14d3efa9b5f9437a5e623b3b9a685bda980f24dc7d3618d1dd60f81098224fdd

Analysis

max time kernel
117s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 19:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14d3efa9b5f9437a5e623b3b9a685bda980f24dc7d3618d1dd60f81098224fdd.exe
Size

448KB
MD5

c1aeb285db3f8455304a9c156cfb2fe7
SHA1

86228126ed343fe2c8fc305545bba96c4830dfda
SHA256

14d3efa9b5f9437a5e623b3b9a685bda980f24dc7d3618d1dd60f81098224fdd
SHA512

9cf98c0098f26fa99c7b85b40a8f4b155fed2703951176e409a55042ca514f8ab0fe7a3c9a7f6616ff292a3e91296ca363767942d1ccd2f39b595b72ba124844
SSDEEP

6144:QgfQIPQ///NR5fLYG3eujPQ///NR5fqZo4tjS6Y:g/NcZ7/NC64tm6Y

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afockelf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Blhpqhlh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bkmmaeap.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Knchpiom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dnmhpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmohno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lfjfecno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Enkmfolf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aplaoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnnkgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcepkfld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gipdap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njkkbehl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gejopl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpkmal32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amkhmoap.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Keceoj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edjgfcec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkdhjknm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hlhccj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gijmad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gkcigjel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gikdkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lnjgfb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hhfpbpdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oidhlb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gpqjglii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kjjiej32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aednci32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gejopl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojhiogdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fhmigagd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ggpbjkpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ckmehb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gpecbk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afpjel32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Coqncejg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fohfbpgi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgobel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bddjpd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eejeiocj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fpimlfke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fmmmfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gijmad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hidgai32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjpode32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eaceghcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Igigla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojgjndno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dbnmke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iedjmioj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lqkqhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbphglbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fnhbmgmk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aoofle32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Blhpqhlh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jphkkpbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jphkkpbp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aokkahlo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnljkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dnljkk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imiehfao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jnnnfalp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jlfhke32.exe

Executes dropped EXE 64 IoCs

pid	Process
1596	Edjgfcec.exe
1988	Edopabqn.exe
4776	Fhmigagd.exe
4572	Fajgkfio.exe
4960	Gkdhjknm.exe
640	Ggpbjkpl.exe
1652	Gdfoio32.exe
3120	Hdmein32.exe
2892	Lajagj32.exe
2644	Lnpofnhk.exe
3972	Laqhhi32.exe
4424	Llhikacp.exe
2912	Mjpbam32.exe
3860	Mnnkgl32.exe
320	Nemmoe32.exe
3552	Nacmdf32.exe
2880	Nefped32.exe
1468	Oidhlb32.exe
2480	Oboijgbl.exe
3624	Ooejohhq.exe
4932	Oimkbaed.exe
4660	Pcepkfld.exe
3512	Plndcl32.exe
1760	Pefhlaie.exe
2904	Plbmokop.exe
2000	Achegd32.exe
1448	Aoofle32.exe
2788	Aoabad32.exe
4344	Ajggomog.exe
3848	Aodogdmn.exe
692	Blhpqhlh.exe
2748	Bkmmaeap.exe
4788	Bjnmpl32.exe
3556	Bcfahbpo.exe
3240	Bkdcbd32.exe
1336	Ccbadp32.exe
4280	Ckmehb32.exe
4936	Ccgjopal.exe
1416	Dmalne32.exe
2384	Dflmlj32.exe
1812	Dfoiaj32.exe
5096	Eiobceef.exe
1076	Elpkep32.exe
5084	Epndknin.exe
1160	Ejchhgid.exe
552	Emdajb32.exe
540	Fpejlmcf.exe
4220	Fbfcmhpg.exe
1292	Fpjcgm32.exe
4216	Fmpqfq32.exe
628	Gpqjglii.exe
3412	Gbabigfj.exe
3816	Gpecbk32.exe
4328	Gipdap32.exe
4840	Hdhedh32.exe
4864	Hlcjhkdp.exe
4020	Higjaoci.exe
2764	Hlhccj32.exe
3592	Iinqbn32.exe
2316	Iknmla32.exe
4768	Innfnl32.exe
3352	Igigla32.exe
4352	Jgkdbacp.exe
3088	Jcbdgb32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Kkpbin32.exe	Jknfcofa.exe
File created	C:\Windows\SysWOW64\Aqhblk32.dll	Oacoqnci.exe
File created	C:\Windows\SysWOW64\Ppolhcnm.exe	Phcgcqab.exe
File created	C:\Windows\SysWOW64\Hbobifpp.dll	Cggimh32.exe
File created	C:\Windows\SysWOW64\Fjoiip32.dll	Mcdeeq32.exe
File created	C:\Windows\SysWOW64\Efeihb32.exe	Efblbbqd.exe
File created	C:\Windows\SysWOW64\Gejhef32.exe	Galoohke.exe
File created	C:\Windows\SysWOW64\Fnebjidl.dll	Kiikpnmj.exe
File opened for modification	C:\Windows\SysWOW64\Fohfbpgi.exe	Fbbicl32.exe
File created	C:\Windows\SysWOW64\Oedlic32.dll	Hjmodffo.exe
File created	C:\Windows\SysWOW64\Oimkbaed.exe	Ooejohhq.exe
File opened for modification	C:\Windows\SysWOW64\Bhblllfo.exe	Bddcenpi.exe
File created	C:\Windows\SysWOW64\Dafppp32.exe	Cacckp32.exe
File created	C:\Windows\SysWOW64\Khgbqkhj.exe	Jojdlfeo.exe
File created	C:\Windows\SysWOW64\Nfgklkoc.exe	Mbibfm32.exe
File created	C:\Windows\SysWOW64\Clbidkde.dll	Cmgqpkip.exe
File opened for modification	C:\Windows\SysWOW64\Aoabad32.exe	Aoofle32.exe
File created	C:\Windows\SysWOW64\Blnoga32.exe	Bahkih32.exe
File created	C:\Windows\SysWOW64\Bghgmioe.dll	Cacckp32.exe
File created	C:\Windows\SysWOW64\Ipbaol32.exe	Hhimhobl.exe
File created	C:\Windows\SysWOW64\Hlglnp32.dll	Jldbpl32.exe
File created	C:\Windows\SysWOW64\Ecfjqmbc.dll	Mbibfm32.exe
File opened for modification	C:\Windows\SysWOW64\Pidlqb32.exe	Pmkofa32.exe
File created	C:\Windows\SysWOW64\Odanidih.dll	Eajlhg32.exe
File created	C:\Windows\SysWOW64\Igigla32.exe	Innfnl32.exe
File created	C:\Windows\SysWOW64\Jgmjmjnb.exe	Jenmcggo.exe
File created	C:\Windows\SysWOW64\Aooold32.dll	Lqkqhm32.exe
File created	C:\Windows\SysWOW64\Mgphpe32.exe	Mcbpjg32.exe
File opened for modification	C:\Windows\SysWOW64\Bgdemb32.exe	Baepolni.exe
File opened for modification	C:\Windows\SysWOW64\Fpjcgm32.exe	Fbfcmhpg.exe
File created	C:\Windows\SysWOW64\Acibndof.dll	Kkgdhp32.exe
File opened for modification	C:\Windows\SysWOW64\Blhpqhlh.exe	Aodogdmn.exe
File created	C:\Windows\SysWOW64\Jcbdgb32.exe	Jgkdbacp.exe
File created	C:\Windows\SysWOW64\Iikikigb.dll	Chlflabp.exe
File opened for modification	C:\Windows\SysWOW64\Gdknpp32.exe	Gkcigjel.exe
File created	C:\Windows\SysWOW64\Llngbabj.exe	Lhpnlclc.exe
File created	C:\Windows\SysWOW64\Hfombjbg.dll	Hdmein32.exe
File opened for modification	C:\Windows\SysWOW64\Hgeihiac.exe	Heepfn32.exe
File created	C:\Windows\SysWOW64\Kbpnnj32.dll	Dfoiaj32.exe
File created	C:\Windows\SysWOW64\Lmafqb32.dll	Mjkblhfo.exe
File created	C:\Windows\SysWOW64\Bohgljdl.dll	Kjgeedch.exe
File created	C:\Windows\SysWOW64\Boenhgdd.exe	Amcehdod.exe
File opened for modification	C:\Windows\SysWOW64\Gpdennml.exe	Gijmad32.exe
File created	C:\Windows\SysWOW64\Gbhibfek.dll	Pmkofa32.exe
File opened for modification	C:\Windows\SysWOW64\Ccbadp32.exe	Bkdcbd32.exe
File created	C:\Windows\SysWOW64\Gipdap32.exe	Gpecbk32.exe
File created	C:\Windows\SysWOW64\Fadggj32.dll	Qhmqdemc.exe
File created	C:\Windows\SysWOW64\Afpjel32.exe	Qhjmdp32.exe
File opened for modification	C:\Windows\SysWOW64\Ihpcinld.exe	Ilibdmgp.exe
File created	C:\Windows\SysWOW64\Pdkjmfeo.dll	Aoofle32.exe
File created	C:\Windows\SysWOW64\Fkldkg32.dll	Napjdpcn.exe
File opened for modification	C:\Windows\SysWOW64\Ojgjndno.exe	Odjeljhd.exe
File opened for modification	C:\Windows\SysWOW64\Pdmdnadc.exe	Ppolhcnm.exe
File created	C:\Windows\SysWOW64\Ehenqf32.dll	Dkekjdck.exe
File created	C:\Windows\SysWOW64\Ipamlopb.dll	Ledepn32.exe
File created	C:\Windows\SysWOW64\Iogkekkb.dll	Ckeimm32.exe
File created	C:\Windows\SysWOW64\Jphkkpbp.exe	Jgmjmjnb.exe
File created	C:\Windows\SysWOW64\Phahglpk.dll	Bkmmaeap.exe
File created	C:\Windows\SysWOW64\Hdhedh32.exe	Gipdap32.exe
File created	C:\Windows\SysWOW64\Oclkgccf.exe	Nagiji32.exe
File created	C:\Windows\SysWOW64\Cqhcce32.dll	Ckmehb32.exe
File created	C:\Windows\SysWOW64\Gpecbk32.exe	Gbabigfj.exe
File opened for modification	C:\Windows\SysWOW64\Eajlhg32.exe	Eqkondfl.exe
File created	C:\Windows\SysWOW64\Qhjmdp32.exe	Pdmdnadc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1300	2652	WerFault.exe	401

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmalne32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Higjaoci.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Igigla32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cocjiehd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipbaol32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afockelf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmjmekgn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gmdcfidg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lnjgfb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckmehb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aaohcj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jknfcofa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bahkih32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Imiehfao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jeapcq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nbbeml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Edopabqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lqkqhm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fohfbpgi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kiikpnmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljdkll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbgfhnhi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcfahbpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kblpcndd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lqikmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fmmmfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ioolkncg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipoheakj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqklkbbi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmkofa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eaceghcg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fklcgk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pehngkcg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gikdkj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hlglidlo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lfjfecno.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dnljkk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pefhlaie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bddjpd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hjmodffo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Epndknin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jgkdbacp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kjjiej32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chlflabp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Efblbbqd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gncchb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kjblje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afpjel32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aoioli32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbkfbcpb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdaile32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbfkceca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdpaeehj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hlpfhe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mledmg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kkpbin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ilnlom32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jojdlfeo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oiagde32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gdknpp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lhpnlclc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ooejohhq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajggomog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iialhaad.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aamebb32.dll"	Cocjiehd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdockf32.dll"	Nmhijd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nmhijd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iinqbn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dflmlj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bnffda32.dll"	Ccgjopal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgklej32.dll"	Gdfoio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aqhblk32.dll"	Oacoqnci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cbkfbcpb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbfkceca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bcfahbpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nchcpi32.dll"	Chnbbqpn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjoiip32.dll"	Mcdeeq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eaecci32.dll"	Eaceghcg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Llngbabj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjpqjh32.dll"	Bcfahbpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aaohcj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Phcgcqab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Galoohke.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nbphglbe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fhmigagd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nbbeml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dkedonpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Boenhgdd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gimqajgh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jgmjmjnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lckggdbo.dll"	Ihpcinld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnoefe32.dll"	Ddmhhd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fpejlmcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kjjbjd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjohgj32.dll"	Khgbqkhj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cpogkhnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ioolkncg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oajpfn32.dll"	Higjaoci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blknem32.dll"	Glfmgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gifffn32.dll"	Hhfpbpdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpiijfll.dll"	Ilibdmgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pefhlaie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnpckhnk.dll"	Nfgklkoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bekdaogi.dll"	Llngbabj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eejeiocj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hlglidlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnpkdp32.dll"	Oclkgccf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kiikpnmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpkehj32.dll"	Aplaoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qfohjf32.dll"	Pejkmk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lcnfohmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdkohe32.dll"	Lgjijmin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jjpode32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkddhfnh.dll"	Baepolni.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Llhikacp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Elpkep32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Epndknin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bhblllfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nfgklkoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmbnnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fklcgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fijgdejm.dll"	Nefped32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gkalbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dodebo32.dll"	Cigkdmel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbhgkfkg.dll"	Jeaiij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhkhop32.dll"	Aibibp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebmenh32.dll"	Doaneiop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lfjfecno.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 1596	4956	14d3efa9b5f9437a5e623b3b9a685bda980f24dc7d3618d1dd60f81098224fdd.exe	86
PID 4956 wrote to memory of 1596	4956	14d3efa9b5f9437a5e623b3b9a685bda980f24dc7d3618d1dd60f81098224fdd.exe	86
PID 4956 wrote to memory of 1596	4956	14d3efa9b5f9437a5e623b3b9a685bda980f24dc7d3618d1dd60f81098224fdd.exe	86
PID 1596 wrote to memory of 1988	1596	Edjgfcec.exe	88
PID 1596 wrote to memory of 1988	1596	Edjgfcec.exe	88
PID 1596 wrote to memory of 1988	1596	Edjgfcec.exe	88
PID 1988 wrote to memory of 4776	1988	Edopabqn.exe	89
PID 1988 wrote to memory of 4776	1988	Edopabqn.exe	89
PID 1988 wrote to memory of 4776	1988	Edopabqn.exe	89
PID 4776 wrote to memory of 4572	4776	Fhmigagd.exe	90
PID 4776 wrote to memory of 4572	4776	Fhmigagd.exe	90
PID 4776 wrote to memory of 4572	4776	Fhmigagd.exe	90
PID 4572 wrote to memory of 4960	4572	Fajgkfio.exe	91
PID 4572 wrote to memory of 4960	4572	Fajgkfio.exe	91
PID 4572 wrote to memory of 4960	4572	Fajgkfio.exe	91
PID 4960 wrote to memory of 640	4960	Gkdhjknm.exe	92
PID 4960 wrote to memory of 640	4960	Gkdhjknm.exe	92
PID 4960 wrote to memory of 640	4960	Gkdhjknm.exe	92
PID 640 wrote to memory of 1652	640	Ggpbjkpl.exe	93
PID 640 wrote to memory of 1652	640	Ggpbjkpl.exe	93
PID 640 wrote to memory of 1652	640	Ggpbjkpl.exe	93
PID 1652 wrote to memory of 3120	1652	Gdfoio32.exe	94
PID 1652 wrote to memory of 3120	1652	Gdfoio32.exe	94
PID 1652 wrote to memory of 3120	1652	Gdfoio32.exe	94
PID 3120 wrote to memory of 2892	3120	Hdmein32.exe	95
PID 3120 wrote to memory of 2892	3120	Hdmein32.exe	95
PID 3120 wrote to memory of 2892	3120	Hdmein32.exe	95
PID 2892 wrote to memory of 2644	2892	Lajagj32.exe	96
PID 2892 wrote to memory of 2644	2892	Lajagj32.exe	96
PID 2892 wrote to memory of 2644	2892	Lajagj32.exe	96
PID 2644 wrote to memory of 3972	2644	Lnpofnhk.exe	97
PID 2644 wrote to memory of 3972	2644	Lnpofnhk.exe	97
PID 2644 wrote to memory of 3972	2644	Lnpofnhk.exe	97
PID 3972 wrote to memory of 4424	3972	Laqhhi32.exe	98
PID 3972 wrote to memory of 4424	3972	Laqhhi32.exe	98
PID 3972 wrote to memory of 4424	3972	Laqhhi32.exe	98
PID 4424 wrote to memory of 2912	4424	Llhikacp.exe	99
PID 4424 wrote to memory of 2912	4424	Llhikacp.exe	99
PID 4424 wrote to memory of 2912	4424	Llhikacp.exe	99
PID 2912 wrote to memory of 3860	2912	Mjpbam32.exe	100
PID 2912 wrote to memory of 3860	2912	Mjpbam32.exe	100
PID 2912 wrote to memory of 3860	2912	Mjpbam32.exe	100
PID 3860 wrote to memory of 320	3860	Mnnkgl32.exe	101
PID 3860 wrote to memory of 320	3860	Mnnkgl32.exe	101
PID 3860 wrote to memory of 320	3860	Mnnkgl32.exe	101
PID 320 wrote to memory of 3552	320	Nemmoe32.exe	102
PID 320 wrote to memory of 3552	320	Nemmoe32.exe	102
PID 320 wrote to memory of 3552	320	Nemmoe32.exe	102
PID 3552 wrote to memory of 2880	3552	Nacmdf32.exe	103
PID 3552 wrote to memory of 2880	3552	Nacmdf32.exe	103
PID 3552 wrote to memory of 2880	3552	Nacmdf32.exe	103
PID 2880 wrote to memory of 1468	2880	Nefped32.exe	104
PID 2880 wrote to memory of 1468	2880	Nefped32.exe	104
PID 2880 wrote to memory of 1468	2880	Nefped32.exe	104
PID 1468 wrote to memory of 2480	1468	Oidhlb32.exe	105
PID 1468 wrote to memory of 2480	1468	Oidhlb32.exe	105
PID 1468 wrote to memory of 2480	1468	Oidhlb32.exe	105
PID 2480 wrote to memory of 3624	2480	Oboijgbl.exe	106
PID 2480 wrote to memory of 3624	2480	Oboijgbl.exe	106
PID 2480 wrote to memory of 3624	2480	Oboijgbl.exe	106
PID 3624 wrote to memory of 4932	3624	Ooejohhq.exe	107
PID 3624 wrote to memory of 4932	3624	Ooejohhq.exe	107
PID 3624 wrote to memory of 4932	3624	Ooejohhq.exe	107
PID 4932 wrote to memory of 4660	4932	Oimkbaed.exe	362

C:\Users\Admin\AppData\Local\Temp\14d3efa9b5f9437a5e623b3b9a685bda980f24dc7d3618d1dd60f81098224fdd.exe
"C:\Users\Admin\AppData\Local\Temp\14d3efa9b5f9437a5e623b3b9a685bda980f24dc7d3618d1dd60f81098224fdd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Windows\SysWOW64\Edjgfcec.exe
  C:\Windows\system32\Edjgfcec.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1596
- - C:\Windows\SysWOW64\Edopabqn.exe
    C:\Windows\system32\Edopabqn.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1988
  - - C:\Windows\SysWOW64\Fhmigagd.exe
      C:\Windows\system32\Fhmigagd.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4776
    - - C:\Windows\SysWOW64\Fajgkfio.exe
        
        C:\Windows\system32\Fajgkfio.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4572
      - C:\Windows\SysWOW64\Gkdhjknm.exe
        
        C:\Windows\system32\Gkdhjknm.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4960
        
        C:\Windows\SysWOW64\Ggpbjkpl.exe
        
        C:\Windows\system32\Ggpbjkpl.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:640
        
        C:\Windows\SysWOW64\Gdfoio32.exe
        
        C:\Windows\system32\Gdfoio32.exe
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1652
        
        C:\Windows\SysWOW64\Hdmein32.exe
        
        C:\Windows\system32\Hdmein32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3120
        
        C:\Windows\SysWOW64\Lajagj32.exe
        
        C:\Windows\system32\Lajagj32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2892
        
        C:\Windows\SysWOW64\Lnpofnhk.exe
        
        C:\Windows\system32\Lnpofnhk.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2644
        
        C:\Windows\SysWOW64\Laqhhi32.exe
        
        C:\Windows\system32\Laqhhi32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3972
        
        C:\Windows\SysWOW64\Llhikacp.exe
        
        C:\Windows\system32\Llhikacp.exe
        13⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4424
        
        C:\Windows\SysWOW64\Mjpbam32.exe
        
        C:\Windows\system32\Mjpbam32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2912
        
        C:\Windows\SysWOW64\Mnnkgl32.exe
        
        C:\Windows\system32\Mnnkgl32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3860
        
        C:\Windows\SysWOW64\Nemmoe32.exe
        
        C:\Windows\system32\Nemmoe32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:320
        
        C:\Windows\SysWOW64\Nacmdf32.exe
        
        C:\Windows\system32\Nacmdf32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3552
        
        C:\Windows\SysWOW64\Nefped32.exe
        
        C:\Windows\system32\Nefped32.exe
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2880
        
        C:\Windows\SysWOW64\Oidhlb32.exe
        
        C:\Windows\system32\Oidhlb32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1468
        
        C:\Windows\SysWOW64\Oboijgbl.exe
        
        C:\Windows\system32\Oboijgbl.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2480
        
        C:\Windows\SysWOW64\Ooejohhq.exe
        
        C:\Windows\system32\Ooejohhq.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3624
        
        C:\Windows\SysWOW64\Oimkbaed.exe
        
        C:\Windows\system32\Oimkbaed.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4932
        
        C:\Windows\SysWOW64\Pcepkfld.exe
        
        C:\Windows\system32\Pcepkfld.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4660
        
        C:\Windows\SysWOW64\Plndcl32.exe
        
        C:\Windows\system32\Plndcl32.exe
        24⤵
        Executes dropped EXE
        
        PID:3512
        
        C:\Windows\SysWOW64\Pefhlaie.exe
        
        C:\Windows\system32\Pefhlaie.exe
        25⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1760
        
        C:\Windows\SysWOW64\Plbmokop.exe
        
        C:\Windows\system32\Plbmokop.exe
        26⤵
        Executes dropped EXE
        
        PID:2904
        
        C:\Windows\SysWOW64\Achegd32.exe
        
        C:\Windows\system32\Achegd32.exe
        27⤵
        Executes dropped EXE
        
        PID:2000
        
        C:\Windows\SysWOW64\Aoofle32.exe
        
        C:\Windows\system32\Aoofle32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1448
        
        C:\Windows\SysWOW64\Aoabad32.exe
        
        C:\Windows\system32\Aoabad32.exe
        29⤵
        Executes dropped EXE
        
        PID:2788
        
        C:\Windows\SysWOW64\Ajggomog.exe
        
        C:\Windows\system32\Ajggomog.exe
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4344
        
        C:\Windows\SysWOW64\Aodogdmn.exe
        
        C:\Windows\system32\Aodogdmn.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3848
        
        C:\Windows\SysWOW64\Blhpqhlh.exe
        
        C:\Windows\system32\Blhpqhlh.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:692
        
        C:\Windows\SysWOW64\Bkmmaeap.exe
        
        C:\Windows\system32\Bkmmaeap.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2748
        
        C:\Windows\SysWOW64\Bjnmpl32.exe
        
        C:\Windows\system32\Bjnmpl32.exe
        34⤵
        Executes dropped EXE
        
        PID:4788
        
        C:\Windows\SysWOW64\Bcfahbpo.exe
        
        C:\Windows\system32\Bcfahbpo.exe
        35⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3556
        
        C:\Windows\SysWOW64\Bkdcbd32.exe
        
        C:\Windows\system32\Bkdcbd32.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3240
        
        C:\Windows\SysWOW64\Ccbadp32.exe
        
        C:\Windows\system32\Ccbadp32.exe
        37⤵
        Executes dropped EXE
        
        PID:1336
        
        C:\Windows\SysWOW64\Ckmehb32.exe
        
        C:\Windows\system32\Ckmehb32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4280
        
        C:\Windows\SysWOW64\Ccgjopal.exe
        
        C:\Windows\system32\Ccgjopal.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4936
        
        C:\Windows\SysWOW64\Dmalne32.exe
        
        C:\Windows\system32\Dmalne32.exe
        40⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1416
        
        C:\Windows\SysWOW64\Dflmlj32.exe
        
        C:\Windows\system32\Dflmlj32.exe
        41⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2384
        
        C:\Windows\SysWOW64\Dfoiaj32.exe
        
        C:\Windows\system32\Dfoiaj32.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1812
        
        C:\Windows\SysWOW64\Eiobceef.exe
        
        C:\Windows\system32\Eiobceef.exe
        43⤵
        Executes dropped EXE
        
        PID:5096
        
        C:\Windows\SysWOW64\Elpkep32.exe
        
        C:\Windows\system32\Elpkep32.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1076
        
        C:\Windows\SysWOW64\Epndknin.exe
        
        C:\Windows\system32\Epndknin.exe
        45⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5084
        
        C:\Windows\SysWOW64\Ejchhgid.exe
        
        C:\Windows\system32\Ejchhgid.exe
        46⤵
        Executes dropped EXE
        
        PID:1160
        
        C:\Windows\SysWOW64\Emdajb32.exe
        
        C:\Windows\system32\Emdajb32.exe
        47⤵
        Executes dropped EXE
        
        PID:552
        
        C:\Windows\SysWOW64\Fpejlmcf.exe
        
        C:\Windows\system32\Fpejlmcf.exe
        48⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:540
        
        C:\Windows\SysWOW64\Fbfcmhpg.exe
        
        C:\Windows\system32\Fbfcmhpg.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4220
        
        C:\Windows\SysWOW64\Fpjcgm32.exe
        
        C:\Windows\system32\Fpjcgm32.exe
        50⤵
        Executes dropped EXE
        
        PID:1292
        
        C:\Windows\SysWOW64\Fmpqfq32.exe
        
        C:\Windows\system32\Fmpqfq32.exe
        51⤵
        Executes dropped EXE
        
        PID:4216
        
        C:\Windows\SysWOW64\Gpqjglii.exe
        
        C:\Windows\system32\Gpqjglii.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:628
        
        C:\Windows\SysWOW64\Gbabigfj.exe
        
        C:\Windows\system32\Gbabigfj.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3412
        
        C:\Windows\SysWOW64\Gpecbk32.exe
        
        C:\Windows\system32\Gpecbk32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3816
        
        C:\Windows\SysWOW64\Gipdap32.exe
        
        C:\Windows\system32\Gipdap32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4328
        
        C:\Windows\SysWOW64\Hdhedh32.exe
        
        C:\Windows\system32\Hdhedh32.exe
        56⤵
        Executes dropped EXE
        
        PID:4840
        
        C:\Windows\SysWOW64\Hlcjhkdp.exe
        
        C:\Windows\system32\Hlcjhkdp.exe
        57⤵
        Executes dropped EXE
        
        PID:4864
        
        C:\Windows\SysWOW64\Higjaoci.exe
        
        C:\Windows\system32\Higjaoci.exe
        58⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4020
        
        C:\Windows\SysWOW64\Hlhccj32.exe
        
        C:\Windows\system32\Hlhccj32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2764
        
        C:\Windows\SysWOW64\Iinqbn32.exe
        
        C:\Windows\system32\Iinqbn32.exe
        60⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3592
        
        C:\Windows\SysWOW64\Iknmla32.exe
        
        C:\Windows\system32\Iknmla32.exe
        61⤵
        Executes dropped EXE
        
        PID:2316
        
        C:\Windows\SysWOW64\Innfnl32.exe
        
        C:\Windows\system32\Innfnl32.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4768
        
        C:\Windows\SysWOW64\Igigla32.exe
        
        C:\Windows\system32\Igigla32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3352
        
        C:\Windows\SysWOW64\Jgkdbacp.exe
        
        C:\Windows\system32\Jgkdbacp.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4352
        
        C:\Windows\SysWOW64\Jcbdgb32.exe
        
        C:\Windows\system32\Jcbdgb32.exe
        65⤵
        Executes dropped EXE
        
        PID:3088
        
        C:\Windows\SysWOW64\Jgpmmp32.exe
        
        C:\Windows\system32\Jgpmmp32.exe
        66⤵
        
        PID:2388
        
        C:\Windows\SysWOW64\Jknfcofa.exe
        
        C:\Windows\system32\Jknfcofa.exe
        67⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1220
        
        C:\Windows\SysWOW64\Kkpbin32.exe
        
        C:\Windows\system32\Kkpbin32.exe
        68⤵
        System Location Discovery: System Language Discovery
        
        PID:4916
        
        C:\Windows\SysWOW64\Kjepjkhf.exe
        
        C:\Windows\system32\Kjepjkhf.exe
        69⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\Knchpiom.exe
        
        C:\Windows\system32\Knchpiom.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4116
        
        C:\Windows\SysWOW64\Kjjiej32.exe
        
        C:\Windows\system32\Kjjiej32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2976
        
        C:\Windows\SysWOW64\Kcejco32.exe
        
        C:\Windows\system32\Kcejco32.exe
        72⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\Lqikmc32.exe
        
        C:\Windows\system32\Lqikmc32.exe
        73⤵
        System Location Discovery: System Language Discovery
        
        PID:3076
        
        C:\Windows\SysWOW64\Lgjijmin.exe
        
        C:\Windows\system32\Lgjijmin.exe
        74⤵
        Modifies registry class
        
        PID:4952
        
        C:\Windows\SysWOW64\Mjkblhfo.exe
        
        C:\Windows\system32\Mjkblhfo.exe
        75⤵
        Drops file in System32 directory
        
        PID:860
        
        C:\Windows\SysWOW64\Mgobel32.exe
        
        C:\Windows\system32\Mgobel32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1316
        
        C:\Windows\SysWOW64\Maggnali.exe
        
        C:\Windows\system32\Maggnali.exe
        77⤵
        
        PID:4772
        
        C:\Windows\SysWOW64\Mgclpkac.exe
        
        C:\Windows\system32\Mgclpkac.exe
        78⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Megljppl.exe
        
        C:\Windows\system32\Megljppl.exe
        79⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Napjdpcn.exe
        
        C:\Windows\system32\Napjdpcn.exe
        80⤵
        Drops file in System32 directory
        
        PID:5216
        
        C:\Windows\SysWOW64\Nenbjo32.exe
        
        C:\Windows\system32\Nenbjo32.exe
        81⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Njkkbehl.exe
        
        C:\Windows\system32\Njkkbehl.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5312
        
        C:\Windows\SysWOW64\Nlmdbh32.exe
        
        C:\Windows\system32\Nlmdbh32.exe
        83⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Oloahhki.exe
        
        C:\Windows\system32\Oloahhki.exe
        84⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Odjeljhd.exe
        
        C:\Windows\system32\Odjeljhd.exe
        85⤵
        Drops file in System32 directory
        
        PID:5468
        
        C:\Windows\SysWOW64\Ojgjndno.exe
        
        C:\Windows\system32\Ojgjndno.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5512
        
        C:\Windows\SysWOW64\Oacoqnci.exe
        
        C:\Windows\system32\Oacoqnci.exe
        87⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5556
        
        C:\Windows\SysWOW64\Pmlmkn32.exe
        
        C:\Windows\system32\Pmlmkn32.exe
        88⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Pehngkcg.exe
        
        C:\Windows\system32\Pehngkcg.exe
        89⤵
        System Location Discovery: System Language Discovery
        
        PID:5660
        
        C:\Windows\SysWOW64\Pejkmk32.exe
        
        C:\Windows\system32\Pejkmk32.exe
        90⤵
        Modifies registry class
        
        PID:5720
        
        C:\Windows\SysWOW64\Qdphngfl.exe
        
        C:\Windows\system32\Qdphngfl.exe
        91⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Qhmqdemc.exe
        
        C:\Windows\system32\Qhmqdemc.exe
        92⤵
        Drops file in System32 directory
        
        PID:5800
        
        C:\Windows\SysWOW64\Aednci32.exe
        
        C:\Windows\system32\Aednci32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5844
        
        C:\Windows\SysWOW64\Adikdfna.exe
        
        C:\Windows\system32\Adikdfna.exe
        94⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Anaomkdb.exe
        
        C:\Windows\system32\Anaomkdb.exe
        95⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Aaohcj32.exe
        
        C:\Windows\system32\Aaohcj32.exe
        96⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5984
        
        C:\Windows\SysWOW64\Bdpaeehj.exe
        
        C:\Windows\system32\Bdpaeehj.exe
        97⤵
        System Location Discovery: System Language Discovery
        
        PID:6028
        
        C:\Windows\SysWOW64\Bddjpd32.exe
        
        C:\Windows\system32\Bddjpd32.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6076
        
        C:\Windows\SysWOW64\Bahkih32.exe
        
        C:\Windows\system32\Bahkih32.exe
        99⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6116
        
        C:\Windows\SysWOW64\Blnoga32.exe
        
        C:\Windows\system32\Blnoga32.exe
        100⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\Cnahdi32.exe
        
        C:\Windows\system32\Cnahdi32.exe
        101⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Ckeimm32.exe
        
        C:\Windows\system32\Ckeimm32.exe
        102⤵
        Drops file in System32 directory
        
        PID:5240
        
        C:\Windows\SysWOW64\Chlflabp.exe
        
        C:\Windows\system32\Chlflabp.exe
        103⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5320
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        104⤵
        Modifies registry class
        
        PID:5380
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        105⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Dnmhpg32.exe
        
        C:\Windows\system32\Dnmhpg32.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5544
        
        C:\Windows\SysWOW64\Dmohno32.exe
        
        C:\Windows\system32\Dmohno32.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5648
        
        C:\Windows\SysWOW64\Dheibpje.exe
        
        C:\Windows\system32\Dheibpje.exe
        108⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Dbnmke32.exe
        
        C:\Windows\system32\Dbnmke32.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5784
        
        C:\Windows\SysWOW64\Doaneiop.exe
        
        C:\Windows\system32\Doaneiop.exe
        110⤵
        Modifies registry class
        
        PID:5872
        
        C:\Windows\SysWOW64\Dijbno32.exe
        
        C:\Windows\system32\Dijbno32.exe
        111⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        112⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Efpomccg.exe
        
        C:\Windows\system32\Efpomccg.exe
        113⤵
        
        PID:688
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        114⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5212
        
        C:\Windows\SysWOW64\Efeihb32.exe
        
        C:\Windows\system32\Efeihb32.exe
        115⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Eejeiocj.exe
        
        C:\Windows\system32\Eejeiocj.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5400
        
        C:\Windows\SysWOW64\Ebnfbcbc.exe
        
        C:\Windows\system32\Ebnfbcbc.exe
        117⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Flfkkhid.exe
        
        C:\Windows\system32\Flfkkhid.exe
        118⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Fealin32.exe
        
        C:\Windows\system32\Fealin32.exe
        119⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Fpimlfke.exe
        
        C:\Windows\system32\Fpimlfke.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6096
        
        C:\Windows\SysWOW64\Fmmmfj32.exe
        
        C:\Windows\system32\Fmmmfj32.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5236
        
        C:\Windows\SysWOW64\Gmojkj32.exe
        
        C:\Windows\system32\Gmojkj32.exe
        122⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5896
        
        C:\Windows\SysWOW64\Gncchb32.exe
        
        C:\Windows\system32\Gncchb32.exe
        124⤵
        System Location Discovery: System Language Discovery
        
        PID:2276
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        125⤵
        System Location Discovery: System Language Discovery
        
        PID:6068
        
        C:\Windows\SysWOW64\Gikdkj32.exe
        
        C:\Windows\system32\Gikdkj32.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4804
        
        C:\Windows\SysWOW64\Gimqajgh.exe
        
        C:\Windows\system32\Gimqajgh.exe
        127⤵
        Modifies registry class
        
        PID:4680
        
        C:\Windows\SysWOW64\Hipmfjee.exe
        
        C:\Windows\system32\Hipmfjee.exe
        128⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Hlpfhe32.exe
        
        C:\Windows\system32\Hlpfhe32.exe
        129⤵
        System Location Discovery: System Language Discovery
        
        PID:6216
        
        C:\Windows\SysWOW64\Hidgai32.exe
        
        C:\Windows\system32\Hidgai32.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6256
        
        C:\Windows\SysWOW64\Hlepcdoa.exe
        
        C:\Windows\system32\Hlepcdoa.exe
        131⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Hlglidlo.exe
        
        C:\Windows\system32\Hlglidlo.exe
        132⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6344
        
        C:\Windows\SysWOW64\Ipeeobbe.exe
        
        C:\Windows\system32\Ipeeobbe.exe
        133⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6444
        
        C:\Windows\SysWOW64\Iedjmioj.exe
        
        C:\Windows\system32\Iedjmioj.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6484
        
        C:\Windows\SysWOW64\Ioolkncg.exe
        
        C:\Windows\system32\Ioolkncg.exe
        136⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6528
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        137⤵
        System Location Discovery: System Language Discovery
        
        PID:6576
        
        C:\Windows\SysWOW64\Jenmcggo.exe
        
        C:\Windows\system32\Jenmcggo.exe
        138⤵
        Drops file in System32 directory
        
        PID:6620
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        139⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6664
        
        C:\Windows\SysWOW64\Jphkkpbp.exe
        
        C:\Windows\system32\Jphkkpbp.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6708
        
        C:\Windows\SysWOW64\Jjpode32.exe
        
        C:\Windows\system32\Jjpode32.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6748
        
        C:\Windows\SysWOW64\Kjblje32.exe
        
        C:\Windows\system32\Kjblje32.exe
        142⤵
        System Location Discovery: System Language Discovery
        
        PID:6800
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        143⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Kjgeedch.exe
        
        C:\Windows\system32\Kjgeedch.exe
        144⤵
        Drops file in System32 directory
        
        PID:6888
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        145⤵
        Modifies registry class
        
        PID:6932
        
        C:\Windows\SysWOW64\Lpfgmnfp.exe
        
        C:\Windows\system32\Lpfgmnfp.exe
        146⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Lnjgfb32.exe
        
        C:\Windows\system32\Lnjgfb32.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7032
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        148⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7124
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6148
        
        C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        151⤵
        Modifies registry class
        
        PID:6196
        
        C:\Windows\SysWOW64\Mqafhl32.exe
        
        C:\Windows\system32\Mqafhl32.exe
        152⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        153⤵
        Drops file in System32 directory
        
        PID:6364
        
        C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        154⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        155⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        156⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        157⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Nagiji32.exe
        
        C:\Windows\system32\Nagiji32.exe
        158⤵
        Drops file in System32 directory
        
        PID:6732
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        159⤵
        Modifies registry class
        
        PID:6832
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        160⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Paeelgnj.exe
        
        C:\Windows\system32\Paeelgnj.exe
        161⤵
        
        PID:452
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        162⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4636
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        163⤵
        Drops file in System32 directory
        
        PID:7028
        
        C:\Windows\SysWOW64\Pdmdnadc.exe
        
        C:\Windows\system32\Pdmdnadc.exe
        164⤵
        Drops file in System32 directory
        
        PID:7072
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        165⤵
        Drops file in System32 directory
        
        PID:7120
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5572
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        167⤵
        System Location Discovery: System Language Discovery
        
        PID:6276
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6408
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        169⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        170⤵
        Drops file in System32 directory
        
        PID:2268
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        171⤵
        Modifies registry class
        
        PID:436
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        172⤵
        Drops file in System32 directory
        
        PID:6772
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        173⤵
        Modifies registry class
        
        PID:6864
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        174⤵
        Drops file in System32 directory
        
        PID:6968
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7020
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        176⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7112
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        177⤵
        Drops file in System32 directory
        
        PID:6240
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        178⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6600
        
        C:\Windows\SysWOW64\Dhdbhifj.exe
        
        C:\Windows\system32\Dhdbhifj.exe
        180⤵
        
        PID:3468
        
        C:\Windows\SysWOW64\Dkekjdck.exe
        
        C:\Windows\system32\Dkekjdck.exe
        181⤵
        Drops file in System32 directory
        
        PID:3628
        
        C:\Windows\SysWOW64\Doccpcja.exe
        
        C:\Windows\system32\Doccpcja.exe
        182⤵
        
        PID:1984
        
        C:\Windows\SysWOW64\Ebdlangb.exe
        
        C:\Windows\system32\Ebdlangb.exe
        183⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Enkmfolf.exe
        
        C:\Windows\system32\Enkmfolf.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7064
        
        C:\Windows\SysWOW64\Enmjlojd.exe
        
        C:\Windows\system32\Enmjlojd.exe
        185⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Edionhpn.exe
        
        C:\Windows\system32\Edionhpn.exe
        186⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Fndpmndl.exe
        
        C:\Windows\system32\Fndpmndl.exe
        187⤵
        
        PID:4492
        
        C:\Windows\SysWOW64\Fbbicl32.exe
        
        C:\Windows\system32\Fbbicl32.exe
        188⤵
        Drops file in System32 directory
        
        PID:6740
        
        C:\Windows\SysWOW64\Fohfbpgi.exe
        
        C:\Windows\system32\Fohfbpgi.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6584
        
        C:\Windows\SysWOW64\Galoohke.exe
        
        C:\Windows\system32\Galoohke.exe
        190⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6572
        
        C:\Windows\SysWOW64\Gejhef32.exe
        
        C:\Windows\system32\Gejhef32.exe
        191⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Gnblnlhl.exe
        
        C:\Windows\system32\Gnblnlhl.exe
        192⤵
        
        PID:4732
        
        C:\Windows\SysWOW64\Glfmgp32.exe
        
        C:\Windows\system32\Glfmgp32.exe
        193⤵
        Modifies registry class
        
        PID:2540
        
        C:\Windows\SysWOW64\Gijmad32.exe
        
        C:\Windows\system32\Gijmad32.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6556
        
        C:\Windows\SysWOW64\Gpdennml.exe
        
        C:\Windows\system32\Gpdennml.exe
        195⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Hnibokbd.exe
        
        C:\Windows\system32\Hnibokbd.exe
        196⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Hbgkei32.exe
        
        C:\Windows\system32\Hbgkei32.exe
        197⤵
        
        PID:5104
        
        C:\Windows\SysWOW64\Hpkknmgd.exe
        
        C:\Windows\system32\Hpkknmgd.exe
        198⤵
        
        PID:2296
        
        C:\Windows\SysWOW64\Hhfpbpdo.exe
        
        C:\Windows\system32\Hhfpbpdo.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1368
        
        C:\Windows\SysWOW64\Hhimhobl.exe
        
        C:\Windows\system32\Hhimhobl.exe
        200⤵
        Drops file in System32 directory
        
        PID:2284
        
        C:\Windows\SysWOW64\Ipbaol32.exe
        
        C:\Windows\system32\Ipbaol32.exe
        201⤵
        System Location Discovery: System Language Discovery
        
        PID:2476
        
        C:\Windows\SysWOW64\Ilibdmgp.exe
        
        C:\Windows\system32\Ilibdmgp.exe
        202⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4960
        
        C:\Windows\SysWOW64\Ihpcinld.exe
        
        C:\Windows\system32\Ihpcinld.exe
        203⤵
        Modifies registry class
        
        PID:772
        
        C:\Windows\SysWOW64\Ilnlom32.exe
        
        C:\Windows\system32\Ilnlom32.exe
        204⤵
        System Location Discovery: System Language Discovery
        
        PID:6744
        
        C:\Windows\SysWOW64\Iialhaad.exe
        
        C:\Windows\system32\Iialhaad.exe
        205⤵
        System Location Discovery: System Language Discovery
        
        PID:6244
        
        C:\Windows\SysWOW64\Jhgiim32.exe
        
        C:\Windows\system32\Jhgiim32.exe
        206⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Jldbpl32.exe
        
        C:\Windows\system32\Jldbpl32.exe
        207⤵
        Drops file in System32 directory
        
        PID:864
        
        C:\Windows\SysWOW64\Jihbip32.exe
        
        C:\Windows\system32\Jihbip32.exe
        208⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Jikoopij.exe
        
        C:\Windows\system32\Jikoopij.exe
        209⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Jeapcq32.exe
        
        C:\Windows\system32\Jeapcq32.exe
        210⤵
        System Location Discovery: System Language Discovery
        
        PID:7272
        
        C:\Windows\SysWOW64\Jojdlfeo.exe
        
        C:\Windows\system32\Jojdlfeo.exe
        211⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7316
        
        C:\Windows\SysWOW64\Khgbqkhj.exe
        
        C:\Windows\system32\Khgbqkhj.exe
        212⤵
        Modifies registry class
        
        PID:7356
        
        C:\Windows\SysWOW64\Kifojnol.exe
        
        C:\Windows\system32\Kifojnol.exe
        213⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Kiikpnmj.exe
        
        C:\Windows\system32\Kiikpnmj.exe
        214⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7444
        
        C:\Windows\SysWOW64\Lafmjp32.exe
        
        C:\Windows\system32\Lafmjp32.exe
        215⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Ledepn32.exe
        
        C:\Windows\system32\Ledepn32.exe
        216⤵
        Drops file in System32 directory
        
        PID:7544
        
        C:\Windows\SysWOW64\Lchfib32.exe
        
        C:\Windows\system32\Lchfib32.exe
        217⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Ljdkll32.exe
        
        C:\Windows\system32\Ljdkll32.exe
        218⤵
        System Location Discovery: System Language Discovery
        
        PID:7632
        
        C:\Windows\SysWOW64\Mapppn32.exe
        
        C:\Windows\system32\Mapppn32.exe
        219⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Mledmg32.exe
        
        C:\Windows\system32\Mledmg32.exe
        220⤵
        System Location Discovery: System Language Discovery
        
        PID:7736
        
        C:\Windows\SysWOW64\Mlhqcgnk.exe
        
        C:\Windows\system32\Mlhqcgnk.exe
        221⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Mcaipa32.exe
        
        C:\Windows\system32\Mcaipa32.exe
        222⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Mcdeeq32.exe
        
        C:\Windows\system32\Mcdeeq32.exe
        223⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7876
        
        C:\Windows\SysWOW64\Mbibfm32.exe
        
        C:\Windows\system32\Mbibfm32.exe
        224⤵
        Drops file in System32 directory
        
        PID:7956
        
        C:\Windows\SysWOW64\Nfgklkoc.exe
        
        C:\Windows\system32\Nfgklkoc.exe
        225⤵
        Modifies registry class
        
        PID:8012
        
        C:\Windows\SysWOW64\Nbphglbe.exe
        
        C:\Windows\system32\Nbphglbe.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8096
        
        C:\Windows\SysWOW64\Nbbeml32.exe
        
        C:\Windows\system32\Nbbeml32.exe
        227⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8152
        
        C:\Windows\SysWOW64\Nmhijd32.exe
        
        C:\Windows\system32\Nmhijd32.exe
        228⤵
        Modifies registry class
        
        PID:6524
        
        C:\Windows\SysWOW64\Ocdnln32.exe
        
        C:\Windows\system32\Ocdnln32.exe
        229⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Oiagde32.exe
        
        C:\Windows\system32\Oiagde32.exe
        230⤵
        System Location Discovery: System Language Discovery
        
        PID:7348
        
        C:\Windows\SysWOW64\Oqklkbbi.exe
        
        C:\Windows\system32\Oqklkbbi.exe
        231⤵
        System Location Discovery: System Language Discovery
        
        PID:7432
        
        C:\Windows\SysWOW64\Ojemig32.exe
        
        C:\Windows\system32\Ojemig32.exe
        232⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Ojhiogdd.exe
        
        C:\Windows\system32\Ojhiogdd.exe
        233⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7600
        
        C:\Windows\SysWOW64\Pmhbqbae.exe
        
        C:\Windows\system32\Pmhbqbae.exe
        234⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Pmkofa32.exe
        
        C:\Windows\system32\Pmkofa32.exe
        235⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7744
        
        C:\Windows\SysWOW64\Pidlqb32.exe
        
        C:\Windows\system32\Pidlqb32.exe
        236⤵
        
        PID:4900
        
        C:\Windows\SysWOW64\Pjcikejg.exe
        
        C:\Windows\system32\Pjcikejg.exe
        237⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Qjffpe32.exe
        
        C:\Windows\system32\Qjffpe32.exe
        238⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Afockelf.exe
        
        C:\Windows\system32\Afockelf.exe
        239⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8080
        
        C:\Windows\SysWOW64\Amkhmoap.exe
        
        C:\Windows\system32\Amkhmoap.exe
        240⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8136
        
        C:\Windows\SysWOW64\Aibibp32.exe
        
        C:\Windows\system32\Aibibp32.exe
        241⤵
        Modifies registry class
        
        PID:4852
        
        C:\Windows\SysWOW64\Aplaoj32.exe
        
        C:\Windows\system32\Aplaoj32.exe
        242⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8188
        
        C:\Windows\SysWOW64\Aidehpea.exe
        
        C:\Windows\system32\Aidehpea.exe
        243⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Bmbnnn32.exe
        
        C:\Windows\system32\Bmbnnn32.exe
        244⤵
        Modifies registry class
        
        PID:2600
        
        C:\Windows\SysWOW64\Bmdkcnie.exe
        
        C:\Windows\system32\Bmdkcnie.exe
        245⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Babcil32.exe
        
        C:\Windows\system32\Babcil32.exe
        246⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Baepolni.exe
        
        C:\Windows\system32\Baepolni.exe
        247⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7684
        
        C:\Windows\SysWOW64\Bgdemb32.exe
        
        C:\Windows\system32\Bgdemb32.exe
        248⤵
        
        PID:2892
        
        C:\Windows\SysWOW64\Cbkfbcpb.exe
        
        C:\Windows\system32\Cbkfbcpb.exe
        249⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3820
        
        C:\Windows\SysWOW64\Cpogkhnl.exe
        
        C:\Windows\system32\Cpogkhnl.exe
        250⤵
        Modifies registry class
        
        PID:7812
        
        C:\Windows\SysWOW64\Cigkdmel.exe
        
        C:\Windows\system32\Cigkdmel.exe
        251⤵
        Modifies registry class
        
        PID:5756
        
        C:\Windows\SysWOW64\Ckggnp32.exe
        
        C:\Windows\system32\Ckggnp32.exe
        252⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Cmgqpkip.exe
        
        C:\Windows\system32\Cmgqpkip.exe
        253⤵
        Drops file in System32 directory
        
        PID:4424
        
        C:\Windows\SysWOW64\Cdaile32.exe
        
        C:\Windows\system32\Cdaile32.exe
        254⤵
        System Location Discovery: System Language Discovery
        
        PID:3148
        
        C:\Windows\SysWOW64\Dmjmekgn.exe
        
        C:\Windows\system32\Dmjmekgn.exe
        255⤵
        System Location Discovery: System Language Discovery
        
        PID:8148
        
        C:\Windows\SysWOW64\Dnljkk32.exe
        
        C:\Windows\system32\Dnljkk32.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:992
        
        C:\Windows\SysWOW64\Dickplko.exe
        
        C:\Windows\system32\Dickplko.exe
        257⤵
        
        PID:3440
        
        C:\Windows\SysWOW64\Dnqcfjae.exe
        
        C:\Windows\system32\Dnqcfjae.exe
        258⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\Dkedonpo.exe
        
        C:\Windows\system32\Dkedonpo.exe
        259⤵
        Modifies registry class
        
        PID:7536
        
        C:\Windows\SysWOW64\Ddmhhd32.exe
        
        C:\Windows\system32\Ddmhhd32.exe
        260⤵
        Modifies registry class
        
        PID:5116
        
        C:\Windows\SysWOW64\Epdime32.exe
        
        C:\Windows\system32\Epdime32.exe
        261⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Eaceghcg.exe
        
        C:\Windows\system32\Eaceghcg.exe
        262⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7756
        
        C:\Windows\SysWOW64\Ejojljqa.exe
        
        C:\Windows\system32\Ejojljqa.exe
        263⤵
        
        PID:2944
        
        C:\Windows\SysWOW64\Eddnic32.exe
        
        C:\Windows\system32\Eddnic32.exe
        264⤵
        
        PID:4660
        
        C:\Windows\SysWOW64\Eqkondfl.exe
        
        C:\Windows\system32\Eqkondfl.exe
        265⤵
        Drops file in System32 directory
        
        PID:6104
        
        C:\Windows\SysWOW64\Eajlhg32.exe
        
        C:\Windows\system32\Eajlhg32.exe
        266⤵
        Drops file in System32 directory
        
        PID:3688
        
        C:\Windows\SysWOW64\Fkcpql32.exe
        
        C:\Windows\system32\Fkcpql32.exe
        267⤵
        
        PID:3512
        
        C:\Windows\SysWOW64\Fjhmbihg.exe
        
        C:\Windows\system32\Fjhmbihg.exe
        268⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Fnffhgon.exe
        
        C:\Windows\system32\Fnffhgon.exe
        269⤵
        
        PID:1652
        
        C:\Windows\SysWOW64\Fgnjqm32.exe
        
        C:\Windows\system32\Fgnjqm32.exe
        270⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\Fnhbmgmk.exe
        
        C:\Windows\system32\Fnhbmgmk.exe
        271⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1336
        
        C:\Windows\SysWOW64\Fklcgk32.exe
        
        C:\Windows\system32\Fklcgk32.exe
        272⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5004
        
        C:\Windows\SysWOW64\Fbfkceca.exe
        
        C:\Windows\system32\Fbfkceca.exe
        273⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2632
        
        C:\Windows\SysWOW64\Gjaphgpl.exe
        
        C:\Windows\system32\Gjaphgpl.exe
        274⤵
        
        PID:4248
        
        C:\Windows\SysWOW64\Gkalbj32.exe
        
        C:\Windows\system32\Gkalbj32.exe
        275⤵
        Modifies registry class
        
        PID:3924
        
        C:\Windows\SysWOW64\Gkcigjel.exe
        
        C:\Windows\system32\Gkcigjel.exe
        276⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4236
        
        C:\Windows\SysWOW64\Gdknpp32.exe
        
        C:\Windows\system32\Gdknpp32.exe
        277⤵
        System Location Discovery: System Language Discovery
        
        PID:7816
        
        C:\Windows\SysWOW64\Gbpnjdkg.exe
        
        C:\Windows\system32\Gbpnjdkg.exe
        278⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Gjkbnfha.exe
        
        C:\Windows\system32\Gjkbnfha.exe
        279⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Hjmodffo.exe
        
        C:\Windows\system32\Hjmodffo.exe
        280⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7992
        
        C:\Windows\SysWOW64\Heepfn32.exe
        
        C:\Windows\system32\Heepfn32.exe
        281⤵
        Drops file in System32 directory
        
        PID:8172
        
        C:\Windows\SysWOW64\Hgeihiac.exe
        
        C:\Windows\system32\Hgeihiac.exe
        282⤵
        
        PID:4200
        
        C:\Windows\SysWOW64\Hannao32.exe
        
        C:\Windows\system32\Hannao32.exe
        283⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Hnbnjc32.exe
        
        C:\Windows\system32\Hnbnjc32.exe
        284⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Ilfodgeg.exe
        
        C:\Windows\system32\Ilfodgeg.exe
        285⤵
        
        PID:3404
        
        C:\Windows\SysWOW64\Icachjbb.exe
        
        C:\Windows\system32\Icachjbb.exe
        286⤵
        
        PID:3060
        
        C:\Windows\SysWOW64\Iecmhlhb.exe
        
        C:\Windows\system32\Iecmhlhb.exe
        287⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Jnnnfalp.exe
        
        C:\Windows\system32\Jnnnfalp.exe
        288⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1696
        
        C:\Windows\SysWOW64\Jnpjlajn.exe
        
        C:\Windows\system32\Jnpjlajn.exe
        289⤵
        
        PID:1292
        
        C:\Windows\SysWOW64\Jlfhke32.exe
        
        C:\Windows\system32\Jlfhke32.exe
        290⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3452
        
        C:\Windows\SysWOW64\Jdalog32.exe
        
        C:\Windows\system32\Jdalog32.exe
        291⤵
        
        PID:4244
        
        C:\Windows\SysWOW64\Jeaiij32.exe
        
        C:\Windows\system32\Jeaiij32.exe
        292⤵
        Modifies registry class
        
        PID:7220
        
        C:\Windows\SysWOW64\Keceoj32.exe
        
        C:\Windows\system32\Keceoj32.exe
        293⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3240
        
        C:\Windows\SysWOW64\Kbgfhnhi.exe
        
        C:\Windows\system32\Kbgfhnhi.exe
        294⤵
        System Location Discovery: System Language Discovery
        
        PID:5084
        
        C:\Windows\SysWOW64\Kongmo32.exe
        
        C:\Windows\system32\Kongmo32.exe
        295⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Kblpcndd.exe
        
        C:\Windows\system32\Kblpcndd.exe
        296⤵
        System Location Discovery: System Language Discovery
        
        PID:7552
        
        C:\Windows\SysWOW64\Kkgdhp32.exe
        
        C:\Windows\system32\Kkgdhp32.exe
        297⤵
        Drops file in System32 directory
        
        PID:2880
        
        C:\Windows\SysWOW64\Klgqabib.exe
        
        C:\Windows\system32\Klgqabib.exe
        298⤵
        
        PID:2036
        
        C:\Windows\SysWOW64\Leoejh32.exe
        
        C:\Windows\system32\Leoejh32.exe
        299⤵
        
        PID:3952
        
        C:\Windows\SysWOW64\Lklnconj.exe
        
        C:\Windows\system32\Lklnconj.exe
        300⤵
        
        PID:3592
        
        C:\Windows\SysWOW64\Lhpnlclc.exe
        
        C:\Windows\system32\Lhpnlclc.exe
        301⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1624
        
        C:\Windows\SysWOW64\Llngbabj.exe
        
        C:\Windows\system32\Llngbabj.exe
        302⤵
        Modifies registry class
        
        PID:5080
        
        C:\Windows\SysWOW64\Ldikgdpe.exe
        
        C:\Windows\system32\Ldikgdpe.exe
        303⤵
        
        PID:2652
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 400
        304⤵
        Program crash
        
        PID:1300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2652 -ip 2652
1⤵
PID:3412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Achegd32.exe

Filesize
448KB

MD5
655b7ee809742e3387ba397eb2acca4a

SHA1
8f522ebd54bb6f90607173b790e8b7ae0cdb4910

SHA256
4a270d5c6a563d88fb8cd536c6f220e877717f6d2a7074857fdcb79bd2c1e282

SHA512
207ef0153078498ec05bf0bbb8575fde8750ec8616e36b5d20d48b8244d78032e62d5361306a6a037b0194f2d7861ff3deae7b12841299ed8e83016ce0913a9e

Download Submit
C:\Windows\SysWOW64\Afockelf.exe

Filesize
448KB

MD5
59a5cd7acdcb718aa40591392aa8bbea

SHA1
8812f288411b946cddc3dee255e435c8217a73a1

SHA256
fa0e33064836385cf21d0b4ba7ccc75390d06e32293b9b0c1ad71b2198a8e1bb

SHA512
ff9dd0035a7fe7519dd7e5541f074403f22a47da1c474f9b8af6285bad4e31a17b215f7abef14025463bc4bc0068339ab4ef97042a20deb4b131423d0fda229d

Download Submit
C:\Windows\SysWOW64\Ajggomog.exe

Filesize
448KB

MD5
83a590a177d957dd5335a987ec4c9f81

SHA1
1d0b5fd35bd297bd6f4509e4d105e211ce2da317

SHA256
90671a57755f2f848534c0490bcee44c9270c3f5831a5a766beb0ee679613ad3

SHA512
3cb0fdae0b4073845df28df483ee4e3f3aa1cce2abf984e5eea264034905fd41e70c9b81cff9c60205a7d420c925f3c4c6c8984d2ca3a7c9afc9d7ece3fa6b2c

Download Submit
C:\Windows\SysWOW64\Amcehdod.exe

Filesize
448KB

MD5
0b83fe459b7fcef71d036571992559aa

SHA1
a95a22e5bd745378387aad8d858761a487562b70

SHA256
fdba017e8cc6d31cf9b19297e93864c3ec07adc8f0dbfdaeb95b4149e48e3c25

SHA512
e4a370e7caa8b1ced682e377123e83d9e850c3428f337402312ae58e796b17b62df2a10abae7d90171e77ec76d95164909588f4ef0a851ffd7b1c7df21967586

Download Submit
C:\Windows\SysWOW64\Aoabad32.exe

Filesize
448KB

MD5
b6c6b320ddc57f5f376598f2f99bf2d7

SHA1
334d40dc80826f56a335ae8080062e29c291816a

SHA256
8743ea47720fc3d4ae09a5cfd37046e2450ab7a33782d1f5d8b54a15629ee949

SHA512
39e03ed7aaeb59ff5024fa565474ad37179fe3e74a492d5094b0abe1f2e24d8176c0201a5b06a4e9fff610f029910896387b86e30c848254bb0d2d56dd0bb68b

Download Submit
C:\Windows\SysWOW64\Aodogdmn.exe

Filesize
448KB

MD5
615731f7e8151659525fbdae99ae3b2d

SHA1
6fc33ee0e2c124a9b59ac4e31ec98b14beb8ec6a

SHA256
cafe3a9f87f1775f9feb1d8efe5f41c7bc57ab6e2378280d99bf940e2661b15d

SHA512
1b41f45787b74b14d8d155a673c20693e50dc8ed7b5992d46042e49d64ee2b181064671a5a882017c2dfbc9f9948dd2f7732054dc8e48453f2af70ff80db5f88

Download Submit
C:\Windows\SysWOW64\Aoofle32.exe

Filesize
448KB

MD5
696b31bc04b7daa918631d285fb2745a

SHA1
2ab6e507a8ea55c979bbb2d7f241d89be83d9753

SHA256
02840dd10f5eddfbd7a73f8345a59ed6bf4fb99f8c25f4fb51e5bce25eddc747

SHA512
1c87d2688df6dba7a8eb113f5db2b6ad8a752d6be2134b6347c079ce1bd0a95eb0d7409abf267fe8acb5d840ecbeb96d14dd1a8c6bb0ad6e6ffc126f950dd790

Download Submit
C:\Windows\SysWOW64\Bahkih32.exe

Filesize
448KB

MD5
58c7423438dc74b130030893e326f6e4

SHA1
930c776fa002bff2d6040396a26cbfe0c3bd0ba0

SHA256
60aece65620ae7cbc4fe1253bdb147a9214078734956b558ae1ccee5e6f735df

SHA512
bd2fd11d83c883629759af02d2c9faeba76693f96e61c2f284dbb7eba9d3fe3ba692abf7c8f5370b7fa36b4d61dc701177dcbad1b9dedc9047fcc4228dac8725

Download Submit
C:\Windows\SysWOW64\Bddcenpi.exe

Filesize
448KB

MD5
363375c2a704814d49a38815be342350

SHA1
5b38fe8f43101f819c5b64d9bec25e10270cdd27

SHA256
7c9d11a3b116017c9cf8c80909292d10213699e4c7695de9ef782e8a212048f9

SHA512
c5ea6db1b209a0c8cc25188b9975e42be9d147b99857ab5562589d65ba59d630a4f7e6710944bef2430d19e3babcdce63929353cc3c5e86be19864b0d2b0b630

Download Submit
C:\Windows\SysWOW64\Bdpaeehj.exe

Filesize
448KB

MD5
c2f894a807431cc45e4f190fd6360702

SHA1
fff6c8f74bb59268cadfeb8153069132aaa3e8fe

SHA256
c6352a2ec1387983212c1bcade5fdfc58e0a7c92fb0ba0fb2d22e1d66f9fd0f9

SHA512
3358b81d5c62252aa79c04f6c59c74455cb88e94f5ce53425d8bee4b58f41922fc7c6b9f7c9b19d2676d11a9e65feb5cc37d0e0fd4b7e1254a75f72b2827df9e

Download Submit
C:\Windows\SysWOW64\Bkmmaeap.exe

Filesize
448KB

MD5
f0d6ebe5ccfe2e85b45e7991b7171321

SHA1
e477abb2327d1ad575c187177793c37e23854c48

SHA256
3579b4b62842c28790394a56c93a093ec91808a3992a6bf9ceaf044efe4b6fa5

SHA512
490632c60716235d91cf506a3137d3bbfe70ccaf8c8338c0dc3627827579e168b0a0937332eaa932bfc9ffe27140c3de0e922e6b7301cc41423e554cfaa53c5a

Download Submit
C:\Windows\SysWOW64\Blhpqhlh.exe

Filesize
448KB

MD5
82cc90508551f32f8a2ddad48a4d93c2

SHA1
88341d451eb1110ba95462ecb0068636c60be9c9

SHA256
46c43af661aea36b6f617c7181ab50a176ead14206f21618f457288a19ec86e4

SHA512
9f10f13ace8b3f952b782a9a70bed09bb2b9b5d38551880c6815c0064c585dfee134e43c1e6e3afc9dd5700ad75b5f3777fc46df5da3074d1a1599cf579acebf

Download Submit
C:\Windows\SysWOW64\Cpogkhnl.exe

Filesize
448KB

MD5
13b7ea9d716a5a1ffa146a11b56c18b8

SHA1
28a1c12700449d7271bfd1e2329ce121626861b4

SHA256
ea915a30f05e56417611c0c905c9359b7e7149d01d5ef20a10d220c2186678e2

SHA512
94d4ee7723a008a49a3bf1e57365b9a4a52463451b3ea6b83fc79569863622961319b78dd89f7020820ed92b21af60b418c979cc81816fc9988ea603220bed7b

Download Submit
C:\Windows\SysWOW64\Dafppp32.exe

Filesize
448KB

MD5
f1f73e46504c32c31a9fc82c42a1a3c7

SHA1
e426931c4cda95d7658ccac6664bee560396af3e

SHA256
f93d7a0687522357494897deb276e825a3fde279254ea928cdf1ed14d12ed7e5

SHA512
dbf8cb315d94e8f915af220049384dc671e28d8a02ef4a354ef5810548ecab922fd2737d4a558d3ac85a882bd1df35198595ec716863711f4043d86ff90afcd7

Download Submit
C:\Windows\SysWOW64\Dmalne32.exe

Filesize
448KB

MD5
d7ee1904205cdfd27f013b3bb437f1bc

SHA1
a7b46758562b56f2ba806179dc9af2ca963c7e3a

SHA256
d95712467f67dc0f99089bd76de19dc88a03d1d1b03a461054d98d12d1a93577

SHA512
f3084a769f44775579d87c2ea07955a4377830a2eefeb1b2a7f039e65ea16132ea1e59af8b4a63026525a1cc54143c22a96d9aac4d2ce06dde68b49cef1a7b84

Download Submit
C:\Windows\SysWOW64\Edjgfcec.exe

Filesize
448KB

MD5
1b0bfbf2ffa436c1d92c1c78467097f3

SHA1
7139bc062ed98b8ef67a8df9de1ac4f827fc6102

SHA256
17f1627fadefe4a9b9adc14b775779c8e4a86f11c6ac312d444a3b25bdb0c059

SHA512
680079640083cfe9d84aedbc34e3be2d12a06f37f2d661fe7cd734b7949a3122af1c7f965cef598abd44222c1f21d0b41e9ac5d9d0acb6bb9c3da014654e32fe

Download Submit
C:\Windows\SysWOW64\Edopabqn.exe

Filesize
448KB

MD5
5914aaa1ee4dd68634749875e17c312e

SHA1
e00cc470a0bf6cfc62700283260974997f17e304

SHA256
9f7a86333a98f5b6f96a1baf3abcd70101c4c6f9767cc0209e327a3195d9db56

SHA512
df53222b0f7e3865acc0beaec9969951cd661e7666e92f20370843673b992a8ab7f3b51ab94ab6ce08dc3039ce7553541ffb69ced927b59b73a0c2daa42708a3

Download Submit
C:\Windows\SysWOW64\Fajgkfio.exe

Filesize
448KB

MD5
43863989dba2dfa20dab5c63cc6dc0bb

SHA1
8efe952e58291e33cf638e780108099a4124a913

SHA256
2ab25cc1a3bb44d391bc36f4cf354bbb9ab22aa43fb254ea76bae7d8923a86bd

SHA512
3770db1cdc1080aa7e051bcb30b189d28266879ea9b83b511c25224917fe66d419d6f0254abfd234e2488ca3dd6de509cce3a63d4e9366fdb0c04f2f800bc70d

Download Submit
C:\Windows\SysWOW64\Fhmigagd.exe

Filesize
448KB

MD5
9b203bf48f7e63b2cf1138eedc7e9421

SHA1
ce287ecdd64996dc83532be8d98aa8eba958c3d0

SHA256
fd04a188333b71ec3607318de3dad4b203e3066ce8cfb500f49d83dcfa58b07d

SHA512
9db8f27989be5d115c1515b42418f8aa4f258f3762467011d41024f8ae5515d5729773153602fa65bbf1ed45b6ed43f03296fe6a5c4f4fc45bc313714acfcbd2

Download Submit
C:\Windows\SysWOW64\Flfkkhid.exe

Filesize
448KB

MD5
3bd7d81b03bca87d0b58d454325d7828

SHA1
3e41627dc3f224d9e1f87078da38ad04a563a920

SHA256
1c2d659f3616e7cbbe0cb3ca636d3ba8fdef9e79370febf274dcb6dfc244bd53

SHA512
e99c2289c5885fa62ff56ab1f21ea1aa4493952926b7900e790b8d31078126e1784c26d5214667967187fdfffe42aea3208a5dd34a01f4f55c2121772f0cf58c

Download Submit
C:\Windows\SysWOW64\Gdfoio32.exe

Filesize
448KB

MD5
29942833766648115aafc6935755cdba

SHA1
74923d8d02a2be779e26913240b7eb88923fbdc4

SHA256
eff0f44fdbb5be1c01ea2340c95e53fd79289f3f2ef28cd302d8b75eefbc6150

SHA512
63cca62295b74ca1ea98293b7808f4679f45e83618841e58b04ff659bf1a635a73f56535ec16c1d6ab77ca64e36408559aac193d210286fbe81f11b551552c28

Download Submit
C:\Windows\SysWOW64\Ggpbjkpl.exe

Filesize
448KB

MD5
05b08ac5cd1b9de541a340483f607df0

SHA1
c1a0e05fde9e6a1d28ad0bedc3eb7ad71edcf630

SHA256
e396a4246fe90beec8c2b3d7f0243d49849efb41251ca0cd84d499438ecedb79

SHA512
20413baaa5c3acc41609e2d4c66c7e607cc298c1d6d4bf6835c0aa21bdac1297c27338382dc19a3123f6a215cf630b90d3f4523d04add90ed56745642cd0b07a

Download Submit
C:\Windows\SysWOW64\Gimqajgh.exe

Filesize
448KB

MD5
bf164bdcd0d75acb13db459c89dab544

SHA1
2d698f14c9f41030ab2e1941fa70e794c05b23bc

SHA256
d41033285636db3a88cc1b65ff7b786df2e6d6ec322374c6d71ac7385208dd56

SHA512
d6250395967c9a74717cd764e332c2e36e35160cc0f0125ca5d11c03ac73287f32e2bee0fad14dba42d22e46c07b8e43c5d1f9b6edf5ba1dd3a6a69540bd8156

Download Submit
C:\Windows\SysWOW64\Gkdhjknm.exe

Filesize
448KB

MD5
db5c1d62278393c8baf25e0bcaa92914

SHA1
d933132c24cb3e7dec2a224991ad24032ebd4501

SHA256
2bf47937d773fd54211ba372959cc76fc173e57813029613b9117cbf1f78e5a2

SHA512
16f94aef4d886144f667dcc5d5f328ef6859f5e104dff37425f7d653fe71249d3ae59af514037f19c54094fa072f0d3ed44dca691cef8edba73865355a943b8d

Download Submit
C:\Windows\SysWOW64\Hbgkei32.exe

Filesize
448KB

MD5
9948c3c5ebb5b09997f5d7df48d44524

SHA1
5c9f1d6e86d578301fcbc5a2463570a535140087

SHA256
cb123e9f267069132163da65c06fc06b62325c9c5c7b89d0713fe282e7bf172e

SHA512
2b9cbddff7acd4e6e01c07df7b3c3dec461427950f2350967f4d5a73146b87b31b232295c25a9e97a44a32443f67b9c6e359aa22819c9b755a08ad5e98baf6cd

Download Submit
C:\Windows\SysWOW64\Hdmein32.exe

Filesize
448KB

MD5
10ab74214ac9d6f2e9ff56b86ae5c645

SHA1
5f3eedc707a740701b598f65e0fe28a4c4f266c2

SHA256
637627eb33aac87559fe3915da9f4727e19f21a20be5dfc27a6a27acf3545470

SHA512
ef58766320eac141bbd669af47f3f9158a26f92b71208b309b1f6134cd8f5c10941e65bc758ea43bb9feafe7155561956ecd01ff25ba0d0947496c7078dcd45c

Download Submit
C:\Windows\SysWOW64\Hjmodffo.exe

Filesize
448KB

MD5
77ce5ed4bfc820b58be53b4449235bd5

SHA1
eb9a2fb605ea2ac337e62a0e6ffae81ea771e2a2

SHA256
b05fa3f010c3cd4feb1a41850afa537a59850b0c31b3728da7d5db8f07d43ea0

SHA512
73d116ecc90e14826fb4e87d9bc2e9b11e0520fc09f448e030623ae38c56449bdd3b43775e5de25f8a821facf6352a5570f651f33f278cefae04a91a189172ee

Download Submit
C:\Windows\SysWOW64\Hlcjhkdp.exe

Filesize
448KB

MD5
0e5939eaed4d24bc3f5b4979fafaff8a

SHA1
671958770e1b06a220104f3b9e3af05ad22bd8c7

SHA256
610a811250c76ec2bf0a21caaa6c783c4121d0364d1ffb516b82946247ad2f61

SHA512
980074de1da8b87a9bccde96ecf36723519cc06f9584df985137d435350788b599258f265169fff3b39bf4f764643720eb09ec5d5b3184c33663adcff4a6d149

Download Submit
C:\Windows\SysWOW64\Hlepcdoa.exe

Filesize
448KB

MD5
80fb7ac8564f6101fc58b675b684612e

SHA1
275abd860bb8869c95561a97b0e42ddf52d6afcb

SHA256
f8b077159ec6de2d85c1fc137196828f281bd699fc4fc8cb7ea787ce2b93a081

SHA512
ddbda356d661b77e3f887a9670c72ce1d0442ba2fcfc5eac563a1853624cd3c11240fdf6415a19afd8d40e9d59fde255aa8e1ed49e8370fc4c6ea7fe4a2a455e

Download Submit
C:\Windows\SysWOW64\Iecmhlhb.exe

Filesize
448KB

MD5
f46e27296029620264b9fb62ad16403d

SHA1
e9e2d52bda4bfe5b8b4edca9d1f76d094e559639

SHA256
d91f125c42fb7a701fa14943a6ba8c7c01b4ae8c047ebd1c7e3118f0773df9e5

SHA512
3b3b3e98d51d851cee7443dcebe3d83bd708ba09cf9aa89d78b2e4d52e53fd00f333cd077e2b62652dacd243cc7e53ac0bd2d738e46263d32af6ca565e6d100d

Download Submit
C:\Windows\SysWOW64\Iialhaad.exe

Filesize
448KB

MD5
4792a8ebb70552b313ca8e4693a274e3

SHA1
8266d164d3fc6790fedb4317f6ce7a3f39bef41e

SHA256
a245ce3b22b0ccbe3a9e74e78c7dfb5be30645187e1214516393d1f7aec72fb7

SHA512
cdb0b76e94daa1b7f02017275deefa2c8e70ccdebb6db8007585714eaff45da0fc53c28d86b5524e0560e2c71d2899ed561a093092b3d108573ab874736455e9

Download Submit
C:\Windows\SysWOW64\Innfnl32.exe

Filesize
448KB

MD5
25a277e5df9c74450a8fdc89dce0f85c

SHA1
a0679d24be0d41fbfdf6be20d90af3d5204a438c

SHA256
dbd385f7506d8f12bfeaeb4bc9ddbcb3b33535ccde1adc8e70eb8a161dcb1dcf

SHA512
048593a94e9fc4bd77c7e59cde9c5b5d792fc00bbd608d7e28c6fd3b70222d989657fddfb8af7c121cefcb875f6f0822c87ebd806d873990eda0c79c965adfca

Download Submit
C:\Windows\SysWOW64\Jojdlfeo.exe

Filesize
448KB

MD5
45f23a9f209ad1883397adf0c76f1feb

SHA1
33509fccb1101bc711b1cfabeb50132f37676a89

SHA256
4a62b96d0845321c511a64b6e3f946f6763e65485e91b4665e132aa45df9d43a

SHA512
55dbb885d60320d980df77926e137b4c3dda3c8b4b3cee12246ebdccbcc9169a2bb6ea94e2c7f4c541abe88df35eaa6f74409e5369207c32459dc72f8d233438

Download Submit
C:\Windows\SysWOW64\Kiikpnmj.exe

Filesize
448KB

MD5
a16fbdf6ac68447079ff89929ddba1e3

SHA1
52f35f6cece64dac33bd3fb1e17caeb7a5c13f39

SHA256
e7838db66e159f60fa1c2be8c38c9186ff545058cde9f60f0812ccec84c0e420

SHA512
bdd5a6e74f0fff54ed51e8f409a62b64085099bd07b3cb98e008198969838d69f3879ded70da4cd349a0b526faf0095f4c2ecfb69c3f48eaf44dbd3049ac80e7

Download Submit
C:\Windows\SysWOW64\Lajagj32.exe

Filesize
448KB

MD5
1502ecd1911687e8934abcc1697fd666

SHA1
9845f2738780fac16510c00d6b299930f8156f34

SHA256
867e7f30a2ef1d6cca9713321805e516268db94a6166a1ba4dd4e7a4a44f7d59

SHA512
f3ff17fd63121e0a4f2343a3f2b61257d13e7ca72ed316fb5954b68e4b45b1b53a04535b835f5d10a0231b81403a0dca76fdca1aae3806fe437b0d9c5d6da2be

Download Submit
C:\Windows\SysWOW64\Laqhhi32.exe

Filesize
448KB

MD5
086a0913983c565a3f6cb253dd8460d8

SHA1
34ae9ea638fd07988ed82d96d1ed16c422b1830d

SHA256
301ba02b39a41d6da0838fb02f05f4c5ff07fdab627e172c823cf7789e921922

SHA512
61fb3cc3a6f6fd41bfa63ac2d16a0026d6b1fe0b2bcf8d593deec35219302dc71995c5005584e054620c742278cf71533a8c48f3f30ac20d89394b17ce5425d5

Download Submit
C:\Windows\SysWOW64\Llhikacp.exe

Filesize
448KB

MD5
97faaa5e4a278791b1563464ebc2c50d

SHA1
f7e895ec194e11cf15ddbc031498b3f34f5c5a41

SHA256
097ee1c923b197e0fb36b2c6117660bb02b2e7f0734cd2424bf506a6ea1df31f

SHA512
159852010e9b56a46f35fcf5936c07bd975eb8663335eb57dfefe7e45451b50324232dcd689e5e0560654aa8af6b6283a0369cff6bb4e65058a44aefb26c2d14

Download Submit
C:\Windows\SysWOW64\Lnpofnhk.exe

Filesize
448KB

MD5
ae830dcac11ef569ffd05c7b592cf358

SHA1
d3706ed468f7b1fd08c3030633611c0946be4006

SHA256
90c2e7b7c25c08d2083fbececf6defdb3d4edd24d375602b5e5040d7636d6a7f

SHA512
85c10a331d26c51237514977978276cb4fc5e570c02ac6ceec354a17f50bc6796ba632c0a416945bf1e9e681fc8aefc3e0bddfff10f7e87bcfe999bd29eadcd1

Download Submit
C:\Windows\SysWOW64\Lqikmc32.exe

Filesize
448KB

MD5
acbdcf377a065e74f7ccee38e10bee63

SHA1
b78aca9ff67e946ecff6ac5134f2c42c4c3f1cb6

SHA256
57a2203e63d1e0446f0604ff04edfb66825fd169b9f33f0224064f5e1a6258b3

SHA512
6c7b4d287d211883a5fb0b226887ca11a7ba2fa8e169607241533458ffdfcf53afea4bed9892f59a9ffa0d78bce14c3a1c20d6c53cdf650918f3d6cd0f48582e

Download Submit
C:\Windows\SysWOW64\Mjpbam32.exe

Filesize
448KB

MD5
bdc71a227de94c4c67df69cc62179345

SHA1
472de67b49eab9be1bcfe1cfcef116e77684e51f

SHA256
f26a4b388495b9ae1fc087eb067c2593da67cca472a6cc6a303e6ed2f194a60f

SHA512
4f4e091aa82edde62f391ed465aa09bfe12c56363012eccf9cf3eca9e2b9e166225957368b0f2abfa876be350e3b12eefb881b7d21d6f86bbe1e1d089b9c0ef7

Download Submit
C:\Windows\SysWOW64\Mnnkgl32.exe

Filesize
448KB

MD5
024b94104edc87e21766b6da8657f6c9

SHA1
26eaa7eb41588fa7f48fd4016bb8b616f507162b

SHA256
532da10528d453a08f0905b05d2bbe4a1fc948fbb160b5ca3f5fed38b156f23f

SHA512
5c6930a40ef997e5701701ea00adef6c0bc9077f16918325d4302f6356366128d7eef2cd20b3b5afce5566d78257d199a175f52811074c07fb12e5ade25ea060

Download Submit
C:\Windows\SysWOW64\Nacmdf32.exe

Filesize
448KB

MD5
0b1eed7225f4ef50385d1226bb40987c

SHA1
4b2bca55cdbcd01f52beb5e9b69e2ac995169256

SHA256
b96258f018559d0b366aa8d0109ff472012e85ce1da351dbab86f6260d529643

SHA512
951ffd82728fec579b490d28e5acd26b43f39b6a437aa6f9bc82a83dab70fef8bb8331e4293c4a72ce63ddd4f97b3ec39e41dab088c8b90a470a77d3df3cae7c

Download Submit
C:\Windows\SysWOW64\Napjdpcn.exe

Filesize
448KB

MD5
8c3fe0a263d3de591aa5a30a374be386

SHA1
18ac15c0b322add6d8c18d752ee81e8ad819f61c

SHA256
4f81a2d84c9513bf1e0f5c40b68b0ee0393017c76a17e0fd93082333394f8329

SHA512
933329245f149f241a71887000a6fea946a9ad60e468392329921830a1a84d5df8b18a4adb3e8bbec4f77ba73c05e7a928651d37dc940c7f60243aa171de3e21

Download Submit
C:\Windows\SysWOW64\Nefped32.exe

Filesize
448KB

MD5
6bc1bd5a6e4c3a18c1f01bf05714267e

SHA1
34fbeb02915042c7972bbee030b6836efab3f15b

SHA256
188397a28681c2975c201100c282b35b3adc58d0c873fc64fc88791ccef519b0

SHA512
a94b284cde57e05bec4d177d359f246966ecb15ef33d70ccef31544a14cb1c5de6ec9ab1034fd06556546facbbf285c4ee4d89f7af5d8f5cffce37e5e39564b0

Download Submit
C:\Windows\SysWOW64\Nemmoe32.exe

Filesize
448KB

MD5
02609bd1e11383e2f5254dac849ae309

SHA1
1a1ca103a316aa8c33fc9d125ec6357f9df4bf59

SHA256
6a4c2f9499e119b3bfda637661db578e6e5238ffca74962e8486ddc7433d0fee

SHA512
e3e3e7dd08ddfdfe2c0419fb69b3f6d24f886c55e466a7d5de5e51e90700bf0e41ac3ceeff92dce02890ed27ecd43cc1a262d6f3465c38e98b208a5c7c00300d

Download Submit
C:\Windows\SysWOW64\Nqmfdj32.exe

Filesize
448KB

MD5
a16b24b454a41daba323462f4c97c445

SHA1
33ab8a23ed7c321b12cbaf771b87e012f0c6b0f6

SHA256
9f106fd8dc2ffb15ec149490c915dc14062112d0e2964e64333641e1117fb6ae

SHA512
8363ffd67f1d76bf11d94806b13c6872e0d45c13e72d9a211866e92f37f3d7c3f1b6476aa7cdfcea3a964c2d5e863a077454681c20121974c7eca622cba23324

Download Submit
C:\Windows\SysWOW64\Oboijgbl.exe

Filesize
448KB

MD5
c832adf5ec15a4f0b7a85c6e5e8e6284

SHA1
17ca991b0f4d581a68ac7b2be30e3f9ce91ee87f

SHA256
92bad7069e91dfe38c77cf55d452ab1ef0b46ef006fb72c5a705f2b5517f20c7

SHA512
6499ca08a9eacb3feeb469bccc00afcf80913cce3677bb39d70a14fdf40eb257df3419a75f45e537e15b6cf78a95d08e9524cc4539616d2e94d242fad5b444f9

Download Submit
C:\Windows\SysWOW64\Oidhlb32.exe

Filesize
448KB

MD5
1c2fcf964a2f617becf1003689949fa3

SHA1
737d22f6207aee7667bdf348fba95ed0b3004a75

SHA256
6787ee1621373fea3dd402abd11b917f8879fc5ee551c4512f47f18fdc18aa0e

SHA512
01ce4758af3e397ef2f9d70efc614282299070b015963c865a889a8265035ff01325fbf8172bd80627860169b805fd1c3d3f57c949297c61f240923b034183b9

Download Submit
C:\Windows\SysWOW64\Oimkbaed.exe

Filesize
448KB

MD5
5205c166b8a88651c9a7c771707766d8

SHA1
b06ee4e037fafe4af0f6e87a0ed07ba7ac36bc48

SHA256
c4a66b92f5216a260297fdf58b86c4b12cacd28b5e547f0f791cc3d94c9ada26

SHA512
a9b72c3354775f8870d74e9fead88b12946d8fa52cecb9350f48240b4789461d550f8a01d929b5ec9231fb815908d37cdcc2cbb85e0cc195b521b0952f348f07

Download Submit
C:\Windows\SysWOW64\Ojgjndno.exe

Filesize
448KB

MD5
293548e8e3bb378becefecd5456cc8d2

SHA1
41e34c46a9029effcf62397e42e8eebd33c78988

SHA256
d8dce1c79bc72687134e961356b2dc538143b3de206ab0449778aace11ecf959

SHA512
c4e409d0b7b61733a388afd77ee4b59897f8cd9fd8878120694dad22d8bf956b0cedb371cacb1f2c71a31ced2d8156b3ae8fd9aa685849d897598ddb48a2133e

Download Submit
C:\Windows\SysWOW64\Ooejohhq.exe

Filesize
448KB

MD5
777f8711725c92a7e29c06a635a0238c

SHA1
d4e3d8a0b1210b572c53dd746d7fd0516f9b06af

SHA256
60aef419e2a925e34ae6380c7c37d87db9f62499325349ba7fa942c87dec1b90

SHA512
ece8bc071482713e5f037bba60c0679c5c9a2f48dcdd74cff25fb29c211eca42bc51ab18efbcbf558fc0cc5679864d608eb35549e55e811c4f6026a9b2cf7f0a

Download Submit
C:\Windows\SysWOW64\Oqklkbbi.exe

Filesize
448KB

MD5
c8d1e770997ceebde98209fa4b7a5ac1

SHA1
314a9091e536c48040fc109a4ded6cb93c58e529

SHA256
5fdd76d2dd0b9845794eed5f7115746b9bb07a0a48331a5f34751e94855648ed

SHA512
f55cfc64e12cf4175a0c00b2c6c26dadc319389c84abcdd81e0aac011db2f59635ddccc2ca05559e7555b29e02a66671a94a642f1a311d83a31c867bb9bea237

Download Submit
C:\Windows\SysWOW64\Pcepkfld.exe

Filesize
448KB

MD5
c3e4ab000f414e68308f803c21e18397

SHA1
adcd85081f0dda2101ee43df003629d2526b920c

SHA256
f5390f34cc6dd09ae409394c5505a1e7f752826753b35dd8a7e82924d0c628e6

SHA512
77c5f38c558666407344e6786935c7ae7edcd80403873d9d3fddf4a544789dffb32a83038b46a0bf1c6f2ed5d1e7d67a091ddea754e774bfa715669dd1450bcd

Download Submit
C:\Windows\SysWOW64\Pefhlaie.exe

Filesize
448KB

MD5
aab53c89ffad80b3ad60e6dabf2f0357

SHA1
2e616aae27eb9864cc8424cdf6f75694fc4379ca

SHA256
180130c30bf210c9cdd5938c5ea3347a61a32a9f81d203ac6c0d9bf217bb769c

SHA512
88d4cea36dfb0d9ef00a2e28a3e7baf6f10b507cc976fb1a211bca0b76b1eeacc8e4bdd3a1d01dc6cc278e83493bef3ec385f5ed31c5a5f19fd90b1c380c34e6

Download Submit
C:\Windows\SysWOW64\Plbmokop.exe

Filesize
448KB

MD5
f4573f45d07d3f343d0889145e2a9b26

SHA1
0740a0568f7986476ec54293e7994629d23f4447

SHA256
f07079001db46c2ad95e4eb5030dcbf8e24dc4e8744fdafe3fad1f9df8d905e1

SHA512
67426a2b077db5dfa21e98069f35a764b7fb28fb51d2d769e38f4bec4d73cf73d83d6ecbf27526c78960efd198c09acc08e58d352e6f2ddb5bed2d21cf001da6

Download Submit
C:\Windows\SysWOW64\Plndcl32.exe

Filesize
448KB

MD5
06761868a724b2ed372e02e72c84a2a6

SHA1
c649853dc15506929c252721b0cd734a0c4e592f

SHA256
2edd9fe65dd46e572007cea2949be2f75ef50ccd25233381651b853dd39b31f5

SHA512
d5b797cf4222414e8f4adcd559c7dc084e08279592763f56e7ba74ffdd75413a54e3ad648bcb381efb6bb1e429922f79e496c135b48e65ac756a45b649f92949

Download Submit
C:\Windows\SysWOW64\Pmkofa32.exe

Filesize
448KB

MD5
00793152beb243505a3f258eb573a028

SHA1
506dda6209bb583e19e0a5433c6dd40eac008422

SHA256
9e4e99bd609d2e851426c15cdeee28a3e5d5db5c1d83071736f002e6bf727713

SHA512
307ffe98e767413cfe6622667cf0f72d39e1edcc06b0a143ebc2dd71eac84129fe102ae4c9ddcb85ef6c7a99b30a114f9ca4b43fcc62eaf04b4f96f6e766f745

Download Submit
C:\Windows\SysWOW64\Qhmqdemc.exe

Filesize
448KB

MD5
137d9c6fa9cc399721e3eefd515402c0

SHA1
00af06ab70ef34dae65288af148e4b79744519f5

SHA256
2d7c549f1f26e6b8d47a9039100930ad3018ec8907afe95108b697b2958b4d3b

SHA512
51fd51e5300bab06db181f773dc29f212975734d230a6b51d237ba04764a506809f51bffa5f6a435705bfbda106015819381661faa9b941b0f924e0412cbb4fb

Download Submit
memory/320-121-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/320-554-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/540-356-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/552-349-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/628-377-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/640-386-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/640-48-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/692-266-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/860-531-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1076-328-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1160-339-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1220-470-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1292-364-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1316-533-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1336-282-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1416-300-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1448-652-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1448-217-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1468-580-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1468-144-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1596-9-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1596-336-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1652-390-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1652-56-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1760-193-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1760-611-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1812-312-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1988-17-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1988-337-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2000-216-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2316-434-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2384-306-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2388-464-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2480-594-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2480-153-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2644-81-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2644-507-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2748-267-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2764-422-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2788-229-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2880-573-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2880-137-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2892-500-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2892-72-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2904-201-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2904-636-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2912-109-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2976-498-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3076-508-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3088-462-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3120-415-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3120-65-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3240-280-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3352-450-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3412-387-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3512-189-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3552-571-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3552-129-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3556-274-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3592-428-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3624-595-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3624-161-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3816-392-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3848-241-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3848-663-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3860-541-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3860-113-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3972-514-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3972-89-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4020-420-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4116-488-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4216-371-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4220-361-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4280-288-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4328-397-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4344-233-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4344-658-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4352-452-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4360-502-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4424-515-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4424-101-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4548-487-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4572-363-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4572-34-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4660-176-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4660-603-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4768-443-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4772-535-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4776-348-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4776-25-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4788-268-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4840-403-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4864-409-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4916-476-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4932-169-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4932-601-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4936-294-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4952-519-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4956-1-0x0000000000432000-0x0000000000433000-memory.dmp

Filesize
4KB

Download
memory/4956-265-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4956-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4960-370-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4960-41-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5084-330-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5096-318-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5128-546-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5168-548-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5216-560-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5256-565-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5312-578-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5348-579-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5412-587-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5468-588-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5512-600-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5556-607-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5612-612-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5660-618-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5720-624-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5760-630-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5800-637-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5844-644-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5888-656-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5936-664-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads