berbew | 8acca9eff58134be9992dbadda8f85a72af52e83d01844b494472812d6ed6b0e

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2025, 13:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8acca9eff58134be9992dbadda8f85a72af52e83d01844b494472812d6ed6b0e.exe
Size

163KB
MD5

35065817dd729d63aed7cfec81650013
SHA1

c1ac42652b004a34f31a68b42a7b60168588ce0e
SHA256

8acca9eff58134be9992dbadda8f85a72af52e83d01844b494472812d6ed6b0e
SHA512

e3e7d8d316f9b3bea2dac0b5e7e6dc5c7de01a3b1a828d5eb60dac296a8d4fd398e0da93beee125dccfe2cb11b6aac877acf8cfe04eb31644c5cd2de5a730420
SSDEEP

3072:nluAsjxtK8dNYBIuT6dJBOltOrWKDBr+yJbw:lu5jxtK8dNYBKBOLOfw

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://master-x.com/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://crutop.ru/index.php

http://kaspersky.ru/index.php

http://color-bank.ru/index.php

http://adult-empire.com/index.php

http://virus-list.com/index.php

http://trojan.ru/index.php

http://xware.cjb.net/index.htm

http://konfiskat.org/index.htm

http://parex-bank.ru/index.htm

http://fethard.biz/index.htm

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bacjdbch.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jikoopij.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kplmliko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bogkmgba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cglbhhga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfccogfc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Khdoqefq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bgbpaipl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dpkmal32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpfbcn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kolabf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kocgbend.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bbaclegm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmedjl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jnpjlajn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kbhmbdle.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdpcal32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jemfhacc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjggal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oiagde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qamago32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dnngpj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dncpkjoc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jldkeeig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kapfiqoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bpqjjjjl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmgqpkip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hjolie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipbaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbccge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qjffpe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpegkj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fjocbhbo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hgeihiac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kbnlim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dqpfmlce.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enfckp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebkbbmqj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kapfiqoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Paihlpfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aibibp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnqcfjae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfiddm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amjbbfgo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkjmlaac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gbpedjnb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jblmgf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpbjfjci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfkbfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdmoafdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fkjmlaac.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klbnajqc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgpeha32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enemaimp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fcbnpnme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hnpaec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ilhkigcd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpgmhg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Llcghg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibnjkbog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ieeimlep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmhocd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bacjdbch.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilphdlqh.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
1192	Pmnbfhal.exe
3128	Pplobcpp.exe
2824	Palklf32.exe
4516	Pfiddm32.exe
2884	Panhbfep.exe
688	Qhhpop32.exe
2144	Qaqegecm.exe
4844	Qhjmdp32.exe
2712	Qjiipk32.exe
1924	Afpjel32.exe
4780	Amjbbfgo.exe
1736	Amcehdod.exe
4560	Bhhiemoj.exe
1080	Bobabg32.exe
1152	Bdojjo32.exe
4064	Bmhocd32.exe
2792	Bacjdbch.exe
4812	Bogkmgba.exe
3268	Bgbpaipl.exe
3932	Bhblllfo.exe
5024	Cggimh32.exe
1444	Cponen32.exe
640	Ckebcg32.exe
2328	Cglbhhga.exe
1596	Cdpcal32.exe
4752	Cacckp32.exe
3036	Cogddd32.exe
2344	Dhphmj32.exe
4328	Dpkmal32.exe
3624	Dgeenfog.exe
1496	Dggbcf32.exe
2948	Dqpfmlce.exe
5092	Doagjc32.exe
1140	Dbocfo32.exe
3328	Enfckp32.exe
3248	Eqdpgk32.exe
1952	Enhpao32.exe
4584	Ehndnh32.exe
1576	Enkmfolf.exe
4712	Edeeci32.exe
2516	Enmjlojd.exe
3012	Ehbnigjj.exe
1392	Ebkbbmqj.exe
4252	Edionhpn.exe
4200	Fnbcgn32.exe
1856	Fdlkdhnk.exe
2348	Fgjhpcmo.exe
3428	Fdnhih32.exe
216	Foclgq32.exe
2944	Feqeog32.exe
4244	Fkjmlaac.exe
4080	Fbdehlip.exe
2064	Fecadghc.exe
2808	Fbgbnkfm.exe
2964	Gnnccl32.exe
3504	Gbiockdj.exe
720	Gpmomo32.exe
3320	Gbkkik32.exe
2976	Gkdpbpih.exe
3804	Gnblnlhl.exe
4460	Geldkfpi.exe
5016	Gbpedjnb.exe
4044	Geoapenf.exe
1468	Gbbajjlp.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ehndnh32.exe	Enhpao32.exe
File created	C:\Windows\SysWOW64\Fbdehlip.exe	Fkjmlaac.exe
File created	C:\Windows\SysWOW64\Jojdlfeo.exe	Jhplpl32.exe
File created	C:\Windows\SysWOW64\Fcpakn32.exe	Fjhmbihg.exe
File opened for modification	C:\Windows\SysWOW64\Fnjocf32.exe	Fjocbhbo.exe
File created	C:\Windows\SysWOW64\Nbnlaldg.exe	Noppeaed.exe
File created	C:\Windows\SysWOW64\Coppbe32.dll	Hnibokbd.exe
File created	C:\Windows\SysWOW64\Aabkbono.exe	Qikbaaml.exe
File created	C:\Windows\SysWOW64\Ejccgi32.exe	Egegjn32.exe
File created	C:\Windows\SysWOW64\Fkgillpj.exe	Fcpakn32.exe
File created	C:\Windows\SysWOW64\Kbqceofn.dll	Bhhiemoj.exe
File created	C:\Windows\SysWOW64\Hpfohk32.dll	Nimmifgo.exe
File created	C:\Windows\SysWOW64\Ndmojj32.dll	Enemaimp.exe
File opened for modification	C:\Windows\SysWOW64\Fcbnpnme.exe	Fbaahf32.exe
File created	C:\Windows\SysWOW64\Jooeqo32.dll	Ibpgqa32.exe
File created	C:\Windows\SysWOW64\Feqeog32.exe	Foclgq32.exe
File created	C:\Windows\SysWOW64\Ehfomc32.dll	Kiphjo32.exe
File opened for modification	C:\Windows\SysWOW64\Noppeaed.exe	Nqmojd32.exe
File created	C:\Windows\SysWOW64\Pciqnk32.exe	Pidlqb32.exe
File created	C:\Windows\SysWOW64\Hbiapb32.exe	Hkohchko.exe
File created	C:\Windows\SysWOW64\Epoaed32.dll	Dgeenfog.exe
File created	C:\Windows\SysWOW64\Ocoick32.dll	Gnblnlhl.exe
File opened for modification	C:\Windows\SysWOW64\Ledepn32.exe	Lojmcdgl.exe
File created	C:\Windows\SysWOW64\Lckboblp.exe	Loofnccf.exe
File opened for modification	C:\Windows\SysWOW64\Ajohfcpj.exe	Adepji32.exe
File opened for modification	C:\Windows\SysWOW64\Ggepalof.exe	Gdgdeppb.exe
File opened for modification	C:\Windows\SysWOW64\Icogcjde.exe	Ibnjkbog.exe
File opened for modification	C:\Windows\SysWOW64\Gpmomo32.exe	Gbiockdj.exe
File created	C:\Windows\SysWOW64\Jlikkkhn.exe	Jikoopij.exe
File opened for modification	C:\Windows\SysWOW64\Jddiegbm.exe	Jogqlpde.exe
File created	C:\Windows\SysWOW64\Bpfljc32.dll	Fecadghc.exe
File created	C:\Windows\SysWOW64\Nhoped32.dll	Pfojdh32.exe
File opened for modification	C:\Windows\SysWOW64\Hiacacpg.exe	Heegad32.exe
File created	C:\Windows\SysWOW64\Jbccge32.exe	Jpegkj32.exe
File created	C:\Windows\SysWOW64\Llcghg32.exe	Lfiokmkc.exe
File created	C:\Windows\SysWOW64\Fllinoed.dll	Eafbmgad.exe
File created	C:\Windows\SysWOW64\Gbjlkd32.dll	Fbaahf32.exe
File created	C:\Windows\SysWOW64\Qhjmdp32.exe	Qaqegecm.exe
File opened for modification	C:\Windows\SysWOW64\Ppgomnai.exe	Pfojdh32.exe
File created	C:\Windows\SysWOW64\Cnidqf32.dll	Famhmfkl.exe
File opened for modification	C:\Windows\SysWOW64\Lbqinm32.exe	Klgqabib.exe
File created	C:\Windows\SysWOW64\Aamebb32.dll	Cdpcal32.exe
File opened for modification	C:\Windows\SysWOW64\Qclmck32.exe	Qamago32.exe
File created	C:\Windows\SysWOW64\Hlnecf32.dll	Infhebbh.exe
File created	C:\Windows\SysWOW64\Cjceejee.dll	Pmnbfhal.exe
File opened for modification	C:\Windows\SysWOW64\Hlblcn32.exe	Hehdfdek.exe
File created	C:\Windows\SysWOW64\Ieicjl32.dll	Jocnlg32.exe
File opened for modification	C:\Windows\SysWOW64\Kcmfnd32.exe	Kpnjah32.exe
File created	C:\Windows\SysWOW64\Jlobem32.dll	Bhblllfo.exe
File created	C:\Windows\SysWOW64\Hioflcbj.exe	Hnibokbd.exe
File opened for modification	C:\Windows\SysWOW64\Kiphjo32.exe	Kedlip32.exe
File created	C:\Windows\SysWOW64\Opbean32.exe	Ojemig32.exe
File created	C:\Windows\SysWOW64\Ldbhiiol.dll	Bfkbfd32.exe
File opened for modification	C:\Windows\SysWOW64\Ekljpm32.exe	Eaceghcg.exe
File opened for modification	C:\Windows\SysWOW64\Kopcbo32.exe	Kdkoef32.exe
File created	C:\Windows\SysWOW64\Lhpnlclc.exe	Laffpi32.exe
File created	C:\Windows\SysWOW64\Dggbcf32.exe	Dgeenfog.exe
File created	C:\Windows\SysWOW64\Fgcpfdbd.dll	Ehbnigjj.exe
File opened for modification	C:\Windows\SysWOW64\Gkdpbpih.exe	Gbkkik32.exe
File created	C:\Windows\SysWOW64\Cgpfqchb.dll	Jeocna32.exe
File created	C:\Windows\SysWOW64\Lpgmhg32.exe	Lcclncbh.exe
File created	C:\Windows\SysWOW64\Njbgmjgl.exe	Nblolm32.exe
File created	C:\Windows\SysWOW64\Fpenlneh.dll	Nbphglbe.exe
File opened for modification	C:\Windows\SysWOW64\Gdiakp32.exe	Gbkdod32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
8636	8372	WerFault.exe	429

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nblolm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgmhcaac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgpeha32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dckoia32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jblmgf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajdbac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bpqjjjjl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gjficg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckebcg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jimldogg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ooibkpmi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dahfkimd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dnngpj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dnqcfjae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddklbd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgihop32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lhcali32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpochfji.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfnamjhk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmladm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdjblf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fcpakn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkgillpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbdnne32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dqpfmlce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fgjhpcmo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hebcao32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Haidfpki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hgcmbj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Icogcjde.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jogqlpde.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbgfhnhi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlikkkhn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kcmfnd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddcebe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Egkddo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ecbeip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ijkled32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbqinm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbdehlip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbkkik32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oonlfo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfojdh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abcgjg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbnlim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbhool32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qclmck32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kapfiqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amcehdod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dggbcf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hioflcbj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jocnlg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jeocna32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqklkbbi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gnnccl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cponen32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eqdpgk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Egegjn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbaahf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gjhfif32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gkhbbi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hqdkkp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aabkbono.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdocph32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojidbohn.dll"	Edeeci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ccppmc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jlikkkhn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kheekkjl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dnqcfjae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jnpjlajn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oonlfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aolphl32.dll"	Ekljpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lgahlk32.dll"	Icogcjde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdqeooaa.dll"	Jacpcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Khabke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epqblnhh.dll"	Kbnlim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghaeocdd.dll"	Ookoaokf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ppgomnai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbdnne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Diadam32.dll"	Ledepn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kefbdjgm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cogddd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocfgbfdm.dll"	Fdlkdhnk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jpbjfjci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jhplpl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bbfmgd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhhnfh32.dll"	Enlcahgh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Geldkfpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Caecnh32.dll"	Mjggal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nqcejcha.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Indkpcdk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bogkmgba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fkjmlaac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aabkbono.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hgcmbj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iaedanal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Laffpi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fckjejfe.dll"	Gpmomo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Geoapenf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibepke32.dll"	Kplmliko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gdiakp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Enmjlojd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qjffpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aaiqcnhg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fohoiloe.dll"	Fgqgfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhkkfnao.dll"	Jaljbmkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgnfpc32.dll"	Kbgfhnhi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmhocd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cggimh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ckebcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjmgil32.dll"	Pcpnhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kdpiqehp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gnmlhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bdojjo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cacckp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kefiopki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qhhpop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Heegad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ajdbac32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gnnccl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hiacacpg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qamago32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Haidfpki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgpchp32.dll"	Hkcbnh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Edionhpn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lhcali32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Afjpan32.dll"	Bphqji32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fnbcgn32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 1192	4112	8acca9eff58134be9992dbadda8f85a72af52e83d01844b494472812d6ed6b0e.exe	83
PID 4112 wrote to memory of 1192	4112	8acca9eff58134be9992dbadda8f85a72af52e83d01844b494472812d6ed6b0e.exe	83
PID 4112 wrote to memory of 1192	4112	8acca9eff58134be9992dbadda8f85a72af52e83d01844b494472812d6ed6b0e.exe	83
PID 1192 wrote to memory of 3128	1192	Pmnbfhal.exe	84
PID 1192 wrote to memory of 3128	1192	Pmnbfhal.exe	84
PID 1192 wrote to memory of 3128	1192	Pmnbfhal.exe	84
PID 3128 wrote to memory of 2824	3128	Pplobcpp.exe	87
PID 3128 wrote to memory of 2824	3128	Pplobcpp.exe	87
PID 3128 wrote to memory of 2824	3128	Pplobcpp.exe	87
PID 2824 wrote to memory of 4516	2824	Palklf32.exe	88
PID 2824 wrote to memory of 4516	2824	Palklf32.exe	88
PID 2824 wrote to memory of 4516	2824	Palklf32.exe	88
PID 4516 wrote to memory of 2884	4516	Pfiddm32.exe	90
PID 4516 wrote to memory of 2884	4516	Pfiddm32.exe	90
PID 4516 wrote to memory of 2884	4516	Pfiddm32.exe	90
PID 2884 wrote to memory of 688	2884	Panhbfep.exe	91
PID 2884 wrote to memory of 688	2884	Panhbfep.exe	91
PID 2884 wrote to memory of 688	2884	Panhbfep.exe	91
PID 688 wrote to memory of 2144	688	Qhhpop32.exe	92
PID 688 wrote to memory of 2144	688	Qhhpop32.exe	92
PID 688 wrote to memory of 2144	688	Qhhpop32.exe	92
PID 2144 wrote to memory of 4844	2144	Qaqegecm.exe	93
PID 2144 wrote to memory of 4844	2144	Qaqegecm.exe	93
PID 2144 wrote to memory of 4844	2144	Qaqegecm.exe	93
PID 4844 wrote to memory of 2712	4844	Qhjmdp32.exe	94
PID 4844 wrote to memory of 2712	4844	Qhjmdp32.exe	94
PID 4844 wrote to memory of 2712	4844	Qhjmdp32.exe	94
PID 2712 wrote to memory of 1924	2712	Qjiipk32.exe	95
PID 2712 wrote to memory of 1924	2712	Qjiipk32.exe	95
PID 2712 wrote to memory of 1924	2712	Qjiipk32.exe	95
PID 1924 wrote to memory of 4780	1924	Afpjel32.exe	96
PID 1924 wrote to memory of 4780	1924	Afpjel32.exe	96
PID 1924 wrote to memory of 4780	1924	Afpjel32.exe	96
PID 4780 wrote to memory of 1736	4780	Amjbbfgo.exe	97
PID 4780 wrote to memory of 1736	4780	Amjbbfgo.exe	97
PID 4780 wrote to memory of 1736	4780	Amjbbfgo.exe	97
PID 1736 wrote to memory of 4560	1736	Amcehdod.exe	98
PID 1736 wrote to memory of 4560	1736	Amcehdod.exe	98
PID 1736 wrote to memory of 4560	1736	Amcehdod.exe	98
PID 4560 wrote to memory of 1080	4560	Bhhiemoj.exe	99
PID 4560 wrote to memory of 1080	4560	Bhhiemoj.exe	99
PID 4560 wrote to memory of 1080	4560	Bhhiemoj.exe	99
PID 1080 wrote to memory of 1152	1080	Bobabg32.exe	100
PID 1080 wrote to memory of 1152	1080	Bobabg32.exe	100
PID 1080 wrote to memory of 1152	1080	Bobabg32.exe	100
PID 1152 wrote to memory of 4064	1152	Bdojjo32.exe	101
PID 1152 wrote to memory of 4064	1152	Bdojjo32.exe	101
PID 1152 wrote to memory of 4064	1152	Bdojjo32.exe	101
PID 4064 wrote to memory of 2792	4064	Bmhocd32.exe	102
PID 4064 wrote to memory of 2792	4064	Bmhocd32.exe	102
PID 4064 wrote to memory of 2792	4064	Bmhocd32.exe	102
PID 2792 wrote to memory of 4812	2792	Bacjdbch.exe	103
PID 2792 wrote to memory of 4812	2792	Bacjdbch.exe	103
PID 2792 wrote to memory of 4812	2792	Bacjdbch.exe	103
PID 4812 wrote to memory of 3268	4812	Bogkmgba.exe	104
PID 4812 wrote to memory of 3268	4812	Bogkmgba.exe	104
PID 4812 wrote to memory of 3268	4812	Bogkmgba.exe	104
PID 3268 wrote to memory of 3932	3268	Bgbpaipl.exe	105
PID 3268 wrote to memory of 3932	3268	Bgbpaipl.exe	105
PID 3268 wrote to memory of 3932	3268	Bgbpaipl.exe	105
PID 3932 wrote to memory of 5024	3932	Bhblllfo.exe	106
PID 3932 wrote to memory of 5024	3932	Bhblllfo.exe	106
PID 3932 wrote to memory of 5024	3932	Bhblllfo.exe	106
PID 5024 wrote to memory of 1444	5024	Cggimh32.exe	107

C:\Users\Admin\AppData\Local\Temp\8acca9eff58134be9992dbadda8f85a72af52e83d01844b494472812d6ed6b0e.exe
"C:\Users\Admin\AppData\Local\Temp\8acca9eff58134be9992dbadda8f85a72af52e83d01844b494472812d6ed6b0e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Windows\SysWOW64\Pmnbfhal.exe
  C:\Windows\system32\Pmnbfhal.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1192
- - C:\Windows\SysWOW64\Pplobcpp.exe
    C:\Windows\system32\Pplobcpp.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3128
  - - C:\Windows\SysWOW64\Palklf32.exe
      C:\Windows\system32\Palklf32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2824
    - - C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4516
      - C:\Windows\SysWOW64\Panhbfep.exe
        
        C:\Windows\system32\Panhbfep.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2884
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:688
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2144
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4844
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2712
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1924
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4780
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1736
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4560
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1080
        
        C:\Windows\SysWOW64\Bdojjo32.exe
        
        C:\Windows\system32\Bdojjo32.exe
        16⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1152
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4064
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2792
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4812
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3268
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3932
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5024
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        23⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1444
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:640
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2328
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1596
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4752
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        28⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3036
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        29⤵
        Executes dropped EXE
        
        PID:2344
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4328
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3624
        
        C:\Windows\SysWOW64\Dggbcf32.exe
        
        C:\Windows\system32\Dggbcf32.exe
        32⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1496
        
        C:\Windows\SysWOW64\Dqpfmlce.exe
        
        C:\Windows\system32\Dqpfmlce.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2948
        
        C:\Windows\SysWOW64\Doagjc32.exe
        
        C:\Windows\system32\Doagjc32.exe
        34⤵
        Executes dropped EXE
        
        PID:5092
        
        C:\Windows\SysWOW64\Dbocfo32.exe
        
        C:\Windows\system32\Dbocfo32.exe
        35⤵
        Executes dropped EXE
        
        PID:1140
        
        C:\Windows\SysWOW64\Enfckp32.exe
        
        C:\Windows\system32\Enfckp32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3328
        
        C:\Windows\SysWOW64\Eqdpgk32.exe
        
        C:\Windows\system32\Eqdpgk32.exe
        37⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3248
        
        C:\Windows\SysWOW64\Enhpao32.exe
        
        C:\Windows\system32\Enhpao32.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1952
        
        C:\Windows\SysWOW64\Ehndnh32.exe
        
        C:\Windows\system32\Ehndnh32.exe
        39⤵
        Executes dropped EXE
        
        PID:4584
        
        C:\Windows\SysWOW64\Enkmfolf.exe
        
        C:\Windows\system32\Enkmfolf.exe
        40⤵
        Executes dropped EXE
        
        PID:1576
        
        C:\Windows\SysWOW64\Edeeci32.exe
        
        C:\Windows\system32\Edeeci32.exe
        41⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4712
        
        C:\Windows\SysWOW64\Enmjlojd.exe
        
        C:\Windows\system32\Enmjlojd.exe
        42⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2516
        
        C:\Windows\SysWOW64\Ehbnigjj.exe
        
        C:\Windows\system32\Ehbnigjj.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3012
        
        C:\Windows\SysWOW64\Ebkbbmqj.exe
        
        C:\Windows\system32\Ebkbbmqj.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1392
        
        C:\Windows\SysWOW64\Edionhpn.exe
        
        C:\Windows\system32\Edionhpn.exe
        45⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4252
        
        C:\Windows\SysWOW64\Fnbcgn32.exe
        
        C:\Windows\system32\Fnbcgn32.exe
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4200
        
        C:\Windows\SysWOW64\Fdlkdhnk.exe
        
        C:\Windows\system32\Fdlkdhnk.exe
        47⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1856
        
        C:\Windows\SysWOW64\Fgjhpcmo.exe
        
        C:\Windows\system32\Fgjhpcmo.exe
        48⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2348
        
        C:\Windows\SysWOW64\Fdnhih32.exe
        
        C:\Windows\system32\Fdnhih32.exe
        49⤵
        Executes dropped EXE
        
        PID:3428
        
        C:\Windows\SysWOW64\Foclgq32.exe
        
        C:\Windows\system32\Foclgq32.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:216
        
        C:\Windows\SysWOW64\Feqeog32.exe
        
        C:\Windows\system32\Feqeog32.exe
        51⤵
        Executes dropped EXE
        
        PID:2944
        
        C:\Windows\SysWOW64\Fkjmlaac.exe
        
        C:\Windows\system32\Fkjmlaac.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4244
        
        C:\Windows\SysWOW64\Fbdehlip.exe
        
        C:\Windows\system32\Fbdehlip.exe
        53⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4080
        
        C:\Windows\SysWOW64\Fecadghc.exe
        
        C:\Windows\system32\Fecadghc.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2064
        
        C:\Windows\SysWOW64\Fbgbnkfm.exe
        
        C:\Windows\system32\Fbgbnkfm.exe
        55⤵
        Executes dropped EXE
        
        PID:2808
        
        C:\Windows\SysWOW64\Gnnccl32.exe
        
        C:\Windows\system32\Gnnccl32.exe
        56⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2964
        
        C:\Windows\SysWOW64\Gbiockdj.exe
        
        C:\Windows\system32\Gbiockdj.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3504
        
        C:\Windows\SysWOW64\Gpmomo32.exe
        
        C:\Windows\system32\Gpmomo32.exe
        58⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:720
        
        C:\Windows\SysWOW64\Gbkkik32.exe
        
        C:\Windows\system32\Gbkkik32.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3320
        
        C:\Windows\SysWOW64\Gkdpbpih.exe
        
        C:\Windows\system32\Gkdpbpih.exe
        60⤵
        Executes dropped EXE
        
        PID:2976
        
        C:\Windows\SysWOW64\Gnblnlhl.exe
        
        C:\Windows\system32\Gnblnlhl.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3804
        
        C:\Windows\SysWOW64\Geldkfpi.exe
        
        C:\Windows\system32\Geldkfpi.exe
        62⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4460
        
        C:\Windows\SysWOW64\Gbpedjnb.exe
        
        C:\Windows\system32\Gbpedjnb.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5016
        
        C:\Windows\SysWOW64\Geoapenf.exe
        
        C:\Windows\system32\Geoapenf.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4044
        
        C:\Windows\SysWOW64\Gbbajjlp.exe
        
        C:\Windows\system32\Gbbajjlp.exe
        65⤵
        Executes dropped EXE
        
        PID:1468
        
        C:\Windows\SysWOW64\Giljfddl.exe
        
        C:\Windows\system32\Giljfddl.exe
        66⤵
        
        PID:4568
        
        C:\Windows\SysWOW64\Hpfbcn32.exe
        
        C:\Windows\system32\Hpfbcn32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4416
        
        C:\Windows\SysWOW64\Hnibokbd.exe
        
        C:\Windows\system32\Hnibokbd.exe
        68⤵
        Drops file in System32 directory
        
        PID:1356
        
        C:\Windows\SysWOW64\Hioflcbj.exe
        
        C:\Windows\system32\Hioflcbj.exe
        69⤵
        System Location Discovery: System Language Discovery
        
        PID:3716
        
        C:\Windows\SysWOW64\Heegad32.exe
        
        C:\Windows\system32\Heegad32.exe
        70⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2156
        
        C:\Windows\SysWOW64\Hiacacpg.exe
        
        C:\Windows\system32\Hiacacpg.exe
        71⤵
        Modifies registry class
        
        PID:1268
        
        C:\Windows\SysWOW64\Hehdfdek.exe
        
        C:\Windows\system32\Hehdfdek.exe
        72⤵
        Drops file in System32 directory
        
        PID:3068
        
        C:\Windows\SysWOW64\Hlblcn32.exe
        
        C:\Windows\system32\Hlblcn32.exe
        73⤵
        
        PID:1088
        
        C:\Windows\SysWOW64\Hnphoj32.exe
        
        C:\Windows\system32\Hnphoj32.exe
        74⤵
        
        PID:2640
        
        C:\Windows\SysWOW64\Hifmmb32.exe
        
        C:\Windows\system32\Hifmmb32.exe
        75⤵
        
        PID:3832
        
        C:\Windows\SysWOW64\Hhimhobl.exe
        
        C:\Windows\system32\Hhimhobl.exe
        76⤵
        
        PID:2552
        
        C:\Windows\SysWOW64\Ihkjno32.exe
        
        C:\Windows\system32\Ihkjno32.exe
        77⤵
        
        PID:4664
        
        C:\Windows\SysWOW64\Ipbaol32.exe
        
        C:\Windows\system32\Ipbaol32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2844
        
        C:\Windows\SysWOW64\Iacngdgj.exe
        
        C:\Windows\system32\Iacngdgj.exe
        79⤵
        
        PID:2492
        
        C:\Windows\SysWOW64\Iijfhbhl.exe
        
        C:\Windows\system32\Iijfhbhl.exe
        80⤵
        
        PID:4084
        
        C:\Windows\SysWOW64\Ieagmcmq.exe
        
        C:\Windows\system32\Ieagmcmq.exe
        81⤵
        
        PID:2308
        
        C:\Windows\SysWOW64\Ilkoim32.exe
        
        C:\Windows\system32\Ilkoim32.exe
        82⤵
        
        PID:868
        
        C:\Windows\SysWOW64\Ihbponja.exe
        
        C:\Windows\system32\Ihbponja.exe
        83⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\Ipihpkkd.exe
        
        C:\Windows\system32\Ipihpkkd.exe
        84⤵
        
        PID:696
        
        C:\Windows\SysWOW64\Ilphdlqh.exe
        
        C:\Windows\system32\Ilphdlqh.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2196
        
        C:\Windows\SysWOW64\Jidinqpb.exe
        
        C:\Windows\system32\Jidinqpb.exe
        86⤵
        
        PID:3024
        
        C:\Windows\SysWOW64\Jblmgf32.exe
        
        C:\Windows\system32\Jblmgf32.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4612
        
        C:\Windows\SysWOW64\Jaonbc32.exe
        
        C:\Windows\system32\Jaonbc32.exe
        88⤵
        
        PID:64
        
        C:\Windows\SysWOW64\Jocnlg32.exe
        
        C:\Windows\system32\Jocnlg32.exe
        89⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2764
        
        C:\Windows\SysWOW64\Jemfhacc.exe
        
        C:\Windows\system32\Jemfhacc.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3708
        
        C:\Windows\SysWOW64\Jhkbdmbg.exe
        
        C:\Windows\system32\Jhkbdmbg.exe
        91⤵
        
        PID:3228
        
        C:\Windows\SysWOW64\Jpbjfjci.exe
        
        C:\Windows\system32\Jpbjfjci.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3608
        
        C:\Windows\SysWOW64\Jeocna32.exe
        
        C:\Windows\system32\Jeocna32.exe
        93⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2992
        
        C:\Windows\SysWOW64\Jikoopij.exe
        
        C:\Windows\system32\Jikoopij.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1508
        
        C:\Windows\SysWOW64\Jlikkkhn.exe
        
        C:\Windows\system32\Jlikkkhn.exe
        95⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2888
        
        C:\Windows\SysWOW64\Jpegkj32.exe
        
        C:\Windows\system32\Jpegkj32.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2608
        
        C:\Windows\SysWOW64\Jbccge32.exe
        
        C:\Windows\system32\Jbccge32.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3096
        
        C:\Windows\SysWOW64\Jimldogg.exe
        
        C:\Windows\system32\Jimldogg.exe
        98⤵
        System Location Discovery: System Language Discovery
        
        PID:1876
        
        C:\Windows\SysWOW64\Jhplpl32.exe
        
        C:\Windows\system32\Jhplpl32.exe
        99⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3760
        
        C:\Windows\SysWOW64\Jojdlfeo.exe
        
        C:\Windows\system32\Jojdlfeo.exe
        100⤵
        
        PID:2892
        
        C:\Windows\SysWOW64\Jbepme32.exe
        
        C:\Windows\system32\Jbepme32.exe
        101⤵
        
        PID:4412
        
        C:\Windows\SysWOW64\Kedlip32.exe
        
        C:\Windows\system32\Kedlip32.exe
        102⤵
        Drops file in System32 directory
        
        PID:1784
        
        C:\Windows\SysWOW64\Kiphjo32.exe
        
        C:\Windows\system32\Kiphjo32.exe
        103⤵
        Drops file in System32 directory
        
        PID:3016
        
        C:\Windows\SysWOW64\Kolabf32.exe
        
        C:\Windows\system32\Kolabf32.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5132
        
        C:\Windows\SysWOW64\Kbhmbdle.exe
        
        C:\Windows\system32\Kbhmbdle.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5168
        
        C:\Windows\SysWOW64\Kefiopki.exe
        
        C:\Windows\system32\Kefiopki.exe
        106⤵
        Modifies registry class
        
        PID:5216
        
        C:\Windows\SysWOW64\Kheekkjl.exe
        
        C:\Windows\system32\Kheekkjl.exe
        107⤵
        Modifies registry class
        
        PID:5260
        
        C:\Windows\SysWOW64\Kplmliko.exe
        
        C:\Windows\system32\Kplmliko.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5300
        
        C:\Windows\SysWOW64\Klbnajqc.exe
        
        C:\Windows\system32\Klbnajqc.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5348
        
        C:\Windows\SysWOW64\Kpnjah32.exe
        
        C:\Windows\system32\Kpnjah32.exe
        110⤵
        Drops file in System32 directory
        
        PID:5388
        
        C:\Windows\SysWOW64\Kcmfnd32.exe
        
        C:\Windows\system32\Kcmfnd32.exe
        111⤵
        System Location Discovery: System Language Discovery
        
        PID:5432
        
        C:\Windows\SysWOW64\Kapfiqoj.exe
        
        C:\Windows\system32\Kapfiqoj.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5476
        
        C:\Windows\SysWOW64\Kifojnol.exe
        
        C:\Windows\system32\Kifojnol.exe
        113⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Kpqggh32.exe
        
        C:\Windows\system32\Kpqggh32.exe
        114⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Kocgbend.exe
        
        C:\Windows\system32\Kocgbend.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5608
        
        C:\Windows\SysWOW64\Kpccmhdg.exe
        
        C:\Windows\system32\Kpccmhdg.exe
        116⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Kadpdp32.exe
        
        C:\Windows\system32\Kadpdp32.exe
        117⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Lljdai32.exe
        
        C:\Windows\system32\Lljdai32.exe
        118⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Lpepbgbd.exe
        
        C:\Windows\system32\Lpepbgbd.exe
        119⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Lcclncbh.exe
        
        C:\Windows\system32\Lcclncbh.exe
        120⤵
        Drops file in System32 directory
        
        PID:5824
        
        C:\Windows\SysWOW64\Lpgmhg32.exe
        
        C:\Windows\system32\Lpgmhg32.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5868
        
        C:\Windows\SysWOW64\Lojmcdgl.exe
        
        C:\Windows\system32\Lojmcdgl.exe
        122⤵
        Drops file in System32 directory
        
        PID:5912
        
        C:\Windows\SysWOW64\Ledepn32.exe
        
        C:\Windows\system32\Ledepn32.exe
        123⤵
        Modifies registry class
        
        PID:5952
        
        C:\Windows\SysWOW64\Lhcali32.exe
        
        C:\Windows\system32\Lhcali32.exe
        124⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5996
        
        C:\Windows\SysWOW64\Llnnmhfe.exe
        
        C:\Windows\system32\Llnnmhfe.exe
        125⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Legben32.exe
        
        C:\Windows\system32\Legben32.exe
        126⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Loofnccf.exe
        
        C:\Windows\system32\Loofnccf.exe
        127⤵
        Drops file in System32 directory
        
        PID:6128
        
        C:\Windows\SysWOW64\Lckboblp.exe
        
        C:\Windows\system32\Lckboblp.exe
        128⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Lfiokmkc.exe
        
        C:\Windows\system32\Lfiokmkc.exe
        129⤵
        Drops file in System32 directory
        
        PID:5224
        
        C:\Windows\SysWOW64\Llcghg32.exe
        
        C:\Windows\system32\Llcghg32.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5284
        
        C:\Windows\SysWOW64\Lpochfji.exe
        
        C:\Windows\system32\Lpochfji.exe
        131⤵
        System Location Discovery: System Language Discovery
        
        PID:5356
        
        C:\Windows\SysWOW64\Loacdc32.exe
        
        C:\Windows\system32\Loacdc32.exe
        132⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Mjggal32.exe
        
        C:\Windows\system32\Mjggal32.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5496
        
        C:\Windows\SysWOW64\Mablfnne.exe
        
        C:\Windows\system32\Mablfnne.exe
        134⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Mbdiknlb.exe
        
        C:\Windows\system32\Mbdiknlb.exe
        135⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Mljmhflh.exe
        
        C:\Windows\system32\Mljmhflh.exe
        136⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Mcdeeq32.exe
        
        C:\Windows\system32\Mcdeeq32.exe
        137⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Mjnnbk32.exe
        
        C:\Windows\system32\Mjnnbk32.exe
        138⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Mlljnf32.exe
        
        C:\Windows\system32\Mlljnf32.exe
        139⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Mcfbkpab.exe
        
        C:\Windows\system32\Mcfbkpab.exe
        140⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Mbibfm32.exe
        
        C:\Windows\system32\Mbibfm32.exe
        141⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Mjpjgj32.exe
        
        C:\Windows\system32\Mjpjgj32.exe
        142⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Nblolm32.exe
        
        C:\Windows\system32\Nblolm32.exe
        143⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2388
        
        C:\Windows\SysWOW64\Njbgmjgl.exe
        
        C:\Windows\system32\Njbgmjgl.exe
        144⤵
        
        PID:2604
        
        C:\Windows\SysWOW64\Nqmojd32.exe
        
        C:\Windows\system32\Nqmojd32.exe
        145⤵
        Drops file in System32 directory
        
        PID:5244
        
        C:\Windows\SysWOW64\Noppeaed.exe
        
        C:\Windows\system32\Noppeaed.exe
        146⤵
        Drops file in System32 directory
        
        PID:5308
        
        C:\Windows\SysWOW64\Nbnlaldg.exe
        
        C:\Windows\system32\Nbnlaldg.exe
        147⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Nqoloc32.exe
        
        C:\Windows\system32\Nqoloc32.exe
        148⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Nbphglbe.exe
        
        C:\Windows\system32\Nbphglbe.exe
        149⤵
        Drops file in System32 directory
        
        PID:5624
        
        C:\Windows\SysWOW64\Njgqhicg.exe
        
        C:\Windows\system32\Njgqhicg.exe
        150⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Nqaiecjd.exe
        
        C:\Windows\system32\Nqaiecjd.exe
        151⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Nfnamjhk.exe
        
        C:\Windows\system32\Nfnamjhk.exe
        152⤵
        System Location Discovery: System Language Discovery
        
        PID:5992
        
        C:\Windows\SysWOW64\Nimmifgo.exe
        
        C:\Windows\system32\Nimmifgo.exe
        153⤵
        Drops file in System32 directory
        
        PID:6116
        
        C:\Windows\SysWOW64\Nqcejcha.exe
        
        C:\Windows\system32\Nqcejcha.exe
        154⤵
        Modifies registry class
        
        PID:4028
        
        C:\Windows\SysWOW64\Ncbafoge.exe
        
        C:\Windows\system32\Ncbafoge.exe
        155⤵
        
        PID:2584
        
        C:\Windows\SysWOW64\Niojoeel.exe
        
        C:\Windows\system32\Niojoeel.exe
        156⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Ooibkpmi.exe
        
        C:\Windows\system32\Ooibkpmi.exe
        157⤵
        System Location Discovery: System Language Discovery
        
        PID:5472
        
        C:\Windows\SysWOW64\Obgohklm.exe
        
        C:\Windows\system32\Obgohklm.exe
        158⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Oiagde32.exe
        
        C:\Windows\system32\Oiagde32.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5832
        
        C:\Windows\SysWOW64\Ookoaokf.exe
        
        C:\Windows\system32\Ookoaokf.exe
        160⤵
        Modifies registry class
        
        PID:5984
        
        C:\Windows\SysWOW64\Objkmkjj.exe
        
        C:\Windows\system32\Objkmkjj.exe
        161⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Oqklkbbi.exe
        
        C:\Windows\system32\Oqklkbbi.exe
        162⤵
        System Location Discovery: System Language Discovery
        
        PID:5204
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        163⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5416
        
        C:\Windows\SysWOW64\Ofgdcipq.exe
        
        C:\Windows\system32\Ofgdcipq.exe
        164⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Oifppdpd.exe
        
        C:\Windows\system32\Oifppdpd.exe
        165⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Ockdmmoj.exe
        
        C:\Windows\system32\Ockdmmoj.exe
        166⤵
        
        PID:1852
        
        C:\Windows\SysWOW64\Obnehj32.exe
        
        C:\Windows\system32\Obnehj32.exe
        167⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Ojemig32.exe
        
        C:\Windows\system32\Ojemig32.exe
        168⤵
        Drops file in System32 directory
        
        PID:5888
        
        C:\Windows\SysWOW64\Opbean32.exe
        
        C:\Windows\system32\Opbean32.exe
        169⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Oflmnh32.exe
        
        C:\Windows\system32\Oflmnh32.exe
        170⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Pcpnhl32.exe
        
        C:\Windows\system32\Pcpnhl32.exe
        171⤵
        Modifies registry class
        
        PID:5692
        
        C:\Windows\SysWOW64\Pfojdh32.exe
        
        C:\Windows\system32\Pfojdh32.exe
        172⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5548
        
        C:\Windows\SysWOW64\Ppgomnai.exe
        
        C:\Windows\system32\Ppgomnai.exe
        173⤵
        Modifies registry class
        
        PID:6156
        
        C:\Windows\SysWOW64\Pcbkml32.exe
        
        C:\Windows\system32\Pcbkml32.exe
        174⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Pfagighf.exe
        
        C:\Windows\system32\Pfagighf.exe
        175⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Piocecgj.exe
        
        C:\Windows\system32\Piocecgj.exe
        176⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Pfccogfc.exe
        
        C:\Windows\system32\Pfccogfc.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6328
        
        C:\Windows\SysWOW64\Paihlpfi.exe
        
        C:\Windows\system32\Paihlpfi.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6376
        
        C:\Windows\SysWOW64\Pplhhm32.exe
        
        C:\Windows\system32\Pplhhm32.exe
        179⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Pfepdg32.exe
        
        C:\Windows\system32\Pfepdg32.exe
        180⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Pidlqb32.exe
        
        C:\Windows\system32\Pidlqb32.exe
        181⤵
        Drops file in System32 directory
        
        PID:6496
        
        C:\Windows\SysWOW64\Pciqnk32.exe
        
        C:\Windows\system32\Pciqnk32.exe
        182⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Pjcikejg.exe
        
        C:\Windows\system32\Pjcikejg.exe
        183⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Qamago32.exe
        
        C:\Windows\system32\Qamago32.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6632
        
        C:\Windows\SysWOW64\Qclmck32.exe
        
        C:\Windows\system32\Qclmck32.exe
        185⤵
        System Location Discovery: System Language Discovery
        
        PID:6672
        
        C:\Windows\SysWOW64\Qjffpe32.exe
        
        C:\Windows\system32\Qjffpe32.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6712
        
        C:\Windows\SysWOW64\Qcnjijoe.exe
        
        C:\Windows\system32\Qcnjijoe.exe
        187⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Qikbaaml.exe
        
        C:\Windows\system32\Qikbaaml.exe
        188⤵
        Drops file in System32 directory
        
        PID:6804
        
        C:\Windows\SysWOW64\Aabkbono.exe
        
        C:\Windows\system32\Aabkbono.exe
        189⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6848
        
        C:\Windows\SysWOW64\Abcgjg32.exe
        
        C:\Windows\system32\Abcgjg32.exe
        190⤵
        System Location Discovery: System Language Discovery
        
        PID:6896
        
        C:\Windows\SysWOW64\Afockelf.exe
        
        C:\Windows\system32\Afockelf.exe
        191⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Apggckbf.exe
        
        C:\Windows\system32\Apggckbf.exe
        192⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Afappe32.exe
        
        C:\Windows\system32\Afappe32.exe
        193⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Aagdnn32.exe
        
        C:\Windows\system32\Aagdnn32.exe
        194⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Adepji32.exe
        
        C:\Windows\system32\Adepji32.exe
        195⤵
        Drops file in System32 directory
        
        PID:7104
        
        C:\Windows\SysWOW64\Ajohfcpj.exe
        
        C:\Windows\system32\Ajohfcpj.exe
        196⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Aibibp32.exe
        
        C:\Windows\system32\Aibibp32.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4332
        
        C:\Windows\SysWOW64\Aaiqcnhg.exe
        
        C:\Windows\system32\Aaiqcnhg.exe
        198⤵
        Modifies registry class
        
        PID:6188
        
        C:\Windows\SysWOW64\Abjmkf32.exe
        
        C:\Windows\system32\Abjmkf32.exe
        199⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Aidehpea.exe
        
        C:\Windows\system32\Aidehpea.exe
        200⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Abmjqe32.exe
        
        C:\Windows\system32\Abmjqe32.exe
        201⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Ajdbac32.exe
        
        C:\Windows\system32\Ajdbac32.exe
        202⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6488
        
        C:\Windows\SysWOW64\Bpqjjjjl.exe
        
        C:\Windows\system32\Bpqjjjjl.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6552
        
        C:\Windows\SysWOW64\Bfkbfd32.exe
        
        C:\Windows\system32\Bfkbfd32.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6616
        
        C:\Windows\SysWOW64\Bmdkcnie.exe
        
        C:\Windows\system32\Bmdkcnie.exe
        205⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Bdocph32.exe
        
        C:\Windows\system32\Bdocph32.exe
        206⤵
        System Location Discovery: System Language Discovery
        
        PID:6752
        
        C:\Windows\SysWOW64\Bbaclegm.exe
        
        C:\Windows\system32\Bbaclegm.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6812
        
        C:\Windows\SysWOW64\Bmggingc.exe
        
        C:\Windows\system32\Bmggingc.exe
        208⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Babcil32.exe
        
        C:\Windows\system32\Babcil32.exe
        209⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Bbdpad32.exe
        
        C:\Windows\system32\Bbdpad32.exe
        210⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Bphqji32.exe
        
        C:\Windows\system32\Bphqji32.exe
        211⤵
        Modifies registry class
        
        PID:7092
        
        C:\Windows\SysWOW64\Bbfmgd32.exe
        
        C:\Windows\system32\Bbfmgd32.exe
        212⤵
        Modifies registry class
        
        PID:6164
        
        C:\Windows\SysWOW64\Bmladm32.exe
        
        C:\Windows\system32\Bmladm32.exe
        213⤵
        System Location Discovery: System Language Discovery
        
        PID:6276
        
        C:\Windows\SysWOW64\Bbhildae.exe
        
        C:\Windows\system32\Bbhildae.exe
        214⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Ckpamabg.exe
        
        C:\Windows\system32\Ckpamabg.exe
        215⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Cmnnimak.exe
        
        C:\Windows\system32\Cmnnimak.exe
        216⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Cdhffg32.exe
        
        C:\Windows\system32\Cdhffg32.exe
        217⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Cgfbbb32.exe
        
        C:\Windows\system32\Cgfbbb32.exe
        218⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Cdjblf32.exe
        
        C:\Windows\system32\Cdjblf32.exe
        219⤵
        System Location Discovery: System Language Discovery
        
        PID:6876
        
        C:\Windows\SysWOW64\Cigkdmel.exe
        
        C:\Windows\system32\Cigkdmel.exe
        220⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Cdmoafdb.exe
        
        C:\Windows\system32\Cdmoafdb.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7112
        
        C:\Windows\SysWOW64\Ccppmc32.exe
        
        C:\Windows\system32\Ccppmc32.exe
        222⤵
        Modifies registry class
        
        PID:6192
        
        C:\Windows\SysWOW64\Cmedjl32.exe
        
        C:\Windows\system32\Cmedjl32.exe
        223⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6412
        
        C:\Windows\SysWOW64\Cgmhcaac.exe
        
        C:\Windows\system32\Cgmhcaac.exe
        224⤵
        System Location Discovery: System Language Discovery
        
        PID:6600
        
        C:\Windows\SysWOW64\Cmgqpkip.exe
        
        C:\Windows\system32\Cmgqpkip.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6732
        
        C:\Windows\SysWOW64\Ccdihbgg.exe
        
        C:\Windows\system32\Ccdihbgg.exe
        226⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Dgpeha32.exe
        
        C:\Windows\system32\Dgpeha32.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7080
        
        C:\Windows\SysWOW64\Dmjmekgn.exe
        
        C:\Windows\system32\Dmjmekgn.exe
        228⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Ddcebe32.exe
        
        C:\Windows\system32\Ddcebe32.exe
        229⤵
        System Location Discovery: System Language Discovery
        
        PID:6640
        
        C:\Windows\SysWOW64\Dcffnbee.exe
        
        C:\Windows\system32\Dcffnbee.exe
        230⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Dknnoofg.exe
        
        C:\Windows\system32\Dknnoofg.exe
        231⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Dahfkimd.exe
        
        C:\Windows\system32\Dahfkimd.exe
        232⤵
        System Location Discovery: System Language Discovery
        
        PID:6528
        
        C:\Windows\SysWOW64\Dnngpj32.exe
        
        C:\Windows\system32\Dnngpj32.exe
        233⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7072
        
        C:\Windows\SysWOW64\Dckoia32.exe
        
        C:\Windows\system32\Dckoia32.exe
        234⤵
        System Location Discovery: System Language Discovery
        
        PID:6728
        
        C:\Windows\SysWOW64\Dggkipii.exe
        
        C:\Windows\system32\Dggkipii.exe
        235⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Dnqcfjae.exe
        
        C:\Windows\system32\Dnqcfjae.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6468
        
        C:\Windows\SysWOW64\Ddklbd32.exe
        
        C:\Windows\system32\Ddklbd32.exe
        237⤵
        System Location Discovery: System Language Discovery
        
        PID:7192
        
        C:\Windows\SysWOW64\Dgihop32.exe
        
        C:\Windows\system32\Dgihop32.exe
        238⤵
        System Location Discovery: System Language Discovery
        
        PID:7232
        
        C:\Windows\SysWOW64\Dncpkjoc.exe
        
        C:\Windows\system32\Dncpkjoc.exe
        239⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7272
        
        C:\Windows\SysWOW64\Egkddo32.exe
        
        C:\Windows\system32\Egkddo32.exe
        240⤵
        System Location Discovery: System Language Discovery
        
        PID:7312
        
        C:\Windows\SysWOW64\Ejjaqk32.exe
        
        C:\Windows\system32\Ejjaqk32.exe
        241⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Enemaimp.exe
        
        C:\Windows\system32\Enemaimp.exe
        242⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7392
        
        C:\Windows\SysWOW64\Edoencdm.exe
        
        C:\Windows\system32\Edoencdm.exe
        243⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Ecbeip32.exe
        
        C:\Windows\system32\Ecbeip32.exe
        244⤵
        System Location Discovery: System Language Discovery
        
        PID:7472
        
        C:\Windows\SysWOW64\Ekimjn32.exe
        
        C:\Windows\system32\Ekimjn32.exe
        245⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Enhifi32.exe
        
        C:\Windows\system32\Enhifi32.exe
        246⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Eaceghcg.exe
        
        C:\Windows\system32\Eaceghcg.exe
        247⤵
        Drops file in System32 directory
        
        PID:7604
        
        C:\Windows\SysWOW64\Ekljpm32.exe
        
        C:\Windows\system32\Ekljpm32.exe
        248⤵
        Modifies registry class
        
        PID:7648
        
        C:\Windows\SysWOW64\Eafbmgad.exe
        
        C:\Windows\system32\Eafbmgad.exe
        249⤵
        Drops file in System32 directory
        
        PID:7688
        
        C:\Windows\SysWOW64\Ephbhd32.exe
        
        C:\Windows\system32\Ephbhd32.exe
        250⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Eddnic32.exe
        
        C:\Windows\system32\Eddnic32.exe
        251⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Ekngemhd.exe
        
        C:\Windows\system32\Ekngemhd.exe
        252⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Enlcahgh.exe
        
        C:\Windows\system32\Enlcahgh.exe
        253⤵
        Modifies registry class
        
        PID:7844
        
        C:\Windows\SysWOW64\Egegjn32.exe
        
        C:\Windows\system32\Egegjn32.exe
        254⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7884
        
        C:\Windows\SysWOW64\Ejccgi32.exe
        
        C:\Windows\system32\Ejccgi32.exe
        255⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\Fjeplijj.exe
        
        C:\Windows\system32\Fjeplijj.exe
        256⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Famhmfkl.exe
        
        C:\Windows\system32\Famhmfkl.exe
        257⤵
        Drops file in System32 directory
        
        PID:8004
        
        C:\Windows\SysWOW64\Fjhmbihg.exe
        
        C:\Windows\system32\Fjhmbihg.exe
        258⤵
        Drops file in System32 directory
        
        PID:8044
        
        C:\Windows\SysWOW64\Fcpakn32.exe
        
        C:\Windows\system32\Fcpakn32.exe
        259⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8084
        
        C:\Windows\SysWOW64\Fkgillpj.exe
        
        C:\Windows\system32\Fkgillpj.exe
        260⤵
        System Location Discovery: System Language Discovery
        
        PID:8128
        
        C:\Windows\SysWOW64\Fbaahf32.exe
        
        C:\Windows\system32\Fbaahf32.exe
        261⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8168
        
        C:\Windows\SysWOW64\Fcbnpnme.exe
        
        C:\Windows\system32\Fcbnpnme.exe
        262⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7180
        
        C:\Windows\SysWOW64\Fnhbmgmk.exe
        
        C:\Windows\system32\Fnhbmgmk.exe
        263⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Fbdnne32.exe
        
        C:\Windows\system32\Fbdnne32.exe
        264⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7300
        
        C:\Windows\SysWOW64\Fgqgfl32.exe
        
        C:\Windows\system32\Fgqgfl32.exe
        265⤵
        Modifies registry class
        
        PID:7376
        
        C:\Windows\SysWOW64\Fjocbhbo.exe
        
        C:\Windows\system32\Fjocbhbo.exe
        266⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7464
        
        C:\Windows\SysWOW64\Fnjocf32.exe
        
        C:\Windows\system32\Fnjocf32.exe
        267⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Gkoplk32.exe
        
        C:\Windows\system32\Gkoplk32.exe
        268⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Gnmlhf32.exe
        
        C:\Windows\system32\Gnmlhf32.exe
        269⤵
        Modifies registry class
        
        PID:7656
        
        C:\Windows\SysWOW64\Gdgdeppb.exe
        
        C:\Windows\system32\Gdgdeppb.exe
        270⤵
        Drops file in System32 directory
        
        PID:7720
        
        C:\Windows\SysWOW64\Ggepalof.exe
        
        C:\Windows\system32\Ggepalof.exe
        271⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Gbkdod32.exe
        
        C:\Windows\system32\Gbkdod32.exe
        272⤵
        Drops file in System32 directory
        
        PID:7860
        
        C:\Windows\SysWOW64\Gdiakp32.exe
        
        C:\Windows\system32\Gdiakp32.exe
        273⤵
        Modifies registry class
        
        PID:7920
        
        C:\Windows\SysWOW64\Gggmgk32.exe
        
        C:\Windows\system32\Gggmgk32.exe
        274⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Gjficg32.exe
        
        C:\Windows\system32\Gjficg32.exe
        275⤵
        System Location Discovery: System Language Discovery
        
        PID:8068
        
        C:\Windows\SysWOW64\Gnaecedp.exe
        
        C:\Windows\system32\Gnaecedp.exe
        276⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Gjhfif32.exe
        
        C:\Windows\system32\Gjhfif32.exe
        277⤵
        System Location Discovery: System Language Discovery
        
        PID:7176
        
        C:\Windows\SysWOW64\Gndbie32.exe
        
        C:\Windows\system32\Gndbie32.exe
        278⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Gcqjal32.exe
        
        C:\Windows\system32\Gcqjal32.exe
        279⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Gkhbbi32.exe
        
        C:\Windows\system32\Gkhbbi32.exe
        280⤵
        System Location Discovery: System Language Discovery
        
        PID:7492
        
        C:\Windows\SysWOW64\Gbbkocid.exe
        
        C:\Windows\system32\Gbbkocid.exe
        281⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Hqdkkp32.exe
        
        C:\Windows\system32\Hqdkkp32.exe
        282⤵
        System Location Discovery: System Language Discovery
        
        PID:7696
        
        C:\Windows\SysWOW64\Hgocgjgk.exe
        
        C:\Windows\system32\Hgocgjgk.exe
        283⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Hbdgec32.exe
        
        C:\Windows\system32\Hbdgec32.exe
        284⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Hebcao32.exe
        
        C:\Windows\system32\Hebcao32.exe
        285⤵
        System Location Discovery: System Language Discovery
        
        PID:8040
        
        C:\Windows\SysWOW64\Hjolie32.exe
        
        C:\Windows\system32\Hjolie32.exe
        286⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8152
        
        C:\Windows\SysWOW64\Haidfpki.exe
        
        C:\Windows\system32\Haidfpki.exe
        287⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7244
        
        C:\Windows\SysWOW64\Hgcmbj32.exe
        
        C:\Windows\system32\Hgcmbj32.exe
        288⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7480
        
        C:\Windows\SysWOW64\Hkohchko.exe
        
        C:\Windows\system32\Hkohchko.exe
        289⤵
        Drops file in System32 directory
        
        PID:7640
        
        C:\Windows\SysWOW64\Hbiapb32.exe
        
        C:\Windows\system32\Hbiapb32.exe
        290⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Halaloif.exe
        
        C:\Windows\system32\Halaloif.exe
        291⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Hgeihiac.exe
        
        C:\Windows\system32\Hgeihiac.exe
        292⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6796
        
        C:\Windows\SysWOW64\Hnpaec32.exe
        
        C:\Windows\system32\Hnpaec32.exe
        293⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7340
        
        C:\Windows\SysWOW64\Hannao32.exe
        
        C:\Windows\system32\Hannao32.exe
        294⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Hkcbnh32.exe
        
        C:\Windows\system32\Hkcbnh32.exe
        295⤵
        Modifies registry class
        
        PID:8120
        
        C:\Windows\SysWOW64\Ibnjkbog.exe
        
        C:\Windows\system32\Ibnjkbog.exe
        296⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7456
        
        C:\Windows\SysWOW64\Icogcjde.exe
        
        C:\Windows\system32\Icogcjde.exe
        297⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7984
        
        C:\Windows\SysWOW64\Indkpcdk.exe
        
        C:\Windows\system32\Indkpcdk.exe
        298⤵
        Modifies registry class
        
        PID:7584
        
        C:\Windows\SysWOW64\Ibpgqa32.exe
        
        C:\Windows\system32\Ibpgqa32.exe
        299⤵
        Drops file in System32 directory
        
        PID:7424
        
        C:\Windows\SysWOW64\Icachjbb.exe
        
        C:\Windows\system32\Icachjbb.exe
        300⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Ilhkigcd.exe
        
        C:\Windows\system32\Ilhkigcd.exe
        301⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8240
        
        C:\Windows\SysWOW64\Ijkled32.exe
        
        C:\Windows\system32\Ijkled32.exe
        302⤵
        System Location Discovery: System Language Discovery
        
        PID:8284
        
        C:\Windows\SysWOW64\Infhebbh.exe
        
        C:\Windows\system32\Infhebbh.exe
        303⤵
        Drops file in System32 directory
        
        PID:8324
        
        C:\Windows\SysWOW64\Iaedanal.exe
        
        C:\Windows\system32\Iaedanal.exe
        304⤵
        Modifies registry class
        
        PID:8364
        
        C:\Windows\SysWOW64\Ieqpbm32.exe
        
        C:\Windows\system32\Ieqpbm32.exe
        305⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Iagqgn32.exe
        
        C:\Windows\system32\Iagqgn32.exe
        306⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\Ihaidhgf.exe
        
        C:\Windows\system32\Ihaidhgf.exe
        307⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Ieeimlep.exe
        
        C:\Windows\system32\Ieeimlep.exe
        308⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8532
        
        C:\Windows\SysWOW64\Ijbbfc32.exe
        
        C:\Windows\system32\Ijbbfc32.exe
        309⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Jaljbmkd.exe
        
        C:\Windows\system32\Jaljbmkd.exe
        310⤵
        Modifies registry class
        
        PID:8612
        
        C:\Windows\SysWOW64\Jdjfohjg.exe
        
        C:\Windows\system32\Jdjfohjg.exe
        311⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Jnpjlajn.exe
        
        C:\Windows\system32\Jnpjlajn.exe
        312⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8688
        
        C:\Windows\SysWOW64\Jdmcdhhe.exe
        
        C:\Windows\system32\Jdmcdhhe.exe
        313⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Jldkeeig.exe
        
        C:\Windows\system32\Jldkeeig.exe
        314⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8764
        
        C:\Windows\SysWOW64\Jbncbpqd.exe
        
        C:\Windows\system32\Jbncbpqd.exe
        315⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\Jelonkph.exe
        
        C:\Windows\system32\Jelonkph.exe
        316⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Jjihfbno.exe
        
        C:\Windows\system32\Jjihfbno.exe
        317⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Jacpcl32.exe
        
        C:\Windows\system32\Jacpcl32.exe
        318⤵
        Modifies registry class
        
        PID:8908
        
        C:\Windows\SysWOW64\Jhmhpfmi.exe
        
        C:\Windows\system32\Jhmhpfmi.exe
        319⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Jogqlpde.exe
        
        C:\Windows\system32\Jogqlpde.exe
        320⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8980
        
        C:\Windows\SysWOW64\Jddiegbm.exe
        
        C:\Windows\system32\Jddiegbm.exe
        321⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Jjnaaa32.exe
        
        C:\Windows\system32\Jjnaaa32.exe
        322⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Kahinkaf.exe
        
        C:\Windows\system32\Kahinkaf.exe
        323⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\Khabke32.exe
        
        C:\Windows\system32\Khabke32.exe
        324⤵
        Modifies registry class
        
        PID:9124
        
        C:\Windows\SysWOW64\Kbgfhnhi.exe
        
        C:\Windows\system32\Kbgfhnhi.exe
        325⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9160
        
        C:\Windows\SysWOW64\Kefbdjgm.exe
        
        C:\Windows\system32\Kefbdjgm.exe
        326⤵
        Modifies registry class
        
        PID:9196
        
        C:\Windows\SysWOW64\Khdoqefq.exe
        
        C:\Windows\system32\Khdoqefq.exe
        327⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8208
        
        C:\Windows\SysWOW64\Kbjbnnfg.exe
        
        C:\Windows\system32\Kbjbnnfg.exe
        328⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\Kdkoef32.exe
        
        C:\Windows\system32\Kdkoef32.exe
        329⤵
        Drops file in System32 directory
        
        PID:8332
        
        C:\Windows\SysWOW64\Kopcbo32.exe
        
        C:\Windows\system32\Kopcbo32.exe
        330⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\Kaopoj32.exe
        
        C:\Windows\system32\Kaopoj32.exe
        331⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Khihld32.exe
        
        C:\Windows\system32\Khihld32.exe
        332⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\Kbnlim32.exe
        
        C:\Windows\system32\Kbnlim32.exe
        333⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8564
        
        C:\Windows\SysWOW64\Kdpiqehp.exe
        
        C:\Windows\system32\Kdpiqehp.exe
        334⤵
        Modifies registry class
        
        PID:8628
        
        C:\Windows\SysWOW64\Klgqabib.exe
        
        C:\Windows\system32\Klgqabib.exe
        335⤵
        Drops file in System32 directory
        
        PID:8680
        
        C:\Windows\SysWOW64\Lbqinm32.exe
        
        C:\Windows\system32\Lbqinm32.exe
        336⤵
        System Location Discovery: System Language Discovery
        
        PID:8752
        
        C:\Windows\SysWOW64\Leoejh32.exe
        
        C:\Windows\system32\Leoejh32.exe
        337⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Lklnconj.exe
        
        C:\Windows\system32\Lklnconj.exe
        338⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Laffpi32.exe
        
        C:\Windows\system32\Laffpi32.exe
        339⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8936
        
        C:\Windows\SysWOW64\Lhpnlclc.exe
        
        C:\Windows\system32\Lhpnlclc.exe
        340⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\Lojfin32.exe
        
        C:\Windows\system32\Lojfin32.exe
        341⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Ledoegkm.exe
        
        C:\Windows\system32\Ledoegkm.exe
        342⤵
        
        PID:9112
        
        C:\Windows\SysWOW64\Lhbkac32.exe
        
        C:\Windows\system32\Lhbkac32.exe
        343⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Lbhool32.exe
        
        C:\Windows\system32\Lbhool32.exe
        344⤵
        System Location Discovery: System Language Discovery
        
        PID:8272
        
        C:\Windows\SysWOW64\Ldikgdpe.exe
        
        C:\Windows\system32\Ldikgdpe.exe
        345⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8372 -s 400
        346⤵
        Program crash
        
        PID:8636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 8372 -ip 8372
1⤵
PID:8540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Afappe32.exe

Filesize
163KB

MD5
8c1655ef0a938d96ddfd423b673452be

SHA1
b8a811014587c1d4f0d93b025edd9eb8f3e9b174

SHA256
e14cc552febdccf78d2eb07fb0029b5835d98fc152d9a19cf59cdbce01a9610e

SHA512
954254196f73494bc5d0dc91c2d60adf67c85b9ed3584d8d164b43587acc4fffb6aac92ebf4565f0103c4fd45952bf724872f83d5398bd28f745e0a2ffd8524f

Download Submit
C:\Windows\SysWOW64\Afpjel32.exe

Filesize
163KB

MD5
d12d440bd171b080b914bfb9ec86544d

SHA1
1dbe8fa20fd5fe28b6e96bf1bec9dc5a1a88473b

SHA256
2331dcaeb46de1ac767a833d70890fbec6b5ff10e5df214cf3c48c44b99be155

SHA512
1ffaa8936eafc8d4d8dad2e5eca0db70b01a93b4bbe66808438f019ddc1471fee388e95a943fa771be4f6db9435e2edf604d207d319798b5c4bd707389fc4712

Download Submit
C:\Windows\SysWOW64\Aidehpea.exe

Filesize
163KB

MD5
12a13fe787e19999a52e1f98bd57bf83

SHA1
fb621dffe7c676a503ee1b1ec6b2b99bf70c2f9d

SHA256
7991ece242f04c2ab91ff949ddbb318807645d93896a0f1552a6a578384a3dfc

SHA512
4bf43d73c1a6ba167bdaf95f93ce33baea469a50ef2126c79c5992bac30747cadd920ee6d6c83b62ab7748733db61e89d8b1820465b5693918ef84df5df223a2

Download Submit
C:\Windows\SysWOW64\Amcehdod.exe

Filesize
163KB

MD5
b7b381a2548fab6d0f89ba019673ee73

SHA1
650664c85436bfad82d582317ec26598c23ff759

SHA256
e020f9c53370d4b85e202f7ddd4d026f9036fe6b6378d2be103c553e142985d3

SHA512
aa93f32cd742fde8fc4024d7acaa6f693acc560911d1782a1199bac2785f6843b2e3e58cc7c9fadc66e69a921f52d6846d22c3bb7cbb121eb7437724b74c82e0

Download Submit
C:\Windows\SysWOW64\Amjbbfgo.exe

Filesize
163KB

MD5
376724a1c6ed2e496f7c0be32bc45bb4

SHA1
90ff6332cf914bc9dbd6bab6eaa794d682235751

SHA256
e1bb10fbd8003617f16bd4769bfbdbfe7b7fafbf4a5c8926f9fe9f26ff7b39aa

SHA512
5822c36acbb655dc8c2fbe4e7764d9e0169367b5cde65be1b9a75ec1488ba2222c1663a617b8db8d4fa6011fedb37a0143c2836e96fae3a07c0f97264f0f3218

Download Submit
C:\Windows\SysWOW64\Bacjdbch.exe

Filesize
163KB

MD5
29971c02533bedff31d0ea1c8ceb17bb

SHA1
deaa4e704e026a33920e9abe241354bf1ddfb2df

SHA256
4a7bcdde0a71f90c5da4d7295136b7d819cad858db6f95a5833edbc10644e239

SHA512
26d5ed324b8b45a10f3fe663044b104ed944ac005029aeaa38972c1cc4767590655c146be0b0f0403215aa7b7dc5eac9c6599f9bd48b97a6985f8529abd4dffa

Download Submit
C:\Windows\SysWOW64\Bbaclegm.exe

Filesize
163KB

MD5
a0fab26c3357bda1db0c1413442bef81

SHA1
c29d95fffd234ff487f7fcd1c6fc8769e20338a9

SHA256
e675c9f697586eb953f97986a3bf50a0f3d0f900a01a55f507202f82ae71b66f

SHA512
b0236bdd0c04a2b163e3168394f2a8af3dc9002dfe42d12581562a7e830cb2a73947ddc7d5b4d01fcdaea5ae0932e0193787bb249192e1e40c8daedc8d76dc07

Download Submit
C:\Windows\SysWOW64\Bdojjo32.exe

Filesize
163KB

MD5
87b4c8897a3ab39be7442887971818af

SHA1
8b7506a5f91e60d97932208393f2de46f9327c5d

SHA256
780a5202d49619b9ec134a98ba7ebe270c4be1b1c3251aa0c71d7192f08ec29c

SHA512
2c50dac7d405c3e78e6ae56a193ef22b86faf2ee39b433c516abf4772168938fc7a65e9fc017ed40a62b2179ce503cf0ef939bd03bda0b28c11fea76ec8be32a

Download Submit
C:\Windows\SysWOW64\Bfkbfd32.exe

Filesize
163KB

MD5
52ab815f0e963d9d469db4a334e6d27b

SHA1
21fee1590b75828a8d6dae0c76471ddaded90081

SHA256
6da70d6b7eccc5758ec178f6f9a4f5bea7dccf12dde807c59180d9b5ca445163

SHA512
b1ca856b3cd1cb1a47a3a136129514f298ba838dcf574e8cbc52b1a1ee5f8d9b1439cc8ed6db6e6495a7acc74aec6223541a53dd23916b5f2dd4859ff3f2a315

Download Submit
C:\Windows\SysWOW64\Bgbpaipl.exe

Filesize
163KB

MD5
cbb7cea14ca5494434c62150eedaafba

SHA1
a4ea58672df9a89eb6444cbee1bcd9e9d5ee3627

SHA256
5eb8af1f47c456784c10a8ba1497cc3081124cfedaf3e6044b628db4d65a2072

SHA512
fe9eef2a01013358bb2a990126ae7c7f13d483c4d78bae45babefb3b8c2adc7c51a6ba5cac87aeaec2ff9e76cc4720669005c7aaa3568ec59bb516a9abf7e209

Download Submit
C:\Windows\SysWOW64\Bhblllfo.exe

Filesize
163KB

MD5
f09e6bde09ead2e53c26c4fb977e72a1

SHA1
80ba05b891edf5bfdd7ae181aa233b35c9ee4129

SHA256
ae9b1636d0c9f95a9077c762167701eec050054b8d50358f4971f52a7ee1ab27

SHA512
47e1666c6f22a5e0922c27256c9103ba3f540c63970c323dd4e219fda04962c27b8fc465ee122737b344ea6849fb67be5322233a91aacedddb4ab70e08709656

Download Submit
C:\Windows\SysWOW64\Bhhiemoj.exe

Filesize
163KB

MD5
f5cfcdef732408f6c38644b6b7fb9092

SHA1
4ada7acbef8fcb21e499d80c0cc665ff12818a31

SHA256
9e0eabd0ab382735cb94e0580b09eae3ad4b6865c0c88ae5b68978c3be2957a4

SHA512
31a4c2c45736eb579569662fd0fa2ea64e2c17d452fd425f07dc89b18c904760f5492a60818e7d6e75c08b796d7dfdd89acdb611b57889ac24cfd0f063f47265

Download Submit
C:\Windows\SysWOW64\Bmhocd32.exe

Filesize
163KB

MD5
5204b451026625934f3fad71468a8d5b

SHA1
67bbee834e1715d3fb866ad72fef678bafc4c6d5

SHA256
ffe49dfa0c6344da2e191f9c101a5fa6034ecde1f45be8f6b35edfe0570a1fbf

SHA512
bb91ffaf25a7a8999032eb0523e78afdf106e08ce9210e56df58f057a034911cacd61cfbd47b7f601c4710b2325a2ab513d0e3f93217bc8afef1ba789d78fc91

Download Submit
C:\Windows\SysWOW64\Bmladm32.exe

Filesize
163KB

MD5
986f150a768aa85a1335caf290662902

SHA1
76cc76ded03cf2f35d7163a7e43a35e3afd875d8

SHA256
e7aead8274ad761fb85802cbeb6bc5a81d7152d396e3eecbb88fceef2d04517a

SHA512
d682f059896a4861e71ead23198e10bbe6c6f065beb66ee4c6a5907e9321635df8b37bd2efcaa31812326c2be98ed57ea2bf4142e24b9761455d9790cffac4f9

Download Submit
C:\Windows\SysWOW64\Bobabg32.exe

Filesize
163KB

MD5
3d973af306d6c85ac76655cd09bf363b

SHA1
e0f7c3cbf9cc249239c98233f25d3786b0df2178

SHA256
2d254cbef75bf37b43989c0818316b6b72c98b998e630b44d5b035576e78646b

SHA512
cf2904dd43b8651772764c22d025762575687fe4bea0266f4dbf858fa2c3368f2c88420e123c595c05727d201de96702a92c529ee9f6ef93e62dadb9f371ea03

Download Submit
C:\Windows\SysWOW64\Bogkmgba.exe

Filesize
163KB

MD5
c89ad3dff4c8bf9a9486e70617fd48dc

SHA1
a9461edc2f979113909f353e4e538374d0010225

SHA256
c1eb04287f01e5b290ddbfabdbd3777adfee2828a0d22024fa76ae5c734fd79a

SHA512
6c03234d68e33ccf5d3e474f68f85a9740984f97b29eedc593ed83fb5e83f7c6f2d6e5a755904f4087e9232facb2e0323ce5485f9a8089050bbab34fb908369e

Download Submit
C:\Windows\SysWOW64\Bphqji32.exe

Filesize
163KB

MD5
13d1d618c596f5e3cbf8fbb7f1bd9649

SHA1
1f4dad5b83420d0f383f487235397a8873c819cb

SHA256
8aa51fe810e64194ca11182f07f349ff6ef0fd3cc27c62e9b30cde54c14af96c

SHA512
1d6a79c3a0cad3666b5bb114835945785ce4027def45d71c4d5fe6db0d0432c4e73c66d8a82f9753323917c76ffc6582155f1b565576617066d3726285a46f6c

Download Submit
C:\Windows\SysWOW64\Cacckp32.exe

Filesize
163KB

MD5
23733f4fdc61c15c3ff1d719211b6bba

SHA1
a812c322580bbba8a4ca02bc8924842e0ac661ac

SHA256
52adbb6fff77b2cfbd664db91f0d52c2b6b9f781c1c1b1bf33b0f2e274a5e5ca

SHA512
3932ef911ca76f5128f48447b6ce8349b312fd0dca1c45817c58a7e6a4c27b6dbb8435a7e6bf8ade2cd5c3ac666086ea91678c852e9a32d7d80a774a9dc614ee

Download Submit
C:\Windows\SysWOW64\Ccppmc32.exe

Filesize
163KB

MD5
fd71cb2c96aedf1d7def77f5c2a76c83

SHA1
040e257c48e28b709b83be06191654f88f140cb6

SHA256
c53367798eea8899c8148d03f3ea8d3bc7f002beee9723dd0313e62f055a4cef

SHA512
734c6fa8071e1a8138c9ca09b9c0d9acccd57b9b4c9ea660bdaf9e269476cb5dd43b8cfb5914e75ec793d7aeb39f91cabab4d9f4cb2aecde0875f007fab91fcc

Download Submit
C:\Windows\SysWOW64\Cdhffg32.exe

Filesize
163KB

MD5
ee13970b6d56fabf323a30888bffafea

SHA1
d36cd83e7053ac1ad752029a8ca9cb1083e599a0

SHA256
73db61f99e3716554055489d389a2f88e5cf1d2e4eecd68e8b8279737dc1c17c

SHA512
ce535e71002f5950011df0d35c8dc74fc14deca9788318319f0da8377fe3869a964147f96732f83d8b5aa8ad72fa184e0fe92c67d9760f559a165c78deb7a244

Download Submit
C:\Windows\SysWOW64\Cdjblf32.exe

Filesize
163KB

MD5
191ebad72a76cc057c19c770424afc22

SHA1
aa72bca49dada1a906b28cafef79b781c0523444

SHA256
f0a250a1f28e9cae72b460994d214282356ef01a6f8615e057c4f0329f2814be

SHA512
3d25dbfb477fd828f7dff6190886226815e6fdbdc9b5295a1a995f107603ab557eaea933b57e927e59a66dbe9ddf6bc710588e90739bcf3b165384ff77d0dba4

Download Submit
C:\Windows\SysWOW64\Cdpcal32.exe

Filesize
163KB

MD5
8d5965f38fa6ce6131bdbfdbd0fdd4a1

SHA1
a35e4d5682e56f9d57fc5e79cd9a05b5b62cb08e

SHA256
e5f4ef3deb89624a2de7d02f9db372b7f99e28a338e0f40ed81f2c7291fa2a95

SHA512
748d84996d5e6d3c69b71c5fd15471d1d2a13330598b49e384f17c4b669ad632f7c50a7acb3f74f6606123c5e88923f8313fbfcae3230fc36f23734ef6dece8e

Download Submit
C:\Windows\SysWOW64\Cggimh32.exe

Filesize
163KB

MD5
cbcb33700f63ca361c7e35992cb0fba2

SHA1
3c597db19e404e5d893e4d24637c9c8ea76916bf

SHA256
6e0338f3c95413fc16d89c06b327eb743bdf7e6386d4d477dcc4d2e76247345d

SHA512
fde9799997f22ba598dbf930ad2c17361f8d9c05fdbb250ebe2a46372cfa92dacd1a598aeafe3f4b325f8a876ed9746925a4f351f506f5d1fae944b032d35de7

Download Submit
C:\Windows\SysWOW64\Cglbhhga.exe

Filesize
163KB

MD5
0d9dd7284f48a23d1c55dd2c1c831982

SHA1
848cfc76c38df5a03280478939568f1e50835284

SHA256
e8dafcdecb1f5eb9ec408af993187d76828ab4603db48eda3d2ce3bdc5811e24

SHA512
9aa7807134f82cc2ef906a7f3da4254de6c6d8ae546ed11a8a8f3d90bda174f253cbe4ce6614041c8b2ff0324992b65bc0f010086aab9e31d309b4da252b6506

Download Submit
C:\Windows\SysWOW64\Cgmhcaac.exe

Filesize
163KB

MD5
e0de6072bff2db8a57855aeec9f13484

SHA1
63bbdef54ddd459a3f7aeac341503c72e2b153d1

SHA256
21194187838023e4c403f32fabc80b1e4efb339aff3262caa2d653df3fbb025e

SHA512
624c7a2056f111abe5568fe620e9267617e1553413a9cbf6766e0b9be3ce4032fb24a58095764f4fa55a31014ab67acb30f4a3a1bc3807217fc3fbdfb249a542

Download Submit
C:\Windows\SysWOW64\Ckebcg32.exe

Filesize
163KB

MD5
ca4aec7476ab2f2532faa00acd31a4a5

SHA1
46222368a2af77ad4428eb0a933e943474f2586a

SHA256
7bbb5c8b73991e597d8cf2068f5ee38a02f884d2eeeb82bf61e6362ae4e8fa58

SHA512
df4c488aafd5c0ab169b98c754d3012ffa20426fa744c97568c8f077ba15c54d6d9a36d932db871043c48a124e0d2f2f42b55d32813795f1d01505b84fafb916

Download Submit
C:\Windows\SysWOW64\Cogddd32.exe

Filesize
163KB

MD5
db09f20ef97cd27ea65caa00ad5755aa

SHA1
79d2a701308255bd1111a72cc9052f90d7e48d72

SHA256
8f99f4c563594cb8f1f78c2fde846ea7c2cc0ba2db26ea9b6d613c1b3cd24a2d

SHA512
14c5952e77cb162a64994b1ccd64cd06cc196466ec9003fafc95139b2253584bd0aa9b64c5d5acb0acaac6f724312d6ccda9096e09787bce41275e55343fd13f

Download Submit
C:\Windows\SysWOW64\Cponen32.exe

Filesize
163KB

MD5
8b3149eeda963c7348b979e089cdef56

SHA1
359ca01be021fc774fbeb3d1ad68b8f6db601482

SHA256
9710e60c2253b17446590544a4557d71fb7fe6909a6c3cdf205dd11f57f1ca82

SHA512
081fd840a98a050a8b61763697fb3b5d279f3e218fb1403e19b8aebef2c29116f6fe8cbb10e3603838e23a5ae717be0d1e592d849b3570037ae98a7f274f163f

Download Submit
C:\Windows\SysWOW64\Dgeenfog.exe

Filesize
163KB

MD5
f2e308a59267a928b4526b0b2ead1478

SHA1
d50c0f4ad8f2d4f43f2f82b0605df0e03ba8121b

SHA256
11baad99e4e54c5f62feeb014d2790b73107506464253e8c2fadd1c8fc90957d

SHA512
e04c694a9b41314cd07b9222e90a63046c049e453282a39839019849c25f4cc0ce2d0489fb392c8d1d465971f83eb3beceaab4248de6b83d9278aeca3a1d1dcf

Download Submit
C:\Windows\SysWOW64\Dggbcf32.exe

Filesize
163KB

MD5
e9f16b25a68e0633b18dfe5debac8184

SHA1
44c79fb4ba85d272ca0b073d1f7edd7263c4fba5

SHA256
876ec2fb7a9c66a48fac352d866deedb5ffc46ba290f677c4f6b561e75fa71c4

SHA512
9721f1cf38f517befe6975936fdd5d5307d4c259742d0afe724b82f25692fb0cbb601eb2ca75194078cca9dcc2b16ae42267fcf8a71d7e5a86c702e47f3f1b73

Download Submit
C:\Windows\SysWOW64\Dhphmj32.exe

Filesize
163KB

MD5
f88919d7dc7563d88f584e82986c7c3e

SHA1
ffe88bd7bbd6e86ff5ff5920982958c37dd5af2d

SHA256
79795be96b813961cd76d8e427d51a43c8f16913b4c4b12e352f42cbeabec55c

SHA512
1f083c0ee60aa0168dd2565303d231c39b8dd916e9a39ac2b6a65174cabe11b03ead3db09cef3ce7a405a2e22f56afff9ecc5fb3d130378972515ab526afd243

Download Submit
C:\Windows\SysWOW64\Dknnoofg.exe

Filesize
163KB

MD5
099ca835cd8b45a34f68f671b5da74c6

SHA1
c5debd8e698318f8eedb7e743e8e1669ce8e997d

SHA256
b85e384b6d52f3008c0c528b5bc6d8b82c5f7c39ac6201c2eff6949b10d1edf0

SHA512
7e885b38a3f1622c0e78aa613c8727df2e91d9f3cabac1ef55d1a165073f92377ef144a68d14379f3bbf3673422a0bee4330ab437a209002fa28b48c564af458

Download Submit
C:\Windows\SysWOW64\Dncpkjoc.exe

Filesize
163KB

MD5
ec4a479b39748fe965ac4a1971632c5b

SHA1
9c0cb7444c8574f0d68db2f5177f6fe179866853

SHA256
4fbae178353e68089ec17b6fbe8abd61785c1494b2e1a1f26359dcfb5c2a3de3

SHA512
c1c11bbcb21b13f12595e6e6baa8eab4a6fbcc9806ba02d5753be4e5ae6272557c3920816474d0234ef69b9e95d9c30463613422d76aabffb38ba6b6f13905cf

Download Submit
C:\Windows\SysWOW64\Dnngpj32.exe

Filesize
163KB

MD5
63f5c22f955313f5378e247715b55ebf

SHA1
33103e2be69ed86e409f39b4830efd02efb29e86

SHA256
6a33b7b2d41ad707e85d54c0ef6711a27c6f162fc18b469c39cb41f7a8bc9a9a

SHA512
c044f6e50323eddfe7df768ab9038f32d2121861f0465e4561125326da30b93d198e218935854ee87070478bc1d51504f9517c70fcb511bee4eaff3c428822c3

Download Submit
C:\Windows\SysWOW64\Doagjc32.exe

Filesize
163KB

MD5
7e4aca5aadb2d30638bf56ae8e834c10

SHA1
120e46d1e576881bd48af5fae0c8eaee30348447

SHA256
d98388c616ab22ebd5922e20a40dffdcd8f5504e436d56891a828c7f530f1b1a

SHA512
d3c09bcf4accfe5b050996544cf79d65970632a5509dbde2411d37476296c4a0646fdb22f34d418c344c17debb8f7825def50acce86db585bab71c0424e0dc4a

Download Submit
C:\Windows\SysWOW64\Dpkmal32.exe

Filesize
128KB

MD5
ba3ccf5fd2eb9cce6c5933b75a711597

SHA1
c3784cba695532cdf040787f73b243c832f84c40

SHA256
12e7ec017f8be11fde0d074dac5ffdfd68b8a4b6c5082296551ed7c8731cddd3

SHA512
fa10295240f3254c37ab4dc9711d0074a2dcacc2b16fc3f6a6e9c99bf1b4cc8caabf190d8dc28967d1d28847afd10184fbf351ecf5f73d69f42be3cfa896686a

Download Submit
C:\Windows\SysWOW64\Dpkmal32.exe

Filesize
163KB

MD5
c32d68183faeb7c9d2269a49e452cd00

SHA1
e2c2b1b1700ec127860c0cdc1418e0b852d306ce

SHA256
2d3e1624ac66b123651093a27897a825de9e90ae606d5497b8412d443ba1d78f

SHA512
916b07164645924f8e897422fb0109780a4297fcd7e929f224f38a53f591a03f2f86355a502f331ef3d577e8c1a61502f9f1a9e2a98079cbfa6571139eb5379e

Download Submit
C:\Windows\SysWOW64\Dqpfmlce.exe

Filesize
163KB

MD5
eaa4633362dfbb0ad9e17400a748d161

SHA1
511621d6c3c2a444b095bbc98e67ba8a7f0d41ec

SHA256
04be0784958e452f856eb604b2cdb3e32ff35670d6fc978c9013b8e3416d009b

SHA512
9eb6973bc89ce59667d8abca84a50ffa6b3d05a9526fced7f48c1110708edad55687c1c4c7ad2286de705b1a902fb436933e1ba8650f142b0b8f7fd07ccb64bc

Download Submit
C:\Windows\SysWOW64\Ebkbbmqj.exe

Filesize
128KB

MD5
6f2379ab34145c24369e905c0c89da50

SHA1
72a37623633ec840b1287630b4bedff9660e591c

SHA256
9638452e58b829a1374b35851a375bbb72f5cab62b7cd51f770ef477148bf467

SHA512
dcd8839625ec4e4638f5d6d76743d441a23390245967bf4a694806954ab5960078c41aa22029717ce196e96e1c6ab74d4d3c1f6d9a939efab89cdb4025816b54

Download Submit
C:\Windows\SysWOW64\Edoencdm.exe

Filesize
163KB

MD5
7a34376c74e85c864f47768f15c80313

SHA1
cd8dc6d9e2ff656eccf83881cc3c40c58387b454

SHA256
bdcbdfdbd537ff05acb8969ab58fc7bf102af9f7e7765af4c2130437d9b7d0ea

SHA512
391f7f79150797b0ddc69f48593a1acb5aaa2c8fcb26e732907365c908819852756bfb2bf585b786ac93259dcaaad06af7facf63ad7d1e43ba7a9d4b4813a633

Download Submit
C:\Windows\SysWOW64\Ehbnigjj.exe

Filesize
163KB

MD5
485cdf3a8ad73693bef2d7bf0bd76b82

SHA1
b0ca3e00d7860415555d8356647325af9fcb126e

SHA256
e9933ec3a19038d945c1638aa91f7a7b395851725fb13d916f33feae5a9161a8

SHA512
19a2d3dea1c9b954ce03ac831080560a449187c5af2f076bcef74f12191b5b26ce42f4cceca99a01825ae342b1db3781908e9f361a8cfec5407b5d5009abe1aa

Download Submit
C:\Windows\SysWOW64\Ekljpm32.exe

Filesize
163KB

MD5
cd740913a85dcd6f8569ef0a33f39b4a

SHA1
2dddd684eceb81dd0b632e93a156df3bda70e6be

SHA256
62d5990d11380bbc83502f565e51815d0b6759fabe517ae6c07f86591729a3b0

SHA512
fd3ac7641854ba73374c90ff9e9c7ace63663984a642f94174a75fc33dbb26fd99977739de79cbee09fea7b79d11848a298df7aedd424ac39332547dfdbb98f3

Download Submit
C:\Windows\SysWOW64\Ekngemhd.exe

Filesize
163KB

MD5
915cd9e60ee8018c2ce24a0f90b11375

SHA1
c3f833edca62b2c1cfcf0c6b11f757590e2a61e6

SHA256
21e90dfc21ac327fd803fe573de5d9a4ab5a8a7b7715a155fe2cdb4b0f5ec49a

SHA512
60d85ced786ef255fccd85a9527f679606e89876258af728be120bb9b6210e132eb1d3292d6357511460052d8268a72e22c6762785bedcf459d95250a7935ff0

Download Submit
C:\Windows\SysWOW64\Enfckp32.exe

Filesize
163KB

MD5
0283d9dc4862a664540c9ee4556659eb

SHA1
6e3b129d083cc6b0cd1d98633ce7493677af5d0e

SHA256
c7c3f12b3617d54d918548d5cc18268d6c4b1112e2a002ebbcab3095dfce6350

SHA512
7775962d22b9fbe026d26f8474e1fde0e14e04615624a7bd28a38a5409b6aeee173c59060a9d226b52ed00d6e2643598a9516c78a26d041464c0a1aa0bf2d036

Download Submit
C:\Windows\SysWOW64\Enhifi32.exe

Filesize
163KB

MD5
d18d5acb7d85bbc89bbe021a65dfc143

SHA1
ca8c5bc3c75990f14cd8b10f2a467e2fbbaccfdb

SHA256
4cc19799a26be96c9e7123f7556810afe8e03524e32b62d83e88cb3356179d30

SHA512
436d06b4936a03a242339cfaf2c5d90b202c714020f9799c7cdb10d8a1bb6ae78caa94f5ae05d1a2f4fe4a011d581578d2e15a457848aec7134e128e9888ca9e

Download Submit
C:\Windows\SysWOW64\Enkmfolf.exe

Filesize
163KB

MD5
874da9a7de910fd6bb9554e9249bc879

SHA1
9a015ccf1c0f35a299974be304ebd726ed633dd6

SHA256
44d0d171175dbe0054818dc4e80a1b34617ff5101dac6cf114e07ab061b7b48d

SHA512
08f86fd8af3499203f456da5adf270d64dbb63a43538a3239d7dc29ef2bc400bae1add138f4dcf722ca1af26e4660f5a7bded29bdf9887dda6a557dc45a9d3df

Download Submit
C:\Windows\SysWOW64\Fbgbnkfm.exe

Filesize
163KB

MD5
fed7382a1b4d4e902645cffd952df9c6

SHA1
b2a41846c53c26185a6fdf051c5f74153d0bf3c4

SHA256
ff89e7110d274d76cfaf5171e4306abb2ed9c7d39f92daf490282cb48af8da1f

SHA512
441640d3e120e81306e0eafaee9d1fb5be4a6fb90513049c4dc116b69b8b2619be63f23e5568ef30d027cf0d93bf783dbff0b2d35ad14302efb9548beb383f3e

Download Submit
C:\Windows\SysWOW64\Fcbnpnme.exe

Filesize
163KB

MD5
f2789ecc600bba58ae8e1d611d07e714

SHA1
b1464444ddd72767b5d74b979b48aa8d075e0545

SHA256
1b4cbeb9a5746e4294f8bc1f2c2f4790dec5369474a6f78449e482a1b08b21f4

SHA512
4a1eaf5d85793e37f2ea79c0efcb66c74b12d89441256fa637866b0b5051732142c4c4eb9c819a3c4070537a9564ecb8448e26228dd9a3bd941bb737312ad72a

Download Submit
C:\Windows\SysWOW64\Fgqgfl32.exe

Filesize
163KB

MD5
62e389d961b7a5516dc6693ad209bd3e

SHA1
3b7ef0c7aabb94b631b8b5a5ce38c2027453276c

SHA256
2eb6b58adc1080b02e3e14f71fe7324a25e3a35b03ec4be188a7bfe43e41dbde

SHA512
607f867e9833fd6b238f5addacdcfdae0c05050789424a5efa0e13e40e12ae30aca7ecd012d1a510c91cce434646633aad02000ed4f06109e24c5ba398deb29e

Download Submit
C:\Windows\SysWOW64\Fjhmbihg.exe

Filesize
163KB

MD5
dfa7220b52f7e24a1e2041cac8b2f827

SHA1
d12fc65ccd8aac5599e0715e916a89a5d0863462

SHA256
f06d71370375086c1a3c5887feaef9d56c01a08b7a54d269e3343506855143e9

SHA512
075926b8d58ba2ebcd2e2836f26d2af1cb77e6f8b0badcc1e1e263bc6a61ebb0f171b5273ac10bf643a57ff7afd85916e69ca6dea46abfa30ef89bcd384b2d2e

Download Submit
C:\Windows\SysWOW64\Fkjmlaac.exe

Filesize
163KB

MD5
d662e833daee106e8187bcc2406155d2

SHA1
5d39f9ec60f358849420e3d53905a5cecab48e5f

SHA256
5d36fa8e780fb18f846c11270817e783eb633a6722a5cd83adc7f73c44eed522

SHA512
1c27ad27698aebe1a493bb1fe86ac90484361dd912187935cea022f04fd41faf21dd752cfad8b3d477a2e2c94701d1571b13e346800318e652336770ee963e02

Download Submit
C:\Windows\SysWOW64\Fnjocf32.exe

Filesize
163KB

MD5
83793c675614543113a7fb8bfbeb75cd

SHA1
0fc25666a83be76278f549124011e1b6111cc217

SHA256
4da0967e98a48acbc02fee79f25aaed1d2bd93f346fd7b161fefca74130ac6ea

SHA512
d96e6eecb1f689d9a45879a371962ab3ff4fbef06cce1953e628ffda234ec94b7c9a12170557dd45610e3448cb88eded8db4b5a42367e8e3b70e2e7a40f0867b

Download Submit
C:\Windows\SysWOW64\Foclgq32.exe

Filesize
128KB

MD5
4e4527e8b0a1e3f737b33ae644441379

SHA1
ed84803cd95947c5794dd348aa966b6bffd70ba9

SHA256
c2a0cba7fb51f4c7fec175f7d97f9232d5b22f4166a504b4d7c5b0b085ec1ad3

SHA512
ae819438eca08c64ef9f0e116482c5095aff33f184cc4cc8d5cab62aaef6513fa09b3ae970d3a4f5fefb0a31ddf764ff18dab241e449d24f407f5e748062f9df

Download Submit
C:\Windows\SysWOW64\Gbbajjlp.exe

Filesize
163KB

MD5
bf1252e85d1dc2ff921e2bf6ae62f01e

SHA1
aa3565ccd0f95bd51180db49a8dab002127dd718

SHA256
551d9860773569fcbda1394598364be67eb62a0852190fea21ad6a51cb29c90f

SHA512
e5eeafd79d1fe7fcd52aca27dc2a60f28c634c7cedfd535d4809a7973c19cadb9accb40f0196623abca484d2b74d91341611ba06f31972e7bc0193407c672a1c

Download Submit
C:\Windows\SysWOW64\Gbkdod32.exe

Filesize
163KB

MD5
669c088bc989ddb1bf2c8a0fd85d5b9a

SHA1
02617749cbd6737e94b3ffb7935d22dd493cf16f

SHA256
21d56584d07a747471b4616d3107f2f561eebd39a01cba5d27a113f5e0280cd9

SHA512
776e86c4e4e6134fc1ba994d41847e65a8a91f47a8b04ae04c9b806f32a966ed77b3a353444d0fe0298fa1eccda72c87c14262875c361421924e757237c95227

Download Submit
C:\Windows\SysWOW64\Gcqjal32.exe

Filesize
163KB

MD5
c7585df1258b692e060a02bbf98e4ae7

SHA1
c07c9db2c99d5f9c49307903fe221bdd0a606c81

SHA256
3fe8a1fb96b34b221298ed114f842ff5e41186885ae2e5d412fa3a73f3339a9b

SHA512
9e2537bbb50a4750d7fa78694df53112ea6354275d44ad35c90dacb4119b8cda6c692b25e8918bcec414eb0047643662c2bd730792793f9417d585c103d594d4

Download Submit
C:\Windows\SysWOW64\Gnaecedp.exe

Filesize
163KB

MD5
7c9dcc75391ab49566199032d54e3660

SHA1
68627ef3a58124b8034314865da3451ab0cca336

SHA256
40d301182a243467a46ddecef88673bbf179f33abc1a8d615ddec6c7c09f9d34

SHA512
967b02d05408c1d83f7c1d1910537ac046a728b1bf957c9ee6991ebe098cb13a35d49278d1b53785d817258db4910ced769f05d62755e5ecb01d037cdcda667d

Download Submit
C:\Windows\SysWOW64\Halaloif.exe

Filesize
163KB

MD5
9dd4a8185f165918b98154d6bea4c3a7

SHA1
0aa6bcfb42f6405520a6a41d35c8cb6e252b0a04

SHA256
1c585e442acf23ded16905f6d85b8945337f084841a88e961ea10d7a72c02397

SHA512
7cf704d40c6b10866090e5e3cfdbe163fd47713dfd2546e6618154257168b68c82facba02e5cea0f2d341c2f7d8b64be20efa022540b2fee8896d42a2f47e658

Download Submit
C:\Windows\SysWOW64\Hbdgec32.exe

Filesize
163KB

MD5
270a94e56737f6bbd468f9234383cc3b

SHA1
17946db4fc5920716f86aab0e51bdaf2dc3f82a1

SHA256
07f8cc31fe4b11a022903ba2e79b97d5c1e25a8638572899dcc22f06a236ea88

SHA512
bfe065f37d57fadf99e8e6465a6c12e1b958df825f63cf8f8fb05411faf005a68a4f4881a67db21d10d64a81a6aec8fc27fd919bcfd308f0c9ade6569716f6a3

Download Submit
C:\Windows\SysWOW64\Heegad32.exe

Filesize
163KB

MD5
76746dd04f42673c6a2a379f015e218c

SHA1
ddcbad0e36dee4e05061538214bb4afb771c65e7

SHA256
c5f0748d91a4aa36f72709f0950695f3e814b15a20628565c842b42062767fb9

SHA512
1a6df7f96a0f3672fe33335661c20adaa68067062aaf03b89d2bb0fb1e44943794aeca0dea5312a599aa707ce46237f70429752ae6954aa8296b68840c8e2c8b

Download Submit
C:\Windows\SysWOW64\Hgcmbj32.exe

Filesize
163KB

MD5
a78a41c995f2ba34c571cef43e16ae99

SHA1
8ecd170ff10dde3d03c6b0a04076ae9fedb3e326

SHA256
df702728aed3ba77328e34711e83547c3fa4d2dcafad1b54fdb04a009c830205

SHA512
0ac6b915c3936504162d4203e8c922f69968b1848b3debaa43b8bc49ca68ce609888b8fc10e6e3bee1ec66c8dca9d6f6e5ad0288596be72ba48891f18c68c5cf

Download Submit
C:\Windows\SysWOW64\Hkcbnh32.exe

Filesize
163KB

MD5
72ceddd222b43d33f5caa08e57fb21c6

SHA1
f4a37df27b8bf28e018ebdab7b6e0efe8fcd1fe5

SHA256
665a556db2df330cf58153df3ddfbce6a2f0c61d7660ec1779e907daa3c963f5

SHA512
42c61a7d607e3cf7b1ae32b19da98ba47bb8eba1b5abefe07b0bbacc9b8223d80c61efff611137216c94a3ccfeff1c66ba5c7e88a778871541923677360a719a

Download Submit
C:\Windows\SysWOW64\Hlblcn32.exe

Filesize
163KB

MD5
4f773f17a02bfbb6befd817290cd5276

SHA1
fdba9ca1fc3e534797117de8a66a4f9dec7a28e0

SHA256
5cf71718528b4be2a21f54f97055dd90b002ac540491fffb7610eb339b9a49a8

SHA512
edbc77ac352bfda7d71be696bf989d908a69eddc334b051ce5da6056513fb0d74e4e5ca3859a1143a416a692251419b7978f0f0801cfc9fdbf53c791b0100b9e

Download Submit
C:\Windows\SysWOW64\Icogcjde.exe

Filesize
163KB

MD5
6e738d6a0621235dd471dc8ffb8dc758

SHA1
ff2c37f9fb6af78375c519fd39fc7dc3e078d194

SHA256
800b2ae9c42ecd5c29733dc6b4df5e7c904d2f8f083bdaa9fac2e327fee4c723

SHA512
3e66bca61ba8f02aa01547910026d190987082c13f04ef6465e230bd9200597255004489861153a35b4ab0b8814c97707f52dcf01bcc5ff232ff54ce409163ec

Download Submit
C:\Windows\SysWOW64\Ihaidhgf.exe

Filesize
163KB

MD5
fcf9bf3f6c57107031675282f246a335

SHA1
920ae9ca9674caa14b5f00b712cff82871447ab0

SHA256
ff59e4528c4e7dbe8c38483f6e848e0e1b846c1ee26ceed453600797b2150ed5

SHA512
affb4c01ff56c2369de4349a076507d7d89104a51a0e6334edee94a14e3d43636dee5e8f6a159229c0b12168cdbf2ba9f7b0a0d0fad8c55b5609d4ac711ae9ef

Download Submit
C:\Windows\SysWOW64\Ihbponja.exe

Filesize
163KB

MD5
d2d3007a200056d02763c05ffa9daa27

SHA1
40d3b7e790ddd97e0a5e968da71a9ed7376d894c

SHA256
38a554dd38aa1e0e0c2a34bf57ffc9ceeef43aa9fbd2f702cbbca2105ea26990

SHA512
095653cd5e4ec900ced82f3c58c65caa815f36a9ddcc67aa6fdaa46872ee1a5932bc3baa4d2548f43890406819eecb276972feb0dea70d022242dd96961a335f

Download Submit
C:\Windows\SysWOW64\Ihkjno32.exe

Filesize
163KB

MD5
86279d2e79f15c98b0aeac4d1939a2af

SHA1
832edab68bd91d302f630d8adcd2dc7250a7695e

SHA256
78391f942619c44e2824d0ba562aaaaf70fd78202af15b30323467faffb98982

SHA512
a26462cde63024c2c2e324d4a41a38a3e694fc2fc01eb87c898752aee11c8b3e683327520f69f2020b723adde38dcb6db2d6525afae65d5c18d2f534340fddb8

Download Submit
C:\Windows\SysWOW64\Jbncbpqd.exe

Filesize
163KB

MD5
181c00201708e29b9af5cd1d4aff34d6

SHA1
b4b310d0d8f4a6f90ffc9573ca670466a04831ee

SHA256
4c8ecb78622744ffbe9cc4314d1f6ea284089074ad94cd35aec28da848b90649

SHA512
9672005d9318249c7f3555c88e55d25aeb6434cac7cc1dcedcbdfbbf37ad99341467f28356da63e8faf077dd9cbc0dd5bf17e4a97f0aa5f7af42f3e99d0ff9dd

Download Submit
C:\Windows\SysWOW64\Jdjfohjg.exe

Filesize
163KB

MD5
36154d3abb5a952d0384e34b0ec0829e

SHA1
b9ba7bbc39cd4cbf17bfbf09d332140825f4edbe

SHA256
fc9738de83507a3b8c9fc74c5883577ed3440852139a28a5cf5e647efe4c6b4d

SHA512
f4461a8bbf52342b115e38c901682825b5adfac6019c104e7ab9163d99fc253147f0e37e4cac176ee6b7b698e328bcee27785f1d0578cabe697d01ec6e5c3866

Download Submit
C:\Windows\SysWOW64\Jdmcdhhe.exe

Filesize
163KB

MD5
99dbd63be58f3821e6f9ae2ab636ae05

SHA1
7842a0402a078395b3db56a8508f5059fa699de2

SHA256
ff515c8f9e518d872575d4818a403d892fc7c2045082359c2b84b896bc60de0c

SHA512
c5f07607aca71ed5ac0fb1a9815a04c4213a9d6cc1ef4f7f1bf70f60ae89077fd6b70e66d00f07a4b518bd23fa1406a36eb4c711d96dc96b705a539c28761acb

Download Submit
C:\Windows\SysWOW64\Jhplpl32.exe

Filesize
163KB

MD5
c75d13004cc1a4c851b8f804361bb0be

SHA1
5f44a7363077973cf5be6f630f04488f1e8ea946

SHA256
0ef502f5a9d29d07a10aec185d3c09be5f278ccd431471a808d262049556b37b

SHA512
9cd728a8612924b677afb0a646d241e4191ef03b0fe6df9c46e2be613ceaf6dcce4e4d5e6b3baa206555dee4dc44b82a8269b8a51062bedf7931e7dd3cf0001d

Download Submit
C:\Windows\SysWOW64\Jidinqpb.exe

Filesize
163KB

MD5
916b51627fb518c29e31dc2708aebfba

SHA1
bddefcfef9fa5cdcd3df90db5d670df4c9bc7a19

SHA256
b853a3194edb6b4288a66c6f72bcaa670fcbb6815099929edc088a534e28fdb0

SHA512
9488c27bfaf9aa0436a770b2a8f4af434901ddd745f44330100747e3f5a725a99c17cf6e25272b40ae144211593e82f9f5531e6875f1792f84bf77c59130a058

Download Submit
C:\Windows\SysWOW64\Jjihfbno.exe

Filesize
163KB

MD5
e467ab85aba2c644936912d8d617a492

SHA1
163d483dff92716d85b88a18a24fc8a1ba4cc558

SHA256
39ba8ef12e3f6f65698715c34adffdf67087e9b1f44c18876279a2c37ede31e9

SHA512
276e46e996a7e77593677c5c2c524b85788eb7b80e99ccb97fcbcca6a7440f7d22b482759507cffed644f4551ac95718dfaa3d7390cf02bb1ee3f58e0381e922

Download Submit
C:\Windows\SysWOW64\Jlikkkhn.exe

Filesize
163KB

MD5
9206318b083ed1743a8e05d3f8407c77

SHA1
af3d799ec6a373249b014260ffa876cfee50ba2b

SHA256
31b365e79b0bce16c0b49feaae9713f306fef3a0daa76f0348bf4c09415304d9

SHA512
ca2888b59b91610f43c8d76563159b837935d61ed6c2149e585345c327d8c6abbc0e510a2e7507e87af91b692aa5f7b44e4208d6c6cc157068e9fddc524535b9

Download Submit
C:\Windows\SysWOW64\Jocnlg32.exe

Filesize
163KB

MD5
a4031349d676c3c91ee10c343fe59e37

SHA1
85fbfcd06e00333ae845789edc31f09626fcef0d

SHA256
060415c2b07e76efd5974a50d749b9fc4ed92eb6f684f61d380f8c5e67d7e34c

SHA512
287bda6e255e2b4ddc0048e37152d410457a68259b6eba79c73ee0e01d256976dd0f0022475c2b8077f4952d1a61b296553c25b63bbd69a43f4b91244018d128

Download Submit
C:\Windows\SysWOW64\Kapfiqoj.exe

Filesize
64KB

MD5
c7d8c592a6dc8f75a5d625498c240252

SHA1
80d41da0077fe0a0dd7fae3b1d32b3f1ea83b1a3

SHA256
cb23f7e6319f074dc44eabe7ecbf50bc282aaed00e2caef49d623a885b3bdc11

SHA512
a2d692068534c185fa1bf4e3e2603a756b1a6828b6a347b84a5624835bc8618fe8eda8a05a98dd4a314e01f5c087f5a0eeaa6d2d8b576503a7fa18272f649dc0

Download Submit
C:\Windows\SysWOW64\Kbjbnnfg.exe

Filesize
163KB

MD5
71da09b611c2b772f98a41f44c2b3420

SHA1
91ae86b12a50e045f9c3bd8ca1362e964038ac71

SHA256
5aeca48516312e6cdfb87ee9e5036d3e4a30af47547d4e13c3378a91fb8db649

SHA512
96f1b9680086641034523bcf6086be9ba5f621658dcf2138d52009a09d8100cd18da69ff4b1ea9790af7a00bf6ee2ab4c0d0d34da5cb665b345518589340b150

Download Submit
C:\Windows\SysWOW64\Kdpiqehp.exe

Filesize
163KB

MD5
bef8855393e9859ccdb66147ca0f5de9

SHA1
e39dadeb4de07084a8e48e6eb3571130d958b734

SHA256
0d24b6b7178bae32b68926c2ae5bd7245c987b3545da95b8e9519d83f25ec84e

SHA512
7f33a3d1c237c56513780bcc649c33d53b47b13d6e933e030c01cf06efca44896145ff0e2c4323742b9c66f5ce356f2f73ace1cdd5d2054478dc31ab1ad6243d

Download Submit
C:\Windows\SysWOW64\Khabke32.exe

Filesize
163KB

MD5
821b36744d2bfe31430fe39ae002e589

SHA1
3fd609a8c8032bbba6eea10cff7a3a4eace02295

SHA256
11848ac8bf1b5c52c1ccfab966c2cdcb149119d75b34738fbaa0aab44804a6f7

SHA512
25452967ec872f89130eb86ec6bce837ab9e23b6604e7984d992dc2851d5684822da5d502f8739b311e5577ec781f92ed59a9390caf0d5aae8c74d7f6540a69c

Download Submit
C:\Windows\SysWOW64\Khihld32.exe

Filesize
163KB

MD5
13cf4b29ae1597145dc0c7372ce78d1c

SHA1
2569e4ac8dd7db251e3b97d40393edaa6522193c

SHA256
9d300fea8c584bc8afa7259cae8329ba810000d715b0870370e604ea58d40e90

SHA512
30aa98819182a5f3f89034e43cdab8b9073b22d384d24e99297c8dcb4d2c8418c9557f26e1f28283ec7dc5dde228e80ea67a3bc9e6ecb50e5dba6ac5f8b598a6

Download Submit
C:\Windows\SysWOW64\Kocgbend.exe

Filesize
163KB

MD5
86317a83e3fb632c145b56dc9af7ae5b

SHA1
6db10902798c238f1a0eefe08e42524d5da449e4

SHA256
635193406a4b00c557446125671f2e52d8a4158f23dc168efaa1f4ae8ec3fdae

SHA512
af4352794f7be1e02b4a375cf457f40e80f47ad2f771fe5492ce0a38398cff8d732f5802bf927c863770e2c7f3c429e0c92425edab604c2ef912d52a19839762

Download Submit
C:\Windows\SysWOW64\Lbhool32.exe

Filesize
163KB

MD5
71a653e523db15068d722df0ee3ba024

SHA1
54f28e2c2a995cb8eac62f6c4a24700b4119e18d

SHA256
7e93da204c47cec7b69f53071599dcc7204fd709fb21fe02986b26db6d66aebf

SHA512
a8fb0c8f346a5466773533a3e0bcb492f79c4d198887b250335b6597ef606d3f1b37ca225f612086e9f18a9b0fd247b34a18c5f5950ea5933507dbe457814c39

Download Submit
C:\Windows\SysWOW64\Lbqinm32.exe

Filesize
163KB

MD5
2262fad917514d36ec9b1cf83a6613f0

SHA1
3ee66bf72b905b29b5c98cdc0f11afe615d4db02

SHA256
e09932b442caa4fba1ffddbd15f72fc52fb612b944156e18285f43243909fda9

SHA512
fbb3d4a49f780753a7574d74005e7cba3944ca8e5352e01371ff586be809c6d44cd07f64690c4a1487e510e50e492133b7357a3cc998dda791457d6ebaa4e583

Download Submit
C:\Windows\SysWOW64\Ledoegkm.exe

Filesize
163KB

MD5
8fb21317265e947cbdd25ef7639253c1

SHA1
310be98ca9f3a78cd79e2a141d16b37e0c566ab4

SHA256
2fde847a7bb25bd2ff2ae222e1b91b7465b279c39a38fdd99de8d6496832cd9b

SHA512
521f4414368f5acdd85095257a4a786abd2410c7d2c91aa6614412082a646e925de68b5c83eaf7e0d3b426bd36b25bdbd9ce13fb952110008f946a56a6363670

Download Submit
C:\Windows\SysWOW64\Mcdeeq32.exe

Filesize
163KB

MD5
b510544cfb90d52530a066c684ad19ec

SHA1
966e5b62e90a05e8298395300ce3d836e98b9a13

SHA256
1e2b6f239bba3a665b2abf7ba18cf2c7b7582cca9e3d32bb9ed7ba97de3d52e0

SHA512
d2bf1b96dd4968dda8b921f2aef2a429f81f42d923740988ce161dcbbcdef3084f3ff329fb0f1848da77c6ec765eb47d615639dc538be58eabc7841723e85d2b

Download Submit
C:\Windows\SysWOW64\Nbnlaldg.exe

Filesize
163KB

MD5
ac493ce2ed0e39ae40770844303861ac

SHA1
28403f5d71c0584e9eea7303f7f94820c68dbdca

SHA256
c8bd9247aefb09bdee2f1d0ef36a7ab5fdc5a681f07be9fc91f6e6876d6e30c0

SHA512
c69e7593189d4dbf0ce9fd74c0364e3da9eaa8a17d316a200b7b791b3ca0aa9854ab43272bf5001383df0cd30cdd213362835cd81f8b92ce6ae7ffa9f244bb20

Download Submit
C:\Windows\SysWOW64\Nimmifgo.exe

Filesize
163KB

MD5
b77c20d1a42d4535b66cc0054a685782

SHA1
c433c099f42d6df3468452dc368d5acb746276d3

SHA256
9fd3380c789799920ad14ab8a44b808eb2f3e55abebcefd2f43304324d5de623

SHA512
7c46b0c738ed4d394f4f6e2349dbf9e22b105a8dfe624e4310b6c5e6f95e3fde125d49ec13247a6d85e380db1a8d8ffa067cb88d8d3e3996d1a82b8d55514e0d

Download Submit
C:\Windows\SysWOW64\Niojoeel.exe

Filesize
163KB

MD5
50989a2c457ec49e1014089b497c9cfd

SHA1
189e94920aa893403be841a005c9d26aec337e20

SHA256
ec7f572f1d85005a6a7aa113882c3f7106b6f4a927982f46e1beb757b705115d

SHA512
bbe3bd949dbdf4ddc896d7b543d9fdb28a107f2a1b91daac0f9fc8969ea4bb0f61f9766de5b586d9dd320d65e28adf59f1c35f40e0abe7a79e6d85a36e70066b

Download Submit
C:\Windows\SysWOW64\Njbgmjgl.exe

Filesize
163KB

MD5
3737c2e52e84caa487c9ff0a242bb8a2

SHA1
0bf03460973b44474a60bbb971b6f61f68e3524a

SHA256
53386937428e94fbd95483808700e75474065c2648701941d7bfc17b4dd35259

SHA512
8667bbb6040b61dfc9416282866b15bc7e75c23273661521a4f18b4afae5b9bffbe8890d47dc869dcaab80cd29972402df6359dd291413948c27d313c31688d9

Download Submit
C:\Windows\SysWOW64\Nqaiecjd.exe

Filesize
163KB

MD5
9ab0df6800b9ddc31ab28c36860e35ea

SHA1
6af7139a53169d6201b692db0e5d08f54f54ec0e

SHA256
3edf330d99b07787917e6361db918407de8fb5a814464461af57d660256c2809

SHA512
6838a6c116685a0eada47cf5134547b88ad1c2916abaa7dbc627378d0cc72b2ea1d3bd11860c547a9d165bcb2d2b16d3251fb7b092b00b1e0d935ac2b1b7a4f1

Download Submit
C:\Windows\SysWOW64\Objkmkjj.exe

Filesize
163KB

MD5
688e9afb44499299f197ece3897facd6

SHA1
f42176985767b181dadfd37d5ede2907e8220097

SHA256
8c112c858d06e065bb86862626afcdf0863a2829c5b7582149515c5baf53a4a4

SHA512
476250a396163f0ff5c4a3c1e50536f8b52bf33e8ba83af9da0035c3c03ffba4f2d03066ec113ad67094fface99a626e38182ae8f28848e0a2d95fddbe31140e

Download Submit
C:\Windows\SysWOW64\Oifppdpd.exe

Filesize
163KB

MD5
d4278c24090ca078685793dd53e3dd81

SHA1
9022f4af8f342019c59eb5ad8da6bad48d4b1ce3

SHA256
14532d1c8fd7551662bb93e3bd010d1d725fc40171f90e9a6337605037ad5bfc

SHA512
ad4109f32d9958a7ccffcfa2cd5bccb3ed1cbb1fd94602eb5bfed5face56f2c4de2406335d294598b9032172ee3af55d9b62330449437d56e29022cb8a990634

Download Submit
C:\Windows\SysWOW64\Opbean32.exe

Filesize
163KB

MD5
2c84c4401ac6ed7881e527a8b7bf8c5a

SHA1
a4760a4d0b87db27613e30d7303256a98e397383

SHA256
3a0220f57a5c7731cfa8d97a13546e7217b82c2d96de733a93e89754fcc47278

SHA512
3606bd7dea14764e91ccd755454b4db289826452c6eda1c0f5791a7bb238447739c6614776555ef2d6a110e6f315f1355e714be1596585865b8482ff511e5bd1

Download Submit
C:\Windows\SysWOW64\Palklf32.exe

Filesize
163KB

MD5
1ba1a9f64375ecc81a382bc5a9c7a17c

SHA1
5d27a71158a2469671537a2206376c00ebbca696

SHA256
e62ee60771461853ad3785c8a872b56ff55bb7c17efcd5f79aae8dc20569101b

SHA512
e8904136ccb3b5061eb30fa18330bd9a9eb55fe1d011d72e2a914454d1b65696e29f45ed6257373cb6760ff9ed60b0b8978573d1e46a684c034150411390da85

Download Submit
C:\Windows\SysWOW64\Panhbfep.exe

Filesize
163KB

MD5
5b563ae1f2c14b6f6acef49e041522dc

SHA1
611ec85803a1590917684a39294719ea74ae84a2

SHA256
eeab2aba88c4566ddb1e0ecc7aa167608cd3f76181c76f200311f4692364d99d

SHA512
090d363300f03dd39088597c402a81b1682df6a1d907f7aba451dbaa3e86cb8be9376c328fa3ab1b5551b1fb4579c60881750c0e7036a0e2705bce5cf92e8b45

Download Submit
C:\Windows\SysWOW64\Pcbkml32.exe

Filesize
163KB

MD5
4b91c091402b6fdfe5d0fa130c555538

SHA1
417db5b91aaa213e3a7b881e93b3ea3135e2ef41

SHA256
234627dc930a62ee43654799dcbe2b18bfdfd4ae5ff1d8b4887d3019ea766029

SHA512
dde20806a141a182b4c36bbee458041723a139a93f3506383dfa5b30ebbf39e15d3e98e5bd5b5ff207b4f37dd886ff0fa969750479f590161d09a00d168ae4fc

Download Submit
C:\Windows\SysWOW64\Pcpnhl32.exe

Filesize
163KB

MD5
d8eb96d596eebf737ddde3bbb626d80a

SHA1
3e8e7a78e0b14a6f7b0881f2b9ade0ec97d15cf6

SHA256
24a5f5753f95e9e8e3a55d7dfd50a9d7d52821a17e9073450b93cc4da2926afe

SHA512
995727ac2f275e35b2b9b26f0cf1351ae6769386604789673531c9e1454f9746efa1a927e944337c0feb999a4e8246a89d5f22b15c6156ff50dc698b685bc9a9

Download Submit
C:\Windows\SysWOW64\Pfiddm32.exe

Filesize
163KB

MD5
6fb55e1beff498ce51c086bd3d489b79

SHA1
fc08e52a50775e161c5bd481df43c3eb226bee29

SHA256
988f27bf5fae6e52bdce45472327679c202a1b74fd7ee591e6715a7e931b49d8

SHA512
7910f7607b6ba292134bd1ebdbcb86db53b06f5bd6bab047bf8034dac36cba163ee36baf280e07fa1ebf086186e322b626238e0d86a39a43b250d9ab794779b8

Download Submit
C:\Windows\SysWOW64\Pjcikejg.exe

Filesize
163KB

MD5
42817fa72d07e4d3278c62566c89e0a0

SHA1
84d3c3565b089e49de8d4bd9fc99281721ffbea8

SHA256
abda6b2d2e603a66cc7a5dc7d81ba7193fb258199bc59d186f2cf19a5cac8570

SHA512
0e0e9bcc036be85c6a14f374f0f77223a8654482ec35c97ea0f9483752add4d964c1a724874f91773fde3680745f27b3c0b8dfc573b3f7f78f43b43194540465

Download Submit
C:\Windows\SysWOW64\Pmnbfhal.exe

Filesize
163KB

MD5
b6178a8b4cba88e0a71da2a050bf6b91

SHA1
0d78d8be2968509a8e7c3b8f7a1f2f7878aaa1fd

SHA256
8a3ebac428a31d73287b136e5729c54bfa775a892a640b500d2d1e4719ce5a9d

SHA512
3085b7134bcb0af259ba585fa452df6a7c464a56dfe2680f162938e78b144a93008e492b0bfb30e06456acf8eab1062f86c3426a6e7adb2feb86ff4ea9e697dd

Download Submit
C:\Windows\SysWOW64\Pplobcpp.exe

Filesize
163KB

MD5
c2b4fa3648a59d0c2b838aefc99ff11b

SHA1
327ad396ce63ebb37a5e4f3d9ad13743d209c1b3

SHA256
2f859a057aa1f2c5f613f6a5d3436b5715194cecc7dcaacf60d32d1327b4c839

SHA512
b59d75dbf29c5c452f8db382ca1e7b26a58825374ad77107cfc919523a857ec86970265a21c35a87003b3b77256166ffdb623163f7423b17ee7735ff4549b9db

Download Submit
C:\Windows\SysWOW64\Qaqegecm.exe

Filesize
163KB

MD5
e9081fe0a32a484d8ecff39a43fb64f1

SHA1
370e1ea7291663ed86500f123a0625414774a0b9

SHA256
9c125a3c19bc9e2447e95e5092c3855461e004f6f0c5b9c820f72d37b7b5c7c1

SHA512
aa17c2e672d3b52aa97fa6bc6ab6780b5377d860d5ebcda21a9ea1f0ebf6543ac2aa3fb0a874a26a6eba548153dd09a7f225549b4612ca70d4c609b520d4b7b2

Download Submit
C:\Windows\SysWOW64\Qcnjijoe.exe

Filesize
163KB

MD5
64af85e24c5860b0d19dac59f11fa461

SHA1
75f33dc73d73bddbef49822e712fb4ad2208dbe9

SHA256
45dfb07ddb7e412f64026373b4c3f571749a9f871e770e492c67dc3ab9a74290

SHA512
d634ff5c7db987b404aafc164f1460a9f01b04cb84b1efa11b44e4dbb227176df5f713b3a4dccb8b6dbc49d6ab7bf6b2a39a279da15d70cb6a890b09cb676e24

Download Submit
C:\Windows\SysWOW64\Qhhpop32.exe

Filesize
163KB

MD5
77c1b9388ca89c1df206ef081fb128cc

SHA1
b1cca945e4abe12feea0f6e6a8e14fce2d60b862

SHA256
acc576f46e292685bf44a88eb5c3ba0eb20f21d8d017c95559c8ef4e65220db2

SHA512
0da01ebf95831965d71bbec90a3c4b3b1100c95dc5c6b9a1648bf2d8c41ea5aadfe969c55edf4b1373b62db8c9111bf54daf0ff861f2d7b6b775fe00c9ab4d38

Download Submit
C:\Windows\SysWOW64\Qhjmdp32.exe

Filesize
163KB

MD5
43c76015c4623bfe6f4db588fa56abb4

SHA1
dad35302437e3f313cc57ae8949c30f1bf64aa73

SHA256
d3e9a27b7a336a92e4d5fa3227d4b2de2770a3722f5161711e7baf388aaccea3

SHA512
fdb4d564c2b67770171018871c974f2d6986bee9adbb421cb61979eb1c4895d14adebc00eaa96bbc0d04f8728bd10d39f6dc4793b211530c62318a850c568015

Download Submit
C:\Windows\SysWOW64\Qjiipk32.exe

Filesize
163KB

MD5
8d4f7e161fb9f5be393b5c0422f669d2

SHA1
c8e24bd568c8e1e2f84931adb682f1dc38e5d780

SHA256
09c7558018dde72a01376e6df9dbbde5b942bde957f12f554ee5528c29e4c9fc

SHA512
7f84043028f8c91ec4f34b4a7c6404e83a0e6d7a77e77008e6750433eec3c36fd4a540ae7ca935fe51151eeb178310a38106335d581cbb820106260de0049fce

Download Submit
memory/64-594-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/216-359-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/640-184-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/688-49-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/688-586-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/696-566-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/720-407-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/868-553-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1080-112-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1088-497-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1140-269-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1152-2826-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1152-120-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1192-13-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1192-552-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1268-485-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1356-467-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1392-323-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1444-176-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1468-449-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1496-249-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1576-299-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1576-2778-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1596-200-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1736-97-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1856-341-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1924-81-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1952-287-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2064-383-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2144-593-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2144-57-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2156-479-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2196-573-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2308-546-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2328-192-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2344-224-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2348-347-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2492-533-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2516-311-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2552-515-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2640-503-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2712-72-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2792-136-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2808-389-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2824-565-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2824-24-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2844-527-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2884-40-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2884-579-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2944-365-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2948-256-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2964-396-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2976-419-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3012-317-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3024-580-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3036-216-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3068-491-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3128-16-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3128-559-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3248-281-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3268-152-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3320-413-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3328-275-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3428-353-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3504-401-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3624-240-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3716-473-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3804-425-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3832-509-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3932-160-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4044-443-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4064-128-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4080-381-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4084-540-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4112-539-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4112-1-0x0000000000432000-0x0000000000433000-memory.dmp

Filesize
4KB

Download
memory/4112-0-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4200-335-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4244-371-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4252-329-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4328-232-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4416-461-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4460-2733-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4460-431-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4516-33-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4516-572-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4560-104-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4568-455-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4584-293-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4612-587-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4664-521-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4712-305-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4752-208-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4780-89-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4812-144-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4844-69-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5016-437-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5024-168-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5092-263-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5260-2644-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5912-2614-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/6328-2504-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/6548-2426-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/8392-2217-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/9016-2226-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads