID 1076 wrote to memory of 3616	1076	Kpoalo32.exe	88
PID 1076 wrote to memory of 3616	1076	Kpoalo32.exe	88
PID 3616 wrote to memory of 2576	3616	Kflide32.exe	89
PID 3616 wrote to memory of 2576	3616	Kflide32.exe	89
PID 3616 wrote to memory of 2576	3616	Kflide32.exe	89
PID 2576 wrote to memory of 1360	2576	Kncaec32.exe	90
PID 2576 wrote to memory of 1360	2576	Kncaec32.exe	90
PID 2576 wrote to memory of 1360	2576	Kncaec32.exe	90
PID 1360 wrote to memory of 3312	1360	Kodnmkap.exe	91
PID 1360 wrote to memory of 3312	1360	Kodnmkap.exe	91
PID 1360 wrote to memory of 3312	1360	Kodnmkap.exe	91
PID 3312 wrote to memory of 3060	3312	Kfnfjehl.exe	92
PID 3312 wrote to memory of 3060	3312	Kfnfjehl.exe	92
PID 3312 wrote to memory of 3060	3312	Kfnfjehl.exe	92
PID 3060 wrote to memory of 2156	3060	Klhnfo32.exe	93
PID 3060 wrote to memory of 2156	3060	Klhnfo32.exe	93
PID 3060 wrote to memory of 2156	3060	Klhnfo32.exe	93
PID 2156 wrote to memory of 2696	2156	Kcbfcigf.exe	94
PID 2156 wrote to memory of 2696	2156	Kcbfcigf.exe	94
PID 2156 wrote to memory of 2696	2156	Kcbfcigf.exe	94
PID 2696 wrote to memory of 3736	2696	Kjlopc32.exe	95
PID 2696 wrote to memory of 3736	2696	Kjlopc32.exe	95
PID 2696 wrote to memory of 3736	2696	Kjlopc32.exe	95
PID 3736 wrote to memory of 3776	3736	Lcdciiec.exe	96
PID 3736 wrote to memory of 3776	3736	Lcdciiec.exe	96
PID 3736 wrote to memory of 3776	3736	Lcdciiec.exe	96
PID 3776 wrote to memory of 4812	3776	Ljnlecmp.exe	97
PID 3776 wrote to memory of 4812	3776	Ljnlecmp.exe	97
PID 3776 wrote to memory of 4812	3776	Ljnlecmp.exe	97
PID 4812 wrote to memory of 3208	4812	Lokdnjkg.exe	98
PID 4812 wrote to memory of 3208	4812	Lokdnjkg.exe	98
PID 4812 wrote to memory of 3208	4812	Lokdnjkg.exe	98
PID 3208 wrote to memory of 4412	3208	Lfeljd32.exe	100
PID 3208 wrote to memory of 4412	3208	Lfeljd32.exe	100
PID 3208 wrote to memory of 4412	3208	Lfeljd32.exe	100
PID 4412 wrote to memory of 4744	4412	Llodgnja.exe	101
PID 4412 wrote to memory of 4744	4412	Llodgnja.exe	101
PID 4412 wrote to memory of 4744	4412	Llodgnja.exe	101
PID 4744 wrote to memory of 948	4744	Lcimdh32.exe	102
PID 4744 wrote to memory of 948	4744	Lcimdh32.exe	102
PID 4744 wrote to memory of 948	4744	Lcimdh32.exe	102
PID 948 wrote to memory of 2164	948	Lfgipd32.exe	103
PID 948 wrote to memory of 2164	948	Lfgipd32.exe	103
PID 948 wrote to memory of 2164	948	Lfgipd32.exe	103
PID 2164 wrote to memory of 3204	2164	Lmaamn32.exe	104
PID 2164 wrote to memory of 3204	2164	Lmaamn32.exe	104
PID 2164 wrote to memory of 3204	2164	Lmaamn32.exe	104
PID 3204 wrote to memory of 4808	3204	Lckiihok.exe	105
PID 3204 wrote to memory of 4808	3204	Lckiihok.exe	105
PID 3204 wrote to memory of 4808	3204	Lckiihok.exe	105
PID 4808 wrote to memory of 1600	4808	Lfjfecno.exe	106

C:\Users\Admin\AppData\Local\Temp\fc28cb9c3eb559586545f8c1314ebc18abd42a527eadc1acc91e50313da506c3.exe
"C:\Users\Admin\AppData\Local\Temp\fc28cb9c3eb559586545f8c1314ebc18abd42a527eadc1acc91e50313da506c3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Windows\SysWOW64\Klahfp32.exe
  C:\Windows\system32\Klahfp32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4196
- - C:\Windows\SysWOW64\Kgflcifg.exe
    C:\Windows\system32\Kgflcifg.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:980
  - - C:\Windows\SysWOW64\Knqepc32.exe
      C:\Windows\system32\Knqepc32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3936
    - - C:\Windows\SysWOW64\Kpoalo32.exe
        
        C:\Windows\system32\Kpoalo32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1076
      - C:\Windows\SysWOW64\Kflide32.exe
        
        C:\Windows\system32\Kflide32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3616
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2576
        
        C:\Windows\SysWOW64\Kodnmkap.exe
        
        C:\Windows\system32\Kodnmkap.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1360
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3312
        
        C:\Windows\SysWOW64\Klhnfo32.exe
        
        C:\Windows\system32\Klhnfo32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3060
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2156
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2696
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3736
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3776
        
        C:\Windows\SysWOW64\Lokdnjkg.exe
        
        C:\Windows\system32\Lokdnjkg.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4812
        
        C:\Windows\SysWOW64\Lfeljd32.exe
        
        C:\Windows\system32\Lfeljd32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3208
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4412
        
        C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4744
        
        C:\Windows\SysWOW64\Lfgipd32.exe
        
        C:\Windows\system32\Lfgipd32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:948
        
        C:\Windows\SysWOW64\Lmaamn32.exe
        
        C:\Windows\system32\Lmaamn32.exe
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2164
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3204
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4808
        
        C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        23⤵
        Executes dropped EXE
        
        PID:1600
        
        C:\Windows\SysWOW64\Lqojclne.exe
        
        C:\Windows\system32\Lqojclne.exe
        24⤵
        Executes dropped EXE
        
        PID:1812
        
        C:\Windows\SysWOW64\Lgibpf32.exe
        
        C:\Windows\system32\Lgibpf32.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:664
        
        C:\Windows\SysWOW64\Mmfkhmdi.exe
        
        C:\Windows\system32\Mmfkhmdi.exe
        26⤵
        Executes dropped EXE
        
        PID:1556
        
        C:\Windows\SysWOW64\Mfnoqc32.exe
        
        C:\Windows\system32\Mfnoqc32.exe
        27⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1152
        
        C:\Windows\SysWOW64\Mnegbp32.exe
        
        C:\Windows\system32\Mnegbp32.exe
        28⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2192
        
        C:\Windows\SysWOW64\Mogcihaj.exe
        
        C:\Windows\system32\Mogcihaj.exe
        29⤵
        Executes dropped EXE
        
        PID:2364
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        30⤵
        Executes dropped EXE
        
        PID:4888
        
        C:\Windows\SysWOW64\Moipoh32.exe
        
        C:\Windows\system32\Moipoh32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3812
        
        C:\Windows\SysWOW64\Mjodla32.exe
        
        C:\Windows\system32\Mjodla32.exe
        32⤵
        Executes dropped EXE
        
        PID:2676
        
        C:\Windows\SysWOW64\Mmmqhl32.exe
        
        C:\Windows\system32\Mmmqhl32.exe
        33⤵
        Executes dropped EXE
        
        PID:1220
        
        C:\Windows\SysWOW64\Mgbefe32.exe
        
        C:\Windows\system32\Mgbefe32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4492
        
        C:\Windows\SysWOW64\Mnmmboed.exe
        
        C:\Windows\system32\Mnmmboed.exe
        35⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4568
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3480
        
        C:\Windows\SysWOW64\Mfhbga32.exe
        
        C:\Windows\system32\Mfhbga32.exe
        37⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4088
        
        C:\Windows\SysWOW64\Nnojho32.exe
        
        C:\Windows\system32\Nnojho32.exe
        38⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2052
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        39⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1336
        
        C:\Windows\SysWOW64\Nmdgikhi.exe
        
        C:\Windows\system32\Nmdgikhi.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4644
        
        C:\Windows\SysWOW64\Nqpcjj32.exe
        
        C:\Windows\system32\Nqpcjj32.exe
        41⤵
        Executes dropped EXE
        
        PID:3108
        
        C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:788
        
        C:\Windows\SysWOW64\Nflkbanj.exe
        
        C:\Windows\system32\Nflkbanj.exe
        43⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4896
        
        C:\Windows\SysWOW64\Nmfcok32.exe
        
        C:\Windows\system32\Nmfcok32.exe
        44⤵
        Executes dropped EXE
        
        PID:1364
        
        C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        45⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1692
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        46⤵
        Executes dropped EXE
        
        PID:2784
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        47⤵
        Executes dropped EXE
        
        PID:320
        
        C:\Windows\SysWOW64\Ngndaccj.exe
        
        C:\Windows\system32\Ngndaccj.exe
        48⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3544
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:840
        
        C:\Windows\SysWOW64\Nagiji32.exe
        
        C:\Windows\system32\Nagiji32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1636
        
        C:\Windows\SysWOW64\Ngqagcag.exe
        
        C:\Windows\system32\Ngqagcag.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3612
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        52⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:372
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        53⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3144
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:556
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        55⤵
        Executes dropped EXE
        
        PID:1128
        
        C:\Windows\SysWOW64\Ompfej32.exe
        
        C:\Windows\system32\Ompfej32.exe
        56⤵
        Executes dropped EXE
        
        PID:4880
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1880
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        58⤵
        Executes dropped EXE
        
        PID:3304
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        59⤵
        Executes dropped EXE
        
        PID:4504
        
        C:\Windows\SysWOW64\Ofkgcobj.exe
        
        C:\Windows\system32\Ofkgcobj.exe
        60⤵
        Executes dropped EXE
        
        PID:1648
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4376
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        62⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:652
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        63⤵
        Executes dropped EXE
        
        PID:1144
        
        C:\Windows\SysWOW64\Opeiadfg.exe
        
        C:\Windows\system32\Opeiadfg.exe
        64⤵
        Executes dropped EXE
        
        PID:1892
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        65⤵
        Executes dropped EXE
        
        PID:3876
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        66⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        67⤵
        
        PID:2548
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        68⤵
        
        PID:1164
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        69⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        70⤵
        
        PID:576
        
        C:\Windows\SysWOW64\Pmnbfhal.exe
        
        C:\Windows\system32\Pmnbfhal.exe
        71⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4860
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        72⤵
        
        PID:4836
        
        C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        73⤵
        Drops file in System32 directory
        
        PID:1660
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        74⤵
        
        PID:4176
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4564
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        76⤵
        Modifies registry class
        
        PID:2856
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        77⤵
        Modifies registry class
        
        PID:4672
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        78⤵
        Drops file in System32 directory
        
        PID:1816
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2432
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        80⤵
        Drops file in System32 directory
        
        PID:2936
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        81⤵
        
        PID:432
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        82⤵
        
        PID:2332
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        83⤵
        
        PID:3284
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        84⤵
        System Location Discovery: System Language Discovery
        
        PID:2232
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        85⤵
        
        PID:216
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        86⤵
        System Location Discovery: System Language Discovery
        
        PID:2008
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        87⤵
        
        PID:4128
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        88⤵
        
        PID:1348
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4480
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2348
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        91⤵
        Drops file in System32 directory
        
        PID:5152
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        92⤵
        System Location Discovery: System Language Discovery
        
        PID:5200
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        93⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        94⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Aajhndkb.exe
        
        C:\Windows\system32\Aajhndkb.exe
        95⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        96⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5500
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        98⤵
        System Location Discovery: System Language Discovery
        
        PID:5544
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5592
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        100⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        101⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5752
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5792
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5836
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        105⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        106⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        107⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        108⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        109⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        110⤵
        System Location Discovery: System Language Discovery
        
        PID:6100
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        111⤵
        Drops file in System32 directory
        
        PID:3668
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        112⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        113⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        114⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        115⤵
        System Location Discovery: System Language Discovery
        
        PID:5496
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        116⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        117⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5728
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        119⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5872
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        121⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6016
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        123⤵
        Modifies registry class
        
        PID:6088
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5144
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5272
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        126⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        127⤵
        System Location Discovery: System Language Discovery
        
        PID:5576
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        128⤵
        Modifies registry class
        
        PID:4256
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        129⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        130⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6036
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        132⤵
        Drops file in System32 directory
        
        PID:5140
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        133⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        134⤵
        System Location Discovery: System Language Discovery
        
        PID:5552
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5784
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        136⤵
        Drops file in System32 directory
        
        PID:5916
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        137⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        138⤵
        Drops file in System32 directory
        
        PID:5432
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5720
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        140⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        141⤵
        Drops file in System32 directory
        
        PID:5536
        
        C:\Windows\SysWOW64\Dolmodpi.exe
        
        C:\Windows\system32\Dolmodpi.exe
        142⤵
        System Location Discovery: System Language Discovery
        
        PID:5936
        
        C:\Windows\SysWOW64\Dakikoom.exe
        
        C:\Windows\system32\Dakikoom.exe
        143⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Dhdbhifj.exe
        
        C:\Windows\system32\Dhdbhifj.exe
        144⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Doojec32.exe
        
        C:\Windows\system32\Doojec32.exe
        145⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Dnajppda.exe
        
        C:\Windows\system32\Dnajppda.exe
        146⤵
        System Location Discovery: System Language Discovery
        
        PID:6160
        
        C:\Windows\SysWOW64\Ddkbmj32.exe
        
        C:\Windows\system32\Ddkbmj32.exe
        147⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Dkekjdck.exe
        
        C:\Windows\system32\Dkekjdck.exe
        148⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Doagjc32.exe
        
        C:\Windows\system32\Doagjc32.exe
        149⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Dqbcbkab.exe
        
        C:\Windows\system32\Dqbcbkab.exe
        150⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Ddnobj32.exe
        
        C:\Windows\system32\Ddnobj32.exe
        151⤵
        Modifies registry class
        
        PID:6380
        
        C:\Windows\SysWOW64\Dkhgod32.exe
        
        C:\Windows\system32\Dkhgod32.exe
        152⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Enfckp32.exe
        
        C:\Windows\system32\Enfckp32.exe
        153⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Ebaplnie.exe
        
        C:\Windows\system32\Ebaplnie.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6512
        
        C:\Windows\SysWOW64\Ehlhih32.exe
        
        C:\Windows\system32\Ehlhih32.exe
        155⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Ekjded32.exe
        
        C:\Windows\system32\Ekjded32.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6596
        
        C:\Windows\SysWOW64\Ebdlangb.exe
        
        C:\Windows\system32\Ebdlangb.exe
        157⤵
        Drops file in System32 directory
        
        PID:6640
        
        C:\Windows\SysWOW64\Ehndnh32.exe
        
        C:\Windows\system32\Ehndnh32.exe
        158⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Eklajcmc.exe
        
        C:\Windows\system32\Eklajcmc.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6728
        
        C:\Windows\SysWOW64\Enkmfolf.exe
        
        C:\Windows\system32\Enkmfolf.exe
        160⤵
        System Location Discovery: System Language Discovery
        
        PID:6772
        
        C:\Windows\SysWOW64\Edeeci32.exe
        
        C:\Windows\system32\Edeeci32.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6816
        
        C:\Windows\SysWOW64\Egcaod32.exe
        
        C:\Windows\system32\Egcaod32.exe
        162⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Eojiqb32.exe
        
        C:\Windows\system32\Eojiqb32.exe
        163⤵
        Drops file in System32 directory
        
        PID:6904
        
        C:\Windows\SysWOW64\Ebifmm32.exe
        
        C:\Windows\system32\Ebifmm32.exe
        164⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Ehbnigjj.exe
        
        C:\Windows\system32\Ehbnigjj.exe
        165⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Egened32.exe
        
        C:\Windows\system32\Egened32.exe
        166⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Ebkbbmqj.exe
        
        C:\Windows\system32\Ebkbbmqj.exe
        167⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7080
        
        C:\Windows\SysWOW64\Eiekog32.exe
        
        C:\Windows\system32\Eiekog32.exe
        168⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7124
        
        C:\Windows\SysWOW64\Fooclapd.exe
        
        C:\Windows\system32\Fooclapd.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6152
        
        C:\Windows\SysWOW64\Fbmohmoh.exe
        
        C:\Windows\system32\Fbmohmoh.exe
        170⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Figgdg32.exe
        
        C:\Windows\system32\Figgdg32.exe
        171⤵
        Modifies registry class
        
        PID:6280
        
        C:\Windows\SysWOW64\Fgjhpcmo.exe
        
        C:\Windows\system32\Fgjhpcmo.exe
        172⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Fndpmndl.exe
        
        C:\Windows\system32\Fndpmndl.exe
        173⤵
        Drops file in System32 directory
        
        PID:6440
        
        C:\Windows\SysWOW64\Fbplml32.exe
        
        C:\Windows\system32\Fbplml32.exe
        174⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Fijdjfdb.exe
        
        C:\Windows\system32\Fijdjfdb.exe
        175⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Fnfmbmbi.exe
        
        C:\Windows\system32\Fnfmbmbi.exe
        176⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Fgoakc32.exe
        
        C:\Windows\system32\Fgoakc32.exe
        177⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Fofilp32.exe
        
        C:\Windows\system32\Fofilp32.exe
        178⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Fqgedh32.exe
        
        C:\Windows\system32\Fqgedh32.exe
        179⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Fkmjaa32.exe
        
        C:\Windows\system32\Fkmjaa32.exe
        180⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Fohfbpgi.exe
        
        C:\Windows\system32\Fohfbpgi.exe
        181⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Fiqjke32.exe
        
        C:\Windows\system32\Fiqjke32.exe
        182⤵
        Modifies registry class
        
        PID:7112
        
        C:\Windows\SysWOW64\Gnnccl32.exe
        
        C:\Windows\system32\Gnnccl32.exe
        183⤵
        Modifies registry class
        
        PID:6172
        
        C:\Windows\SysWOW64\Gegkpf32.exe
        
        C:\Windows\system32\Gegkpf32.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6268
        
        C:\Windows\SysWOW64\Ggfglb32.exe
        
        C:\Windows\system32\Ggfglb32.exe
        185⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Gnpphljo.exe
        
        C:\Windows\system32\Gnpphljo.exe
        186⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Gejhef32.exe
        
        C:\Windows\system32\Gejhef32.exe
        187⤵
        Modifies registry class
        
        PID:6628
        
        C:\Windows\SysWOW64\Giecfejd.exe
        
        C:\Windows\system32\Giecfejd.exe
        188⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Gpolbo32.exe
        
        C:\Windows\system32\Gpolbo32.exe
        189⤵
        Drops file in System32 directory
        
        PID:5612
        
        C:\Windows\SysWOW64\Gaqhjggp.exe
        
        C:\Windows\system32\Gaqhjggp.exe
        190⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Glfmgp32.exe
        
        C:\Windows\system32\Glfmgp32.exe
        191⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Gpaihooo.exe
        
        C:\Windows\system32\Gpaihooo.exe
        192⤵
        Modifies registry class
        
        PID:6148
        
        C:\Windows\SysWOW64\Gacepg32.exe
        
        C:\Windows\system32\Gacepg32.exe
        193⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Gijmad32.exe
        
        C:\Windows\system32\Gijmad32.exe
        194⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Gpdennml.exe
        
        C:\Windows\system32\Gpdennml.exe
        195⤵
        System Location Discovery: System Language Discovery
        
        PID:6712
        
        C:\Windows\SysWOW64\Gbbajjlp.exe
        
        C:\Windows\system32\Gbbajjlp.exe
        196⤵
        System Location Discovery: System Language Discovery
        
        PID:6876
        
        C:\Windows\SysWOW64\Giljfddl.exe
        
        C:\Windows\system32\Giljfddl.exe
        197⤵
        System Location Discovery: System Language Discovery
        
        PID:7048
        
        C:\Windows\SysWOW64\Hlkfbocp.exe
        
        C:\Windows\system32\Hlkfbocp.exe
        198⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Hnibokbd.exe
        
        C:\Windows\system32\Hnibokbd.exe
        199⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Hbenoi32.exe
        
        C:\Windows\system32\Hbenoi32.exe
        200⤵
        Modifies registry class
        
        PID:6824
        
        C:\Windows\SysWOW64\Hecjke32.exe
        
        C:\Windows\system32\Hecjke32.exe
        201⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Hpioin32.exe
        
        C:\Windows\system32\Hpioin32.exe
        202⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Hiacacpg.exe
        
        C:\Windows\system32\Hiacacpg.exe
        203⤵
        Drops file in System32 directory
        
        PID:6856
        
        C:\Windows\SysWOW64\Hpkknmgd.exe
        
        C:\Windows\system32\Hpkknmgd.exe
        204⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Hbihjifh.exe
        
        C:\Windows\system32\Hbihjifh.exe
        205⤵
        System Location Discovery: System Language Discovery
        
        PID:6196
        
        C:\Windows\SysWOW64\Hehdfdek.exe
        
        C:\Windows\system32\Hehdfdek.exe
        206⤵
        System Location Discovery: System Language Discovery
        
        PID:6500
        
        C:\Windows\SysWOW64\Hhfpbpdo.exe
        
        C:\Windows\system32\Hhfpbpdo.exe
        207⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Hlblcn32.exe
        
        C:\Windows\system32\Hlblcn32.exe
        208⤵
        Modifies registry class
        
        PID:7224
        
        C:\Windows\SysWOW64\Hnphoj32.exe
        
        C:\Windows\system32\Hnphoj32.exe
        209⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Hejqldci.exe
        
        C:\Windows\system32\Hejqldci.exe
        210⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Hldiinke.exe
        
        C:\Windows\system32\Hldiinke.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7388
        
        C:\Windows\SysWOW64\Hnbeeiji.exe
        
        C:\Windows\system32\Hnbeeiji.exe
        212⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7432
        
        C:\Windows\SysWOW64\Ilfennic.exe
        
        C:\Windows\system32\Ilfennic.exe
        213⤵
        Modifies registry class
        
        PID:7476
        
        C:\Windows\SysWOW64\Ieojgc32.exe
        
        C:\Windows\system32\Ieojgc32.exe
        214⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Iogopi32.exe
        
        C:\Windows\system32\Iogopi32.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7564
        
        C:\Windows\SysWOW64\Ipgkjlmg.exe
        
        C:\Windows\system32\Ipgkjlmg.exe
        216⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Iiopca32.exe
        
        C:\Windows\system32\Iiopca32.exe
        217⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7652
        
        C:\Windows\SysWOW64\Iolhkh32.exe
        
        C:\Windows\system32\Iolhkh32.exe
        218⤵
        Modifies registry class
        
        PID:7696
        
        C:\Windows\SysWOW64\Iialhaad.exe
        
        C:\Windows\system32\Iialhaad.exe
        219⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7740
        
        C:\Windows\SysWOW64\Iondqhpl.exe
        
        C:\Windows\system32\Iondqhpl.exe
        220⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7784
        
        C:\Windows\SysWOW64\Iehmmb32.exe
        
        C:\Windows\system32\Iehmmb32.exe
        221⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Jpnakk32.exe
        
        C:\Windows\system32\Jpnakk32.exe
        222⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Jblmgf32.exe
        
        C:\Windows\system32\Jblmgf32.exe
        223⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Jldbpl32.exe
        
        C:\Windows\system32\Jldbpl32.exe
        224⤵
        System Location Discovery: System Language Discovery
        
        PID:7964
        
        C:\Windows\SysWOW64\Jhkbdmbg.exe
        
        C:\Windows\system32\Jhkbdmbg.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8012
        
        C:\Windows\SysWOW64\Joekag32.exe
        
        C:\Windows\system32\Joekag32.exe
        226⤵
        Modifies registry class
        
        PID:8056
        
        C:\Windows\SysWOW64\Jlikkkhn.exe
        
        C:\Windows\system32\Jlikkkhn.exe
        227⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Jbccge32.exe
        
        C:\Windows\system32\Jbccge32.exe
        228⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8144
        
        C:\Windows\SysWOW64\Jpgdai32.exe
        
        C:\Windows\system32\Jpgdai32.exe
        229⤵
        Drops file in System32 directory
        
        PID:8188
        
        C:\Windows\SysWOW64\Jbepme32.exe
        
        C:\Windows\system32\Jbepme32.exe
        230⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Kolabf32.exe
        
        C:\Windows\system32\Kolabf32.exe
        231⤵
        System Location Discovery: System Language Discovery
        
        PID:7300
        
        C:\Windows\SysWOW64\Kibeoo32.exe
        
        C:\Windows\system32\Kibeoo32.exe
        232⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4580
        
        C:\Windows\SysWOW64\Klpakj32.exe
        
        C:\Windows\system32\Klpakj32.exe
        233⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Koonge32.exe
        
        C:\Windows\system32\Koonge32.exe
        234⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Keifdpif.exe
        
        C:\Windows\system32\Keifdpif.exe
        235⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7560
        
        C:\Windows\SysWOW64\Kidben32.exe
        
        C:\Windows\system32\Kidben32.exe
        236⤵
        Drops file in System32 directory
        
        PID:7664
        
        C:\Windows\SysWOW64\Kpnjah32.exe
        
        C:\Windows\system32\Kpnjah32.exe
        237⤵
        Modifies registry class
        
        PID:7768
        
        C:\Windows\SysWOW64\Kcmfnd32.exe
        
        C:\Windows\system32\Kcmfnd32.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7860
        
        C:\Windows\SysWOW64\Kekbjo32.exe
        
        C:\Windows\system32\Kekbjo32.exe
        239⤵
        Modifies registry class
        
        PID:7936
        
        C:\Windows\SysWOW64\Khiofk32.exe
        
        C:\Windows\system32\Khiofk32.exe
        240⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Klekfinp.exe
        
        C:\Windows\system32\Klekfinp.exe
        241⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Kocgbend.exe
        
        C:\Windows\system32\Kocgbend.exe
        242⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8140
        
        C:\Windows\SysWOW64\Kemooo32.exe
        
        C:\Windows\system32\Kemooo32.exe
        243⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7252
        
        C:\Windows\SysWOW64\Kiikpnmj.exe
        
        C:\Windows\system32\Kiikpnmj.exe
        244⤵
        
        PID:4556
        
        C:\Windows\SysWOW64\Klggli32.exe
        
        C:\Windows\system32\Klggli32.exe
        245⤵
        System Location Discovery: System Language Discovery
        
        PID:7424
        
        C:\Windows\SysWOW64\Kcapicdj.exe
        
        C:\Windows\system32\Kcapicdj.exe
        246⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7552
        
        C:\Windows\SysWOW64\Lljdai32.exe
        
        C:\Windows\system32\Lljdai32.exe
        247⤵
        System Location Discovery: System Language Discovery
        
        PID:7732
        
        C:\Windows\SysWOW64\Lindkm32.exe
        
        C:\Windows\system32\Lindkm32.exe
        248⤵
        Drops file in System32 directory
        
        PID:7868
        
        C:\Windows\SysWOW64\Lcfidb32.exe
        
        C:\Windows\system32\Lcfidb32.exe
        249⤵
        System Location Discovery: System Language Discovery
        
        PID:8020
        
        C:\Windows\SysWOW64\Llnnmhfe.exe
        
        C:\Windows\system32\Llnnmhfe.exe
        250⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Ljbnfleo.exe
        
        C:\Windows\system32\Ljbnfleo.exe
        251⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7208
        
        C:\Windows\SysWOW64\Lhenai32.exe
        
        C:\Windows\system32\Lhenai32.exe
        252⤵
        System Location Discovery: System Language Discovery
        
        PID:7372
        
        C:\Windows\SysWOW64\Lancko32.exe
        
        C:\Windows\system32\Lancko32.exe
        253⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Llcghg32.exe
        
        C:\Windows\system32\Llcghg32.exe
        254⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Loacdc32.exe
        
        C:\Windows\system32\Loacdc32.exe
        255⤵
        Modifies registry class
        
        PID:7976
        
        C:\Windows\SysWOW64\Mapppn32.exe
        
        C:\Windows\system32\Mapppn32.exe
        256⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7220
        
        C:\Windows\SysWOW64\Mhjhmhhd.exe
        
        C:\Windows\system32\Mhjhmhhd.exe
        257⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Mcoljagj.exe
        
        C:\Windows\system32\Mcoljagj.exe
        258⤵
        Modifies registry class
        
        PID:7720
        
        C:\Windows\SysWOW64\Mjidgkog.exe
        
        C:\Windows\system32\Mjidgkog.exe
        259⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Mofmobmo.exe
        
        C:\Windows\system32\Mofmobmo.exe
        260⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Mjlalkmd.exe
        
        C:\Windows\system32\Mjlalkmd.exe
        261⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Mljmhflh.exe
        
        C:\Windows\system32\Mljmhflh.exe
        262⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Mohidbkl.exe
        
        C:\Windows\system32\Mohidbkl.exe
        263⤵
        Modifies registry class
        
        PID:8072
        
        C:\Windows\SysWOW64\Mcdeeq32.exe
        
        C:\Windows\system32\Mcdeeq32.exe
        264⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Mjnnbk32.exe
        
        C:\Windows\system32\Mjnnbk32.exe
        265⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Mlljnf32.exe
        
        C:\Windows\system32\Mlljnf32.exe
        266⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8132
        
        C:\Windows\SysWOW64\Mjpjgj32.exe
        
        C:\Windows\system32\Mjpjgj32.exe
        267⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8200
        
        C:\Windows\SysWOW64\Nciopppp.exe
        
        C:\Windows\system32\Nciopppp.exe
        268⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Nckkfp32.exe
        
        C:\Windows\system32\Nckkfp32.exe
        269⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Noblkqca.exe
        
        C:\Windows\system32\Noblkqca.exe
        270⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8332
        
        C:\Windows\SysWOW64\Nbphglbe.exe
        
        C:\Windows\system32\Nbphglbe.exe
        271⤵
        Drops file in System32 directory
        
        PID:8376
        
        C:\Windows\SysWOW64\Njgqhicg.exe
        
        C:\Windows\system32\Njgqhicg.exe
        272⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8420
        
        C:\Windows\SysWOW64\Nmfmde32.exe
        
        C:\Windows\system32\Nmfmde32.exe
        273⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8464
        
        C:\Windows\SysWOW64\Nqaiecjd.exe
        
        C:\Windows\system32\Nqaiecjd.exe
        274⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8508
        
        C:\Windows\SysWOW64\Nfnamjhk.exe
        
        C:\Windows\system32\Nfnamjhk.exe
        275⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8552
        
        C:\Windows\SysWOW64\Nqcejcha.exe
        
        C:\Windows\system32\Nqcejcha.exe
        276⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Njljch32.exe
        
        C:\Windows\system32\Njljch32.exe
        277⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8640
        
        C:\Windows\SysWOW64\Ocdnln32.exe
        
        C:\Windows\system32\Ocdnln32.exe
        278⤵
        Drops file in System32 directory
        
        PID:8684
        
        C:\Windows\SysWOW64\Ookoaokf.exe
        
        C:\Windows\system32\Ookoaokf.exe
        279⤵
        Drops file in System32 directory
        
        PID:8728
        
        C:\Windows\SysWOW64\Oiccje32.exe
        
        C:\Windows\system32\Oiccje32.exe
        280⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\Ofgdcipq.exe
        
        C:\Windows\system32\Ofgdcipq.exe
        281⤵
        Drops file in System32 directory
        
        PID:8816
        
        C:\Windows\SysWOW64\Omalpc32.exe
        
        C:\Windows\system32\Omalpc32.exe
        282⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Ockdmmoj.exe
        
        C:\Windows\system32\Ockdmmoj.exe
        283⤵
        System Location Discovery: System Language Discovery
        
        PID:8904
        
        C:\Windows\SysWOW64\Opbean32.exe
        
        C:\Windows\system32\Opbean32.exe
        284⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8948
        
        C:\Windows\SysWOW64\Oikjkc32.exe
        
        C:\Windows\system32\Oikjkc32.exe
        285⤵
        Drops file in System32 directory
        
        PID:8992
        
        C:\Windows\SysWOW64\Pqbala32.exe
        
        C:\Windows\system32\Pqbala32.exe
        286⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9036
        
        C:\Windows\SysWOW64\Pcpnhl32.exe
        
        C:\Windows\system32\Pcpnhl32.exe
        287⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Pimfpc32.exe
        
        C:\Windows\system32\Pimfpc32.exe
        288⤵
        Drops file in System32 directory
        
        PID:9128
        
        C:\Windows\SysWOW64\Ppgomnai.exe
        
        C:\Windows\system32\Ppgomnai.exe
        289⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9172
        
        C:\Windows\SysWOW64\Pbekii32.exe
        
        C:\Windows\system32\Pbekii32.exe
        290⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Pjlcjf32.exe
        
        C:\Windows\system32\Pjlcjf32.exe
        291⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Pmkofa32.exe
        
        C:\Windows\system32\Pmkofa32.exe
        292⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:8324
        
        C:\Windows\SysWOW64\Ppikbm32.exe
        
        C:\Windows\system32\Ppikbm32.exe
        293⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8404
        
        C:\Windows\SysWOW64\Pbhgoh32.exe
        
        C:\Windows\system32\Pbhgoh32.exe
        294⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8476
        
        C:\Windows\SysWOW64\Pjoppf32.exe
        
        C:\Windows\system32\Pjoppf32.exe
        295⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Paihlpfi.exe
        
        C:\Windows\system32\Paihlpfi.exe
        296⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8608
        
        C:\Windows\SysWOW64\Pplhhm32.exe
        
        C:\Windows\system32\Pplhhm32.exe
        297⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Pmphaaln.exe
        
        C:\Windows\system32\Pmphaaln.exe
        298⤵
        System Location Discovery: System Language Discovery
        
        PID:8760
        
        C:\Windows\SysWOW64\Ppnenlka.exe
        
        C:\Windows\system32\Ppnenlka.exe
        299⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\Pjcikejg.exe
        
        C:\Windows\system32\Pjcikejg.exe
        300⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Qclmck32.exe
        
        C:\Windows\system32\Qclmck32.exe
        301⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\Qiiflaoo.exe
        
        C:\Windows\system32\Qiiflaoo.exe
        302⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Qpbnhl32.exe
        
        C:\Windows\system32\Qpbnhl32.exe
        303⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:9092
        
        C:\Windows\SysWOW64\Qcnjijoe.exe
        
        C:\Windows\system32\Qcnjijoe.exe
        304⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:9164
        
        C:\Windows\SysWOW64\Qfmfefni.exe
        
        C:\Windows\system32\Qfmfefni.exe
        305⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\Amfobp32.exe
        
        C:\Windows\system32\Amfobp32.exe
        306⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Abcgjg32.exe
        
        C:\Windows\system32\Abcgjg32.exe
        307⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Ajjokd32.exe
        
        C:\Windows\system32\Ajjokd32.exe
        308⤵
        
        PID:5040
        
        C:\Windows\SysWOW64\Amikgpcc.exe
        
        C:\Windows\system32\Amikgpcc.exe
        309⤵
        Drops file in System32 directory
        
        PID:8540
        
        C:\Windows\SysWOW64\Aadghn32.exe
        
        C:\Windows\system32\Aadghn32.exe
        310⤵
        System Location Discovery: System Language Discovery
        
        PID:8632
        
        C:\Windows\SysWOW64\Acccdj32.exe
        
        C:\Windows\system32\Acccdj32.exe
        311⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Ajmladbl.exe
        
        C:\Windows\system32\Ajmladbl.exe
        312⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8808
        
        C:\Windows\SysWOW64\Amkhmoap.exe
        
        C:\Windows\system32\Amkhmoap.exe
        313⤵
        Drops file in System32 directory
        
        PID:8960
        
        C:\Windows\SysWOW64\Apjdikqd.exe
        
        C:\Windows\system32\Apjdikqd.exe
        314⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\Abhqefpg.exe
        
        C:\Windows\system32\Abhqefpg.exe
        315⤵
        
        PID:900
        
        C:\Windows\SysWOW64\Aaiqcnhg.exe
        
        C:\Windows\system32\Aaiqcnhg.exe
        316⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Abjmkf32.exe
        
        C:\Windows\system32\Abjmkf32.exe
        317⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Ajaelc32.exe
        
        C:\Windows\system32\Ajaelc32.exe
        318⤵
        
        PID:1888
        
        C:\Windows\SysWOW64\Aalmimfd.exe
        
        C:\Windows\system32\Aalmimfd.exe
        319⤵
        Drops file in System32 directory
        
        PID:8648
        
        C:\Windows\SysWOW64\Adjjeieh.exe
        
        C:\Windows\system32\Adjjeieh.exe
        320⤵
        System Location Discovery: System Language Discovery
        
        PID:8800
        
        C:\Windows\SysWOW64\Ajdbac32.exe
        
        C:\Windows\system32\Ajdbac32.exe
        321⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Bmbnnn32.exe
        
        C:\Windows\system32\Bmbnnn32.exe
        322⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\Bpqjjjjl.exe
        
        C:\Windows\system32\Bpqjjjjl.exe
        323⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Bjfogbjb.exe
        
        C:\Windows\system32\Bjfogbjb.exe
        324⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Bfmolc32.exe
        
        C:\Windows\system32\Bfmolc32.exe
        325⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Bdapehop.exe
        
        C:\Windows\system32\Bdapehop.exe
        326⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Bmidnm32.exe
        
        C:\Windows\system32\Bmidnm32.exe
        327⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3528
        
        C:\Windows\SysWOW64\Bfaigclq.exe
        
        C:\Windows\system32\Bfaigclq.exe
        328⤵
        System Location Discovery: System Language Discovery
        
        PID:8784
        
        C:\Windows\SysWOW64\Bdeiqgkj.exe
        
        C:\Windows\system32\Bdeiqgkj.exe
        329⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\Cajjjk32.exe
        
        C:\Windows\system32\Cajjjk32.exe
        330⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Cgfbbb32.exe
        
        C:\Windows\system32\Cgfbbb32.exe
        331⤵
        Modifies registry class
        
        PID:8520
        
        C:\Windows\SysWOW64\Cmpjoloh.exe
        
        C:\Windows\system32\Cmpjoloh.exe
        332⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\Cgiohbfi.exe
        
        C:\Windows\system32\Cgiohbfi.exe
        333⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8412
        
        C:\Windows\SysWOW64\Ccppmc32.exe
        
        C:\Windows\system32\Ccppmc32.exe
        334⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Ciihjmcj.exe
        
        C:\Windows\system32\Ciihjmcj.exe
        335⤵
        System Location Discovery: System Language Discovery
        
        PID:9300
        
        C:\Windows\SysWOW64\Cpcpfg32.exe
        
        C:\Windows\system32\Cpcpfg32.exe
        336⤵
        System Location Discovery: System Language Discovery
        
        PID:9344
        
        C:\Windows\SysWOW64\Ccblbb32.exe
        
        C:\Windows\system32\Ccblbb32.exe
        337⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Cildom32.exe
        
        C:\Windows\system32\Cildom32.exe
        338⤵
        Modifies registry class
        
        PID:9436
        
        C:\Windows\SysWOW64\Cacmpj32.exe
        
        C:\Windows\system32\Cacmpj32.exe
        339⤵
        Drops file in System32 directory
        
        PID:9476
        
        C:\Windows\SysWOW64\Cdaile32.exe
        
        C:\Windows\system32\Cdaile32.exe
        340⤵
        Drops file in System32 directory
        
        PID:9516
        
        C:\Windows\SysWOW64\Dkkaiphj.exe
        
        C:\Windows\system32\Dkkaiphj.exe
        341⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Dmjmekgn.exe
        
        C:\Windows\system32\Dmjmekgn.exe
        342⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9612
        
        C:\Windows\SysWOW64\Daeifj32.exe
        
        C:\Windows\system32\Daeifj32.exe
        343⤵
        
        PID:9656
        
        C:\Windows\SysWOW64\Dcffnbee.exe
        
        C:\Windows\system32\Dcffnbee.exe
        344⤵
        
        PID:9700
        
        C:\Windows\SysWOW64\Dnljkk32.exe
        
        C:\Windows\system32\Dnljkk32.exe
        345⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9744
        
        C:\Windows\SysWOW64\Dpjfgf32.exe
        
        C:\Windows\system32\Dpjfgf32.exe
        346⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9788
        
        C:\Windows\SysWOW64\Dcibca32.exe
        
        C:\Windows\system32\Dcibca32.exe
        347⤵
        Modifies registry class
        
        PID:9828
        
        C:\Windows\SysWOW64\Dkpjdo32.exe
        
        C:\Windows\system32\Dkpjdo32.exe
        348⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Dajbaika.exe
        
        C:\Windows\system32\Dajbaika.exe
        349⤵
        System Location Discovery: System Language Discovery
        
        PID:9920
        
        C:\Windows\SysWOW64\Ddhomdje.exe
        
        C:\Windows\system32\Ddhomdje.exe
        350⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\Dkbgjo32.exe
        
        C:\Windows\system32\Dkbgjo32.exe
        351⤵
        Drops file in System32 directory
        
        PID:10008
        
        C:\Windows\SysWOW64\Dnqcfjae.exe
        
        C:\Windows\system32\Dnqcfjae.exe
        352⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Ddklbd32.exe
        
        C:\Windows\system32\Ddklbd32.exe
        353⤵
        
        PID:10096
        
        C:\Windows\SysWOW64\Dgihop32.exe
        
        C:\Windows\system32\Dgihop32.exe
        354⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Dncpkjoc.exe
        
        C:\Windows\system32\Dncpkjoc.exe
        355⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10184
        
        C:\Windows\SysWOW64\Ddmhhd32.exe
        
        C:\Windows\system32\Ddmhhd32.exe
        356⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Egkddo32.exe
        
        C:\Windows\system32\Egkddo32.exe
        357⤵
        Modifies registry class
        
        PID:9268
        
        C:\Windows\SysWOW64\Enemaimp.exe
        
        C:\Windows\system32\Enemaimp.exe
        358⤵
        
        PID:9332
        
        C:\Windows\SysWOW64\Edoencdm.exe
        
        C:\Windows\system32\Edoencdm.exe
        359⤵
        
        PID:9408
        
        C:\Windows\SysWOW64\Ekimjn32.exe
        
        C:\Windows\system32\Ekimjn32.exe
        360⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9472
        
        C:\Windows\SysWOW64\Ejlnfjbd.exe
        
        C:\Windows\system32\Ejlnfjbd.exe
        361⤵
        Drops file in System32 directory
        
        PID:9532
        
        C:\Windows\SysWOW64\Epffbd32.exe
        
        C:\Windows\system32\Epffbd32.exe
        362⤵
        
        PID:9600
        
        C:\Windows\SysWOW64\Edaaccbj.exe
        
        C:\Windows\system32\Edaaccbj.exe
        363⤵
        Modifies registry class
        
        PID:9688
        
        C:\Windows\SysWOW64\Ejojljqa.exe
        
        C:\Windows\system32\Ejojljqa.exe
        364⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Eafbmgad.exe
        
        C:\Windows\system32\Eafbmgad.exe
        365⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Eddnic32.exe
        
        C:\Windows\system32\Eddnic32.exe
        366⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\Ekngemhd.exe
        
        C:\Windows\system32\Ekngemhd.exe
        367⤵
        
        PID:9956
        
        C:\Windows\SysWOW64\Enlcahgh.exe
        
        C:\Windows\system32\Enlcahgh.exe
        368⤵
        System Location Discovery: System Language Discovery
        
        PID:10028
        
        C:\Windows\SysWOW64\Eahobg32.exe
        
        C:\Windows\system32\Eahobg32.exe
        369⤵
        
        PID:10092
        
        C:\Windows\SysWOW64\Ecikjoep.exe
        
        C:\Windows\system32\Ecikjoep.exe
        370⤵
        
        PID:10148
        
        C:\Windows\SysWOW64\Ejccgi32.exe
        
        C:\Windows\system32\Ejccgi32.exe
        371⤵
        
        PID:10220
        
        C:\Windows\SysWOW64\Eqmlccdi.exe
        
        C:\Windows\system32\Eqmlccdi.exe
        372⤵
        Modifies registry class
        
        PID:9292
        
        C:\Windows\SysWOW64\Edihdb32.exe
        
        C:\Windows\system32\Edihdb32.exe
        373⤵
        
        PID:9396
        
        C:\Windows\SysWOW64\Fggdpnkf.exe
        
        C:\Windows\system32\Fggdpnkf.exe
        374⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Fnalmh32.exe
        
        C:\Windows\system32\Fnalmh32.exe
        375⤵
        
        PID:9584
        
        C:\Windows\SysWOW64\Fgiaemic.exe
        
        C:\Windows\system32\Fgiaemic.exe
        376⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Fjhmbihg.exe
        
        C:\Windows\system32\Fjhmbihg.exe
        377⤵
        Modifies registry class
        
        PID:9800
        
        C:\Windows\SysWOW64\Fqbeoc32.exe
        
        C:\Windows\system32\Fqbeoc32.exe
        378⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\Fdmaoahm.exe
        
        C:\Windows\system32\Fdmaoahm.exe
        379⤵
        Modifies registry class
        
        PID:10060
        
        C:\Windows\SysWOW64\Fkgillpj.exe
        
        C:\Windows\system32\Fkgillpj.exe
        380⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\Fnffhgon.exe
        
        C:\Windows\system32\Fnffhgon.exe
        381⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Fdpnda32.exe
        
        C:\Windows\system32\Fdpnda32.exe
        382⤵
        System Location Discovery: System Language Discovery
        
        PID:9384
        
        C:\Windows\SysWOW64\Fgnjqm32.exe
        
        C:\Windows\system32\Fgnjqm32.exe
        383⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Fjmfmh32.exe
        
        C:\Windows\system32\Fjmfmh32.exe
        384⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Fbdnne32.exe
        
        C:\Windows\system32\Fbdnne32.exe
        385⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\Fdbkja32.exe
        
        C:\Windows\system32\Fdbkja32.exe
        386⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Fjocbhbo.exe
        
        C:\Windows\system32\Fjocbhbo.exe
        387⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Fbfkceca.exe
        
        C:\Windows\system32\Fbfkceca.exe
        388⤵
        
        PID:9328
        
        C:\Windows\SysWOW64\Gddgpqbe.exe
        
        C:\Windows\system32\Gddgpqbe.exe
        389⤵
        System Location Discovery: System Language Discovery
        
        PID:9672
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9672 -s 412
        390⤵
        Program crash
        
        PID:9240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 9672 -ip 9672
1⤵
PID:10116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aaiqcnhg.exe

Filesize
97KB

MD5
e42279f5c232cec5477d51388e15604c

SHA1
a0e95185e246b71acc4fd1902245e32b6449e097

SHA256
9de02ebe7cdafdcd45750c1c96a88ca11e756eab5d6951bb021c70972299b579

SHA512
7206966839e490afa144e729b943e947eb40a2c0071af48ffe4f523e4015111ffdfc420024bbe6f460afedcaf24d3a09641940b2fe6784a7a73bf15800546d60

Download Submit
C:\Windows\SysWOW64\Adjjeieh.exe

Filesize
97KB

MD5
4aee7a90bcd4aac4f3961e4ee64c9d49

SHA1
4d8768840f19613d7bb6d41c53f93bc4a5b049e9

SHA256
cc5556eb312c04bb06d53dae0d78ff6a0684b510aa85ef9124050978b88bb8f4

SHA512
f6ab50b7aa64c6932cf5b8dac26b15671d0500738627474c1acb6d1cbb526be2ec362919ffc1d0b0f7fadb43ab4d618af546248fe3236e47d94d2a27c5837ac6

Download Submit
C:\Windows\SysWOW64\Amqhbe32.exe

Filesize
97KB

MD5
20c2560df518ee78ea847c95c5c6bef5

SHA1
b8c78fe42518168a3132e7809da6344a590b61b3

SHA256
f18ca087c67de4424e100a042640e897efc87d67a7ddf3f20f259ccda8a929ff

SHA512
985da113871491f461d3318453829649cf67d2dca32701057d5949107ad8df8c6a22a3cc01ead918369d26df3c8dbae8cec9b43744af8e56537495f3366ed1a3

Download Submit
C:\Windows\SysWOW64\Bfaigclq.exe

Filesize
97KB

MD5
8db1f7617e22c5634bbc1cc5437f676d

SHA1
11a21539dbc042b078b5da521c892471bfc47745

SHA256
39a40ba91b1a81e1abf3abfcb4656d9d9a6e4db879b963010287b449480f35fe

SHA512
27944663e85f2e8debd0d4df1cae01985008851102eae9df45cf6141c49be37a2af87b7a3f6f476cdad6e79518ee0e12b579982afdfa7abb3af4774f67dba237

Download Submit
C:\Windows\SysWOW64\Bgkiaj32.exe

Filesize
97KB

MD5
160a48a42119a073e79d122bb925b16b

SHA1
1d9af6997b838199f0493740742ccb61e84e38ab

SHA256
b57df0ce7dbecb8e1202089fb2e23a398f1fdee94609cbcc85c7a5d8fa03bc71

SHA512
e0fcb3bd10b2d7a152a555695a7e7d5f05ec44a5ca2c4f78cf0c01e0b01973696e950e51246e5459159f07af92d596390f61eabf9ef15279cd670635d403393c

Download Submit
C:\Windows\SysWOW64\Bjdbkbbn.dll

Filesize
7KB

MD5
08ce08d922f3787c4fd0950099b61990

SHA1
d2383b80ae98876b5697080f6589360a0e46f90b

SHA256
fd01ada32231990311f0f883b53feb831c9b6ae430508a3bc9916bac976a6869

SHA512
d5c543edbd10194abd9b8c33055f2224ff814532e5030686a6c06b735df37d5747069ce4d16d10f0828f0dce096caaf0edab22518a37224d7c64f878c3d439db

Download Submit
C:\Windows\SysWOW64\Bjfogbjb.exe

Filesize
97KB

MD5
66b6309ad1ee435989e51681d0007249

SHA1
ed8a929a4ebfe52252e6e1777f4764d4f307feff

SHA256
df2b497efd6c0dc6ac99854beee47c062d242ff12b8060e8386483514abe2f93

SHA512
a182f65103f74dc6f8a9363883e0c54b5a671ef2fc2e6078dc5db1b43f0bdd399b6ba1458fdb80e32aaa2f07619ee7ddeff1fd545cc41e09d133eb3e0aba4611

Download Submit
C:\Windows\SysWOW64\Bkibgh32.exe

Filesize
97KB

MD5
03889b7efe6bc30aacb3719715680fbc

SHA1
fc60a00a6ba28783c0afa6d480318d08c994d5e0

SHA256
94dda1da1cbf686a531da62ba2591efdd7c4de46b85b6d3e363e214edd7d99fe

SHA512
3d058316370cf8ecac05176f7ef19e565f802549c450eae6fd75b8d7e35a559c023173af0b997a8077969471796aa260d9a4beb16cdc8ba7fdeabf8a310bbaa4

Download Submit
C:\Windows\SysWOW64\Bkphhgfc.exe

Filesize
97KB

MD5
bbf56f31a457a6ef8f515eb435dafee8

SHA1
a688af7c8348fd128d9356498fa83f44f7666746

SHA256
11fd704d7781626be5332d6c97626a3e6b85fc9966a4d2f1639f6c2da18904d4

SHA512
0b9d9f11c78dc6f9e7d4f8a2c21385ca37aa78fad247cc4de9bf8d0fbb00c7e1c93409039d5d151681955fbd8edf37d1e9a61c23e8acf7319bc4190d52bac55a

Download Submit
C:\Windows\SysWOW64\Boihcf32.exe

Filesize
97KB

MD5
fa654995972cebe0bf6246e7d6387e18

SHA1
a6a558f89609ea9f196705cea03b469e0b0f75fa

SHA256
c7e3dccfda07a9afb4374ce1280f54f3e0b6559ae6bdaf9ea21bdb77d03c1c8f

SHA512
d5bd0f2a83a075a5fa941be349dd363d9072502f99f966d22cf662f1e9f0f7eed673dc3abc0a5318b38605f5b50aaeeae6ef3ecc31dfd7483a8fbfd5605743ea

Download Submit
C:\Windows\SysWOW64\Ccblbb32.exe

Filesize
97KB

MD5
4b6c867cb5cca47aa320d642d516df87

SHA1
fa33fc4b97a43a60069bbb37c7dd7be3e3909002

SHA256
b7e0c7e125f8ddbb74e402a9776afa3431853659ece3ebc1f18c0572d32f53ee

SHA512
b8666ac70320731d30a3fdbdea66bd11940ac3d7a86a813191c40bf04131947533caa80006edd9bc0373b7e9bcdccb237f78f87f94ad5ea74b41516202e1fef0

Download Submit
C:\Windows\SysWOW64\Ccppmc32.exe

Filesize
97KB

MD5
d15b488832da550c1f67fdd5f56bd548

SHA1
1465bac0f98721f63ef0f82928fe16080714b3f6

SHA256
456a2ebeb6c96d4cd2d9ecd7a4dfa698d2e6499a5ee73b8020d39e2a806f7841

SHA512
6940d5a9ad865eed91c5514433dc0753d53decf524fb206c0c43a30e9919fef25aa7e5505caeabd6af3fed4ba3482c63c79b5affac99048c8298ab37315702fd

Download Submit
C:\Windows\SysWOW64\Cgiohbfi.exe

Filesize
97KB

MD5
3477bc5a4397f4c3eb76828bb5c4b46c

SHA1
d6869758d31241e3654575cabbff2814f29598cb

SHA256
d34be5dc02c3f96aedb0d040ccab2478ab894b22a81e43bb7fee1f0644653ac4

SHA512
8be4af5f879c019368d248b9e8ac03ae8874a2a9beb3b10f3477301f8d1fe191209b3e752aad4d8ba4ab718f5dc9a2d893b2b8e669971e6afb3c81dead3fb2f9

Download Submit
C:\Windows\SysWOW64\Chdialdl.exe

Filesize
97KB

MD5
9287b9b10aff55f7d8ee2001d4335fd2

SHA1
ac8087c1342efb2cd821c7930018c90086c2560c

SHA256
6ae9d71b956886f5a83fb2067bc3a8ab51e2691a951025efee9be1029beca197

SHA512
9aff52d9f87473f569cab33eb45d8dde8d429654add6625f415ea46ff3ca11cef66b345d84b21db42451276c5d44c37d1d71d62ae2dd1206fbcb803465adbb16

Download Submit
C:\Windows\SysWOW64\Dajbaika.exe

Filesize
97KB

MD5
7866a2382b253f13629f53a938034a47

SHA1
00f644f9557c2462118c493c29e9d5375b58d13b

SHA256
3ee7d8c2d3b072dba0025f2af66b6bb28bac9f2cdf8b0c9b4069186ce6c7b143

SHA512
fb5b09f7a697f1a9172ec8be20432c31dff69579620a26644e9bc95ee580ea1a9bb385042134a6b94e62fdc68832f787fe9b55ec5d750be18798efe9fdf3ddca

Download Submit
C:\Windows\SysWOW64\Dcffnbee.exe

Filesize
97KB

MD5
b97b1368195fde106fddca6c78411c13

SHA1
aa65326f54cbf26408d45c6d57d8ad874a69b950

SHA256
505d862fd9d53b9d6ddb6b30c3e2080b8c9932bb5811903831f13e1fd7200220

SHA512
b36950f821efc75a6432acf4f282b73cb66a866352f6fe189390081fb84a56dc59eb91e070051c6bc9f94847babec77ea7119c8f11bb19d5d0f8beaeb66d6f1f

Download Submit
C:\Windows\SysWOW64\Ddklbd32.exe

Filesize
97KB

MD5
3e8f8c83843352e3c7b6272e60b17627

SHA1
8c6af8e4ce0a38c10872384b6b05c8248c46469f

SHA256
c5fb2551d2694c220932d4a200e91d0f88a46fb66e84ee34ad115a06ea7210be

SHA512
19e291c9e3b016ff9e2569261e73842e73ac2a8b0cb14a425d9bbc83d573f3593d1ce212010639181e5033f2fc8aa3a1a0b95a36eacb5211fe9b966acd239d18

Download Submit
C:\Windows\SysWOW64\Dkekjdck.exe

Filesize
97KB

MD5
27d04133ace23d810f503ff4cfc3841b

SHA1
c728394a185c1e07bd05a841b32318beacff6e3d

SHA256
e8318aa789d9db944df16e2f00a6caf279d5ee4b26088340cb03a39455987519

SHA512
724c3792236815bb0432a3d1dbc7275b0cdf1784df04dc0b7a4e6b76b84de7b9e4a09175c4b98daa1e50e127729e0dcbda3d029e0b4d6a22349547dc59641a79

Download Submit
C:\Windows\SysWOW64\Dnajppda.exe

Filesize
97KB

MD5
4a199d6ed7add7b44e24b6310ed320e8

SHA1
5cc0228ea49c68dcfcd9d9143ee1bb171709bb58

SHA256
b861cd7fcc3c433479e44dce33bf564b5498900406ee46ddf902b93f16d68156

SHA512
379fcb21c47bd51451bd5bc343061fda8537d2e623fea2a3c641d993840c8b87daaacfb381abb691535d998c7a1ee12d45ca63a28dcfec92175a72ad3ba84630

Download Submit
C:\Windows\SysWOW64\Dncpkjoc.exe

Filesize
97KB

MD5
eb6cc59e18ae7fcbdd8197aa2433bd3a

SHA1
7a3d3900896b5ce92eda975f4aa4b0698229b37d

SHA256
2dab7bb835de708a788f1044b0a2cd6b98c4fc1d0342dbb15c9e67b69fe2c707

SHA512
67768d7ab77a635b210ded596e5c3aa2c9845497f3742668f9d5707d6b98b7fa6cf330603966d61de85a74c0ff47594a291d028039c8673cdc6a8d52aec3ebc7

Download Submit
C:\Windows\SysWOW64\Egkddo32.exe

Filesize
97KB

MD5
b5eb82ebf454634a9d76c74699c9e052

SHA1
25d11b7f1479e47e3a991be8d4ffe724ef5aca5e

SHA256
50e75a19afe1ed6516785232fbf6cf97ffd17e6aede6a02b0e9567ca79e26efc

SHA512
af81e02ef5093ed76d21c9baed32e9add7f58d63addd52a1e8da8bfcd0cd4d54431bc5d96c4d52a6756c72b26b014bb51ac685a8a26bffb387d858ba6214bfe4

Download Submit
C:\Windows\SysWOW64\Ejccgi32.exe

Filesize
97KB

MD5
bfb780d10a0614603bdcb9e17744f416

SHA1
5b34cfc825503ae80b1a432684d027f447f357d5

SHA256
f07e6cce01e0393ccdec7febffdb0293165e2c4354588a79778273895eaf465a

SHA512
43d4746607a673c618f84935c43a2de6ad8b8a694c275246881b282fa155a8c6c87b8e421358c81cd000f3529b12e5fef90eb2abb432bc3368a0c74bb79104c2

Download Submit
C:\Windows\SysWOW64\Ejojljqa.exe

Filesize
97KB

MD5
5f4c9dcb9da6e23501386184080bba3d

SHA1
4a1e8dd5af1408d8c6fc63e7ae660c57ce39f0e9

SHA256
9fb6f1a9fd80362b5bc912e323fadaef454bc3101b90b12bd5198661bd7d2fda

SHA512
30a6b3a1daa7118fa112531288a3484df7293a87ce7aeec5dcbcf9425d04b069a6c827751b4ca985f8aa35989ac8da8eeb26312e88c61a793be46d85bad70689

Download Submit
C:\Windows\SysWOW64\Ekjded32.exe

Filesize
97KB

MD5
f1c60d92c7538738d87eaa41cad49a52

SHA1
be08afcbb8b3c380546503567f63cdd91affebe3

SHA256
5040fa797b3e58a6f6f450423f2259d93020c3635e70db449556e85030fdbdd1

SHA512
eb88e3692c74eb1f6109de9729a1e7f4d2324e4953720d793bb8b8859acb9c5aae511b635ec0fb51c9386d301f6122a1346b6dae9276187a901368a4401a6a95

Download Submit
C:\Windows\SysWOW64\Enkmfolf.exe

Filesize
97KB

MD5
b63ada3cc8765a5efc33da54b35b4099

SHA1
83336fe34a128ec211c137a168862cf2ac78d3ab

SHA256
382f2e6be2e70c5c0ade7f55fc8a15d38947ad9e5815fe715a8d7722936da0e8

SHA512
28942924d36f8b0782ef3f91a15d16b4b68093233a8b8e3809afb5502138aa202ebf9813e3dd3bebebc6fc886abf5a4b7a50cc50d4fae80b2a77629a257f9902

Download Submit
C:\Windows\SysWOW64\Eojiqb32.exe

Filesize
97KB

MD5
11648b5b5a7aec8594829beee4366cbc

SHA1
e50139ef9a2d1dbe45de555166309d5de21c40bc

SHA256
0beda78f87b1b3729bf47b055213d95c2820bbf1c171d4fa446ef0662398ac07

SHA512
f86d27f52fb7b974365bdc5d3ba29ffaf843abd1d21f2d78338c7661d78754bfc90d949253b296e183bead37a3f37b33da036e484450fe18944fc8e732ad81c0

Download Submit
C:\Windows\SysWOW64\Fdpnda32.exe

Filesize
97KB

MD5
35047f5bc8326e7c20eb214e4d6130fa

SHA1
93c993ecf180801bde149649e0969b7ee0fd3a7d

SHA256
350c02ec994eb0274f64ba922b57383684111c356bc1d78b22c2eb335e441c90

SHA512
581f776abc7ea533fd7232582c4ca7d2f573a0fc5d8bf73556fecd36ac0e86c5702506087a15ce44f23231d7e3deab78789a2cbb07e722d42576c6790cc6b12f

Download Submit
C:\Windows\SysWOW64\Fgiaemic.exe

Filesize
97KB

MD5
1f14c7cce7505f9fda2604303d787e7f

SHA1
fbd4fd300be6aa3ad5986d56b738d701c9718a8c

SHA256
008854e779cee4de98f8cdf311f971a8fa111b33f2744e3ffa5381f8cd349372

SHA512
01a9c56b3b3309a946253fcdab40d21a5fdfb836ca46c505c8b9fb43d6dd7a2d30170639b98a561e5ca751daf0d282a15c5c0d2fe6443013a460e9649fb3590a

Download Submit
C:\Windows\SysWOW64\Fiqjke32.exe

Filesize
97KB

MD5
861556a6997c3b31c6f260cf22ffdbdf

SHA1
0a4729b473fc9647a3b95d56627a924ce6bd1493

SHA256
491d23c1af5d7f2b1f13377d680adcfa0e1a6bee21aa183a5399168eaca7b145

SHA512
7adcfd56995f55f464447cd0faeb3ae79809d1f5cfe950c996d801b3fd60f1d65b164bdaf39230822798828e524c7fca2e433fe94771428216b71d849ec1bea6

Download Submit
C:\Windows\SysWOW64\Fjocbhbo.exe

Filesize
97KB

MD5
de4b7ef8766c10bcca33b28ce4a86655

SHA1
bc5c9da0ff4e37b85d530c861b8b01a40f67842d

SHA256
d7a681fbb9c4172a7ef3f2cfee1e80bb5eb10f1d7e37500ac0e65a9686d4d846

SHA512
2897e4a10fe136352f8dc34f0ddcc12b9cd6a94f95369d4225aa2f07b332d5d2a0c85ce19fc29a730c7b2834f45772c551b87d6f3dff3a17d0946541c578444e

Download Submit
C:\Windows\SysWOW64\Fkmjaa32.exe

Filesize
97KB

MD5
aac538be93c96d817e681dba2c69476e

SHA1
bd2c06293f853c8fa764caa36b28b830d6eb3b47

SHA256
3b4ed22f364103f70693335b13dd8d4e902492ddd763d66b534215738c4bfb28

SHA512
4321715d4726186db060ac5f63131fbc182901db05783307497ba138f040371a14f6d4cda7f97915577b479897667346efdc696d2e92adff43c8306844293182

Download Submit
C:\Windows\SysWOW64\Fooclapd.exe

Filesize
97KB

MD5
170108a11de91b273747c0b763a60d3f

SHA1
7bac1fa65d8bf8dbb409869585172344ece7518f

SHA256
13d476581a7468525cedd330535a8dfcca2f7768ddcbb491fd6b8c26a0708076

SHA512
b2f9c6fb29de42e57cf20c7eac748238ea28221a777c4c5bb07417d97cd45f7aad292335ca59ec9d1405a515496d6adb0c55028fe9530e043a1a809bd971fbfe

Download Submit
C:\Windows\SysWOW64\Fqbeoc32.exe

Filesize
97KB

MD5
7408dde0379048cfc340c2f996c9fd60

SHA1
9392c9380f24aa612f08bdab599bd75e360f4c12

SHA256
07158c11b844c3cb9163b8a78dc85a83d82895a638d7b111da76e2961f79fcdc

SHA512
2662536a3221594e84dc24192b3194df2d6d9432cde8d5aec316dbfea92c4448697720ecd1a514655d79b6bf28fd1b33aa87bed46432f03ff21748b25134dff4

Download Submit
C:\Windows\SysWOW64\Giljfddl.exe

Filesize
97KB

MD5
fe499873509d8eb35447c863d078e292

SHA1
58f74f0e487bb9365810540aa2f69b20dc11363a

SHA256
be6f5ba301666bfaf871abf0cdd1dc964c72265f10695a784fa851e831ca0ca2

SHA512
c2188a03a24db7b76b76b7c21d6b0de97820e713564f24d2d0ff78cbf32f82ee11049f97c60cc9fc0bf1801b9aaa513bfdafe94845f1b9c1a8dd278dcf8933cc

Download Submit
C:\Windows\SysWOW64\Iialhaad.exe

Filesize
97KB

MD5
cde08b5cbafcfad7a819eba9aef2f234

SHA1
df7a009d254218e8d23b14040c5025ba5cc16cbf

SHA256
0e671e3958f196dfc97de38b54a745dd4c27d688cb27e040f2f3e4ea459a301d

SHA512
f757f94ceb80343cbf3769f800e480ad101ad80f635a3e18177c6f51fd79c73ec91f5c2f241ea061e1958bdd6fd3788c8eca932cf29fba6e570bd8f5de04fce7

Download Submit
C:\Windows\SysWOW64\Iiopca32.exe

Filesize
97KB

MD5
108293d0da9c7cfcf27a1f95486f8c00

SHA1
1719df9ef705a7af668778c9a75ce95f8a87515d

SHA256
d6fe32d7903d32b296d4ca6805c97aa26435b0a2cd8711d8696760090c57e945

SHA512
169f79b1bd2fe530edc8fdd47b16de4eea9923d8278bcdbe6823cf836551ae9a43f82a6be4e67a5887664ef7b7458e06ae6b98d494f186036c7eee5ab258c9a0

Download Submit
C:\Windows\SysWOW64\Ilfennic.exe

Filesize
97KB

MD5
6618a8b114d79160dccdd8de8bc4f5f6

SHA1
814299cf2c9c719d995ec0d27797f47bdb430bf9

SHA256
92bbf35b7008f4cf9b49d00f11b153fdf99460c39f258512e7661b7f0301a23a

SHA512
567094a44b36570a46a48ed1cfe06c36753c273b0949d348a64a8d510c8cf46ca479db50f7ed2fd1fcec1fd0bed7294f92beb8aa592d19c4ae8cb9cfe5c6efba

Download Submit
C:\Windows\SysWOW64\Iogopi32.exe

Filesize
97KB

MD5
92b352642e7247bfa480c1488236631e

SHA1
0b1a28609095fdda3097a081db5d50eaa7328ebc

SHA256
cdbafd9d8b9f3f6b4559fc2eec01f7ac0f5b42c013840b0dab9d1eb9bc6afe08

SHA512
c3da729f1669ba41a125fa5e785a8ff497f476ea6e4355593c31531576662dabdcce89c76e1be3df2dce3e884588ee387c387ff596a72b479e997fd85d1a2dbd

Download Submit
C:\Windows\SysWOW64\Jldbpl32.exe

Filesize
97KB

MD5
f627587020d178c643737bab0e3ab746

SHA1
e05521ac30afbd437e437abd9bae1c3ba978c541

SHA256
20e675faadab9eb9ef45722e179411665728cd63c8d597e0769d35ab6112416f

SHA512
0256c0a4cf4d9fed076ea6fa3011ebd61c8dfb7d9ce191f6418d3fde7a7b8ebc0a2048166d21a2934aa40053c6d81b1b863123daf9f76b239b9dc81f8d537b55

Download Submit
C:\Windows\SysWOW64\Kcbfcigf.exe

Filesize
97KB

MD5
b4f171ef3e085916d56ea415745f9ac2

SHA1
9cc476224de7d4416a81e69cc0f47856def9013c

SHA256
0912e32348679638b1dbf456ec0c442882d5249c0a87519f955fabc3f3575d3e

SHA512
dbcb994d2c4de023e641b7644120e9bda6aa5ff436aad7281e41fd90e3077720d17151039470c5c606906edcdb53321b4d5b04b643e1e5ffdf55af0f6545befe

Download Submit
C:\Windows\SysWOW64\Kflide32.exe

Filesize
97KB

MD5
bc7c90d78386bb0f498ddb690595f702

SHA1
28ebe98dc15856d3281aa563a385c11193e0952c

SHA256
58481435b94efd108b8163439df7e5e18a84f67f4d5bb2bfd897a4d196169818

SHA512
9326f13a1075abe0a6fe58dd1dfed56687e837dde328a65e9c65475ee295d18755dff455d33977cf9d372fc8b42901caea754a02b8b5a478de05ca43399b4ff3

Download Submit
C:\Windows\SysWOW64\Kfnfjehl.exe

Filesize
97KB

MD5
6d1d90f5d519606d64a927870abdffdc

SHA1
e13afd39314da13731b70f6a86267bbf5a8d6b8c

SHA256
4a2a9e74bfa3b46fe9b5272210aa7f6ffae22d9cc30a148e54040181a575b3c7

SHA512
bdbb2dac3abd55cbacd869346c9ef7da56a5ac5d2ab32425d15b52f1e6c7ff6f59b513f3b425ef47f5299609057fb075daa548853587dad0e987b48da699e73e

Download Submit
C:\Windows\SysWOW64\Kgflcifg.exe

Filesize
97KB

MD5
5a319dcbb0fa98014aa5c86550c432be

SHA1
3931c21c8d1221469a445c69092f40c9c5c28b1e

SHA256
73acecdbd2fe645d0e8300352651f617d0f6d10640c05de51341b3636a77484d

SHA512
a2c48de23aacc42c9dd5d29a0958e244bc603b51d56421c2395a043418644f57ae337c638136469a3a60526d061d0ce8a812424b06d5a397591953c32f4511db

Download Submit
C:\Windows\SysWOW64\Kgflcifg.exe

Filesize
97KB

MD5
01771f522d2940cd457fe248d9f38bc7

SHA1
089eac5c149c2b5b3ae2634021c1112ecb069754

SHA256
0a567e00f2c89eaa67469463a48f21431a372723e8b5f204d9379695feb0d839

SHA512
f829d729a611a094d6d068f77b61062ca5fafd36909ec09f935102ec0596bcb12b01b239dadbb9bbfcc5afdd0b7f12bd497db1551e04249e75da8c992409e802

Download Submit
C:\Windows\SysWOW64\Kjlopc32.exe

Filesize
97KB

MD5
9e9d33098fc76b0c4e60ff4968f06fd4

SHA1
f61e0de59ddad6760b0c560d6e6b962a8c46dac0

SHA256
a4f3db0661a442defce4548ef355f67864d7e8d21baec8e508b9d5a0c961d7ce

SHA512
b3585a5c9a7ea1f835b257cbcb6e7fe4319d1e6de8b3c900c368201e5705102fdde152e025247df917d33b232ebaaa48f7fe63ba2de511671ae6f683d30e1d7d

Download Submit
C:\Windows\SysWOW64\Klahfp32.exe

Filesize
97KB

MD5
18b80a81e08b42ccd94d57168779375b

SHA1
c623cf7bd66e9f8df98df657bcf43a92f4bb8eaf

SHA256
3d4046b73f5c27487848d477eed16b70daaae12ccda168dc4f723181b2ccc2bb

SHA512
ad3d5483dc793fccce28eac48b03110e10e76865a18b81a0f9475aa8fd7bec59feb7b0ac7ebec1a0d03b54c5d3a307037ec22fe8048aafe9d0f02343d758c783

Download Submit
C:\Windows\SysWOW64\Klhnfo32.exe

Filesize
97KB

MD5
ccd53064b4dfbb8a600a30b227f3d0e7

SHA1
02f07c11b17285d702b48bfc12e4e18d1cc4fa99

SHA256
c612f1ea9eecbd0f9fb440cb656c99b039939f1cc313d7c11fd5689d5e275a7a

SHA512
91622307f2ec37aff0277111fb5699d9450343f7fe6a0ac15132970c6c7ff0462c435bb92fbe6c3fd2466f1ebac65df93b36dc8ce42e3074b163eb882809e54d

Download Submit
C:\Windows\SysWOW64\Kncaec32.exe

Filesize
97KB

MD5
d533a725a1264c169e261cbc70187de1

SHA1
9ed2e401d2dc1f9c634b25212b70ab6f0a4f8be0

SHA256
d07b38272ebf81c967d7fb4bfe2e777761df57fd0b9bd06a97f2d043316d2b23

SHA512
fe60e1bf6c87158a88bee0e6cec4cc732b6005ad4ca201078cc61b7ad73220b66d2f1933c251143ce68fa4301c26ca1434d96822c45fce45d888d0ac87b6f60c

Download Submit
C:\Windows\SysWOW64\Knqepc32.exe

Filesize
97KB

MD5
acde549c022f5624691c4933bf957e60

SHA1
4ac933a5ec08da1b9d2a8697a465abd3a9f342d3

SHA256
0e8c0c4395cf1043924fc0c2cac6d00c96ef72cc168bcc2cb43093313fac252d

SHA512
526dfdb8f516c73b0c03dab1b9d87d5144cea8001819e8d638337c2edf3e825b04982fe3672c666bc6f853ce07c93ac70a0da6da58968b996fb5902ef15e9138

Download Submit
C:\Windows\SysWOW64\Kodnmkap.exe

Filesize
97KB

MD5
e3839d4b19511a162abbc7b005b7bed8

SHA1
3d43b68bdd3bf4719757af974cf92397e504caad

SHA256
60f25788b217ba759a5d06619532e7c1248c7b32b9a12c456c0448eeabe2236f

SHA512
e84c71ca05816941325521873ad45ac2ac7e421ee29b1cbbdbb136da976732702a4b4e36931e3619fab2e799840f8a84c8e1362e22831b913d4f6a53afdb1790

Download Submit
C:\Windows\SysWOW64\Kpoalo32.exe

Filesize
97KB

MD5
d6af42c54e77b9f09e5ac1c6c8ab899d

SHA1
97211d38eadcbd5cebd15f3988f6dd24e8d5b031

SHA256
39f5ea813103b460c2fde196b6afeee3d2477ca26a11f04afbc101d4ac5b6395

SHA512
cd5b8c153c174bdc07594779a4c1486efdd41fb0753eff00c83ffd309cad335bd053a8bfe671c9367f38f7863df548a5880590e6c9714674af9da15f92f2c5a4

Download Submit
C:\Windows\SysWOW64\Lcdciiec.exe

Filesize
97KB

MD5
9efff7d684009910ba5e35a47d9f24fa

SHA1
637c51935b64da13bf323d209f786256ac652f1a

SHA256
8b0a9ee3a14805ed91275a8ae4035f7198ff1049446b600e598a31561be89b7a

SHA512
18a24aa2c82f41f9f5b250c26e871d31faa6b2eda625f69e83c5aa73036305c14eb841bd74438c2af6709d30e7b8100812e5a75b5fbd54c751255c71b6d2bf92

Download Submit
C:\Windows\SysWOW64\Lcimdh32.exe

Filesize
97KB

MD5
41fa7df30ed1dc16d654f99f024aef00

SHA1
194e2262fe308986fd10827a51c42fc6fc181aff

SHA256
eb42bc512b9f89e54507610e737ff84bc2944b6a269bc7ae68c9c82d10b06a39

SHA512
6aa61fd799a4c9d51b60a30265061303abb18476309bdded71b8b8cb3b8f6168315175e936609405a92cf5cb0f458f6764bb15643aa0fc0261157b7a79f0bf21

Download Submit
C:\Windows\SysWOW64\Lckiihok.exe

Filesize
97KB

MD5
ea3804b763503d18109a3d2587ccf474

SHA1
d19cde3ef55bf4a6cd568a3cdd522667ecdbb916

SHA256
f24ed41f9916f35a67430dbd3176b8f8174c4e0dc105feed839e7e6e06f96a9c

SHA512
13b47cd6345c2c631d1b493482d62477ffa5b9794ec00e653f34c9962b4da15ea00191b9bb96f7513729b0c84f9ac4e80c0a68d59ba8e8441b6b33a607ff1a8e

Download Submit
C:\Windows\SysWOW64\Lfeljd32.exe

Filesize
97KB

MD5
8497854e73a1afd58393fdc90b14ec34

SHA1
e3398b4a130495c0e5243adca73c52b1cd2c16b6

SHA256
1a6922757df416a866bb33730b5a5163183b2df61fcc617d26ec14ee59cebf54

SHA512
18a74bc382e33527837f85a6b1895636dcaed4f4158aa9f5d883c2db17f1b30b868d071bad6f2016d9f8092bd137be6f41362a43d5ac157fcbdd0de857e8cfb9

Download Submit
C:\Windows\SysWOW64\Lfgipd32.exe

Filesize
97KB

MD5
af819c2cae6ee0923b8f5069e6718b3c

SHA1
c19092c50d29be9fd3c49ed42a0c6446ccbcfb4a

SHA256
29ffedd9c18ac76076f7204b4139eec32a54f4b7cbafe7c4b512fe168ff70b7f

SHA512
277432dca767478c97e5c9d50f70273a321e0afe13ae0aa909faa471025c7613298dc5d7b435c4ed0fdf9407e9541e5a488a27e3d6cd8091c66b4a78f5828cba

Download Submit
C:\Windows\SysWOW64\Lfjfecno.exe

Filesize
97KB

MD5
9a4de4bf12113d814c92b1239134f567

SHA1
8376ed5598230d5fa3018d04d1da08a1283a2451

SHA256
0f29534413ebdcc64bf21cbf07179ce11f12111faa858cd12a14bea936fd2aba

SHA512
6c1ccce723a878b7eec1e81ca39a18cf468eb249adc0c7afbd40ebed4dccf2d9160f8735c62c92c37c16a406150227ffb3e910f7eafbbc20deead68bce556ed4

Download Submit
C:\Windows\SysWOW64\Lgibpf32.exe

Filesize
97KB

MD5
e9daf9dd501fd535fd4fc47f2857deed

SHA1
6dfc6984504442eda8607df48b1ea30f1155f1df

SHA256
1e6c6b99e7bdeed5bd0707819f6ee4ec344f713ea31a54f84660e22dcd6682c7

SHA512
f27397cd8eec89ab4669075601abbb982b1c3b1fa6f98059379d2dff58d8a7a989c812020743c55c933222c872d23819d8d13cc537c2479417861ac00988aed0

Download Submit
C:\Windows\SysWOW64\Lindkm32.exe

Filesize
97KB

MD5
1f627f16330c3fb9c49fc5f965cd7b43

SHA1
959316529af722cd5a8bea915ccacab337951dd6

SHA256
3aa99661ca891ea36e3a765505c8a73bbe2ab7e95d54f6961998b75942af576b

SHA512
99a2f204849e994a7821c1a1e6fa9987ca32532cb3adce0712b8f5aab3a000acd972c721da2e95a2e9c8e44704eb382c6b007e7a2d4459acd5390cadf96ad238

Download Submit
C:\Windows\SysWOW64\Ljnlecmp.exe

Filesize
97KB

MD5
cde78a4fce5cfada0c233d76abb9fd7c

SHA1
5c7f80af8fe12fffc6587669dcecc349968464ce

SHA256
2136db12163329524c9a98a37788d3172102b82b6c29a49f838104214add08a4

SHA512
4f6e1ad54bc6e7aa53bd51e9930b7d3f18218db19195a900f1543a621651ad03c9993aa7269930dac105913848c77c32bee66880e6c7717c0052ca3bcb8b6d83

Download Submit
C:\Windows\SysWOW64\Llcghg32.exe

Filesize
97KB

MD5
b0e9f4ed6bb2a3a3415e221371d17b60

SHA1
0e00c76fe794e9b26c94bdad2fb57a760ec34cbd

SHA256
b07e6bea1d05ebffcb3f476a22405d73a4adebf9459df5c83b6abe62c8806daa

SHA512
fbf505e41849c458c63f69d4698881dea0aa0a9a9c369415bca1253000b787e759365cf09da938e0c82f06acafa63b76c374ee1bf22ef31761fdb38fe5833ca7

Download Submit
C:\Windows\SysWOW64\Llnnmhfe.exe

Filesize
97KB

MD5
3adfe31a995adca5b7e1c3ee477a1ee1

SHA1
0c3a0e1bbb66883fe83f185e5bfa5720c67faed2

SHA256
d6ca1363f38be6b24c5900926ad2d64645979957e5a59920eb5cbdca4014529b

SHA512
44e2e62f4168bbec37873d0fd26f75aae828fc56d43de8369fb60a407f82bfa278b622d82daa4f4a281f5c84f4b057c967817c25d21dccd2faf8deab54242228

Download Submit
C:\Windows\SysWOW64\Llodgnja.exe

Filesize
97KB

MD5
1c20d0afcd5e6d52a77607d9fab3abb7

SHA1
1d61961aab2e3d7f8af8331e3faf577f3283607b

SHA256
a2afc98ee11fc25db7762fe4e9649f01508b6e0f6dc0a029dc0d6c48d6305114

SHA512
2b32c40feac2ecd309e7359a4955ca57a4002e25ea21645c6b695889430ea071267ca82615b91ac120de4c088701320ca14f3aaf13155c7f02b1b0353d224b26

Download Submit
C:\Windows\SysWOW64\Lmaamn32.exe

Filesize
97KB

MD5
20d6c012d2ebdd221143819129c9b1dd

SHA1
dda954b8ca25b71a809ded743fd1cf207d5f11a7

SHA256
029c7fa1d4c73dbca937e1a3a23d7067a3e70ea849e1428a78d3c84f8522783e

SHA512
f84662c6ed353d443c39eea105187c8085a8a9057754266593ad7faae460437deca4b7fea4f933452f04ef4190ac9702d4002dd6ce25c2f68d3ef9c98046ac8f

Download Submit
C:\Windows\SysWOW64\Lmdnbn32.exe

Filesize
97KB

MD5
4673435d0b4b7b12418606a53e1af0be

SHA1
8bd151110e7cd52fd437b4395684a525b054228f

SHA256
8f6234a732357491982196d4380b7350931b0a2aa4ea1dcc9b3725bfe4f525b0

SHA512
262d93c68bbe28f1af1d1ca3cc697277d01d269fa3baa872f4e4c9d70c50eeea78e6b483b210e1604e7243b4b1b3c415b66e14831a9c36bd56f93c28c956e36f

Download Submit
C:\Windows\SysWOW64\Lokdnjkg.exe

Filesize
97KB

MD5
aab63c46fe515cc77dcb2deebb9c002b

SHA1
6de82502317bcc80310ec442c302aeb763a54314

SHA256
8d337ebd9cda911101915d6e90e5ef27fcadbf744fe9c44772513c86771cb035

SHA512
310acb713a60d7525c9f0911b4fd29a6bef4fcf4fc5a366f88df1b1e11deeea5c7d4a80fd4999f97a8996bf19216940b5137cba1f7279ffe791464faf00adfff

Download Submit
C:\Windows\SysWOW64\Lqojclne.exe

Filesize
97KB

MD5
3e9f17d305659e0a550a5e115f0ffde4

SHA1
6d3404de822411a5f59637c03c436574c1e0bbbf

SHA256
8d68b97ad64656405c38b450b0024b0068421aad0f1d162a8dbb98754a3d8fb7

SHA512
1ee6d114867f17bb579a4df4afb067efc82c626584ba329d101493fd63190c1b770cecf6f4dfee9d1b3d486480b596f9435b01dce1e4620491878b7bfea887c9

Download Submit
C:\Windows\SysWOW64\Mfnoqc32.exe

Filesize
97KB

MD5
1d50461ca72ab74ccd39f3f51be26082

SHA1
9bb4b73b7028672afdf26484bb4ae76ee4125c31

SHA256
78100872e39e305c5de86f2d157ceda80737b44d245635b90b3686295d237155

SHA512
5d30d6b5a195e280269c929a2eabbe1b6c4d7790744b00d851799e27390ca8f288aab42d4e8ffa05993274a097d6fcd6fd09557b02cbf72ff6e0901a598ceb70

Download Submit
C:\Windows\SysWOW64\Mfqlfb32.exe

Filesize
97KB

MD5
f02738091454e182b1fd3ab989f0c88f

SHA1
90c705af60fbcc3f1f2d4a21690701498a995ceb

SHA256
ad538ef0dbbb20d5af1d597cbf2f503cc6c52c5e77769b98ca396ba914808fef

SHA512
4458a95f6d9ad1f33480fefe4beee8ce8f3f427cacaa29419d6c4c29897c72b404a30072d6b2ac14ad7db557877bfeb3bb88c8ef26089fff906855fefb40d672

Download Submit
C:\Windows\SysWOW64\Mjodla32.exe

Filesize
97KB

MD5
fb86cf7a3fe14dc3363c7447382ca2a6

SHA1
1ca879caa916b6806ba8bc47b172acdbd5a57003

SHA256
dac063a868043b756215728ffc4d9e74e24588b0b6ccddc4fdac8a37643d21f1

SHA512
40d6ce31c2408fe14fd235e0780714c60f235e6843928707f896c921a0a5f4cd8f40b776823f2210f22d526147a1aeb83dac6a3a0a21157dab9d09e3b51f50ea

Download Submit
C:\Windows\SysWOW64\Mlljnf32.exe

Filesize
97KB

MD5
7fafb8c3a3212a15946f942a8e34cf4e

SHA1
06fa1abe492bae51cfdd553ce24fd1b8cbf674eb

SHA256
e216ea11a7198a3c2c83301aca3c9294cdd849e84ea72a88aed3cb19140daf12

SHA512
f38e1b157595ccec79941f80cd3e93c0b57ecc954d11a72c337d099ef14d71489ee8e0ade1d852311884353d4f9da71b9c71cb2464fa853a93d7ff4746f8a90b

Download Submit
C:\Windows\SysWOW64\Mmfkhmdi.exe

Filesize
97KB

MD5
6cd72083d9a48fd301fb58461eb050d8

SHA1
a31d52f47c658ccf0e2a7485ca3b5ea7a0592446

SHA256
90d9eaa7e3469dea03878000520fc25fd6e302c907f310140c5bd9239a42b130

SHA512
e0d72bc6b1e268ead8aa7e31ed23d2b9885e1106fdb32ecf37af9113a12b792076b4c279d1a8dc574ed60c2b4dfc1f9c7fd42d3cc6d84cbf5307be5aead4af64

Download Submit
C:\Windows\SysWOW64\Mmmqhl32.exe

Filesize
97KB

MD5
e5d15f1804d8efb789798c6a1acadc44

SHA1
8203bb05ee83a65622b12ca402febed75629177a

SHA256
e5e55639541e038c55ffcd6e6f9e5581792862fe24e9d6c0de87f6585eb8397d

SHA512
4b3277566ee58a62eb94dee76ed35843304a08214c7c7056eccad6d6fd24d6e6914c63d25a437f6fff685d656f34e940798f8d2f0c130180236dc7e40a060ccb

Download Submit
C:\Windows\SysWOW64\Mnegbp32.exe

Filesize
97KB

MD5
37d027384d25db7b658a2fd278018ae8

SHA1
64860cace765151362aa0525775efd16edd81118

SHA256
656685ca41b64d6f1a64018a7694fb4ac53e63c68d7588bfaeef3bdb2cc3bb7c

SHA512
8aaa5f4d9334e596d4067f44891a3e260ae68c45a55e9faf422c3910cb877aece0ae46d4ad454c3425ab44269498f7cc65ebbb4be435722612078fae6bfa64a3

Download Submit
C:\Windows\SysWOW64\Mofmobmo.exe

Filesize
97KB

MD5
19929b6fad612e99770ddef52ace8eeb

SHA1
3d6f5727c0fadf57719a6ea6862d14a50fa05521

SHA256
cd0a2b0c2be38d6eb8aca878012c64cc70229f5a5b2a9dd6a5805e7f404ef2d5

SHA512
81e6d9b1c4a76dbaa0d794278b01840b6701e2c9e129ce7758f605afb27c511df87977b2e044b995dca5c77ae68da14a27e4e4aee666cbaa67a0ff7befb91b38

Download Submit
C:\Windows\SysWOW64\Mogcihaj.exe

Filesize
97KB

MD5
b74293ca0ff8a60c71f9f30b525b6878

SHA1
c65036cda87e96f19eb7cbf1383615e6f3aa30b8

SHA256
ca6a88253a434463cffd6cfff51ad303604fe969c503556045895712ae537356

SHA512
70d54be2f635b14a0b8872c3649e5db6abdc3374cbe5e1e731844e382e8ee4e3bf62cdec773991f3d77f5bf8bda6ecf3f9b97275180949ca149d9be67e9e6558

Download Submit
C:\Windows\SysWOW64\Moipoh32.exe

Filesize
97KB

MD5
f064a9eb28d57cee3d50785f5a198b11

SHA1
6af52d9d559c0c1a177be1512b3f436012f2f7b3

SHA256
99da321c33c183c69b6cae7a32d455dbc111e28c02b24623bcdd59174aac6110

SHA512
d57ba19740bef362ed1893263f5590d31a048dffad216c7f136644b97efcb51726bd943b20edce4a45db2ef0861ba075a9ba2362aa8858b3a8359c833bd26208

Download Submit
C:\Windows\SysWOW64\Nckkfp32.exe

Filesize
97KB

MD5
5bc6ed11bb0aeba4a911dbb680e50516

SHA1
bffe4681e5c58f96fdb670d3fbea7c33b2d9cebc

SHA256
7e5ed26a009d0066d0d8b985ebda6c2729b1be92b19c59bbf406ca44c39ad181

SHA512
3eec7d6e0812bcb645d03fc368d3b57327103ce5278df8ecbc314658367b1d30a7004548b70b29164dfa0504d3f7aad80bd8ecd99662ad2adcf04cb2cc18f92e

Download Submit
C:\Windows\SysWOW64\Nflkbanj.exe

Filesize
97KB

MD5
677088891c8da8dc36d7a67924c1c95d

SHA1
4424ce6a2ab0766a15be8383f3ce47ef3eccd4e0

SHA256
a0b8df31632e9bf5b8f54bd30137fb2593664e03d9b8f88370471f0b7a333bcf

SHA512
ea63cb93c1fc88420bacc73793cd7bb20f3b760ba15a879dd5dc473d0408a432a3cfebde013cc7075cc4f940f5f73580b51ae0c8e3e1423ee6a16841d9a294ca

Download Submit
C:\Windows\SysWOW64\Nfnamjhk.exe

Filesize
97KB

MD5
5c3403ba1b3217d7534ea5bda7037010

SHA1
5441ecd11284480f57ef2601748f0be9d3e43a9a

SHA256
ca5f33903f5ed2ccc85fc037fce7807c571fd9e1d520c1516ca0315b3684c74a

SHA512
e7a98a038922fab055f7c92575ed2f4b7366cb5c63c28340c8a5a6ebc250deddb856c558aec908a0528b67c313314d450e2933e9365a82ba7be73aa549c0c6e3

Download Submit
C:\Windows\SysWOW64\Ngqagcag.exe

Filesize
97KB

MD5
bc1ebc75f5465480bea654f9f50bf8fc

SHA1
8914014756fa9673f29f52ce08bfbee852b69a6c

SHA256
0f5aecac56918ecab59ac01993d353f315f8f050aedf16d8211a493c1d77a228

SHA512
eaf3bad134597035722f2763407809b0a74b4a3bcae8d8f391aa5adb9c1af991436b2f2913ba769563d3bb3e89e6756ade7cf65bd0d9a382dd89828cea13756e

Download Submit
C:\Windows\SysWOW64\Njljch32.exe

Filesize
97KB

MD5
d47f912b172c5d3e6cd5878a300e7569

SHA1
eb80d62e3772ea8aacc22c580acae024f405478b

SHA256
8ce74381a06151a6ec7463a364b6538d3f7a3ea89b55d15c6e71f7606c865562

SHA512
e23debfddb73076df82524b419c5db8d247cbc66a27cf929c56d75949914fbd6449423d8f39d5771554f38fa912c4717733ee0b1de6650e036ec1bfb3b5cfbb9

Download Submit
C:\Windows\SysWOW64\Ofkgcobj.exe

Filesize
97KB

MD5
67550fd5082beee435499425050e684b

SHA1
6974f453dbee15986ab5b12fd6143fa72395224a

SHA256
0e5c3a243fa52f3183365e66d0d99605b0a3115263c133d351c0bf0236d85ab7

SHA512
be3b4f4e3e5f73ada29e209ef93ec055f23f8b71517f60458e6fbe641c0fc5302105aad0ef9277147a1cfae88638d7b5ca217a66d99ac9bb61def61439a514d4

Download Submit
C:\Windows\SysWOW64\Oiccje32.exe

Filesize
97KB

MD5
9157573241fd3655b9a418e9a43b5afd

SHA1
e4dfbf73f5869323b01d947d6972513ac0c35998

SHA256
881e0905152731f505600a9645d4aebb5025b6d0129d512956622399ea93c25f

SHA512
802bfac0933934b662575f71da15be61e4d09cb2f52dd8ef34c58fc4bec19de5a1b89b6434b9c2922e79f0442c49fb8e01c405f96313e799ebff875b9792c27c

Download Submit
C:\Windows\SysWOW64\Ojhpimhp.exe

Filesize
97KB

MD5
efde1348762059c6b0bac75f2644cdf7

SHA1
b948c601c41425f6711c0b03fdecb246a106ff15

SHA256
65ebbadf6561b53e525018e02bcb26c2478cb07b56931614ceb6d635534c63f8

SHA512
27d4f73b881a2c0f63bac72aba65f090819afcc575f3bdc6b42c2caa7d749ea78d442ca2df71f74541ccdca6e7f327907a2bc9ee6d5ae5a0319fdfb1b12c193b

Download Submit
C:\Windows\SysWOW64\Paihlpfi.exe

Filesize
97KB

MD5
535752d3359facf059fe96975cfe0a70

SHA1
a11e89332e828d2f067de14a1d0a3d8bd59736e2

SHA256
22318d9649d2b6bf6fe761a86e0b29d207d2af8f4a9fefbd9c69b2f977d49f49

SHA512
179ba2589e973395287ef7dc96ec4f96330610b0af95a7d2b272b00f549586f67f666761beb9948c468c4241358f9d752bb643f12bf3ae3463ceec8fb11d8ec5

Download Submit
C:\Windows\SysWOW64\Pcpnhl32.exe

Filesize
97KB

MD5
e17c879a66fd3af5ab6d854529e172be

SHA1
662df7d90784fa388fcfd641d1e275c4dc7af88b

SHA256
43c74abfc1a1f342e4d4346bbf16a00f761d8e372fb7a1a24a42552a69ceaec7

SHA512
13b46f414441762fa793e23296f7ed9c22b49af0b3483e6dfebc066a56c1e4b36be145a4eb1ca15748907f468ccdb7a95c403332aaa8b41addf6b612e712026f

Download Submit
C:\Windows\SysWOW64\Pjcikejg.exe

Filesize
97KB

MD5
962c40e67caa7ecdc0c7a444be32927e

SHA1
1b3b1a7a02e02e3394ca48e7d02dbde81c3d63b3

SHA256
ebeba16e08a33fb5cc57274f809b5cb7b74bd255962efb38825424d7726e6188

SHA512
9ed044e575f25f9f4d99aa4ca0e28294711ee43b6976de03a6ee897dd7899f65acb4c1b842805ee20bf7a9a942b412e9071b33f4f8c47d108d945f621a9bb265

Download Submit
C:\Windows\SysWOW64\Pmphaaln.exe

Filesize
97KB

MD5
e5167187c17a927b0a0dc430fab82cb9

SHA1
7ccf8c03e87e31d7f0023ed0587790c26fed635e

SHA256
806ec981b8d69e9ef65888a1e7f6587c3db7a3a450cc99ee54bafcc553560969

SHA512
f2c3ae7cf3c41bafbb90d23b6bd059398104e13a26a878b3758eaac73070e5d0bf7f9d12455bc24286b49b38ec3e8752c59545f100e33673c24e8a0ea887d573

Download Submit
C:\Windows\SysWOW64\Ppikbm32.exe

Filesize
97KB

MD5
ed809036547ce679138d04c5a104d122

SHA1
c60162e07c5c46421e81d7633412267253be0bb3

SHA256
69189305e3b287c586397958d9d111609dfd51831191663bd13e6ca8ffcff6c4

SHA512
fdbaf6f95f6e097fe0c66c05fcd30011a10aa872f002edc8a0fa5f5dfbb138a680647450fcf8473a8613a7e46c9dccced904b44e0119c49409b50e2289cb41d1

Download Submit
memory/216-573-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/320-340-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/372-370-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/432-545-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/556-386-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/576-478-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/652-430-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/664-197-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/788-310-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/840-352-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/948-143-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/980-15-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/980-558-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1076-572-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1076-31-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1128-388-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1144-436-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1152-212-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1164-466-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1220-255-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1336-292-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1348-594-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1360-56-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1360-593-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1364-322-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1556-199-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1600-176-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1636-358-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1648-418-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1660-496-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1692-328-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1812-184-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1816-526-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1836-472-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1880-400-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1892-442-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2008-580-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2052-286-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2156-79-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2164-151-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2192-215-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2232-566-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2332-556-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2364-224-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2432-532-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2548-460-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2576-47-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2576-586-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2676-248-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2696-87-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2784-334-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2856-514-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2936-538-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3060-71-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3108-308-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3144-376-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3204-160-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3208-119-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3284-559-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3304-406-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3312-63-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3480-274-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3544-346-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3612-364-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3616-579-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3616-39-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3736-96-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3776-104-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3812-239-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3876-448-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3936-23-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3936-565-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4060-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4060-544-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4088-280-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4128-587-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4176-502-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4196-7-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4196-551-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4376-424-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4412-127-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4492-262-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4504-412-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4564-512-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4568-268-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4644-298-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4672-520-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4744-135-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4808-172-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4812-111-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4836-490-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4860-484-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4880-394-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4888-232-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4896-316-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5080-454-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/9584-2744-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/9600-2767-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/9668-2730-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/9688-2766-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/10128-2736-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads