c6f98cb601b70bc6f8039b573f998d6610aad6e6b5bf77096c54375769a92b4f

Analysis

max time kernel
62s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/10/2022, 20:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c6f98cb601b70bc6f8039b573f998d6610aad6e6b5bf77096c54375769a92b4f.exe
Size

92KB
MD5

6ffb890f44c2eda9844e30e5d6c5b3f0
SHA1

35136eaab5e0eaf00bf84a07403facc33dbe1583
SHA256

c6f98cb601b70bc6f8039b573f998d6610aad6e6b5bf77096c54375769a92b4f
SHA512

7ac454a2fc0ca3db3128c36370f15440de11ab05d4e16bb74086212aaa53da6d9dbb41d8caae5418a9d91952b99294e6f4a3d9e9725f1be48d588dc94a5f1df5
SSDEEP

1536:VsUE8JqIGzUE+spzv89xW7mVzBy3jLV3BGnMPJKEsztuJO:aUvqIGIETVon+jLlBRh1sN

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 42 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aocfbgmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bcanifcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bipcflpk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cpeogj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	c6f98cb601b70bc6f8039b573f998d6610aad6e6b5bf77096c54375769a92b4f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Piokknbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qgnnhfho.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aqniak32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	c6f98cb601b70bc6f8039b573f998d6610aad6e6b5bf77096c54375769a92b4f.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdpemh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajdqea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aocfbgmp.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhkjkm32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcanifcf.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjhfoc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjhfoc32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qaafppjh.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qgnnhfho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acglbgla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Alppkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhkjkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdpemh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aadbeohe.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajogjaep.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahimfm32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bipcflpk.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bqpafn32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajdqea32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bklcmhaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajogjaep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bklcmhaa.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bbhhobfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bqpafn32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpeogj32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Piokknbe.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aadbeohe.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Alppkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aqniak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ahimfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bbhhobfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qaafppjh.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acglbgla.exe

Executes dropped EXE 21 IoCs

pid	Process
1284	Pdpemh32.exe
1668	Piokknbe.exe
1616	Qaafppjh.exe
1600	Qgnnhfho.exe
1500	Aadbeohe.exe
908	Ajogjaep.exe
268	Acglbgla.exe
520	Alppkm32.exe
1144	Ajdqea32.exe
1000	Aqniak32.exe
1532	Ahimfm32.exe
980	Aocfbgmp.exe
904	Bhkjkm32.exe
1088	Bcanifcf.exe
1952	Bklcmhaa.exe
1540	Bipcflpk.exe
1384	Bbhhobfk.exe
1732	Bqpafn32.exe
608	Cjhfoc32.exe
960	Cpeogj32.exe
1252	Cglghh32.exe

Loads dropped DLL 46 IoCs

pid	Process
1324	c6f98cb601b70bc6f8039b573f998d6610aad6e6b5bf77096c54375769a92b4f.exe
1324	c6f98cb601b70bc6f8039b573f998d6610aad6e6b5bf77096c54375769a92b4f.exe
1284	Pdpemh32.exe
1284	Pdpemh32.exe
1668	Piokknbe.exe
1668	Piokknbe.exe
1616	Qaafppjh.exe
1616	Qaafppjh.exe
1600	Qgnnhfho.exe
1600	Qgnnhfho.exe
1500	Aadbeohe.exe
1500	Aadbeohe.exe
908	Ajogjaep.exe
908	Ajogjaep.exe
268	Acglbgla.exe
268	Acglbgla.exe
520	Alppkm32.exe
520	Alppkm32.exe
1144	Ajdqea32.exe
1144	Ajdqea32.exe
1000	Aqniak32.exe
1000	Aqniak32.exe
1532	Ahimfm32.exe
1532	Ahimfm32.exe
980	Aocfbgmp.exe
980	Aocfbgmp.exe
904	Bhkjkm32.exe
904	Bhkjkm32.exe
1088	Bcanifcf.exe
1088	Bcanifcf.exe
1952	Bklcmhaa.exe
1952	Bklcmhaa.exe
1540	Bipcflpk.exe
1540	Bipcflpk.exe
1384	Bbhhobfk.exe
1384	Bbhhobfk.exe
1732	Bqpafn32.exe
1732	Bqpafn32.exe
608	Cjhfoc32.exe
608	Cjhfoc32.exe
960	Cpeogj32.exe
960	Cpeogj32.exe
292	WerFault.exe
292	WerFault.exe
292	WerFault.exe
292	WerFault.exe

Drops file in System32 directory 63 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Bhkjkm32.exe	Aocfbgmp.exe
File created	C:\Windows\SysWOW64\Piokknbe.exe	Pdpemh32.exe
File created	C:\Windows\SysWOW64\Gmpeca32.dll	Acglbgla.exe
File created	C:\Windows\SysWOW64\Hkjdoh32.dll	Alppkm32.exe
File created	C:\Windows\SysWOW64\Aocfbgmp.exe	Ahimfm32.exe
File created	C:\Windows\SysWOW64\Bcanifcf.exe	Bhkjkm32.exe
File created	C:\Windows\SysWOW64\Bkqihbqe.dll	Aocfbgmp.exe
File opened for modification	C:\Windows\SysWOW64\Bklcmhaa.exe	Bcanifcf.exe
File created	C:\Windows\SysWOW64\Dhhdlomp.dll	Cjhfoc32.exe
File created	C:\Windows\SysWOW64\Chffcaag.dll	Aadbeohe.exe
File opened for modification	C:\Windows\SysWOW64\Acglbgla.exe	Ajogjaep.exe
File opened for modification	C:\Windows\SysWOW64\Ahimfm32.exe	Aqniak32.exe
File created	C:\Windows\SysWOW64\Cokkdaim.dll	Ahimfm32.exe
File created	C:\Windows\SysWOW64\Alppkm32.exe	Acglbgla.exe
File created	C:\Windows\SysWOW64\Clnidbgm.dll	Bklcmhaa.exe
File created	C:\Windows\SysWOW64\Dboilk32.dll	Bbhhobfk.exe
File created	C:\Windows\SysWOW64\Cglghh32.exe	Cpeogj32.exe
File created	C:\Windows\SysWOW64\Hbgdedmd.dll	Bcanifcf.exe
File created	C:\Windows\SysWOW64\Bagfcdog.dll	Bqpafn32.exe
File created	C:\Windows\SysWOW64\Cpeogj32.exe	Cjhfoc32.exe
File created	C:\Windows\SysWOW64\Acglbgla.exe	Ajogjaep.exe
File opened for modification	C:\Windows\SysWOW64\Aocfbgmp.exe	Ahimfm32.exe
File created	C:\Windows\SysWOW64\Bhkjkm32.exe	Aocfbgmp.exe
File created	C:\Windows\SysWOW64\Khdndj32.dll	Bhkjkm32.exe
File opened for modification	C:\Windows\SysWOW64\Pdpemh32.exe	c6f98cb601b70bc6f8039b573f998d6610aad6e6b5bf77096c54375769a92b4f.exe
File opened for modification	C:\Windows\SysWOW64\Aqniak32.exe	Ajdqea32.exe
File created	C:\Windows\SysWOW64\Peopgfge.dll	Aqniak32.exe
File opened for modification	C:\Windows\SysWOW64\Cjhfoc32.exe	Bqpafn32.exe
File created	C:\Windows\SysWOW64\Jbmdnb32.dll	Pdpemh32.exe
File opened for modification	C:\Windows\SysWOW64\Qaafppjh.exe	Piokknbe.exe
File opened for modification	C:\Windows\SysWOW64\Bcanifcf.exe	Bhkjkm32.exe
File opened for modification	C:\Windows\SysWOW64\Bipcflpk.exe	Bklcmhaa.exe
File opened for modification	C:\Windows\SysWOW64\Piokknbe.exe	Pdpemh32.exe
File opened for modification	C:\Windows\SysWOW64\Alppkm32.exe	Acglbgla.exe
File created	C:\Windows\SysWOW64\Aadbeohe.exe	Qgnnhfho.exe
File created	C:\Windows\SysWOW64\Ajogjaep.exe	Aadbeohe.exe
File created	C:\Windows\SysWOW64\Ahimfm32.exe	Aqniak32.exe
File created	C:\Windows\SysWOW64\Pdpemh32.exe	c6f98cb601b70bc6f8039b573f998d6610aad6e6b5bf77096c54375769a92b4f.exe
File created	C:\Windows\SysWOW64\Djaehp32.dll	Ajdqea32.exe
File created	C:\Windows\SysWOW64\Lgmkjn32.dll	Bipcflpk.exe
File opened for modification	C:\Windows\SysWOW64\Qgnnhfho.exe	Qaafppjh.exe
File created	C:\Windows\SysWOW64\Bipcflpk.exe	Bklcmhaa.exe
File created	C:\Windows\SysWOW64\Jclmia32.dll	Cpeogj32.exe
File created	C:\Windows\SysWOW64\Adqkgjao.dll	c6f98cb601b70bc6f8039b573f998d6610aad6e6b5bf77096c54375769a92b4f.exe
File created	C:\Windows\SysWOW64\Qgnnhfho.exe	Qaafppjh.exe
File opened for modification	C:\Windows\SysWOW64\Aadbeohe.exe	Qgnnhfho.exe
File opened for modification	C:\Windows\SysWOW64\Bqpafn32.exe	Bbhhobfk.exe
File created	C:\Windows\SysWOW64\Hfgcia32.dll	Piokknbe.exe
File opened for modification	C:\Windows\SysWOW64\Ajogjaep.exe	Aadbeohe.exe
File created	C:\Windows\SysWOW64\Aqniak32.exe	Ajdqea32.exe
File created	C:\Windows\SysWOW64\Bqpafn32.exe	Bbhhobfk.exe
File created	C:\Windows\SysWOW64\Obniea32.dll	Ajogjaep.exe
File created	C:\Windows\SysWOW64\Ajdqea32.exe	Alppkm32.exe
File created	C:\Windows\SysWOW64\Bklcmhaa.exe	Bcanifcf.exe
File created	C:\Windows\SysWOW64\Cjhfoc32.exe	Bqpafn32.exe
File opened for modification	C:\Windows\SysWOW64\Cpeogj32.exe	Cjhfoc32.exe
File opened for modification	C:\Windows\SysWOW64\Cglghh32.exe	Cpeogj32.exe
File created	C:\Windows\SysWOW64\Napkgpdg.dll	Qaafppjh.exe
File created	C:\Windows\SysWOW64\Mghgfl32.dll	Qgnnhfho.exe
File created	C:\Windows\SysWOW64\Bbhhobfk.exe	Bipcflpk.exe
File opened for modification	C:\Windows\SysWOW64\Bbhhobfk.exe	Bipcflpk.exe
File created	C:\Windows\SysWOW64\Qaafppjh.exe	Piokknbe.exe
File opened for modification	C:\Windows\SysWOW64\Ajdqea32.exe	Alppkm32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
292	1252	WerFault.exe	48

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bcanifcf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aqniak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ahimfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bipcflpk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pdpemh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aadbeohe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Obniea32.dll"	Ajogjaep.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bipcflpk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cjhfoc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbmdnb32.dll"	Pdpemh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chffcaag.dll"	Aadbeohe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkqihbqe.dll"	Aocfbgmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Acglbgla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Peopgfge.dll"	Aqniak32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajogjaep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djaehp32.dll"	Ajdqea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bagfcdog.dll"	Bqpafn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	c6f98cb601b70bc6f8039b573f998d6610aad6e6b5bf77096c54375769a92b4f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Piokknbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dboilk32.dll"	Bbhhobfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mghgfl32.dll"	Qgnnhfho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbgdedmd.dll"	Bcanifcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Napkgpdg.dll"	Qaafppjh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qgnnhfho.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bbhhobfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qgnnhfho.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bhkjkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ajdqea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bbhhobfk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Piokknbe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajdqea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jclmia32.dll"	Cpeogj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	c6f98cb601b70bc6f8039b573f998d6610aad6e6b5bf77096c54375769a92b4f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hkjdoh32.dll"	Alppkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clnidbgm.dll"	Bklcmhaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aadbeohe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bklcmhaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ahimfm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aocfbgmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bklcmhaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjhfoc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cpeogj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pdpemh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qaafppjh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfgcia32.dll"	Piokknbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bcanifcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lgmkjn32.dll"	Bipcflpk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cpeogj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	c6f98cb601b70bc6f8039b573f998d6610aad6e6b5bf77096c54375769a92b4f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	c6f98cb601b70bc6f8039b573f998d6610aad6e6b5bf77096c54375769a92b4f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ajogjaep.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Alppkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cokkdaim.dll"	Ahimfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aocfbgmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bhkjkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Adqkgjao.dll"	c6f98cb601b70bc6f8039b573f998d6610aad6e6b5bf77096c54375769a92b4f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qaafppjh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dhhdlomp.dll"	Cjhfoc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmpeca32.dll"	Acglbgla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Alppkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aqniak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khdndj32.dll"	Bhkjkm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bqpafn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bqpafn32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 1284	1324	c6f98cb601b70bc6f8039b573f998d6610aad6e6b5bf77096c54375769a92b4f.exe	28
PID 1324 wrote to memory of 1284	1324	c6f98cb601b70bc6f8039b573f998d6610aad6e6b5bf77096c54375769a92b4f.exe	28
PID 1324 wrote to memory of 1284	1324	c6f98cb601b70bc6f8039b573f998d6610aad6e6b5bf77096c54375769a92b4f.exe	28
PID 1324 wrote to memory of 1284	1324	c6f98cb601b70bc6f8039b573f998d6610aad6e6b5bf77096c54375769a92b4f.exe	28
PID 1284 wrote to memory of 1668	1284	Pdpemh32.exe	29
PID 1284 wrote to memory of 1668	1284	Pdpemh32.exe	29
PID 1284 wrote to memory of 1668	1284	Pdpemh32.exe	29
PID 1284 wrote to memory of 1668	1284	Pdpemh32.exe	29
PID 1668 wrote to memory of 1616	1668	Piokknbe.exe	30
PID 1668 wrote to memory of 1616	1668	Piokknbe.exe	30
PID 1668 wrote to memory of 1616	1668	Piokknbe.exe	30
PID 1668 wrote to memory of 1616	1668	Piokknbe.exe	30
PID 1616 wrote to memory of 1600	1616	Qaafppjh.exe	31
PID 1616 wrote to memory of 1600	1616	Qaafppjh.exe	31
PID 1616 wrote to memory of 1600	1616	Qaafppjh.exe	31
PID 1616 wrote to memory of 1600	1616	Qaafppjh.exe	31
PID 1600 wrote to memory of 1500	1600	Qgnnhfho.exe	32
PID 1600 wrote to memory of 1500	1600	Qgnnhfho.exe	32
PID 1600 wrote to memory of 1500	1600	Qgnnhfho.exe	32
PID 1600 wrote to memory of 1500	1600	Qgnnhfho.exe	32
PID 1500 wrote to memory of 908	1500	Aadbeohe.exe	33
PID 1500 wrote to memory of 908	1500	Aadbeohe.exe	33
PID 1500 wrote to memory of 908	1500	Aadbeohe.exe	33
PID 1500 wrote to memory of 908	1500	Aadbeohe.exe	33
PID 908 wrote to memory of 268	908	Ajogjaep.exe	34
PID 908 wrote to memory of 268	908	Ajogjaep.exe	34
PID 908 wrote to memory of 268	908	Ajogjaep.exe	34
PID 908 wrote to memory of 268	908	Ajogjaep.exe	34
PID 268 wrote to memory of 520	268	Acglbgla.exe	35
PID 268 wrote to memory of 520	268	Acglbgla.exe	35
PID 268 wrote to memory of 520	268	Acglbgla.exe	35
PID 268 wrote to memory of 520	268	Acglbgla.exe	35
PID 520 wrote to memory of 1144	520	Alppkm32.exe	36
PID 520 wrote to memory of 1144	520	Alppkm32.exe	36
PID 520 wrote to memory of 1144	520	Alppkm32.exe	36
PID 520 wrote to memory of 1144	520	Alppkm32.exe	36
PID 1144 wrote to memory of 1000	1144	Ajdqea32.exe	37
PID 1144 wrote to memory of 1000	1144	Ajdqea32.exe	37
PID 1144 wrote to memory of 1000	1144	Ajdqea32.exe	37
PID 1144 wrote to memory of 1000	1144	Ajdqea32.exe	37
PID 1000 wrote to memory of 1532	1000	Aqniak32.exe	38
PID 1000 wrote to memory of 1532	1000	Aqniak32.exe	38
PID 1000 wrote to memory of 1532	1000	Aqniak32.exe	38
PID 1000 wrote to memory of 1532	1000	Aqniak32.exe	38
PID 1532 wrote to memory of 980	1532	Ahimfm32.exe	39
PID 1532 wrote to memory of 980	1532	Ahimfm32.exe	39
PID 1532 wrote to memory of 980	1532	Ahimfm32.exe	39
PID 1532 wrote to memory of 980	1532	Ahimfm32.exe	39
PID 980 wrote to memory of 904	980	Aocfbgmp.exe	40
PID 980 wrote to memory of 904	980	Aocfbgmp.exe	40
PID 980 wrote to memory of 904	980	Aocfbgmp.exe	40
PID 980 wrote to memory of 904	980	Aocfbgmp.exe	40
PID 904 wrote to memory of 1088	904	Bhkjkm32.exe	41
PID 904 wrote to memory of 1088	904	Bhkjkm32.exe	41
PID 904 wrote to memory of 1088	904	Bhkjkm32.exe	41
PID 904 wrote to memory of 1088	904	Bhkjkm32.exe	41
PID 1088 wrote to memory of 1952	1088	Bcanifcf.exe	42
PID 1088 wrote to memory of 1952	1088	Bcanifcf.exe	42
PID 1088 wrote to memory of 1952	1088	Bcanifcf.exe	42
PID 1088 wrote to memory of 1952	1088	Bcanifcf.exe	42
PID 1952 wrote to memory of 1540	1952	Bklcmhaa.exe	43
PID 1952 wrote to memory of 1540	1952	Bklcmhaa.exe	43
PID 1952 wrote to memory of 1540	1952	Bklcmhaa.exe	43
PID 1952 wrote to memory of 1540	1952	Bklcmhaa.exe	43

C:\Users\Admin\AppData\Local\Temp\c6f98cb601b70bc6f8039b573f998d6610aad6e6b5bf77096c54375769a92b4f.exe
"C:\Users\Admin\AppData\Local\Temp\c6f98cb601b70bc6f8039b573f998d6610aad6e6b5bf77096c54375769a92b4f.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\SysWOW64\Pdpemh32.exe
  C:\Windows\system32\Pdpemh32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Windows\SysWOW64\Piokknbe.exe
    C:\Windows\system32\Piokknbe.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1668
  - - C:\Windows\SysWOW64\Qaafppjh.exe
      C:\Windows\system32\Qaafppjh.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1616
    - - C:\Windows\SysWOW64\Qgnnhfho.exe
        
        C:\Windows\system32\Qgnnhfho.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1600
      - C:\Windows\SysWOW64\Aadbeohe.exe
        
        C:\Windows\system32\Aadbeohe.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1500
        
        C:\Windows\SysWOW64\Ajogjaep.exe
        
        C:\Windows\system32\Ajogjaep.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:908
        
        C:\Windows\SysWOW64\Acglbgla.exe
        
        C:\Windows\system32\Acglbgla.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:268
        
        C:\Windows\SysWOW64\Alppkm32.exe
        
        C:\Windows\system32\Alppkm32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:520
        
        C:\Windows\SysWOW64\Ajdqea32.exe
        
        C:\Windows\system32\Ajdqea32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1144
        
        C:\Windows\SysWOW64\Aqniak32.exe
        
        C:\Windows\system32\Aqniak32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1000
        
        C:\Windows\SysWOW64\Ahimfm32.exe
        
        C:\Windows\system32\Ahimfm32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1532
        
        C:\Windows\SysWOW64\Aocfbgmp.exe
        
        C:\Windows\system32\Aocfbgmp.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:980
        
        C:\Windows\SysWOW64\Bhkjkm32.exe
        
        C:\Windows\system32\Bhkjkm32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:904
        
        C:\Windows\SysWOW64\Bcanifcf.exe
        
        C:\Windows\system32\Bcanifcf.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1088
        
        C:\Windows\SysWOW64\Bklcmhaa.exe
        
        C:\Windows\system32\Bklcmhaa.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1952
        
        C:\Windows\SysWOW64\Bipcflpk.exe
        
        C:\Windows\system32\Bipcflpk.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Modifies registry class
        
        PID:1540
        
        C:\Windows\SysWOW64\Bbhhobfk.exe
        
        C:\Windows\system32\Bbhhobfk.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Modifies registry class
        
        PID:1384
        
        C:\Windows\SysWOW64\Bqpafn32.exe
        
        C:\Windows\system32\Bqpafn32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Modifies registry class
        
        PID:1732
        
        C:\Windows\SysWOW64\Cjhfoc32.exe
        
        C:\Windows\system32\Cjhfoc32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Modifies registry class
        
        PID:608
        
        C:\Windows\SysWOW64\Cpeogj32.exe
        
        C:\Windows\system32\Cpeogj32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Modifies registry class
        
        PID:960
        
        C:\Windows\SysWOW64\Cglghh32.exe
        
        C:\Windows\system32\Cglghh32.exe
        22⤵
        Executes dropped EXE
        
        PID:1252
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 140
        23⤵
        Loads dropped DLL
        Program crash
        
        PID:292

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aadbeohe.exe

Filesize
92KB

MD5
43115dc4b4f86251407e9711f067c065

SHA1
459056cc66672f78b3509fa8a652026a582ca067

SHA256
b1320ae3fc1a5f96a917f867d6a88ca80df4c8dd823a9cf5c69cc3b33f450f69

SHA512
ef24f9025b80bb6f1fbbf0247470a1de51bb45bf522d68b93b382b572bfbcb036eadd729233240669d4a0b3d5e2bade04ba6676b18847354e81d399ad0cf451e

Download Submit
C:\Windows\SysWOW64\Aadbeohe.exe

Filesize
92KB

MD5
43115dc4b4f86251407e9711f067c065

SHA1
459056cc66672f78b3509fa8a652026a582ca067

SHA256
b1320ae3fc1a5f96a917f867d6a88ca80df4c8dd823a9cf5c69cc3b33f450f69

SHA512
ef24f9025b80bb6f1fbbf0247470a1de51bb45bf522d68b93b382b572bfbcb036eadd729233240669d4a0b3d5e2bade04ba6676b18847354e81d399ad0cf451e

Download Submit
C:\Windows\SysWOW64\Acglbgla.exe

Filesize
92KB

MD5
065244b7bf53313cd80c112a4edd13fb

SHA1
12464426a3aff27ee2da1623cc9c43532cc900c1

SHA256
db5c9b70a519ac9cdd05675c236dcb1eeb6d6f7571ca0a0da49069d664ee2e83

SHA512
265a1893dc050f3643bc5fb3ca47a24194fb519602bbc00786385c276e4f5b73c4c972eb69970250dba4df5e9b478991eea2eb08d987ae290bb5e0974232984e

Download Submit
C:\Windows\SysWOW64\Acglbgla.exe

Filesize
92KB

MD5
065244b7bf53313cd80c112a4edd13fb

SHA1
12464426a3aff27ee2da1623cc9c43532cc900c1

SHA256
db5c9b70a519ac9cdd05675c236dcb1eeb6d6f7571ca0a0da49069d664ee2e83

SHA512
265a1893dc050f3643bc5fb3ca47a24194fb519602bbc00786385c276e4f5b73c4c972eb69970250dba4df5e9b478991eea2eb08d987ae290bb5e0974232984e

Download Submit
C:\Windows\SysWOW64\Ahimfm32.exe

Filesize
92KB

MD5
6493ad4d520e34001068a64c60881302

SHA1
3e72112508d246970379f8d7dc44d041d8fb4b22

SHA256
d8d36e41f8df9a615658b4a8c8cbd6388a906ee71b8831038b6222853e3c4811

SHA512
6675d335ac1cd66fe2d87ca8d90b7ea136d65256f75f6dddb0f524db6196a60bb9734368c9b4285b9bc8b756e1d90c143c47b5cb66640e55eab4816672d0142b

Download Submit
C:\Windows\SysWOW64\Ahimfm32.exe

Filesize
92KB

MD5
6493ad4d520e34001068a64c60881302

SHA1
3e72112508d246970379f8d7dc44d041d8fb4b22

SHA256
d8d36e41f8df9a615658b4a8c8cbd6388a906ee71b8831038b6222853e3c4811

SHA512
6675d335ac1cd66fe2d87ca8d90b7ea136d65256f75f6dddb0f524db6196a60bb9734368c9b4285b9bc8b756e1d90c143c47b5cb66640e55eab4816672d0142b

Download Submit
C:\Windows\SysWOW64\Ajdqea32.exe

Filesize
92KB

MD5
36200fc95ee30963b08cfa0cc0ec0e41

SHA1
93185601c386073da609c3931652c9d45a69428d

SHA256
78c9d08d745ba0ba8744ccf42feebeaf497ded057f8cf8293808328b9f1b8b61

SHA512
d4b2b40567177776cfa41722557d953d2f929e9ac7acb73e281d19636e4777cbdf02389c659b9979fc025d35e0840ad71d8748eff1df81d0fe966597dcfde4ea

Download Submit
C:\Windows\SysWOW64\Ajdqea32.exe

Filesize
92KB

MD5
36200fc95ee30963b08cfa0cc0ec0e41

SHA1
93185601c386073da609c3931652c9d45a69428d

SHA256
78c9d08d745ba0ba8744ccf42feebeaf497ded057f8cf8293808328b9f1b8b61

SHA512
d4b2b40567177776cfa41722557d953d2f929e9ac7acb73e281d19636e4777cbdf02389c659b9979fc025d35e0840ad71d8748eff1df81d0fe966597dcfde4ea

Download Submit
C:\Windows\SysWOW64\Ajogjaep.exe

Filesize
92KB

MD5
7f8bedeba9588a39355ae14b351a72d1

SHA1
6888374e6ce4af0064590324896422615b19ba74

SHA256
e3010e8adaeaabd003bf337771c62ce5a435ddb115cce5870c398106f5df23e0

SHA512
f0826395b5845b781e3a24164b67608c8767a899a17205fee01272655bf0e3756c7a544693d62b3515e5b5e4efdef061d63efaaff45adb9cf53890377bf389f1

Download Submit
C:\Windows\SysWOW64\Ajogjaep.exe

Filesize
92KB

MD5
7f8bedeba9588a39355ae14b351a72d1

SHA1
6888374e6ce4af0064590324896422615b19ba74

SHA256
e3010e8adaeaabd003bf337771c62ce5a435ddb115cce5870c398106f5df23e0

SHA512
f0826395b5845b781e3a24164b67608c8767a899a17205fee01272655bf0e3756c7a544693d62b3515e5b5e4efdef061d63efaaff45adb9cf53890377bf389f1

Download Submit
C:\Windows\SysWOW64\Alppkm32.exe

Filesize
92KB

MD5
ca986de9d7663d6c6e49174572ef573a

SHA1
fe220a5c1ef37a4f24471718253559ee9e0bc56b

SHA256
63c1b609e5651a269223936c47a50c05952f03e384fb58e91f4ad424d628bcac

SHA512
72a158c7d08de496780c9137e5d0cfafd3af73cf8157c15ffa20bd4dee6fab7fcc9def89d54cf75da0e36a12be202f9ebf7c19e275cb678b6d75e947e1919cae

Download Submit
C:\Windows\SysWOW64\Alppkm32.exe

Filesize
92KB

MD5
ca986de9d7663d6c6e49174572ef573a

SHA1
fe220a5c1ef37a4f24471718253559ee9e0bc56b

SHA256
63c1b609e5651a269223936c47a50c05952f03e384fb58e91f4ad424d628bcac

SHA512
72a158c7d08de496780c9137e5d0cfafd3af73cf8157c15ffa20bd4dee6fab7fcc9def89d54cf75da0e36a12be202f9ebf7c19e275cb678b6d75e947e1919cae

Download Submit
C:\Windows\SysWOW64\Aocfbgmp.exe

Filesize
92KB

MD5
8f5908abfc0599162920e33aa8d92072

SHA1
b5834d67ce954985a644fc745d38dac0c90fbe35

SHA256
f06346a72794b4be1cc928c5304872aaa707c5ed40210b5989fa5979f3b5eb70

SHA512
65dfaedbc97d20b3c3445f811b0a862ec8391ed7b8c397f0cdb98943faef2659f2e41ff6475cf024b6ae1e5a8ea1091c754b8ae002f984803e53dd85b5f6ed3b

Download Submit
C:\Windows\SysWOW64\Aocfbgmp.exe

Filesize
92KB

MD5
8f5908abfc0599162920e33aa8d92072

SHA1
b5834d67ce954985a644fc745d38dac0c90fbe35

SHA256
f06346a72794b4be1cc928c5304872aaa707c5ed40210b5989fa5979f3b5eb70

SHA512
65dfaedbc97d20b3c3445f811b0a862ec8391ed7b8c397f0cdb98943faef2659f2e41ff6475cf024b6ae1e5a8ea1091c754b8ae002f984803e53dd85b5f6ed3b

Download Submit
C:\Windows\SysWOW64\Aqniak32.exe

Filesize
92KB

MD5
0ef7446813775fe436021e1438f4437a

SHA1
9afdc0a0e40f2caf964f388b3ee188f63454ed4b

SHA256
779aae1c782a9b119d12ff16ade2369df89ed91fd6d6b752135796dd7be71f83

SHA512
7abd7857064bbaaadcccac3c0ff256eae05e3a2bc2027932907d48ab609fe4736ca12ed51391ab0fc0a2c2259fe82dea67501212715e036bab72fa41a1fc81a2

Download Submit
C:\Windows\SysWOW64\Aqniak32.exe

Filesize
92KB

MD5
0ef7446813775fe436021e1438f4437a

SHA1
9afdc0a0e40f2caf964f388b3ee188f63454ed4b

SHA256
779aae1c782a9b119d12ff16ade2369df89ed91fd6d6b752135796dd7be71f83

SHA512
7abd7857064bbaaadcccac3c0ff256eae05e3a2bc2027932907d48ab609fe4736ca12ed51391ab0fc0a2c2259fe82dea67501212715e036bab72fa41a1fc81a2

Download Submit
C:\Windows\SysWOW64\Bcanifcf.exe

Filesize
92KB

MD5
6e8fb2f2686ab4e29c1891ba8a24816c

SHA1
5c94cb16dbc6f1757da020bba7ecdc53a052f5f4

SHA256
d94d5b5d29d9d61a0a0c37ca6babeae02544f35d21816c69d6ce516310b7d451

SHA512
5d885238cf776ec19dfd79d713c21fa96bc370d0444353eb0cf01d49a1b6b96d69f7b3036a4511e0e038a135e86075642fa5a5c03f55ec03b6fa38004dee2a84

Download Submit
C:\Windows\SysWOW64\Bcanifcf.exe

Filesize
92KB

MD5
6e8fb2f2686ab4e29c1891ba8a24816c

SHA1
5c94cb16dbc6f1757da020bba7ecdc53a052f5f4

SHA256
d94d5b5d29d9d61a0a0c37ca6babeae02544f35d21816c69d6ce516310b7d451

SHA512
5d885238cf776ec19dfd79d713c21fa96bc370d0444353eb0cf01d49a1b6b96d69f7b3036a4511e0e038a135e86075642fa5a5c03f55ec03b6fa38004dee2a84

Download Submit
C:\Windows\SysWOW64\Bhkjkm32.exe

Filesize
92KB

MD5
13e0b9987a5a9dd934c2d37a42ed5755

SHA1
db552f0c9b4bd5b948371b2cc11a89237aacc41b

SHA256
5b758f61f974ef33539b84917a73487467da4bdc5199dee6130d77f9f6519080

SHA512
c79dd0f764426cac92693368863aa25a6ed777168045379b7593ad2c235f73aacc94caf09ec949caeba1f022b26a96880b7dd002fb6ec81ac4437341a2da9622

Download Submit
C:\Windows\SysWOW64\Bhkjkm32.exe

Filesize
92KB

MD5
13e0b9987a5a9dd934c2d37a42ed5755

SHA1
db552f0c9b4bd5b948371b2cc11a89237aacc41b

SHA256
5b758f61f974ef33539b84917a73487467da4bdc5199dee6130d77f9f6519080

SHA512
c79dd0f764426cac92693368863aa25a6ed777168045379b7593ad2c235f73aacc94caf09ec949caeba1f022b26a96880b7dd002fb6ec81ac4437341a2da9622

Download Submit
C:\Windows\SysWOW64\Bipcflpk.exe

Filesize
92KB

MD5
957096ff0a63092cb67fde8b85460951

SHA1
9830546b8027e26b7a241aa2a7a85cde49fefefb

SHA256
16ba5b493ce0637506751f08dd2cb6fcd76abea7a52369e5c5dc5409cc51665d

SHA512
1fad6f92413355aaf4bbb3450fca34cbae4fe269fb1280db63044e13289c801e3e550456c29248a21dafa2dd26af82a85ca1e84f2c7e7f0309477abbe7892079

Download Submit
C:\Windows\SysWOW64\Bipcflpk.exe

Filesize
92KB

MD5
957096ff0a63092cb67fde8b85460951

SHA1
9830546b8027e26b7a241aa2a7a85cde49fefefb

SHA256
16ba5b493ce0637506751f08dd2cb6fcd76abea7a52369e5c5dc5409cc51665d

SHA512
1fad6f92413355aaf4bbb3450fca34cbae4fe269fb1280db63044e13289c801e3e550456c29248a21dafa2dd26af82a85ca1e84f2c7e7f0309477abbe7892079

Download Submit
C:\Windows\SysWOW64\Bklcmhaa.exe

Filesize
92KB

MD5
e8d467f1266c3ac67fb7cda4a1e575f5

SHA1
31aeef820db7782135bf8ec06a2cf127aca2ffff

SHA256
09624ff9f4162200bd69eabd74eb9726bdd3b1a353f330b1a0ff036dca4649f7

SHA512
a382c7ecea9d502a6fa804b5c76b3bcd540837a976a98be2472c8486ba7cdd3e73ac93e7540fe41f98c30b51fed359b91bb8c1cd63d7ed3f05aab58379591cd8

Download Submit
C:\Windows\SysWOW64\Bklcmhaa.exe

Filesize
92KB

MD5
e8d467f1266c3ac67fb7cda4a1e575f5

SHA1
31aeef820db7782135bf8ec06a2cf127aca2ffff

SHA256
09624ff9f4162200bd69eabd74eb9726bdd3b1a353f330b1a0ff036dca4649f7

SHA512
a382c7ecea9d502a6fa804b5c76b3bcd540837a976a98be2472c8486ba7cdd3e73ac93e7540fe41f98c30b51fed359b91bb8c1cd63d7ed3f05aab58379591cd8

Download Submit
C:\Windows\SysWOW64\Pdpemh32.exe

Filesize
92KB

MD5
e356e591c8660d2e0e44c252a90991e9

SHA1
1cca0aa790ec9534ffdcfba284c03135a63765ca

SHA256
cb3c6855ddd8d571eca528526169b6fb498651712b015ff631fc4680ed124dfa

SHA512
5021f7be7fcfa84c2f994ff58e6c99d545445c2fa367b5db836025ff11b57dcbe3ee189e527f7d1c226befbf9a02139d94130364c8287366ca9d91131fecb123

Download Submit
C:\Windows\SysWOW64\Pdpemh32.exe

Filesize
92KB

MD5
e356e591c8660d2e0e44c252a90991e9

SHA1
1cca0aa790ec9534ffdcfba284c03135a63765ca

SHA256
cb3c6855ddd8d571eca528526169b6fb498651712b015ff631fc4680ed124dfa

SHA512
5021f7be7fcfa84c2f994ff58e6c99d545445c2fa367b5db836025ff11b57dcbe3ee189e527f7d1c226befbf9a02139d94130364c8287366ca9d91131fecb123

Download Submit
C:\Windows\SysWOW64\Piokknbe.exe

Filesize
92KB

MD5
cf0b047b05306cef9b9b8e0913f9e90d

SHA1
9be5e0bdcc98d4a66e8aa761840e60a77c205702

SHA256
d66f559823bfc0d4e8cf7157333374ac4480712eeb9d89b00e4a2f2aed194eb8

SHA512
160a00ce2e4a046e763412cbac8fac9b153b3f19cd9ba98acffad183831b3ec4d2ebe36983d20020848461cf728726dca02c297322f8f2a391aac6f560fb54d9

Download Submit
C:\Windows\SysWOW64\Piokknbe.exe

Filesize
92KB

MD5
cf0b047b05306cef9b9b8e0913f9e90d

SHA1
9be5e0bdcc98d4a66e8aa761840e60a77c205702

SHA256
d66f559823bfc0d4e8cf7157333374ac4480712eeb9d89b00e4a2f2aed194eb8

SHA512
160a00ce2e4a046e763412cbac8fac9b153b3f19cd9ba98acffad183831b3ec4d2ebe36983d20020848461cf728726dca02c297322f8f2a391aac6f560fb54d9

Download Submit
C:\Windows\SysWOW64\Qaafppjh.exe

Filesize
92KB

MD5
18cbd3581889761ca2c3465349ef6d78

SHA1
5d1b2612782e0e43ae5c487eb4b58e4a07817e8e

SHA256
c5f61585481025ef520079b4f8f4ed2dc05c35287c6afdb5a6de487e18536d83

SHA512
003ea4afdab5acb506e575ecb698bc9fd83fbf93a9dff0f27ab69658ef8c8eb689723f4cc2a0ce004a68b124178b42bcdcd6819e03ecfe37f56c116acfe7daf8

Download Submit
C:\Windows\SysWOW64\Qaafppjh.exe

Filesize
92KB

MD5
18cbd3581889761ca2c3465349ef6d78

SHA1
5d1b2612782e0e43ae5c487eb4b58e4a07817e8e

SHA256
c5f61585481025ef520079b4f8f4ed2dc05c35287c6afdb5a6de487e18536d83

SHA512
003ea4afdab5acb506e575ecb698bc9fd83fbf93a9dff0f27ab69658ef8c8eb689723f4cc2a0ce004a68b124178b42bcdcd6819e03ecfe37f56c116acfe7daf8

Download Submit
C:\Windows\SysWOW64\Qgnnhfho.exe

Filesize
92KB

MD5
27de6a3e4b489cfadca21c9aa4695073

SHA1
088d95f4dc4c0b6e40eb9d01e426a059c0559d0d

SHA256
1f8e126d4f52a1362f2d18caa75205e4081ab075187989c310191db132060fa0

SHA512
7b1cb81a82d7a0216297e2f68faca2cc60a64f9e2fb08feabf2ac9ac7439370b5d9162cbd6bc6f7905d8730b4f680fcf3a0e633aa808c7347cdb30c0544f2593

Download Submit
C:\Windows\SysWOW64\Qgnnhfho.exe

Filesize
92KB

MD5
27de6a3e4b489cfadca21c9aa4695073

SHA1
088d95f4dc4c0b6e40eb9d01e426a059c0559d0d

SHA256
1f8e126d4f52a1362f2d18caa75205e4081ab075187989c310191db132060fa0

SHA512
7b1cb81a82d7a0216297e2f68faca2cc60a64f9e2fb08feabf2ac9ac7439370b5d9162cbd6bc6f7905d8730b4f680fcf3a0e633aa808c7347cdb30c0544f2593

Download Submit
\Windows\SysWOW64\Aadbeohe.exe

Filesize
92KB

MD5
43115dc4b4f86251407e9711f067c065

SHA1
459056cc66672f78b3509fa8a652026a582ca067

SHA256
b1320ae3fc1a5f96a917f867d6a88ca80df4c8dd823a9cf5c69cc3b33f450f69

SHA512
ef24f9025b80bb6f1fbbf0247470a1de51bb45bf522d68b93b382b572bfbcb036eadd729233240669d4a0b3d5e2bade04ba6676b18847354e81d399ad0cf451e

Download Submit
\Windows\SysWOW64\Aadbeohe.exe

Filesize
92KB

MD5
43115dc4b4f86251407e9711f067c065

SHA1
459056cc66672f78b3509fa8a652026a582ca067

SHA256
b1320ae3fc1a5f96a917f867d6a88ca80df4c8dd823a9cf5c69cc3b33f450f69

SHA512
ef24f9025b80bb6f1fbbf0247470a1de51bb45bf522d68b93b382b572bfbcb036eadd729233240669d4a0b3d5e2bade04ba6676b18847354e81d399ad0cf451e

Download Submit
\Windows\SysWOW64\Acglbgla.exe

Filesize
92KB

MD5
065244b7bf53313cd80c112a4edd13fb

SHA1
12464426a3aff27ee2da1623cc9c43532cc900c1

SHA256
db5c9b70a519ac9cdd05675c236dcb1eeb6d6f7571ca0a0da49069d664ee2e83

SHA512
265a1893dc050f3643bc5fb3ca47a24194fb519602bbc00786385c276e4f5b73c4c972eb69970250dba4df5e9b478991eea2eb08d987ae290bb5e0974232984e

Download Submit
\Windows\SysWOW64\Acglbgla.exe

Filesize
92KB

MD5
065244b7bf53313cd80c112a4edd13fb

SHA1
12464426a3aff27ee2da1623cc9c43532cc900c1

SHA256
db5c9b70a519ac9cdd05675c236dcb1eeb6d6f7571ca0a0da49069d664ee2e83

SHA512
265a1893dc050f3643bc5fb3ca47a24194fb519602bbc00786385c276e4f5b73c4c972eb69970250dba4df5e9b478991eea2eb08d987ae290bb5e0974232984e

Download Submit
\Windows\SysWOW64\Ahimfm32.exe

Filesize
92KB

MD5
6493ad4d520e34001068a64c60881302

SHA1
3e72112508d246970379f8d7dc44d041d8fb4b22

SHA256
d8d36e41f8df9a615658b4a8c8cbd6388a906ee71b8831038b6222853e3c4811

SHA512
6675d335ac1cd66fe2d87ca8d90b7ea136d65256f75f6dddb0f524db6196a60bb9734368c9b4285b9bc8b756e1d90c143c47b5cb66640e55eab4816672d0142b

Download Submit
\Windows\SysWOW64\Ahimfm32.exe

Filesize
92KB

MD5
6493ad4d520e34001068a64c60881302

SHA1
3e72112508d246970379f8d7dc44d041d8fb4b22

SHA256
d8d36e41f8df9a615658b4a8c8cbd6388a906ee71b8831038b6222853e3c4811

SHA512
6675d335ac1cd66fe2d87ca8d90b7ea136d65256f75f6dddb0f524db6196a60bb9734368c9b4285b9bc8b756e1d90c143c47b5cb66640e55eab4816672d0142b

Download Submit
\Windows\SysWOW64\Ajdqea32.exe

Filesize
92KB

MD5
36200fc95ee30963b08cfa0cc0ec0e41

SHA1
93185601c386073da609c3931652c9d45a69428d

SHA256
78c9d08d745ba0ba8744ccf42feebeaf497ded057f8cf8293808328b9f1b8b61

SHA512
d4b2b40567177776cfa41722557d953d2f929e9ac7acb73e281d19636e4777cbdf02389c659b9979fc025d35e0840ad71d8748eff1df81d0fe966597dcfde4ea

Download Submit
\Windows\SysWOW64\Ajdqea32.exe

Filesize
92KB

MD5
36200fc95ee30963b08cfa0cc0ec0e41

SHA1
93185601c386073da609c3931652c9d45a69428d

SHA256
78c9d08d745ba0ba8744ccf42feebeaf497ded057f8cf8293808328b9f1b8b61

SHA512
d4b2b40567177776cfa41722557d953d2f929e9ac7acb73e281d19636e4777cbdf02389c659b9979fc025d35e0840ad71d8748eff1df81d0fe966597dcfde4ea

Download Submit
\Windows\SysWOW64\Ajogjaep.exe

Filesize
92KB

MD5
7f8bedeba9588a39355ae14b351a72d1

SHA1
6888374e6ce4af0064590324896422615b19ba74

SHA256
e3010e8adaeaabd003bf337771c62ce5a435ddb115cce5870c398106f5df23e0

SHA512
f0826395b5845b781e3a24164b67608c8767a899a17205fee01272655bf0e3756c7a544693d62b3515e5b5e4efdef061d63efaaff45adb9cf53890377bf389f1

Download Submit
\Windows\SysWOW64\Ajogjaep.exe

Filesize
92KB

MD5
7f8bedeba9588a39355ae14b351a72d1

SHA1
6888374e6ce4af0064590324896422615b19ba74

SHA256
e3010e8adaeaabd003bf337771c62ce5a435ddb115cce5870c398106f5df23e0

SHA512
f0826395b5845b781e3a24164b67608c8767a899a17205fee01272655bf0e3756c7a544693d62b3515e5b5e4efdef061d63efaaff45adb9cf53890377bf389f1

Download Submit
\Windows\SysWOW64\Alppkm32.exe

Filesize
92KB

MD5
ca986de9d7663d6c6e49174572ef573a

SHA1
fe220a5c1ef37a4f24471718253559ee9e0bc56b

SHA256
63c1b609e5651a269223936c47a50c05952f03e384fb58e91f4ad424d628bcac

SHA512
72a158c7d08de496780c9137e5d0cfafd3af73cf8157c15ffa20bd4dee6fab7fcc9def89d54cf75da0e36a12be202f9ebf7c19e275cb678b6d75e947e1919cae

Download Submit
\Windows\SysWOW64\Alppkm32.exe

Filesize
92KB

MD5
ca986de9d7663d6c6e49174572ef573a

SHA1
fe220a5c1ef37a4f24471718253559ee9e0bc56b

SHA256
63c1b609e5651a269223936c47a50c05952f03e384fb58e91f4ad424d628bcac

SHA512
72a158c7d08de496780c9137e5d0cfafd3af73cf8157c15ffa20bd4dee6fab7fcc9def89d54cf75da0e36a12be202f9ebf7c19e275cb678b6d75e947e1919cae

Download Submit
\Windows\SysWOW64\Aocfbgmp.exe

Filesize
92KB

MD5
8f5908abfc0599162920e33aa8d92072

SHA1
b5834d67ce954985a644fc745d38dac0c90fbe35

SHA256
f06346a72794b4be1cc928c5304872aaa707c5ed40210b5989fa5979f3b5eb70

SHA512
65dfaedbc97d20b3c3445f811b0a862ec8391ed7b8c397f0cdb98943faef2659f2e41ff6475cf024b6ae1e5a8ea1091c754b8ae002f984803e53dd85b5f6ed3b

Download Submit
\Windows\SysWOW64\Aocfbgmp.exe

Filesize
92KB

MD5
8f5908abfc0599162920e33aa8d92072

SHA1
b5834d67ce954985a644fc745d38dac0c90fbe35

SHA256
f06346a72794b4be1cc928c5304872aaa707c5ed40210b5989fa5979f3b5eb70

SHA512
65dfaedbc97d20b3c3445f811b0a862ec8391ed7b8c397f0cdb98943faef2659f2e41ff6475cf024b6ae1e5a8ea1091c754b8ae002f984803e53dd85b5f6ed3b

Download Submit
\Windows\SysWOW64\Aqniak32.exe

Filesize
92KB

MD5
0ef7446813775fe436021e1438f4437a

SHA1
9afdc0a0e40f2caf964f388b3ee188f63454ed4b

SHA256
779aae1c782a9b119d12ff16ade2369df89ed91fd6d6b752135796dd7be71f83

SHA512
7abd7857064bbaaadcccac3c0ff256eae05e3a2bc2027932907d48ab609fe4736ca12ed51391ab0fc0a2c2259fe82dea67501212715e036bab72fa41a1fc81a2

Download Submit
\Windows\SysWOW64\Aqniak32.exe

Filesize
92KB

MD5
0ef7446813775fe436021e1438f4437a

SHA1
9afdc0a0e40f2caf964f388b3ee188f63454ed4b

SHA256
779aae1c782a9b119d12ff16ade2369df89ed91fd6d6b752135796dd7be71f83

SHA512
7abd7857064bbaaadcccac3c0ff256eae05e3a2bc2027932907d48ab609fe4736ca12ed51391ab0fc0a2c2259fe82dea67501212715e036bab72fa41a1fc81a2

Download Submit
\Windows\SysWOW64\Bcanifcf.exe

Filesize
92KB

MD5
6e8fb2f2686ab4e29c1891ba8a24816c

SHA1
5c94cb16dbc6f1757da020bba7ecdc53a052f5f4

SHA256
d94d5b5d29d9d61a0a0c37ca6babeae02544f35d21816c69d6ce516310b7d451

SHA512
5d885238cf776ec19dfd79d713c21fa96bc370d0444353eb0cf01d49a1b6b96d69f7b3036a4511e0e038a135e86075642fa5a5c03f55ec03b6fa38004dee2a84

Download Submit
\Windows\SysWOW64\Bcanifcf.exe

Filesize
92KB

MD5
6e8fb2f2686ab4e29c1891ba8a24816c

SHA1
5c94cb16dbc6f1757da020bba7ecdc53a052f5f4

SHA256
d94d5b5d29d9d61a0a0c37ca6babeae02544f35d21816c69d6ce516310b7d451

SHA512
5d885238cf776ec19dfd79d713c21fa96bc370d0444353eb0cf01d49a1b6b96d69f7b3036a4511e0e038a135e86075642fa5a5c03f55ec03b6fa38004dee2a84

Download Submit
\Windows\SysWOW64\Bhkjkm32.exe

Filesize
92KB

MD5
13e0b9987a5a9dd934c2d37a42ed5755

SHA1
db552f0c9b4bd5b948371b2cc11a89237aacc41b

SHA256
5b758f61f974ef33539b84917a73487467da4bdc5199dee6130d77f9f6519080

SHA512
c79dd0f764426cac92693368863aa25a6ed777168045379b7593ad2c235f73aacc94caf09ec949caeba1f022b26a96880b7dd002fb6ec81ac4437341a2da9622

Download Submit
\Windows\SysWOW64\Bhkjkm32.exe

Filesize
92KB

MD5
13e0b9987a5a9dd934c2d37a42ed5755

SHA1
db552f0c9b4bd5b948371b2cc11a89237aacc41b

SHA256
5b758f61f974ef33539b84917a73487467da4bdc5199dee6130d77f9f6519080

SHA512
c79dd0f764426cac92693368863aa25a6ed777168045379b7593ad2c235f73aacc94caf09ec949caeba1f022b26a96880b7dd002fb6ec81ac4437341a2da9622

Download Submit
\Windows\SysWOW64\Bipcflpk.exe

Filesize
92KB

MD5
957096ff0a63092cb67fde8b85460951

SHA1
9830546b8027e26b7a241aa2a7a85cde49fefefb

SHA256
16ba5b493ce0637506751f08dd2cb6fcd76abea7a52369e5c5dc5409cc51665d

SHA512
1fad6f92413355aaf4bbb3450fca34cbae4fe269fb1280db63044e13289c801e3e550456c29248a21dafa2dd26af82a85ca1e84f2c7e7f0309477abbe7892079

Download Submit
\Windows\SysWOW64\Bipcflpk.exe

Filesize
92KB

MD5
957096ff0a63092cb67fde8b85460951

SHA1
9830546b8027e26b7a241aa2a7a85cde49fefefb

SHA256
16ba5b493ce0637506751f08dd2cb6fcd76abea7a52369e5c5dc5409cc51665d

SHA512
1fad6f92413355aaf4bbb3450fca34cbae4fe269fb1280db63044e13289c801e3e550456c29248a21dafa2dd26af82a85ca1e84f2c7e7f0309477abbe7892079

Download Submit
\Windows\SysWOW64\Bklcmhaa.exe

Filesize
92KB

MD5
e8d467f1266c3ac67fb7cda4a1e575f5

SHA1
31aeef820db7782135bf8ec06a2cf127aca2ffff

SHA256
09624ff9f4162200bd69eabd74eb9726bdd3b1a353f330b1a0ff036dca4649f7

SHA512
a382c7ecea9d502a6fa804b5c76b3bcd540837a976a98be2472c8486ba7cdd3e73ac93e7540fe41f98c30b51fed359b91bb8c1cd63d7ed3f05aab58379591cd8

Download Submit
\Windows\SysWOW64\Bklcmhaa.exe

Filesize
92KB

MD5
e8d467f1266c3ac67fb7cda4a1e575f5

SHA1
31aeef820db7782135bf8ec06a2cf127aca2ffff

SHA256
09624ff9f4162200bd69eabd74eb9726bdd3b1a353f330b1a0ff036dca4649f7

SHA512
a382c7ecea9d502a6fa804b5c76b3bcd540837a976a98be2472c8486ba7cdd3e73ac93e7540fe41f98c30b51fed359b91bb8c1cd63d7ed3f05aab58379591cd8

Download Submit
\Windows\SysWOW64\Pdpemh32.exe

Filesize
92KB

MD5
e356e591c8660d2e0e44c252a90991e9

SHA1
1cca0aa790ec9534ffdcfba284c03135a63765ca

SHA256
cb3c6855ddd8d571eca528526169b6fb498651712b015ff631fc4680ed124dfa

SHA512
5021f7be7fcfa84c2f994ff58e6c99d545445c2fa367b5db836025ff11b57dcbe3ee189e527f7d1c226befbf9a02139d94130364c8287366ca9d91131fecb123

Download Submit
\Windows\SysWOW64\Pdpemh32.exe

Filesize
92KB

MD5
e356e591c8660d2e0e44c252a90991e9

SHA1
1cca0aa790ec9534ffdcfba284c03135a63765ca

SHA256
cb3c6855ddd8d571eca528526169b6fb498651712b015ff631fc4680ed124dfa

SHA512
5021f7be7fcfa84c2f994ff58e6c99d545445c2fa367b5db836025ff11b57dcbe3ee189e527f7d1c226befbf9a02139d94130364c8287366ca9d91131fecb123

Download Submit
\Windows\SysWOW64\Piokknbe.exe

Filesize
92KB

MD5
cf0b047b05306cef9b9b8e0913f9e90d

SHA1
9be5e0bdcc98d4a66e8aa761840e60a77c205702

SHA256
d66f559823bfc0d4e8cf7157333374ac4480712eeb9d89b00e4a2f2aed194eb8

SHA512
160a00ce2e4a046e763412cbac8fac9b153b3f19cd9ba98acffad183831b3ec4d2ebe36983d20020848461cf728726dca02c297322f8f2a391aac6f560fb54d9

Download Submit
\Windows\SysWOW64\Piokknbe.exe

Filesize
92KB

MD5
cf0b047b05306cef9b9b8e0913f9e90d

SHA1
9be5e0bdcc98d4a66e8aa761840e60a77c205702

SHA256
d66f559823bfc0d4e8cf7157333374ac4480712eeb9d89b00e4a2f2aed194eb8

SHA512
160a00ce2e4a046e763412cbac8fac9b153b3f19cd9ba98acffad183831b3ec4d2ebe36983d20020848461cf728726dca02c297322f8f2a391aac6f560fb54d9

Download Submit
\Windows\SysWOW64\Qaafppjh.exe

Filesize
92KB

MD5
18cbd3581889761ca2c3465349ef6d78

SHA1
5d1b2612782e0e43ae5c487eb4b58e4a07817e8e

SHA256
c5f61585481025ef520079b4f8f4ed2dc05c35287c6afdb5a6de487e18536d83

SHA512
003ea4afdab5acb506e575ecb698bc9fd83fbf93a9dff0f27ab69658ef8c8eb689723f4cc2a0ce004a68b124178b42bcdcd6819e03ecfe37f56c116acfe7daf8

Download Submit
\Windows\SysWOW64\Qaafppjh.exe

Filesize
92KB

MD5
18cbd3581889761ca2c3465349ef6d78

SHA1
5d1b2612782e0e43ae5c487eb4b58e4a07817e8e

SHA256
c5f61585481025ef520079b4f8f4ed2dc05c35287c6afdb5a6de487e18536d83

SHA512
003ea4afdab5acb506e575ecb698bc9fd83fbf93a9dff0f27ab69658ef8c8eb689723f4cc2a0ce004a68b124178b42bcdcd6819e03ecfe37f56c116acfe7daf8

Download Submit
\Windows\SysWOW64\Qgnnhfho.exe

Filesize
92KB

MD5
27de6a3e4b489cfadca21c9aa4695073

SHA1
088d95f4dc4c0b6e40eb9d01e426a059c0559d0d

SHA256
1f8e126d4f52a1362f2d18caa75205e4081ab075187989c310191db132060fa0

SHA512
7b1cb81a82d7a0216297e2f68faca2cc60a64f9e2fb08feabf2ac9ac7439370b5d9162cbd6bc6f7905d8730b4f680fcf3a0e633aa808c7347cdb30c0544f2593

Download Submit
\Windows\SysWOW64\Qgnnhfho.exe

Filesize
92KB

MD5
27de6a3e4b489cfadca21c9aa4695073

SHA1
088d95f4dc4c0b6e40eb9d01e426a059c0559d0d

SHA256
1f8e126d4f52a1362f2d18caa75205e4081ab075187989c310191db132060fa0

SHA512
7b1cb81a82d7a0216297e2f68faca2cc60a64f9e2fb08feabf2ac9ac7439370b5d9162cbd6bc6f7905d8730b4f680fcf3a0e633aa808c7347cdb30c0544f2593

Download Submit
memory/268-149-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/520-150-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/608-161-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/904-155-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/908-148-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/960-162-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/980-154-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1000-152-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1088-156-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1144-151-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1252-163-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1284-61-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1284-143-0x0000000000220000-0x0000000000252000-memory.dmp

Filesize
200KB

Download
memory/1324-60-0x0000000000220000-0x0000000000252000-memory.dmp

Filesize
200KB

Download
memory/1324-59-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1384-159-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1500-147-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1532-153-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1540-158-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1600-146-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1616-145-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1668-144-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1732-160-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1952-157-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download