berbew | a821d111c5e6b518b8267052cbccc57e0cd636c1475b0f43e77e962fb3e86e14

Analysis

max time kernel
120s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2025, 07:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a821d111c5e6b518b8267052cbccc57e0cd636c1475b0f43e77e962fb3e86e14.exe
Size

90KB
MD5

6259576152cc0412c0e817a14d95bda3
SHA1

eda1319dbc71205d15992f3a80a11adcc96e48ff
SHA256

a821d111c5e6b518b8267052cbccc57e0cd636c1475b0f43e77e962fb3e86e14
SHA512

854598ae6cd21295222aa6b1376685e316781ca8f9317f5f53f8c3e11402bd558dad7cdf9c034201297feae8892fe47be308818e1578584dfd2867b354c97dd5
SSDEEP

1536:+0ulz2r0X/i2TnCpjbqnDg6pZ+HyXEyOQZMZ3QNlnW/rvGlu/Ub0VkVNK:xi2remjbqU6pZ2IyZ3QNSvGlu/Ub0+NK

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jianff32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmbdbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qceiaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qjoankoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Agoabn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kiidgeki.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odmgcgbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pnlaml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pgefeajb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bjfaeh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdgljmcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lmgfda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ogifjcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Opakbi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmannhhj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcebhoii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjagjhnc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deagdn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfpnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lgokmgjm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocbddc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Echknh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kdgljmcd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llemdo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mckemg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oncofm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pgllfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Acqimo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hijooifk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnebeogl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oncofm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnkgeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eamhodmf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hopnqdan.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbpgbo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klimip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kdqejn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmncnb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmiciaaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngdmod32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdlnbm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jianff32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kimnbd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogpmjb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqhacgdh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pgnilpah.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fbnafb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nphhmj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nloiakho.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nggjdc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjjhbl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beglgani.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ghlcnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hopnqdan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hecmijim.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojoign32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hbpgbo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jplfcpin.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klljnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aqkgpedc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dopigd32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
1752	Dlijfneg.exe
4524	Dohfbj32.exe
4944	Dafbne32.exe
968	Dddojq32.exe
1016	Dhpjkojk.exe
400	Dojcgi32.exe
3928	Dahode32.exe
372	Dhbgqohi.exe
3840	Ekacmjgl.exe
2212	Echknh32.exe
2972	Eefhjc32.exe
1160	Elppfmoo.exe
4796	Eoolbinc.exe
4816	Eamhodmf.exe
1028	Edkdkplj.exe
2284	Elbmlmml.exe
2884	Eoaihhlp.exe
2016	Eapedd32.exe
2792	Eleiam32.exe
4576	Ekhjmiad.exe
4528	Eemnjbaj.exe
4516	Ekjfcipa.exe
2624	Ecandfpd.exe
720	Eepjpb32.exe
3196	Ehnglm32.exe
4580	Fkmchi32.exe
1140	Fafkecel.exe
3324	Fdegandp.exe
1916	Fkopnh32.exe
2856	Fojlngce.exe
1600	Ffddka32.exe
736	Fhcpgmjf.exe
1584	Fomhdg32.exe
4008	Fakdpb32.exe
2260	Fdialn32.exe
4904	Fooeif32.exe
2248	Fbnafb32.exe
2660	Fdlnbm32.exe
1688	Flceckoj.exe
3256	Foabofnn.exe
1392	Fbpnkama.exe
4156	Ffkjlp32.exe
2480	Fhjfhl32.exe
2816	Gkhbdg32.exe
2020	Gcojed32.exe
396	Gfngap32.exe
1676	Ghlcnk32.exe
5024	Gofkje32.exe
2232	Gbdgfa32.exe
4768	Gdcdbl32.exe
2188	Gmjlcj32.exe
1328	Gohhpe32.exe
5088	Gfbploob.exe
4108	Gdeqhl32.exe
3876	Gmlhii32.exe
3660	Gokdeeec.exe
4708	Gbiaapdf.exe
4560	Gdhmnlcj.exe
2896	Gmoeoidl.exe
688	Gomakdcp.exe
1888	Gblngpbd.exe
1624	Gdjjckag.exe
620	Hiefcj32.exe
1900	Hopnqdan.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Jcbdhp32.dll	Deokon32.exe
File created	C:\Windows\SysWOW64\Ajhddjfn.exe	Afmhck32.exe
File created	C:\Windows\SysWOW64\Eemnjbaj.exe	Ekhjmiad.exe
File created	C:\Windows\SysWOW64\Gmlhii32.exe	Gdeqhl32.exe
File created	C:\Windows\SysWOW64\Lafdhogo.dll	Mnebeogl.exe
File created	C:\Windows\SysWOW64\Lfjhbihm.dll	Cfpnph32.exe
File opened for modification	C:\Windows\SysWOW64\Eamhodmf.exe	Eoolbinc.exe
File created	C:\Windows\SysWOW64\Fomhdg32.exe	Fhcpgmjf.exe
File opened for modification	C:\Windows\SysWOW64\Fbnafb32.exe	Fooeif32.exe
File created	C:\Windows\SysWOW64\Ceacpg32.dll	Ipknlb32.exe
File opened for modification	C:\Windows\SysWOW64\Ipnjab32.exe	Iicbehnq.exe
File created	C:\Windows\SysWOW64\Jfaklh32.dll	Kiidgeki.exe
File created	C:\Windows\SysWOW64\Qncbfk32.dll	Ldanqkki.exe
File created	C:\Windows\SysWOW64\Aihbcp32.dll	Mlampmdo.exe
File created	C:\Windows\SysWOW64\Bcjlcn32.exe	Beglgani.exe
File created	C:\Windows\SysWOW64\Kpmmhi32.dll	Dojcgi32.exe
File created	C:\Windows\SysWOW64\Dhbgqohi.exe	Dahode32.exe
File created	C:\Windows\SysWOW64\Cdbinofi.dll	Jidklf32.exe
File created	C:\Windows\SysWOW64\Kibgmdcn.exe	Kfckahdj.exe
File created	C:\Windows\SysWOW64\Pjcbnbmg.dll	Nggjdc32.exe
File created	C:\Windows\SysWOW64\Booogccm.dll	Ogkcpbam.exe
File created	C:\Windows\SysWOW64\Pgefeajb.exe	Pcijeb32.exe
File opened for modification	C:\Windows\SysWOW64\Hiefcj32.exe	Gdjjckag.exe
File opened for modification	C:\Windows\SysWOW64\Fhcpgmjf.exe	Ffddka32.exe
File opened for modification	C:\Windows\SysWOW64\Njqmepik.exe	Ngbpidjh.exe
File created	C:\Windows\SysWOW64\Dopigd32.exe	Dfiafg32.exe
File created	C:\Windows\SysWOW64\Jihdea32.dll	Eefhjc32.exe
File created	C:\Windows\SysWOW64\Hiefcj32.exe	Gdjjckag.exe
File opened for modification	C:\Windows\SysWOW64\Hkfoeega.exe	Hmcojh32.exe
File created	C:\Windows\SysWOW64\Oncmnnje.dll	Pmannhhj.exe
File opened for modification	C:\Windows\SysWOW64\Nngokoej.exe	Nilcjp32.exe
File opened for modification	C:\Windows\SysWOW64\Qnhahj32.exe	Pjmehkqk.exe
File opened for modification	C:\Windows\SysWOW64\Pcbmka32.exe	Pqdqof32.exe
File created	C:\Windows\SysWOW64\Hjlena32.dll	Amgapeea.exe
File created	C:\Windows\SysWOW64\Pmgmnjcj.dll	Bfdodjhm.exe
File opened for modification	C:\Windows\SysWOW64\Kepelfam.exe	Kfmepi32.exe
File created	C:\Windows\SysWOW64\Lbmhlihl.exe	Lpnlpnih.exe
File opened for modification	C:\Windows\SysWOW64\Mdehlk32.exe	Mpjlklok.exe
File opened for modification	C:\Windows\SysWOW64\Ncianepl.exe	Ndfqbhia.exe
File created	C:\Windows\SysWOW64\Gcdmai32.dll	Ogpmjb32.exe
File created	C:\Windows\SysWOW64\Hijooifk.exe	Hbpgbo32.exe
File created	C:\Windows\SysWOW64\Mpablkhc.exe	Mlefklpj.exe
File created	C:\Windows\SysWOW64\Odaoecld.dll	Pgllfp32.exe
File opened for modification	C:\Windows\SysWOW64\Gomakdcp.exe	Gmoeoidl.exe
File created	C:\Windows\SysWOW64\Nngokoej.exe	Nilcjp32.exe
File created	C:\Windows\SysWOW64\Kboeke32.dll	Ageolo32.exe
File opened for modification	C:\Windows\SysWOW64\Fhjfhl32.exe	Ffkjlp32.exe
File created	C:\Windows\SysWOW64\Jfeopj32.exe	Jbjcolha.exe
File opened for modification	C:\Windows\SysWOW64\Klgqcqkl.exe	Kiidgeki.exe
File created	C:\Windows\SysWOW64\Pqbdjfln.exe	Pmfhig32.exe
File created	C:\Windows\SysWOW64\Aadifclh.exe	Aminee32.exe
File opened for modification	C:\Windows\SysWOW64\Fakdpb32.exe	Fomhdg32.exe
File created	C:\Windows\SysWOW64\Mmnldp32.exe	Megdccmb.exe
File opened for modification	C:\Windows\SysWOW64\Dhhnpjmh.exe	Danecp32.exe
File created	C:\Windows\SysWOW64\Aipoal32.dll	Ekacmjgl.exe
File created	C:\Windows\SysWOW64\Edkdkplj.exe	Eamhodmf.exe
File created	C:\Windows\SysWOW64\Dejpjp32.dll	Foabofnn.exe
File created	C:\Windows\SysWOW64\Kipkhdeq.exe	Kedoge32.exe
File opened for modification	C:\Windows\SysWOW64\Ngdmod32.exe	Ncianepl.exe
File opened for modification	C:\Windows\SysWOW64\Pmannhhj.exe	Pjcbbmif.exe
File created	C:\Windows\SysWOW64\Ipnjafgo.dll	Hopnqdan.exe
File opened for modification	C:\Windows\SysWOW64\Bfdodjhm.exe	Bganhm32.exe
File opened for modification	C:\Windows\SysWOW64\Dobfld32.exe	Dhhnpjmh.exe
File created	C:\Windows\SysWOW64\Hbbdholl.exe	Hmfkoh32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9868	9740	WerFault.exe	432

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcbmka32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmmnjfnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajkaii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dojcgi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhbgqohi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jbjcolha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klgqcqkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ndcdmikd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnakhkol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agglboim.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkkcge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ehnglm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npfkgjdn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nebdoa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncianepl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onjegled.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocbddc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gdcdbl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hijooifk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmjdjgjo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iiaephpc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmbmibhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lenamdem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdehlk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbpnkama.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcpnhfhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njqmepik.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qcgffqei.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ampkof32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeiofcji.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcoenmao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pflplnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajanck32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bclhhnca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdabcm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Danecp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fojlngce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkfoeega.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofnckp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oneklm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fafkecel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kfmepi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eefhjc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhpjkojk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpcfkm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmnldp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oncofm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cndikf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogpmjb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fomhdg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fhjfhl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmgfda32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfjjppmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqpgdfnp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqkgpedc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dobfld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gfngap32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kebbafoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngdmod32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nggjdc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjmehkqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daekdooc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gkhbdg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmiciaaj.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndqgbjkm.dll"	Jblpek32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Odapnf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cfmajipb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pnfdcjkg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bfhhoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fomhdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Onliio32.dll"	Mpablkhc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pqdqof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bneljh32.dll"	Bnkgeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fooeif32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gdeqhl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mlefklpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fkmchi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fdialn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ffkjlp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ndfqbhia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pdifoehl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Popodg32.dll"	Pdifoehl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qmmnjfnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehmdjdgk.dll"	Ajanck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dqlbaq32.dll"	Gcojed32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ainpbi32.dll"	Gmoeoidl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Klgqcqkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ooojbbid.dll"	Aminee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkmjgool.dll"	Cegdnopg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hbnjmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihlnnp32.dll"	Jmbdbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ngdmod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bhhdil32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ghlcnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Iifokh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmlihfed.dll"	Mdjagjco.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nggjdc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnlden32.dll"	Pjjhbl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Acnlgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Acqimo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ehnglm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Miemjaci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Panfqmhb.dll"	Pgefeajb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgaoidec.dll"	Pgnilpah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aqkgpedc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jplfcpin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ojoign32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lipdae32.dll"	Pqdqof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Benlnbhb.dll"	Lfhdlh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ofnckp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pmfhig32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gfbploob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmdfog32.dll"	Kebbafoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ldleel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Beihma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gdeqhl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Himldi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jmbdbd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mdckfk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ognpebpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ogpmjb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ekjfcipa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgfkkboc.dll"	Eepjpb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gokdeeec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jmbdbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Onhhamgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odmkog32.dll"	Eoaihhlp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jbjcolha.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1752	2028	a821d111c5e6b518b8267052cbccc57e0cd636c1475b0f43e77e962fb3e86e14.exe	89
PID 2028 wrote to memory of 1752	2028	a821d111c5e6b518b8267052cbccc57e0cd636c1475b0f43e77e962fb3e86e14.exe	89
PID 2028 wrote to memory of 1752	2028	a821d111c5e6b518b8267052cbccc57e0cd636c1475b0f43e77e962fb3e86e14.exe	89
PID 1752 wrote to memory of 4524	1752	Dlijfneg.exe	90
PID 1752 wrote to memory of 4524	1752	Dlijfneg.exe	90
PID 1752 wrote to memory of 4524	1752	Dlijfneg.exe	90
PID 4524 wrote to memory of 4944	4524	Dohfbj32.exe	91
PID 4524 wrote to memory of 4944	4524	Dohfbj32.exe	91
PID 4524 wrote to memory of 4944	4524	Dohfbj32.exe	91
PID 4944 wrote to memory of 968	4944	Dafbne32.exe	92
PID 4944 wrote to memory of 968	4944	Dafbne32.exe	92
PID 4944 wrote to memory of 968	4944	Dafbne32.exe	92
PID 968 wrote to memory of 1016	968	Dddojq32.exe	93
PID 968 wrote to memory of 1016	968	Dddojq32.exe	93
PID 968 wrote to memory of 1016	968	Dddojq32.exe	93
PID 1016 wrote to memory of 400	1016	Dhpjkojk.exe	94
PID 1016 wrote to memory of 400	1016	Dhpjkojk.exe	94
PID 1016 wrote to memory of 400	1016	Dhpjkojk.exe	94
PID 400 wrote to memory of 3928	400	Dojcgi32.exe	95
PID 400 wrote to memory of 3928	400	Dojcgi32.exe	95
PID 400 wrote to memory of 3928	400	Dojcgi32.exe	95
PID 3928 wrote to memory of 372	3928	Dahode32.exe	96
PID 3928 wrote to memory of 372	3928	Dahode32.exe	96
PID 3928 wrote to memory of 372	3928	Dahode32.exe	96
PID 372 wrote to memory of 3840	372	Dhbgqohi.exe	97
PID 372 wrote to memory of 3840	372	Dhbgqohi.exe	97
PID 372 wrote to memory of 3840	372	Dhbgqohi.exe	97
PID 3840 wrote to memory of 2212	3840	Ekacmjgl.exe	98
PID 3840 wrote to memory of 2212	3840	Ekacmjgl.exe	98
PID 3840 wrote to memory of 2212	3840	Ekacmjgl.exe	98
PID 2212 wrote to memory of 2972	2212	Echknh32.exe	99
PID 2212 wrote to memory of 2972	2212	Echknh32.exe	99
PID 2212 wrote to memory of 2972	2212	Echknh32.exe	99
PID 2972 wrote to memory of 1160	2972	Eefhjc32.exe	100
PID 2972 wrote to memory of 1160	2972	Eefhjc32.exe	100
PID 2972 wrote to memory of 1160	2972	Eefhjc32.exe	100
PID 1160 wrote to memory of 4796	1160	Elppfmoo.exe	101
PID 1160 wrote to memory of 4796	1160	Elppfmoo.exe	101
PID 1160 wrote to memory of 4796	1160	Elppfmoo.exe	101
PID 4796 wrote to memory of 4816	4796	Eoolbinc.exe	102
PID 4796 wrote to memory of 4816	4796	Eoolbinc.exe	102
PID 4796 wrote to memory of 4816	4796	Eoolbinc.exe	102
PID 4816 wrote to memory of 1028	4816	Eamhodmf.exe	103
PID 4816 wrote to memory of 1028	4816	Eamhodmf.exe	103
PID 4816 wrote to memory of 1028	4816	Eamhodmf.exe	103
PID 1028 wrote to memory of 2284	1028	Edkdkplj.exe	104
PID 1028 wrote to memory of 2284	1028	Edkdkplj.exe	104
PID 1028 wrote to memory of 2284	1028	Edkdkplj.exe	104
PID 2284 wrote to memory of 2884	2284	Elbmlmml.exe	105
PID 2284 wrote to memory of 2884	2284	Elbmlmml.exe	105
PID 2284 wrote to memory of 2884	2284	Elbmlmml.exe	105
PID 2884 wrote to memory of 2016	2884	Eoaihhlp.exe	106
PID 2884 wrote to memory of 2016	2884	Eoaihhlp.exe	106
PID 2884 wrote to memory of 2016	2884	Eoaihhlp.exe	106
PID 2016 wrote to memory of 2792	2016	Eapedd32.exe	107
PID 2016 wrote to memory of 2792	2016	Eapedd32.exe	107
PID 2016 wrote to memory of 2792	2016	Eapedd32.exe	107
PID 2792 wrote to memory of 4576	2792	Eleiam32.exe	109
PID 2792 wrote to memory of 4576	2792	Eleiam32.exe	109
PID 2792 wrote to memory of 4576	2792	Eleiam32.exe	109
PID 4576 wrote to memory of 4528	4576	Ekhjmiad.exe	110
PID 4576 wrote to memory of 4528	4576	Ekhjmiad.exe	110
PID 4576 wrote to memory of 4528	4576	Ekhjmiad.exe	110
PID 4528 wrote to memory of 4516	4528	Eemnjbaj.exe	112

C:\Users\Admin\AppData\Local\Temp\a821d111c5e6b518b8267052cbccc57e0cd636c1475b0f43e77e962fb3e86e14.exe
"C:\Users\Admin\AppData\Local\Temp\a821d111c5e6b518b8267052cbccc57e0cd636c1475b0f43e77e962fb3e86e14.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\Dlijfneg.exe
  C:\Windows\system32\Dlijfneg.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Windows\SysWOW64\Dohfbj32.exe
    C:\Windows\system32\Dohfbj32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4524
  - - C:\Windows\SysWOW64\Dafbne32.exe
      C:\Windows\system32\Dafbne32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4944
    - - C:\Windows\SysWOW64\Dddojq32.exe
        
        C:\Windows\system32\Dddojq32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:968
      - C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1016
        
        C:\Windows\SysWOW64\Dojcgi32.exe
        
        C:\Windows\system32\Dojcgi32.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:400
        
        C:\Windows\SysWOW64\Dahode32.exe
        
        C:\Windows\system32\Dahode32.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3928
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:372
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3840
        
        C:\Windows\SysWOW64\Echknh32.exe
        
        C:\Windows\system32\Echknh32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2212
        
        C:\Windows\SysWOW64\Eefhjc32.exe
        
        C:\Windows\system32\Eefhjc32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2972
        
        C:\Windows\SysWOW64\Elppfmoo.exe
        
        C:\Windows\system32\Elppfmoo.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1160
        
        C:\Windows\SysWOW64\Eoolbinc.exe
        
        C:\Windows\system32\Eoolbinc.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4796
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4816
        
        C:\Windows\SysWOW64\Edkdkplj.exe
        
        C:\Windows\system32\Edkdkplj.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1028
        
        C:\Windows\SysWOW64\Elbmlmml.exe
        
        C:\Windows\system32\Elbmlmml.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2284
        
        C:\Windows\SysWOW64\Eoaihhlp.exe
        
        C:\Windows\system32\Eoaihhlp.exe
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2884
        
        C:\Windows\SysWOW64\Eapedd32.exe
        
        C:\Windows\system32\Eapedd32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2016
        
        C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2792
        
        C:\Windows\SysWOW64\Ekhjmiad.exe
        
        C:\Windows\system32\Ekhjmiad.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4576
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4528
        
        C:\Windows\SysWOW64\Ekjfcipa.exe
        
        C:\Windows\system32\Ekjfcipa.exe
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4516
        
        C:\Windows\SysWOW64\Ecandfpd.exe
        
        C:\Windows\system32\Ecandfpd.exe
        24⤵
        Executes dropped EXE
        
        PID:2624
        
        C:\Windows\SysWOW64\Eepjpb32.exe
        
        C:\Windows\system32\Eepjpb32.exe
        25⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:720
        
        C:\Windows\SysWOW64\Ehnglm32.exe
        
        C:\Windows\system32\Ehnglm32.exe
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3196
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4580
        
        C:\Windows\SysWOW64\Fafkecel.exe
        
        C:\Windows\system32\Fafkecel.exe
        28⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1140
        
        C:\Windows\SysWOW64\Fdegandp.exe
        
        C:\Windows\system32\Fdegandp.exe
        29⤵
        Executes dropped EXE
        
        PID:3324
        
        C:\Windows\SysWOW64\Fkopnh32.exe
        
        C:\Windows\system32\Fkopnh32.exe
        30⤵
        Executes dropped EXE
        
        PID:1916
        
        C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        31⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2856
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1600
        
        C:\Windows\SysWOW64\Fhcpgmjf.exe
        
        C:\Windows\system32\Fhcpgmjf.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:736
        
        C:\Windows\SysWOW64\Fomhdg32.exe
        
        C:\Windows\system32\Fomhdg32.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1584
        
        C:\Windows\SysWOW64\Fakdpb32.exe
        
        C:\Windows\system32\Fakdpb32.exe
        35⤵
        Executes dropped EXE
        
        PID:4008
        
        C:\Windows\SysWOW64\Fdialn32.exe
        
        C:\Windows\system32\Fdialn32.exe
        36⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2260
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4904
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2248
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2660
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        40⤵
        Executes dropped EXE
        
        PID:1688
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3256
        
        C:\Windows\SysWOW64\Fbpnkama.exe
        
        C:\Windows\system32\Fbpnkama.exe
        42⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1392
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4156
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        44⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2480
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        45⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2816
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2020
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        47⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:396
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1676
        
        C:\Windows\SysWOW64\Gofkje32.exe
        
        C:\Windows\system32\Gofkje32.exe
        49⤵
        Executes dropped EXE
        
        PID:5024
        
        C:\Windows\SysWOW64\Gbdgfa32.exe
        
        C:\Windows\system32\Gbdgfa32.exe
        50⤵
        Executes dropped EXE
        
        PID:2232
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        51⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4768
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        52⤵
        Executes dropped EXE
        
        PID:2188
        
        C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        53⤵
        Executes dropped EXE
        
        PID:1328
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        54⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5088
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4108
        
        C:\Windows\SysWOW64\Gmlhii32.exe
        
        C:\Windows\system32\Gmlhii32.exe
        56⤵
        Executes dropped EXE
        
        PID:3876
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3660
        
        C:\Windows\SysWOW64\Gbiaapdf.exe
        
        C:\Windows\system32\Gbiaapdf.exe
        58⤵
        Executes dropped EXE
        
        PID:4708
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        59⤵
        Executes dropped EXE
        
        PID:4560
        
        C:\Windows\SysWOW64\Gmoeoidl.exe
        
        C:\Windows\system32\Gmoeoidl.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2896
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        61⤵
        Executes dropped EXE
        
        PID:688
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        62⤵
        Executes dropped EXE
        
        PID:1888
        
        C:\Windows\SysWOW64\Gdjjckag.exe
        
        C:\Windows\system32\Gdjjckag.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1624
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        64⤵
        Executes dropped EXE
        
        PID:620
        
        C:\Windows\SysWOW64\Hopnqdan.exe
        
        C:\Windows\system32\Hopnqdan.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1900
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        66⤵
        
        PID:3116
        
        C:\Windows\SysWOW64\Hbnjmp32.exe
        
        C:\Windows\system32\Hbnjmp32.exe
        67⤵
        Modifies registry class
        
        PID:380
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        68⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        69⤵
        Drops file in System32 directory
        
        PID:2924
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        70⤵
        System Location Discovery: System Language Discovery
        
        PID:4332
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        71⤵
        
        PID:3092
        
        C:\Windows\SysWOW64\Hbpgbo32.exe
        
        C:\Windows\system32\Hbpgbo32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1716
        
        C:\Windows\SysWOW64\Hijooifk.exe
        
        C:\Windows\system32\Hijooifk.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:404
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        74⤵
        Drops file in System32 directory
        
        PID:5136
        
        C:\Windows\SysWOW64\Hbbdholl.exe
        
        C:\Windows\system32\Hbbdholl.exe
        75⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Heapdjlp.exe
        
        C:\Windows\system32\Heapdjlp.exe
        76⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        77⤵
        Modifies registry class
        
        PID:5264
        
        C:\Windows\SysWOW64\Hkkhqd32.exe
        
        C:\Windows\system32\Hkkhqd32.exe
        78⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        79⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Hecmijim.exe
        
        C:\Windows\system32\Hecmijim.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5392
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        81⤵
        System Location Discovery: System Language Discovery
        
        PID:5432
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        82⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        83⤵
        System Location Discovery: System Language Discovery
        
        PID:5520
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        84⤵
        Drops file in System32 directory
        
        PID:5564
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        85⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        86⤵
        Drops file in System32 directory
        
        PID:5648
        
        C:\Windows\SysWOW64\Ipnjab32.exe
        
        C:\Windows\system32\Ipnjab32.exe
        87⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        88⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        89⤵
        Modifies registry class
        
        PID:5784
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        90⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        91⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5928
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5972
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        94⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6016
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        95⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        96⤵
        Drops file in System32 directory
        
        PID:6104
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        97⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        98⤵
        Modifies registry class
        
        PID:5248
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        99⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5416
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        101⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Kfjhkjle.exe
        
        C:\Windows\system32\Kfjhkjle.exe
        102⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5640
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        104⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5712
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        105⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        106⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5844
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        107⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        108⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6068
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6140
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        111⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5276
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5388
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5508
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        114⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        115⤵
        Drops file in System32 directory
        
        PID:5688
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        116⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        117⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        118⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        119⤵
        Drops file in System32 directory
        
        PID:5124
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        120⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Kmncnb32.exe
        
        C:\Windows\system32\Kmncnb32.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5592
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        122⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5916
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        124⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        125⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        126⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        127⤵
        Drops file in System32 directory
        
        PID:5816
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        128⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        129⤵
        Modifies registry class
        
        PID:5556
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        130⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        131⤵
        System Location Discovery: System Language Discovery
        
        PID:5760
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5828
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        133⤵
        Modifies registry class
        
        PID:5728
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        134⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        135⤵
        System Location Discovery: System Language Discovery
        
        PID:6212
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        136⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        137⤵
        System Location Discovery: System Language Discovery
        
        PID:6308
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        138⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        139⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        140⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        141⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6536
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        143⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        144⤵
        Drops file in System32 directory
        
        PID:6632
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6676
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        146⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6768
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        148⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        149⤵
        Modifies registry class
        
        PID:6856
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        150⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        151⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        152⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        153⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        154⤵
        Drops file in System32 directory
        
        PID:7100
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        155⤵
        System Location Discovery: System Language Discovery
        
        PID:7136
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        156⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        157⤵
        Drops file in System32 directory
        
        PID:6244
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        158⤵
        System Location Discovery: System Language Discovery
        
        PID:6320
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        159⤵
        Drops file in System32 directory
        
        PID:6368
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        160⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6528
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        162⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        163⤵
        Modifies registry class
        
        PID:6688
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        164⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        165⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        166⤵
        Modifies registry class
        
        PID:6936
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        167⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        168⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        169⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6196
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        170⤵
        Modifies registry class
        
        PID:6324
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        171⤵
        System Location Discovery: System Language Discovery
        
        PID:6480
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        172⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6840
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        174⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        175⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        176⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        177⤵
        Drops file in System32 directory
        
        PID:6752
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        178⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        179⤵
        System Location Discovery: System Language Discovery
        
        PID:6256
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        180⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        181⤵
        System Location Discovery: System Language Discovery
        
        PID:6332
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        182⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6348
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        184⤵
        System Location Discovery: System Language Discovery
        
        PID:7180
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        185⤵
        Drops file in System32 directory
        
        PID:7228
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        186⤵
        System Location Discovery: System Language Discovery
        
        PID:7272
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        187⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7364
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        189⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7408
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        190⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7452
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7496
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        192⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        193⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        194⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        195⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7712
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        197⤵
        System Location Discovery: System Language Discovery
        
        PID:7756
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        198⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        199⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        200⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        201⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7976
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        203⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8064
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8108
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8152
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        207⤵
        Drops file in System32 directory
        
        PID:7076
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        208⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7244
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        209⤵
        System Location Discovery: System Language Discovery
        
        PID:7324
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        210⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        211⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        212⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7528
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        213⤵
        Modifies registry class
        
        PID:7612
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        214⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        215⤵
        Modifies registry class
        
        PID:7744
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        216⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        217⤵
        Modifies registry class
        
        PID:7872
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7948
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        219⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8076
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        221⤵
        System Location Discovery: System Language Discovery
        
        PID:8144
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        222⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7216
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        223⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        224⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        225⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7636
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        227⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        228⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        229⤵
        Drops file in System32 directory
        
        PID:7988
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8096
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        231⤵
        Drops file in System32 directory
        
        PID:7176
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        232⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7372
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        233⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        234⤵
        Modifies registry class
        
        PID:7720
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        235⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        236⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        237⤵
        System Location Discovery: System Language Discovery
        
        PID:8168
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        238⤵
        System Location Discovery: System Language Discovery
        
        PID:7492
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        239⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        240⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        241⤵
        System Location Discovery: System Language Discovery
        
        PID:7260
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        242⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        243⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        244⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7696
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        245⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        246⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        247⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8204
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        248⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8244
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        249⤵
        Modifies registry class
        
        PID:8288
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        250⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8336
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        251⤵
        System Location Discovery: System Language Discovery
        
        PID:8380
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        252⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8424
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        253⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8468
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        254⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        255⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8600
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        257⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        258⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8688
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        259⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8732
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        260⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        261⤵
        System Location Discovery: System Language Discovery
        
        PID:8820
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        262⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        263⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8916
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        264⤵
        System Location Discovery: System Language Discovery
        
        PID:8960
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        265⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9004
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        266⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        267⤵
        Drops file in System32 directory
        
        PID:9100
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        268⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        269⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        270⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        271⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        272⤵
        System Location Discovery: System Language Discovery
        
        PID:8352
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        273⤵
        System Location Discovery: System Language Discovery
        
        PID:8412
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        274⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        275⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        276⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        277⤵
        Modifies registry class
        
        PID:8700
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        278⤵
        Drops file in System32 directory
        
        PID:8768
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        279⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        280⤵
        Drops file in System32 directory
        
        PID:8908
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        281⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        282⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9044
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        283⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        284⤵
        System Location Discovery: System Language Discovery
        
        PID:9200
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        285⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8300
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        286⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        287⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        288⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8612
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        289⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        290⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        291⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        292⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9068
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        293⤵
        Drops file in System32 directory
        
        PID:9188
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        294⤵
        Drops file in System32 directory
        
        PID:8308
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        295⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8544
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        296⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        297⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        298⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        299⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8276
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        300⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        301⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        302⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9140
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        303⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        304⤵
        Modifies registry class
        
        PID:9160
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        305⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        306⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        307⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        308⤵
        Modifies registry class
        
        PID:9260
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        309⤵
        System Location Discovery: System Language Discovery
        
        PID:9304
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        310⤵
        Modifies registry class
        
        PID:9348
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        311⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9392
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        312⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        313⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        314⤵
        
        PID:9524
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        315⤵
        System Location Discovery: System Language Discovery
        
        PID:9568
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        316⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9612
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        317⤵
        Modifies registry class
        
        PID:9656
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        318⤵
        System Location Discovery: System Language Discovery
        
        PID:9704
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        319⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9748
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        320⤵
        System Location Discovery: System Language Discovery
        
        PID:9792
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        321⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9832
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        322⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9876
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        323⤵
        
        PID:9920
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        324⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        325⤵
        Modifies registry class
        
        PID:10012
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        326⤵
        Drops file in System32 directory
        
        PID:10056
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        327⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10100
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        328⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:10144
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        329⤵
        Drops file in System32 directory
        
        PID:10188
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        330⤵
        System Location Discovery: System Language Discovery
        
        PID:10232
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        331⤵
        
        PID:9248
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        332⤵
        
        PID:9332
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        333⤵
        Drops file in System32 directory
        
        PID:9384
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        334⤵
        System Location Discovery: System Language Discovery
        
        PID:9464
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        335⤵
        System Location Discovery: System Language Discovery
        
        PID:9536
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        336⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9600
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        337⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        338⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9740 -s 216
        339⤵
        Program crash
        
        PID:9868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 9740 -ip 9740
1⤵
PID:9840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Acnlgp32.exe

Filesize
90KB

MD5
a114bf600d0f2363ca9eb384125ddd91

SHA1
74efb5ed5c1c123c5667426ddbe7e47b817eecee

SHA256
50c1db0c06e39ed08a37aea133531e43d2a89331e603c63e0cae970acd4e3877

SHA512
129e4bedd9654849f1ef2a46380eb9aed2a6a2eb2cad5f30096682ab74db86cad888b1dad0bd757435d619488c193da37d4b761676caf8a8d7e1c93bfa99455a

Download Submit
C:\Windows\SysWOW64\Ajckij32.exe

Filesize
90KB

MD5
13492a4ed719a91f400cb04abad794e7

SHA1
49bedb572ce69f9cc12277dcd9d3033cc8219eff

SHA256
53a3711cc7031bfd916d51a3d4a11cc50810a14677d8e545ca10f9ba2be8951f

SHA512
dc66694f678c304bb2f716e9709d0112be7c9cba30b77dbc096b62aaba874a070bc048a62e6422463e6872043b4c4eebe81ca923a8830a987da69c919e0d57b1

Download Submit
C:\Windows\SysWOW64\Ajhddjfn.exe

Filesize
90KB

MD5
e1cde83bdddfb92e9ca3adc626cc0016

SHA1
73765e28d82edf602c5b77d06214c523b091a3bd

SHA256
511fb8c74fde60837c099957dfcda12686db036892dab80abc027cc876533ce6

SHA512
ab1be6a8ea2dc14e1c1de4a47bfa145e288223918f75e889f75e9097a6e4d6344af53a0d5caea4c8dcfcf96c7d8fbf2b7fe1ddb32f559332a7dd3b66b748ea67

Download Submit
C:\Windows\SysWOW64\Baicac32.exe

Filesize
90KB

MD5
fbf14e7384b3b2f0c7a194e4f7e0bf0e

SHA1
d05f2c7af28525986adef03448af5fcbe77f38b2

SHA256
15b25e8e34b7fb1dd057a45e3cc8f5cad3378a866b784dad50c810986aeba863

SHA512
d722a66bb6e5bbd5fbe2f5e3230876d03813a282faef600568498acaf7adea1eb628b997fae4466d839552d455909b1041abf1108d3368fd9d2e99368036b79d

Download Submit
C:\Windows\SysWOW64\Bapolp32.dll

Filesize
7KB

MD5
e840a5d0ab47cf940d360df9f212f96d

SHA1
d802ff1c959b3e26818ce3cd7c3a562a1add5610

SHA256
e20289882b06e0faadeb05e72585acef8401ba599fe45d7d09743ca3ac55c2d6

SHA512
788492df391394c8e3d2b54db45c8382d40d197dde892c0ff47683d2b08c09edc1870669b269d109ab0fc540f63ce9d83b77439e671b855ea3985d60f996892f

Download Submit
C:\Windows\SysWOW64\Beglgani.exe

Filesize
90KB

MD5
d6cf24a4c5ce2f6fec036f02f8742e0d

SHA1
7fed2246b5e1d0f45492dac681189b9cdf2b0272

SHA256
e1d8c7b6ef9bd584a4bfa4f96cc0d9d7a25c6ce190d3ef5ba5ba106b8c379774

SHA512
7da9d5c4aad8e253a8f8f53f74c3c2b8b15e6634838c17aac14efa52130e13c5afa17378f6de1b34799703532b268a53d7b7996e571bcc7c08d8de7c9a650bf6

Download Submit
C:\Windows\SysWOW64\Dafbne32.exe

Filesize
90KB

MD5
3cf483c55da3df45ce355aff19c011f2

SHA1
b6138744c66295d3798c1a58868bfd5de14482ee

SHA256
14337dd76ebd472c95a40416731a45eb0ebbf5e11be34ba890a2fa5582601e1f

SHA512
8fdfdfd8bed9793ec1fbf43ea34ac74e6a3da4552235cb638abbd38caca3fa8ca9810d3e090b1f7aed32bde0a78dcb88e2d8237863253a7c3313f98c39ce9bbf

Download Submit
C:\Windows\SysWOW64\Dahode32.exe

Filesize
90KB

MD5
0e57ad6b63356a71b0b7bfc840d1d740

SHA1
c01f3bd100dd967d031ae03587a18abfd93acd45

SHA256
105f56418dacf404b906999fc618ef5a7d976af9d163f9d55f16c62e184311d8

SHA512
bc0fe63b485036413c3791b37d5afbc82491d4a6ad956d7ff81182e132487d6cae3770fd2ede57586feb11329b22b60f3ecd837bc6122cf684ce802f6613d810

Download Submit
C:\Windows\SysWOW64\Danecp32.exe

Filesize
90KB

MD5
9ab1dd88f9c9c33e93181513d995694c

SHA1
93a36144549c024977c04d3d2e0f8e93ab532951

SHA256
9ec29687d0d12172e55d1eb0fc51483f1fcd9e6abcbf0052cd4bd2315bcdc61e

SHA512
c015e942044c06c50a9c4c0abfdfc7ae8043a69922060a18678d4c53421f44ff7897ec167259e9bd906c91b964564323d8318d17addf0f540c6abbc0fac0250c

Download Submit
C:\Windows\SysWOW64\Dddojq32.exe

Filesize
90KB

MD5
562969daf55c8dfe13e3e1774322dec3

SHA1
880b75c47dcac103e96d8e12e78ea890419fbefb

SHA256
bbc8a025e4e7b394a8291454d9d9e565498c3b132d08e38dae7289b06c190e73

SHA512
731038b88d9ce4d3b0be8607d8dec5322a8655b52b708a6811b40bbeea5c3e51e2122c59a5b723c64c4ba19754e9419492f2d674425de65a0bd20fd8a3fd5acc

Download Submit
C:\Windows\SysWOW64\Deagdn32.exe

Filesize
90KB

MD5
083a4aa476d96e1b5feaa5f6c08c19a1

SHA1
799e322a4747e98272bb4ed334033e1a31ec7ff0

SHA256
70404752442100a3f09cc3ce9038a7d267b51aaee737d75391456599d39067ce

SHA512
a3430aba09ac7d09edb6087196eb178ff0251c68bc164e9107decc23c6be279c762c2ee165014826eaa482dad9e44534ed83d72fab169c384ac383f3ba8d4c01

Download Submit
C:\Windows\SysWOW64\Dhbgqohi.exe

Filesize
90KB

MD5
fc9c1f6734a04d197b962a731755b271

SHA1
90e0a8e252fb2431c46d69e0e92f2cc67b29d886

SHA256
6704b42edbaeed0f476fc579d5502a1d6ed1fc0eede3ad9d019d12d9f63e5267

SHA512
033a187ddc631c8b3b782ad65dcbdf57d1734d3368a353c191dee25812f49282a55a7d55fcd44747e87920b35470627d1e438cb06b0620a963a0c3f194ea6548

Download Submit
C:\Windows\SysWOW64\Dhpjkojk.exe

Filesize
90KB

MD5
799154883ddf2c3274ad5b2879f81439

SHA1
90674ecc8a43af42785227ddc5e03337fa3e5a71

SHA256
996457b73417a3dbd3bce7343b9ce556e397662d34bc8b3444726abdf4d9aba9

SHA512
679113858ff35ec9c96f13a28150130799f48d0e156f7cbdd2331f9983cf5ed55961366eea962c794d3de7a869897b98ff65614d817852792f59903754a1a46b

Download Submit
C:\Windows\SysWOW64\Dlijfneg.exe

Filesize
90KB

MD5
ca007dab10f18be7b1830d1e964d007d

SHA1
e18ffcec87dce65f62007887faf9d780f19c57ad

SHA256
dce3bd8afa88aa91464df2276fcf3fbf8777822a1bfbc580f05096831aadb82a

SHA512
9b9efb6b5e8487b62056f5b0a62bbfbd8236b49cbb663329d4af31c4a53f66a87a98020d3877d9868bb6cf43b44ac3b02d1178ae97e5fa51e244a5ca5d647a30

Download Submit
C:\Windows\SysWOW64\Dohfbj32.exe

Filesize
90KB

MD5
ed94d675dec476ff51227fea5091e2d9

SHA1
6178212f3c9f3dbe864755b45db330381244c451

SHA256
014336b45130e18c19922d8e036e29cf0aecd8bdcf42d73a4619decda4dab6cd

SHA512
f30d8124d97d9d2e6d885453183ea31e4b424dc63365f7634185d135247e4fa48cea72e8993e4552361e1cbefafbcd44a78cd16b8d4d3c4f01a9ad681efef18d

Download Submit
C:\Windows\SysWOW64\Dojcgi32.exe

Filesize
90KB

MD5
9621a7063f0de356aafc6080c22391b0

SHA1
0dde3c1f066d58b9f3a0e3c6ab6d8a830dad92de

SHA256
674f75b965cbb90ea3fd11fb42293fc7e8ffa0f93f6c15e48bc7764ea84035f6

SHA512
c5e1d035623226e96b6477712693ff836a35e33214a5e5b3ae38d58c918a8f218416aee68605560e43e3f69f0b24a2eaaa19c3b05e008d4f2b3ff2e417a83580

Download Submit
C:\Windows\SysWOW64\Eamhodmf.exe

Filesize
90KB

MD5
3ab7a4d541b2120d87982495181b4f48

SHA1
537d5e03fa067dade195a2d11627586bc7b56061

SHA256
f008819910991b7477a94b5d833bd4a95a54dce0df5020880768f21eeea4010d

SHA512
b418989fdf426f0ee595b83ae40d58d5194a6f8ad7459f0a07da9439802cec05000a3400f14595482a091e61bae4930613a9ebe1542fc89314784ceefe616f1b

Download Submit
C:\Windows\SysWOW64\Eapedd32.exe

Filesize
90KB

MD5
e3d51f71c97da5f80675f858e66a039b

SHA1
5965b18a25b937193b5fe5a6647703bfbe19f183

SHA256
56345499512d7933dbe6417359be2ba38778669d3904aab35f10189a293a65b0

SHA512
789c7c3a7a9b19f032ac55c36b7464d401ffea14a818d2b99498112071727e7cd9f516d4cd95da3017a352a121d3468b8a835024778cf8e24b3f91fc82451df2

Download Submit
C:\Windows\SysWOW64\Ecandfpd.exe

Filesize
90KB

MD5
43ba40e721765f0e40f4529da899e66f

SHA1
f5710233ece35c5dc3676274f9b7613786fbb8d1

SHA256
72f37006c7299e0353cc056bed5c78fed944f544bc39cc7cc81813d188477d70

SHA512
0b04d2453d0891df721ac0d5a4bd713914659121c02b4f1e6638d05469f7b92867dc4b8616f0d3f9835a7282f8a733a101db751ebfe215e427e2f0c4c74c9a98

Download Submit
C:\Windows\SysWOW64\Echknh32.exe

Filesize
90KB

MD5
0cf1c87b375e37f790b92132948d418a

SHA1
2f080b7f038e521f4f44c35f707aa78c99dd1cd6

SHA256
eb5240978d635c04ebbdc500b9f77b4f173185b73a7918a43b6af9e3407c345c

SHA512
e59633c88e14cfff3a1f5a5f2cd49744f748c45efc6b55e818a16474744e8a5b1f5f1baf6e48d55be7fc9ea959ad49054e4eaad46cb6c1bcbd59e4804f83a53a

Download Submit
C:\Windows\SysWOW64\Edkdkplj.exe

Filesize
90KB

MD5
2bda137bd843d0623ae57445910cfe25

SHA1
81136251d2530742e06a46afb9bf86142b24bdb8

SHA256
9982cede121e8ad8d10634c963ebfe51dbccaffea91bd7e604dd1430c2a8ffc2

SHA512
071c0e2448d97a9457fa90299ee03be43b281621d908b759173b4679fe9d6d8e6e58b641327898822556b1264a1d6a15066995f482b7ab2279d09dec0c89276e

Download Submit
C:\Windows\SysWOW64\Eefhjc32.exe

Filesize
90KB

MD5
c9bfe5ccbdb716b2b66406cf0070a06f

SHA1
9d30bb845fa0856f14586d78e6f342a58913104e

SHA256
29814dab075eecd48e2237e50ea4a0258382a9900aa6e9ff6f7eba464fbd1d82

SHA512
cfaf14e1629f664f797f982830b314211f9c89729b339f764f8732b9511ae7994a490269c723ad0bd1fb146872568df36bb865918c0db33fb31bf6fad8fb3b0f

Download Submit
C:\Windows\SysWOW64\Eemnjbaj.exe

Filesize
90KB

MD5
f29e4e7c321bb79542e4abc063eb7aa0

SHA1
85bb5e35896be6b556a601684eba528873a51f97

SHA256
4fc1c823224f4361e0e8a52e7a9e03a27dfaf93b06562dd081cc52ab95c63f66

SHA512
680747ec9b5eacf603ebd9105f26d008aa57a9e1469f906e2ea12577672307d66139983567ce6bb969dbb7b925d5bc61d6bed2119e619469d5662ce7cdc96f10

Download Submit
C:\Windows\SysWOW64\Eemnjbaj.exe

Filesize
90KB

MD5
1861e4865eac7e63cb36efcccbace7f9

SHA1
8b6f3e76884672a2ad18c43cfd8154b1bd311105

SHA256
01bbfdc2a38878446c0b9d6fdfb57659784686fe370ef3dfe2d2706ebaef5f3f

SHA512
1aa1aab2378babb6c1be8d7b399d1496e82b35bbfd5777d162407f41866abfcba2cbf54a61306992b4bfdcbe7ee3a0654cdebaae5baec2234f16abf758949c4f

Download Submit
C:\Windows\SysWOW64\Eepjpb32.exe

Filesize
90KB

MD5
19fcd5a573a3c7e53ddfc0b854210f07

SHA1
2da208ce674144c5b7e4d471a7ba549225ab1cbe

SHA256
1d979720415909ab4beca2a70db9fdb441b2a64e37918222537a06061ef1303a

SHA512
2c2111cef95035a05c3e621b5ec93904ef918bd76e5aa1b88f09440ee2b2a11461e73cd76d069df1ad828e67880ce7c246b5ba7d1c01c8a09c5c175732ed12db

Download Submit
C:\Windows\SysWOW64\Ehnglm32.exe

Filesize
90KB

MD5
f9bb322b654bb602be113a271c31816c

SHA1
b967746a954fbb67ab984bb8877165eece34fdcc

SHA256
b26933128d19322cd314a0a0ade6cfe683ef3f08e0016a50d1d10a2f611dc5d2

SHA512
90333df3209bc7b8022146b1eb3bb2ff71cde63ced53d47c57d608c286d3debb227be2c86c04d5226e6e59cb83115af539d9d71827fc2d7e8d094aca146a3a36

Download Submit
C:\Windows\SysWOW64\Ekacmjgl.exe

Filesize
90KB

MD5
3af15b498b343f41a47d359802f2be61

SHA1
2da00bd484aae91a171adefc086e2c9b06172abc

SHA256
2c26160acb84998da60250c530c7926a40608624cea2288e993a4a329a8709ff

SHA512
0dd0aef50606229dd94289e821b8ef34ef12ed2802b918ead18a3098321614aa17f34a9c647e94cde1e024df7080eb74e28bbe2e23dd13d45748127ab55af5e9

Download Submit
C:\Windows\SysWOW64\Ekhjmiad.exe

Filesize
90KB

MD5
a2fa5e5839550a8b04f1b3944be053f6

SHA1
d728f080fa316e9d00b7f37b604b9b2b65cb3c69

SHA256
40ee6af890da5b5ccf60f421282a19b961c68ce76d4f51ac71d511fe5924247d

SHA512
bf1b5130fd583bb1d8187a1259c0591c64191f136240bf9482f0a4309642664beb3053b305af3ee7094ae4b0be00ca009121a1aefb5c65f689fc14c1dc43eb2b

Download Submit
C:\Windows\SysWOW64\Ekjfcipa.exe

Filesize
90KB

MD5
b7c2f266428a26d45c6d0ed8d95a6ef9

SHA1
b88b22e7fc0bfb4ef6380798ef88dd875bbe2e90

SHA256
2817b9f178aa31209eac940c87ca0b36eba6137608c46bc8bfe4fae54daac055

SHA512
84472f719a158f09a9cbcc671ac76a4ef5d24171d9742ad7ffead1539f84683d55d4714cc12455730c6d73118620fa34385f7672f21b5d209a27dee0d5d089a2

Download Submit
C:\Windows\SysWOW64\Elbmlmml.exe

Filesize
90KB

MD5
93abc341bc1ac38a5c9fcddd15306c6f

SHA1
e4c9a8128378846880d1bec0b847f5b398350e87

SHA256
bd8c0579281b13e218fc4fc7c0a930dfefb1f193365f028c05cd94f48f0b50e0

SHA512
ecc4aaafe98d66f6c266d6a7e67f33a1b24953d19faba951c6a97952025cee029218f7d5acffe499f643d3c70b604db6c5cfdcfc2da45fe36677aaa6989aec13

Download Submit
C:\Windows\SysWOW64\Eleiam32.exe

Filesize
90KB

MD5
749d8fdc9443a3176234bd4527822535

SHA1
3d875877ff8fa18c482f245d781d4e857e225603

SHA256
2a53a7406bac5da7a0b620473c93676ed287aca087e497b16a4f5db620ba6b9b

SHA512
f56c82aab59873132b38a94910331e395ea75bd9c03bdedc65496b9eb8747af825071b865e212288f5239529ecf65820c752d9d683c0f818352e090a8da3247c

Download Submit
C:\Windows\SysWOW64\Elppfmoo.exe

Filesize
90KB

MD5
dcf6805b57e310eea33342eaf15a90f6

SHA1
d4da78b99a6b2ed9440692dc1391ce54f56baf6c

SHA256
7081428e8cbb49bb86cc62c90890021a293304a589f1f3abb7ff34041c8adf4c

SHA512
6866f2b82fb067c95c3ec4ff585f597a245ed81d8c275502035ecbe0e02d61db29d12b31c9e7a00ee60fec5a1ea691d6aa1aacc8306b4bc395d99a7ed99e82f1

Download Submit
C:\Windows\SysWOW64\Eoaihhlp.exe

Filesize
90KB

MD5
b59ace0037c02f55eb464d5cb8990e4f

SHA1
66938b4164248890b50615f2f40a0a5d5ba4fd01

SHA256
f4e09dcaf767252c90b2992641bb19edca757823d97cffd6e90f4d4769530e43

SHA512
d694a575b8c213aad003b1f6bfb0007868bf66638e2f34f492f01b767d2df8d814dc3e1182370f638dd642c0cf652cd861d229a052bc012396432dd1acb2c4aa

Download Submit
C:\Windows\SysWOW64\Eoolbinc.exe

Filesize
90KB

MD5
6c3228ddc8e30b2cc6a0afe4360f0004

SHA1
feb1644451d43bff538102999e1825f28b3cf81f

SHA256
114a02ba90250a7cb412d850e233c4687a6731f6f730d9266ea21f213a7df1b9

SHA512
23f59365516271f2a3b436f76f70dcb1e62a20c97761cc5cc6681453c3797bb9283afb4d580c5ae998da61e8013966ae122ea70a608bdd35d711c5e590434b21

Download Submit
C:\Windows\SysWOW64\Fafkecel.exe

Filesize
90KB

MD5
5845eac0fa2865a6f04d582f6de8be9f

SHA1
c3e6b04e2b465f21320fca40d964a04d63c4eb23

SHA256
076874c0f37163d17e62de2b2bed0ac36ac51c6402a7233c6bc804a860ca106f

SHA512
1b89dd665f2aa6efd6da7b8c787e06b69ab9e2bf0dedc0340b324d36a08092f9c78c0f1ad99cc568fa864d2f134e0e70fcc3be00d68dec9faae91e2e520899f2

Download Submit
C:\Windows\SysWOW64\Fdegandp.exe

Filesize
90KB

MD5
9fd20114e185a46f9c5d0c4b3252c194

SHA1
75b1383423e9fd75ef906079e8d7148756eb0fde

SHA256
1fd97b25b5fa2d8d47aaa2c891dadc279c86978f7bdbf11eac5357eacb7dc394

SHA512
58fdae9d7555b6ee99f2c0e9ef1d2c286cab278d2b7279a2747f1c13f074c72640a609ab4a773905e41be34e8d4fa864ef71edcb1df97586273ca0bd16ac6876

Download Submit
C:\Windows\SysWOW64\Ffddka32.exe

Filesize
90KB

MD5
b634af88a110ef0ed2c4476f70e2cd30

SHA1
c704b7aeebe3f130a35b7499a8bc6768ac0b2267

SHA256
f6a14f90b84e1027f488c4781c01b415309028804643f78bfca9103ab7048b39

SHA512
27d92d49f6f1b05ab3c821e2c89f02e85c08169b88dfc56bde5847d21426fb290afe17fc5cde0847b9c40f53404be264ab7ac108b9121c96352dec642f57ea2c

Download Submit
C:\Windows\SysWOW64\Fhcpgmjf.exe

Filesize
90KB

MD5
89f10bdc940f53e9557ad30a7a80c7f8

SHA1
82d279b93c46037c2b3e0f4d9ace11a785d90bcd

SHA256
0298f15fe438acaadcb1b862acb2fab6836fdd77c0d14e32e57aa9c467e37c0c

SHA512
31db5c5ad9511bcd11df8fad8352ea4fad6e769fa43b627abadfb649368ce26a2ab679454904affd9ae8b48f86655dd0a5d37c491cd2b083a079ea6cef6569e6

Download Submit
C:\Windows\SysWOW64\Fkmchi32.exe

Filesize
90KB

MD5
966cbbb593a9fa3645e3a538e68356bf

SHA1
f5f463c6d3c794848af64a740d38d74b2e68a86b

SHA256
519918c8bcf4ce2ad82ad2b9f796e30f577bce935b89c938b3582c5c055618cb

SHA512
23b7d986d1e67b6c1993ec712c5be9d0314b794bcd0cb7cfaa0d9eddf4f3a3f2637a9158885dc3fc98da993c8204d9df75e00c1c51f62bf1d018af4a59041801

Download Submit
C:\Windows\SysWOW64\Fkopnh32.exe

Filesize
90KB

MD5
0143de62dcf904bcc9066580bbeaaf64

SHA1
6de76ca299442a2e141c6f385c3048d312d21008

SHA256
bbbe3e54f9e01e36e577d044e30508a3c3935235978a7577249ad42a3e734d93

SHA512
72b27230b45d1811dff38ec0075dff3483a274658c74a647430b4707c2a3d725f7ceaa8718af277c9d46b9485285f4230fce59f1d298712f015e9429cf982133

Download Submit
C:\Windows\SysWOW64\Fojlngce.exe

Filesize
90KB

MD5
554f96a7e10c36c02ca8068ab6f03d8d

SHA1
bfc30a133da2c122053c77705d08509d9f4343f5

SHA256
0a175a25e5acbf92f20a94a5872583c159402846dd936308f190f8c4f738b8e2

SHA512
8218eee6944e9585e3e01f61e394b5ae8a5b32875b7eacb13d40aad08993f70936a8db08e41299fc90464a7b60e160f61fb5fbb79499dd2f2b7d501623353697

Download Submit
C:\Windows\SysWOW64\Iicbehnq.exe

Filesize
90KB

MD5
7d0f77637895fe301234a021389bd302

SHA1
f40245216e480c8652a507029014f49f1e6fe483

SHA256
2bc0858b03b3b777b862d669f9e08ec5c0b852134903d1edfb3c3039cfc082c7

SHA512
f9816cb2053f60441f0a2a0f80fe51b18cfd1025a89a4ee287dca45a06822ddb3336e5f8e2aa3e681252ba90df663422330ae0ee856c91236873d073d7d25456

Download Submit
C:\Windows\SysWOW64\Jcllonma.exe

Filesize
90KB

MD5
e99fff39deba994595f6c225f399b987

SHA1
ee88f480ae2a1baab6d2cce79706b87cbe5bcef0

SHA256
56bf42aafe95a348bb113b3cf4e1232d60abd94cb29c2adc40d95927d7e256d3

SHA512
f6ca3fe593ce35038275ca832137d210d84f3f4010d5292d6a2a3cc6391c5a723aebbd1e1569cfc42973efb86ee7a09cee4e610c4e0ddf267dd492d71659c4a2

Download Submit
C:\Windows\SysWOW64\Jidklf32.exe

Filesize
90KB

MD5
d9b2ffeebb6d49502973a770634cf1d1

SHA1
7abdeb52681f78a71d5348eb33d54143ca94e96a

SHA256
3b570594f54b8d6cf3cc1f9215e7bd041134299712edb9c1ee514854f5d1fcca

SHA512
7cc6e77adca376cb630099132af17fa221a1d413775c949adfcecaad81bccd22c199bf91389ec1bf6c138e492951b156bf3ae5a5da7f87e15c588a8c385fec0e

Download Submit
C:\Windows\SysWOW64\Jplfcpin.exe

Filesize
90KB

MD5
7e12e1605fc3985d8f9131180dcaec81

SHA1
474e08500b784890286645d3dcc3481ee81f79c1

SHA256
af969373aefd692b77234aaae4eddcd5c88d5cd785f6d347da1bf371711c7ad1

SHA512
b4cdf301d63570c5cc28eeaf52c399410700132a1250e2d176c445f2891bcda37bce2f5160d060a6c2a6ec0a1ad6668763057a13ab7fcc19447469b14ea2fde2

Download Submit
C:\Windows\SysWOW64\Lpcfkm32.exe

Filesize
90KB

MD5
79337087119a30c409aca75f3aab254a

SHA1
ebf8531b9195c665774734ab5adf4b77ee06aebb

SHA256
b8538fd68a578cc1dfaea82329238e50b8243f113771e00e7bfc790f9e4df34d

SHA512
5c2e606917de77fe5d5dcba2ba5e8c9ecaccf07c8490fb14cd93b699662f00ffdc4e7896e8edc92e488759acb5d43b3bd621d6987982321d5abfcd2882dc579b

Download Submit
C:\Windows\SysWOW64\Ngbpidjh.exe

Filesize
90KB

MD5
5d1f600b3fd6c76d656828b35350b405

SHA1
17974391e0137b2de119702374cb3b9d4047a27d

SHA256
76fe1492174ed26dcfb937dd528c767dae0f634b47dd4ddfcda011f706a50f74

SHA512
1a0301ab6a343bfe135109ceee1afdd8422b9c1c1d11e521d5a93bc59b6cc7783ae28565a939e5d60e1f0209ccb2deb1742fcc4d37160c5b5d298b7f854486e1

Download Submit
C:\Windows\SysWOW64\Ojoign32.exe

Filesize
90KB

MD5
768f426445bceed766738950794abc50

SHA1
4f41fdb0ae25cf09264ec45d4f19db56553e985f

SHA256
cedcee278d0f4120e44e1c97b6731d3d21bc9e7c5e99e93ee01541b0e9882993

SHA512
5f484e6035142ae6d957d2b3778706bc04f2da149c137e2fc774ff909417584ae2f1cb18192855116be26717cb4ff8cb07c05a19728b40ae8cf9e25f7bec2973

Download Submit
C:\Windows\SysWOW64\Pgnilpah.exe

Filesize
90KB

MD5
f6ec10f969d868f40e8341d8a972199b

SHA1
423be2cf6fe2ccd79002d19e2712fa7466fa98d6

SHA256
b5ea4d4d406b54fc81d0b19f8db00267f0aa12d93a88a87418b88eb15464e9f0

SHA512
3253b2643ca96422e638d31143a6e85bb3a6963a2d9798de6f07beac6197072b6a2300340ed3452f8f435ee98f21340d6b3bcc3c2d6dd7bcfcf03d9f7c586163

Download Submit
C:\Windows\SysWOW64\Pjeoglgc.exe

Filesize
90KB

MD5
c345bb177754c7e57296b99c3002b351

SHA1
df8cf29e36db84ecd239b75ee5bc516a0cfa0c07

SHA256
b477e524c6af1e4cea8b1400028840d8ab0a26120464982476cf75cd46c0d39e

SHA512
a1b55b6dde9b4118d3dc168363d3cfd33d2598639e19e25b2af506a220b267cac4534959d1dbe4f952b74507325c00f5c0281b00039947822c71c1c598305419

Download Submit
C:\Windows\SysWOW64\Qfcfml32.exe

Filesize
90KB

MD5
726ced850f193762332a87cef23f4b87

SHA1
ba993436c4acd01cfdeb8d641a470ce2d91669d6

SHA256
4fb38ca5ef7c86923124e49e454f542d6e3d24934c862390e0aaa265f6a3dfd1

SHA512
ef575f877dea889b3b569aa1f1d625965ffcfa56040d72825ab84408420424aa628e3dec2ac392fa9f7642a2126664d636d6776b242e8a937e70928b3a070a7c

Download Submit
memory/372-63-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/372-599-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/380-460-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/396-344-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/400-47-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/400-585-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/404-496-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/620-442-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/688-424-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/720-191-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/736-256-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/968-36-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1016-578-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1016-40-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1028-120-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1140-216-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1160-96-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1328-376-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1392-310-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1456-466-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1584-266-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1600-252-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1624-436-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1676-346-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1688-298-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1716-490-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1752-551-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1752-7-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1888-430-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1900-448-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1916-232-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2016-143-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2020-334-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2028-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2028-544-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2188-374-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2212-79-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2232-358-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2248-286-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2260-274-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2284-128-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2480-322-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2624-183-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2660-292-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2792-152-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2816-328-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2856-239-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2884-136-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2896-422-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2924-472-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2972-88-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3092-484-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3116-454-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3196-199-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3256-304-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3324-223-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3660-400-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3840-71-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3876-394-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3928-592-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3928-55-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4008-268-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4108-388-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4156-316-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4332-478-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4516-175-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4524-558-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4524-15-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4528-167-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4560-412-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4576-159-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4580-207-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4708-406-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4768-364-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4796-103-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4816-112-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4904-280-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4944-565-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4944-24-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5024-352-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5088-382-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5136-502-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5180-508-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5220-514-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5264-520-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5312-526-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5352-532-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5392-538-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5432-545-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5476-552-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5520-559-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5564-570-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5608-572-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5648-579-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5696-586-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5740-593-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads