berbew | 58792337e2e21717ff061e28cbdb7a93feb90b55a1cd794f7a0b608106d75039

Analysis

max time kernel
146s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 05:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_4a0ed738d98ba69a4eae6c6807524718_elex_wannacry.exe
Size 320KB
Sample260701-fs459sgy5v
SHA256 58792337e2e21717ff061e28cbdb7a93feb90b55a1cd794f7a0b608106d75039
MD5 4a0ed738d98ba69a4eae6c6807524718
SHA1 7db0e59cd9682b1fac76dc895387cd3e00b30439
SHA512 4d30077868289aba661d468c1f9f8ad80e2ecc719fbaff4dca4ead669677208f4b1a2426acab78c94f2a99f4b3070ba750eb08b0561ceedb9694b30cbfc74fba
SSDEEP 3072:ag5S5dhDQ8pJyCzbZwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:agihU8qsZV/Ah1G/AcQ///NR5fn
TLSH
T17564400A26300AEACDED5BB5AC424AD85541E4F215F1E17E6123EFDCD8E4D72D868FC2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware backdoor discovery berbew persistence ransomware spyware

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ejkenpnp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfbdpabn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ghpooanf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hchihhng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jhjcbljf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cejaobel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Efhjjcpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gipbck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ijjnpg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmiljn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qnopjfgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hjbhph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ehnpmkbg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hjnndime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Npjnbg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oinbgk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gekeie32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hleneo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ghpooanf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gomkkagl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hjnndime.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jggapj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgjglg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhbahm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dlobmd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dnnoip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ggdbmoho.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gjghdj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjgemi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dajnol32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jflgfpkc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kofheeoq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpihbjmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hlogfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Okbhlm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qgehml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fongpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gcfjfqah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cinpdl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cejaobel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icbbimih.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bkhceh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dajnol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fjpoio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hikkdc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dngobghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpgoolbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ohaokbfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Giokid32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cldjkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hlhaee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laiafl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmiealgc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajmgof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbiabq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Glpdjpbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gammbfqa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Efhjjcpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nieoal32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bqnemp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbdhgaid.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnkilbni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ioafchai.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kcikfcab.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 64 IoCs

pid	Process
3152	Bflagg32.exe
3964	Bbbblhnc.exe
3668	Bpfcelml.exe
6048	Cgagjo32.exe
4804	Cnlpgibd.exe
5884	Cfbhhfbg.exe
1292	Chddpn32.exe
1092	Chfaenfb.exe
5892	Cejaobel.exe
4280	Cldjkl32.exe
2080	Cpbbak32.exe
5660	Cbqonf32.exe
1288	Deokja32.exe
1524	Dngobghg.exe
3328	Dpglmjoj.exe
2988	Dpihbjmg.exe
5264	Dfcqod32.exe
1336	Dhgjll32.exe
1632	Doqbifpl.exe
2260	Efhjjcpo.exe
892	Eifffoob.exe
5636	Efjgpc32.exe
3544	Epbkhhel.exe
4552	Ehnpmkbg.exe
456	Eeaqfo32.exe
108	Eojeodga.exe
4856	Epiaig32.exe
5688	Fidbgm32.exe
1284	Fekclnif.exe
3420	Fhiphi32.exe
972	Fiilblom.exe
3616	Flghognq.exe
2352	Fhnichde.exe
3256	Gebimmco.exe
1832	Ghqeihbb.exe
2008	Gcfjfqah.exe
3004	Gipbck32.exe
2676	Gomkkagl.exe
4200	Ggdbmoho.exe
5752	Gheodg32.exe
3936	Gckcap32.exe
1400	Gjdknjep.exe
2960	Gpodkdll.exe
5468	Gcmpgpkp.exe
5948	Gjghdj32.exe
5176	Hodqlq32.exe
2904	Hlhaee32.exe
4724	Hgmebnpd.exe
1064	Hljnkdnk.exe
2968	Hcdfho32.exe
5672	Hjnndime.exe
5136	Hfeoijbi.exe
624	Hlogfd32.exe
4608	Hgdlcm32.exe
5540	Hjbhph32.exe
5776	Iqmplbpl.exe
5968	Igghilhi.exe
5348	Ihheqd32.exe
1840	Iqombb32.exe
4992	Igieoleg.exe
1976	Iodjcnca.exe
3952	Ijjnpg32.exe
5492	Icbbimih.exe
1252	Ijlkfg32.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Kidmcqeg.exe	Kcgekjgp.exe
File opened for modification	C:\Windows\SysWOW64\Lccdghmc.exe	Lmiljn32.exe
File created	C:\Windows\SysWOW64\Cicjokll.exe	Cbiabq32.exe
File created	C:\Windows\SysWOW64\Hligqnjp.exe	Hikkdc32.exe
File created	C:\Windows\SysWOW64\Iibaeb32.exe	Hchihhng.exe
File created	C:\Windows\SysWOW64\Qfhapinj.dll	Dpihbjmg.exe
File created	C:\Windows\SysWOW64\Bldcodde.dll	Eojeodga.exe
File created	C:\Windows\SysWOW64\Elaobdmm.exe	Dehgejep.exe
File opened for modification	C:\Windows\SysWOW64\Chddpn32.exe	Cfbhhfbg.exe
File created	C:\Windows\SysWOW64\Mnkqde32.dll	Gcfjfqah.exe
File opened for modification	C:\Windows\SysWOW64\Ihheqd32.exe	Igghilhi.exe
File opened for modification	C:\Windows\SysWOW64\Kpgoolbl.exe	Kimgba32.exe
File created	C:\Windows\SysWOW64\Jhhgmlli.exe	Jfikaqme.exe
File created	C:\Windows\SysWOW64\Bfgkjnai.dll	Nieoal32.exe
File created	C:\Windows\SysWOW64\Mejnfo32.dll	Nmbhgjoi.exe
File created	C:\Windows\SysWOW64\Mfhjji32.dll	Fkehdnee.exe
File created	C:\Windows\SysWOW64\Fbnmkk32.exe	Fhiinbdo.exe
File opened for modification	C:\Windows\SysWOW64\Hligqnjp.exe	Hikkdc32.exe
File created	C:\Windows\SysWOW64\Cipokd32.dll	Kfggbope.exe
File opened for modification	C:\Windows\SysWOW64\Cpbbak32.exe	Cldjkl32.exe
File created	C:\Windows\SysWOW64\Mpedgghj.exe	Mjiloqjb.exe
File created	C:\Windows\SysWOW64\Odgodh32.dll	Bnaffdfc.exe
File created	C:\Windows\SysWOW64\Gjghdj32.exe	Gcmpgpkp.exe
File created	C:\Windows\SysWOW64\Lcndab32.exe	Lihpdj32.exe
File created	C:\Windows\SysWOW64\Doqbifpl.exe	Dhgjll32.exe
File opened for modification	C:\Windows\SysWOW64\Lcealh32.exe	Lipmoo32.exe
File created	C:\Windows\SysWOW64\Bhbahm32.exe	Anmmkd32.exe
File created	C:\Windows\SysWOW64\Jhhgefed.dll	Dehgejep.exe
File created	C:\Windows\SysWOW64\Dafhdj32.dll	Pgkegn32.exe
File opened for modification	C:\Windows\SysWOW64\Phpklp32.exe	Pnjgog32.exe
File created	C:\Windows\SysWOW64\Ahkkhnpg.exe	Ababkdij.exe
File created	C:\Windows\SysWOW64\Jhjcbljf.exe	Jflgfpkc.exe
File created	C:\Windows\SysWOW64\Pleapoon.dll	Jfehpg32.exe
File created	C:\Windows\SysWOW64\Egagemmk.dll	Cfbhhfbg.exe
File created	C:\Windows\SysWOW64\Bdnkhn32.exe	Bkefphem.exe
File created	C:\Windows\SysWOW64\Jdbklkdg.dll	Lihpdj32.exe
File created	C:\Windows\SysWOW64\Eifffoob.exe	Efhjjcpo.exe
File opened for modification	C:\Windows\SysWOW64\Bdphnmjk.exe	Bkhceh32.exe
File created	C:\Windows\SysWOW64\Fhnichde.exe	Flghognq.exe
File opened for modification	C:\Windows\SysWOW64\Oaejhh32.exe	Oinbgk32.exe
File created	C:\Windows\SysWOW64\Effjdd32.dll	Hchihhng.exe
File opened for modification	C:\Windows\SysWOW64\Iadljc32.exe	Iofpnhmc.exe
File created	C:\Windows\SysWOW64\Ghldkkkk.dll	Iqombb32.exe
File opened for modification	C:\Windows\SysWOW64\Igieoleg.exe	Iqombb32.exe
File created	C:\Windows\SysWOW64\Qpjjkc32.dll	Iodjcnca.exe
File opened for modification	C:\Windows\SysWOW64\Ahkkhnpg.exe	Ababkdij.exe
File opened for modification	C:\Windows\SysWOW64\Jifabb32.exe	Jgedjjki.exe
File opened for modification	C:\Windows\SysWOW64\Kanbjn32.exe	Kpnepk32.exe
File created	C:\Windows\SysWOW64\Ikcmmjkb.exe	Iibaeb32.exe
File created	C:\Windows\SysWOW64\Mcggga32.exe	Llpofd32.exe
File created	C:\Windows\SysWOW64\Ggdbmoho.exe	Gomkkagl.exe
File created	C:\Windows\SysWOW64\Ifckkhfi.exe	Iqfcbahb.exe
File opened for modification	C:\Windows\SysWOW64\Onngci32.exe	Ohaokbfd.exe
File created	C:\Windows\SysWOW64\Gkeakl32.exe	Giddddad.exe
File created	C:\Windows\SysWOW64\Dfoamm32.dll	Ieiajckh.exe
File opened for modification	C:\Windows\SysWOW64\Jokiig32.exe	Jllmml32.exe
File opened for modification	C:\Windows\SysWOW64\Epiaig32.exe	Eojeodga.exe
File created	C:\Windows\SysWOW64\Mlcieblm.dll	Ljoiibbm.exe
File created	C:\Windows\SysWOW64\Lfjkngdo.dll	Jggapj32.exe
File opened for modification	C:\Windows\SysWOW64\Lipmoo32.exe	Lccdghmc.exe
File created	C:\Windows\SysWOW64\Mdlgmgdh.exe	Migcpneb.exe
File opened for modification	C:\Windows\SysWOW64\Gkeakl32.exe	Giddddad.exe
File created	C:\Windows\SysWOW64\Iqombb32.exe	Ihheqd32.exe
File opened for modification	C:\Windows\SysWOW64\Ebbmpmnb.exe	Ejkenpnp.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
8908	8816	WerFault.exe	388

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjafoapj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgjcfgoa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ndhgie32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhbahm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjaiac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ieiajckh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnenchoc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adkelplc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lipmoo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onngci32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odhppclh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppffec32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdlncn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gammbfqa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lfnmcnjn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jqbbno32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njmejp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oacmchcl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phpklp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cicjokll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iljpgl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kfndlphp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkehdnee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Feofmf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_4a0ed738d98ba69a4eae6c6807524718_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngipjp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gkqhpmkg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iofpnhmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpglmjoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Efhjjcpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oinbgk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bkjpkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eoindndf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfdafa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gojgkl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oahgnh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdnkhn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbggkl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcggga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ehnpmkbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iodjcnca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Icbbimih.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfgnka32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mbldhn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hlogfd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akgjnj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dlobmd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ebbmpmnb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkjjfkcm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jhjcbljf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hfeoijbi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kcgekjgp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iapbodql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lihpdj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpinac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdodbf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nhhldc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbnmkk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ghmbib32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlbllc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpbbak32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fiilblom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqbfaa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hjbhph32.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ploobn32.dll"	Bdnkhn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbmhjmdk.dll"	Gbcffk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhalmkbm.dll"	Kiajck32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lpinac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eifffoob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Edmleg32.dll"	Pnenchoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phbcfe32.dll"	Cicjokll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cibdlc32.dll"	Hleneo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iqbjnc32.dll"	Lflpmn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bbbblhnc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qnamofdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cqccqo32.dll"	Hikkdc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jfdafa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Deokja32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnaffdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cejaobel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijipia32.dll"	Igieoleg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dflfoi32.dll"	Dgmpkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmdqfa32.dll"	Dnghhqdk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Edgccoai.dll"	Jhcmbm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Efjgpc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gcmpgpkp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hjbhph32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cinpdl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekkgpgdg.dll"	Ejiiippb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qjdhlc32.dll"	Ebbmpmnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ihgnfnjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gomkkagl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nhhldc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oahgnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cbiabq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ijigfaol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lekldqpd.dll"	Cnlpgibd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Icbbimih.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iolhpo32.dll"	Kaflio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bkhceh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ahafcp32.dll"	Aqbfaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iglfhe32.dll"	Jfikaqme.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmaece32.dll"	Bkjpkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dlobmd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fiheheka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Phpklp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Miogkjip.dll"	Lcndab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mpedgghj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mlbllc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gckcap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fndjec32.dll"	Mhefhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dgmpkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Effjdd32.dll"	Hchihhng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iibaeb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pagebpan.dll"	Hjnndime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbccec32.dll"	Bkefphem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Afnpjk32.dll"	Ijigfaol.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lijlii32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Anjpeelk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Djpfbahm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmhaae32.dll"	Giddddad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epehoppk.dll"	2026-06-30_4a0ed738d98ba69a4eae6c6807524718_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Efhjjcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Modkhnci.dll"	Miipencp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Phkaqqoi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Phpklp32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6264	explorer.exe
6264	explorer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6264	explorer.exe
Token: SeCreatePagefilePrivilege	6264	explorer.exe
Token: SeShutdownPrivilege	6264	explorer.exe
Token: SeCreatePagefilePrivilege	6264	explorer.exe
Token: SeShutdownPrivilege	6264	explorer.exe
Token: SeCreatePagefilePrivilege	6264	explorer.exe
Token: SeShutdownPrivilege	6264	explorer.exe
Token: SeCreatePagefilePrivilege	6264	explorer.exe
Token: SeShutdownPrivilege	6264	explorer.exe
Token: SeCreatePagefilePrivilege	6264	explorer.exe
Token: SeShutdownPrivilege	6264	explorer.exe
Token: SeCreatePagefilePrivilege	6264	explorer.exe
Token: SeShutdownPrivilege	6264	explorer.exe
Token: SeCreatePagefilePrivilege	6264	explorer.exe
Token: SeShutdownPrivilege	6264	explorer.exe
Token: SeCreatePagefilePrivilege	6264	explorer.exe
Token: SeShutdownPrivilege	6264	explorer.exe
Token: SeCreatePagefilePrivilege	6264	explorer.exe
Token: SeShutdownPrivilege	6264	explorer.exe
Token: SeCreatePagefilePrivilege	6264	explorer.exe
Token: SeShutdownPrivilege	6264	explorer.exe
Token: SeCreatePagefilePrivilege	6264	explorer.exe
Token: SeShutdownPrivilege	6264	explorer.exe
Token: SeCreatePagefilePrivilege	6264	explorer.exe
Token: SeShutdownPrivilege	6264	explorer.exe
Token: SeCreatePagefilePrivilege	6264	explorer.exe
Token: SeShutdownPrivilege	6264	explorer.exe
Token: SeCreatePagefilePrivilege	6264	explorer.exe
Token: SeShutdownPrivilege	6264	explorer.exe
Token: SeCreatePagefilePrivilege	6264	explorer.exe
Token: SeShutdownPrivilege	6264	explorer.exe
Token: SeCreatePagefilePrivilege	6264	explorer.exe
Token: SeShutdownPrivilege	6264	explorer.exe
Token: SeCreatePagefilePrivilege	6264	explorer.exe
Token: SeShutdownPrivilege	6264	explorer.exe
Token: SeCreatePagefilePrivilege	6264	explorer.exe
Token: SeShutdownPrivilege	6264	explorer.exe
Token: SeCreatePagefilePrivilege	6264	explorer.exe
Token: SeShutdownPrivilege	6264	explorer.exe
Token: SeCreatePagefilePrivilege	6264	explorer.exe
Token: SeShutdownPrivilege	6264	explorer.exe
Token: SeCreatePagefilePrivilege	6264	explorer.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
6848	sihost.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe
6264	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
6392	StartMenuExperienceHost.exe
8540	SearchHost.exe
6264	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 3152	2124	2026-06-30_4a0ed738d98ba69a4eae6c6807524718_elex_wannacry.exe	88
PID 3152 wrote to memory of 3964	3152	Bflagg32.exe	89
PID 3964 wrote to memory of 3668	3964	Bbbblhnc.exe	90
PID 3668 wrote to memory of 6048	3668	Bpfcelml.exe	91
PID 6048 wrote to memory of 4804	6048	Cgagjo32.exe	92
PID 4804 wrote to memory of 5884	4804	Cnlpgibd.exe	93
PID 5884 wrote to memory of 1292	5884	Cfbhhfbg.exe	94
PID 1292 wrote to memory of 1092	1292	Chddpn32.exe	95
PID 1092 wrote to memory of 5892	1092	Chfaenfb.exe	96
PID 5892 wrote to memory of 4280	5892	Cejaobel.exe	97
PID 4280 wrote to memory of 2080	4280	Cldjkl32.exe	98
PID 2080 wrote to memory of 5660	2080	Cpbbak32.exe	99
PID 5660 wrote to memory of 1288	5660	Cbqonf32.exe	100
PID 1288 wrote to memory of 1524	1288	Deokja32.exe	101
PID 1524 wrote to memory of 3328	1524	Dngobghg.exe	102
PID 3328 wrote to memory of 2988	3328	Dpglmjoj.exe	103
PID 2988 wrote to memory of 5264	2988	Dpihbjmg.exe	104
PID 5264 wrote to memory of 1336	5264	Dfcqod32.exe	105
PID 1336 wrote to memory of 1632	1336	Dhgjll32.exe	106
PID 1632 wrote to memory of 2260	1632	Doqbifpl.exe	107
PID 2260 wrote to memory of 892	2260	Efhjjcpo.exe	108
PID 892 wrote to memory of 5636	892	Eifffoob.exe	109
PID 5636 wrote to memory of 3544	5636	Efjgpc32.exe	110
PID 3544 wrote to memory of 4552	3544	Epbkhhel.exe	111
PID 4552 wrote to memory of 456	4552	Ehnpmkbg.exe	112
PID 456 wrote to memory of 108	456	Eeaqfo32.exe	113
PID 108 wrote to memory of 4856	108	Eojeodga.exe	114
PID 4856 wrote to memory of 5688	4856	Epiaig32.exe	115
PID 5688 wrote to memory of 1284	5688	Fidbgm32.exe	116
PID 1284 wrote to memory of 3420	1284	Fekclnif.exe	117
PID 3420 wrote to memory of 972	3420	Fhiphi32.exe	118
PID 972 wrote to memory of 3616	972	Fiilblom.exe	119
PID 3616 wrote to memory of 2352	3616	Flghognq.exe	120
PID 2352 wrote to memory of 3256	2352	Fhnichde.exe	121
PID 3256 wrote to memory of 1832	3256	Gebimmco.exe	122
PID 1832 wrote to memory of 2008	1832	Ghqeihbb.exe	123
PID 2008 wrote to memory of 3004	2008	Gcfjfqah.exe	124
PID 3004 wrote to memory of 2676	3004	Gipbck32.exe	125
PID 2676 wrote to memory of 4200	2676	Gomkkagl.exe	126
PID 4200 wrote to memory of 5752	4200	Ggdbmoho.exe	127
PID 5752 wrote to memory of 3936	5752	Gheodg32.exe	128
PID 3936 wrote to memory of 1400	3936	Gckcap32.exe	129
PID 1400 wrote to memory of 2960	1400	Gjdknjep.exe	130
PID 2960 wrote to memory of 5468	2960	Gpodkdll.exe	131
PID 5468 wrote to memory of 5948	5468	Gcmpgpkp.exe	132
PID 5948 wrote to memory of 5176	5948	Gjghdj32.exe	133
PID 5176 wrote to memory of 2904	5176	Hodqlq32.exe	134
PID 2904 wrote to memory of 4724	2904	Hlhaee32.exe	135
PID 4724 wrote to memory of 1064	4724	Hgmebnpd.exe	136
PID 1064 wrote to memory of 2968	1064	Hljnkdnk.exe	137
PID 2968 wrote to memory of 5672	2968	Hcdfho32.exe	138
PID 5672 wrote to memory of 5136	5672	Hjnndime.exe	139
PID 5136 wrote to memory of 624	5136	Hfeoijbi.exe	140
PID 624 wrote to memory of 4608	624	Hlogfd32.exe	141
PID 4608 wrote to memory of 5540	4608	Hgdlcm32.exe	142
PID 5540 wrote to memory of 5776	5540	Hjbhph32.exe	143
PID 5776 wrote to memory of 5968	5776	Iqmplbpl.exe	144
PID 5968 wrote to memory of 5348	5968	Igghilhi.exe	145
PID 5348 wrote to memory of 1840	5348	Ihheqd32.exe	146
PID 1840 wrote to memory of 4992	1840	Iqombb32.exe	147
PID 4992 wrote to memory of 1976	4992	Igieoleg.exe	148
PID 1976 wrote to memory of 3952	1976	Iodjcnca.exe	149
PID 3952 wrote to memory of 5492	3952	Ijjnpg32.exe	150
PID 5492 wrote to memory of 1252	5492	Icbbimih.exe	151

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-30_4a0ed738d98ba69a4eae6c6807524718_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_4a0ed738d98ba69a4eae6c6807524718_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\SysWOW64\Bflagg32.exe
  C:\Windows\system32\Bflagg32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3152
- - C:\Windows\SysWOW64\Bbbblhnc.exe
    C:\Windows\system32\Bbbblhnc.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3964
  - - C:\Windows\SysWOW64\Bpfcelml.exe
      C:\Windows\system32\Bpfcelml.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3668
    - - C:\Windows\SysWOW64\Cgagjo32.exe
        
        C:\Windows\system32\Cgagjo32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6048
      - C:\Windows\SysWOW64\Cnlpgibd.exe
        
        C:\Windows\system32\Cnlpgibd.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4804
        
        C:\Windows\SysWOW64\Cfbhhfbg.exe
        
        C:\Windows\system32\Cfbhhfbg.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5884
        
        C:\Windows\SysWOW64\Chddpn32.exe
        
        C:\Windows\system32\Chddpn32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1292
        
        C:\Windows\SysWOW64\Chfaenfb.exe
        
        C:\Windows\system32\Chfaenfb.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1092
        
        C:\Windows\SysWOW64\Cejaobel.exe
        
        C:\Windows\system32\Cejaobel.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5892
        
        C:\Windows\SysWOW64\Cldjkl32.exe
        
        C:\Windows\system32\Cldjkl32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4280
        
        C:\Windows\SysWOW64\Cpbbak32.exe
        
        C:\Windows\system32\Cpbbak32.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2080
        
        C:\Windows\SysWOW64\Cbqonf32.exe
        
        C:\Windows\system32\Cbqonf32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5660
        
        C:\Windows\SysWOW64\Deokja32.exe
        
        C:\Windows\system32\Deokja32.exe
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1288
        
        C:\Windows\SysWOW64\Dngobghg.exe
        
        C:\Windows\system32\Dngobghg.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1524
        
        C:\Windows\SysWOW64\Dpglmjoj.exe
        
        C:\Windows\system32\Dpglmjoj.exe
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3328
        
        C:\Windows\SysWOW64\Dpihbjmg.exe
        
        C:\Windows\system32\Dpihbjmg.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2988
        
        C:\Windows\SysWOW64\Dfcqod32.exe
        
        C:\Windows\system32\Dfcqod32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5264
        
        C:\Windows\SysWOW64\Dhgjll32.exe
        
        C:\Windows\system32\Dhgjll32.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1336
        
        C:\Windows\SysWOW64\Doqbifpl.exe
        
        C:\Windows\system32\Doqbifpl.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1632
        
        C:\Windows\SysWOW64\Efhjjcpo.exe
        
        C:\Windows\system32\Efhjjcpo.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2260
        
        C:\Windows\SysWOW64\Eifffoob.exe
        
        C:\Windows\system32\Eifffoob.exe
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:892
        
        C:\Windows\SysWOW64\Efjgpc32.exe
        
        C:\Windows\system32\Efjgpc32.exe
        23⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5636
        
        C:\Windows\SysWOW64\Epbkhhel.exe
        
        C:\Windows\system32\Epbkhhel.exe
        24⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3544
        
        C:\Windows\SysWOW64\Ehnpmkbg.exe
        
        C:\Windows\system32\Ehnpmkbg.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4552
        
        C:\Windows\SysWOW64\Eeaqfo32.exe
        
        C:\Windows\system32\Eeaqfo32.exe
        26⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:456
        
        C:\Windows\SysWOW64\Eojeodga.exe
        
        C:\Windows\system32\Eojeodga.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:108
        
        C:\Windows\SysWOW64\Epiaig32.exe
        
        C:\Windows\system32\Epiaig32.exe
        28⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4856
        
        C:\Windows\SysWOW64\Fidbgm32.exe
        
        C:\Windows\system32\Fidbgm32.exe
        29⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5688
        
        C:\Windows\SysWOW64\Fekclnif.exe
        
        C:\Windows\system32\Fekclnif.exe
        30⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1284
        
        C:\Windows\SysWOW64\Fhiphi32.exe
        
        C:\Windows\system32\Fhiphi32.exe
        31⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3420
        
        C:\Windows\SysWOW64\Fiilblom.exe
        
        C:\Windows\system32\Fiilblom.exe
        32⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:972
        
        C:\Windows\SysWOW64\Flghognq.exe
        
        C:\Windows\system32\Flghognq.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3616
        
        C:\Windows\SysWOW64\Fhnichde.exe
        
        C:\Windows\system32\Fhnichde.exe
        34⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2352
        
        C:\Windows\SysWOW64\Gebimmco.exe
        
        C:\Windows\system32\Gebimmco.exe
        35⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3256
        
        C:\Windows\SysWOW64\Ghqeihbb.exe
        
        C:\Windows\system32\Ghqeihbb.exe
        36⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1832
        
        C:\Windows\SysWOW64\Gcfjfqah.exe
        
        C:\Windows\system32\Gcfjfqah.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2008
        
        C:\Windows\SysWOW64\Gipbck32.exe
        
        C:\Windows\system32\Gipbck32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3004
        
        C:\Windows\SysWOW64\Gomkkagl.exe
        
        C:\Windows\system32\Gomkkagl.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2676
        
        C:\Windows\SysWOW64\Ggdbmoho.exe
        
        C:\Windows\system32\Ggdbmoho.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4200
        
        C:\Windows\SysWOW64\Gheodg32.exe
        
        C:\Windows\system32\Gheodg32.exe
        41⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5752
        
        C:\Windows\SysWOW64\Gckcap32.exe
        
        C:\Windows\system32\Gckcap32.exe
        42⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3936
        
        C:\Windows\SysWOW64\Gjdknjep.exe
        
        C:\Windows\system32\Gjdknjep.exe
        43⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1400
        
        C:\Windows\SysWOW64\Gpodkdll.exe
        
        C:\Windows\system32\Gpodkdll.exe
        44⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2960
        
        C:\Windows\SysWOW64\Gcmpgpkp.exe
        
        C:\Windows\system32\Gcmpgpkp.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5468
        
        C:\Windows\SysWOW64\Gjghdj32.exe
        
        C:\Windows\system32\Gjghdj32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5948
        
        C:\Windows\SysWOW64\Hodqlq32.exe
        
        C:\Windows\system32\Hodqlq32.exe
        47⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5176
        
        C:\Windows\SysWOW64\Hlhaee32.exe
        
        C:\Windows\system32\Hlhaee32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2904
        
        C:\Windows\SysWOW64\Hgmebnpd.exe
        
        C:\Windows\system32\Hgmebnpd.exe
        49⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4724
        
        C:\Windows\SysWOW64\Hljnkdnk.exe
        
        C:\Windows\system32\Hljnkdnk.exe
        50⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1064
        
        C:\Windows\SysWOW64\Hcdfho32.exe
        
        C:\Windows\system32\Hcdfho32.exe
        51⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2968
        
        C:\Windows\SysWOW64\Hjnndime.exe
        
        C:\Windows\system32\Hjnndime.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5672
        
        C:\Windows\SysWOW64\Hfeoijbi.exe
        
        C:\Windows\system32\Hfeoijbi.exe
        53⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5136
        
        C:\Windows\SysWOW64\Hlogfd32.exe
        
        C:\Windows\system32\Hlogfd32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:624
        
        C:\Windows\SysWOW64\Hgdlcm32.exe
        
        C:\Windows\system32\Hgdlcm32.exe
        55⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4608
        
        C:\Windows\SysWOW64\Hjbhph32.exe
        
        C:\Windows\system32\Hjbhph32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5540
        
        C:\Windows\SysWOW64\Iqmplbpl.exe
        
        C:\Windows\system32\Iqmplbpl.exe
        57⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5776
        
        C:\Windows\SysWOW64\Igghilhi.exe
        
        C:\Windows\system32\Igghilhi.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5968
        
        C:\Windows\SysWOW64\Ihheqd32.exe
        
        C:\Windows\system32\Ihheqd32.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5348
        
        C:\Windows\SysWOW64\Iqombb32.exe
        
        C:\Windows\system32\Iqombb32.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1840
        
        C:\Windows\SysWOW64\Igieoleg.exe
        
        C:\Windows\system32\Igieoleg.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4992
        
        C:\Windows\SysWOW64\Iodjcnca.exe
        
        C:\Windows\system32\Iodjcnca.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1976
        
        C:\Windows\SysWOW64\Ijjnpg32.exe
        
        C:\Windows\system32\Ijjnpg32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3952
        
        C:\Windows\SysWOW64\Icbbimih.exe
        
        C:\Windows\system32\Icbbimih.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5492
        
        C:\Windows\SysWOW64\Ijlkfg32.exe
        
        C:\Windows\system32\Ijlkfg32.exe
        65⤵
        Executes dropped EXE
        
        PID:1252
        
        C:\Windows\SysWOW64\Iqfcbahb.exe
        
        C:\Windows\system32\Iqfcbahb.exe
        66⤵
        Drops file in System32 directory
        
        PID:5072
        
        C:\Windows\SysWOW64\Ifckkhfi.exe
        
        C:\Windows\system32\Ifckkhfi.exe
        67⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Jqhphq32.exe
        
        C:\Windows\system32\Jqhphq32.exe
        68⤵
        
        PID:3364
        
        C:\Windows\SysWOW64\Jfehpg32.exe
        
        C:\Windows\system32\Jfehpg32.exe
        69⤵
        Drops file in System32 directory
        
        PID:2480
        
        C:\Windows\SysWOW64\Jmopmalc.exe
        
        C:\Windows\system32\Jmopmalc.exe
        70⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Jgedjjki.exe
        
        C:\Windows\system32\Jgedjjki.exe
        71⤵
        Drops file in System32 directory
        
        PID:5684
        
        C:\Windows\SysWOW64\Jifabb32.exe
        
        C:\Windows\system32\Jifabb32.exe
        72⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Jggapj32.exe
        
        C:\Windows\system32\Jggapj32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2584
        
        C:\Windows\SysWOW64\Jmdjha32.exe
        
        C:\Windows\system32\Jmdjha32.exe
        74⤵
        
        PID:1700
        
        C:\Windows\SysWOW64\Jflnafno.exe
        
        C:\Windows\system32\Jflnafno.exe
        75⤵
        
        PID:3508
        
        C:\Windows\SysWOW64\Jqbbno32.exe
        
        C:\Windows\system32\Jqbbno32.exe
        76⤵
        System Location Discovery: System Language Discovery
        
        PID:5428
        
        C:\Windows\SysWOW64\Kimgba32.exe
        
        C:\Windows\system32\Kimgba32.exe
        77⤵
        Drops file in System32 directory
        
        PID:4520
        
        C:\Windows\SysWOW64\Kpgoolbl.exe
        
        C:\Windows\system32\Kpgoolbl.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1476
        
        C:\Windows\SysWOW64\Kjlcmdbb.exe
        
        C:\Windows\system32\Kjlcmdbb.exe
        79⤵
        
        PID:3012
        
        C:\Windows\SysWOW64\Kaflio32.exe
        
        C:\Windows\system32\Kaflio32.exe
        80⤵
        Modifies registry class
        
        PID:2704
        
        C:\Windows\SysWOW64\Kfcdaehf.exe
        
        C:\Windows\system32\Kfcdaehf.exe
        81⤵
        
        PID:3492
        
        C:\Windows\SysWOW64\Kmmmnp32.exe
        
        C:\Windows\system32\Kmmmnp32.exe
        82⤵
        
        PID:4500
        
        C:\Windows\SysWOW64\Kcgekjgp.exe
        
        C:\Windows\system32\Kcgekjgp.exe
        83⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2892
        
        C:\Windows\SysWOW64\Kidmcqeg.exe
        
        C:\Windows\system32\Kidmcqeg.exe
        84⤵
        
        PID:2132
        
        C:\Windows\SysWOW64\Kpnepk32.exe
        
        C:\Windows\system32\Kpnepk32.exe
        85⤵
        Drops file in System32 directory
        
        PID:4932
        
        C:\Windows\SysWOW64\Kanbjn32.exe
        
        C:\Windows\system32\Kanbjn32.exe
        86⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Kggjghkd.exe
        
        C:\Windows\system32\Kggjghkd.exe
        87⤵
        
        PID:1564
        
        C:\Windows\SysWOW64\Lgjglg32.exe
        
        C:\Windows\system32\Lgjglg32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3232
        
        C:\Windows\SysWOW64\Lpelqj32.exe
        
        C:\Windows\system32\Lpelqj32.exe
        89⤵
        
        PID:2712
        
        C:\Windows\SysWOW64\Lfodmdni.exe
        
        C:\Windows\system32\Lfodmdni.exe
        90⤵
        
        PID:820
        
        C:\Windows\SysWOW64\Lmiljn32.exe
        
        C:\Windows\system32\Lmiljn32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1444
        
        C:\Windows\SysWOW64\Lccdghmc.exe
        
        C:\Windows\system32\Lccdghmc.exe
        92⤵
        Drops file in System32 directory
        
        PID:1784
        
        C:\Windows\SysWOW64\Lipmoo32.exe
        
        C:\Windows\system32\Lipmoo32.exe
        93⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4532
        
        C:\Windows\SysWOW64\Lcealh32.exe
        
        C:\Windows\system32\Lcealh32.exe
        94⤵
        
        PID:5084
        
        C:\Windows\SysWOW64\Ljoiibbm.exe
        
        C:\Windows\system32\Ljoiibbm.exe
        95⤵
        Drops file in System32 directory
        
        PID:1880
        
        C:\Windows\SysWOW64\Laiafl32.exe
        
        C:\Windows\system32\Laiafl32.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2328
        
        C:\Windows\SysWOW64\Mjafoapj.exe
        
        C:\Windows\system32\Mjafoapj.exe
        97⤵
        System Location Discovery: System Language Discovery
        
        PID:1256
        
        C:\Windows\SysWOW64\Malnklgg.exe
        
        C:\Windows\system32\Malnklgg.exe
        98⤵
        
        PID:3856
        
        C:\Windows\SysWOW64\Mhefhf32.exe
        
        C:\Windows\system32\Mhefhf32.exe
        99⤵
        Modifies registry class
        
        PID:5728
        
        C:\Windows\SysWOW64\Migcpneb.exe
        
        C:\Windows\system32\Migcpneb.exe
        100⤵
        Drops file in System32 directory
        
        PID:3984
        
        C:\Windows\SysWOW64\Mdlgmgdh.exe
        
        C:\Windows\system32\Mdlgmgdh.exe
        101⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Miipencp.exe
        
        C:\Windows\system32\Miipencp.exe
        102⤵
        Modifies registry class
        
        PID:3096
        
        C:\Windows\SysWOW64\Mdodbf32.exe
        
        C:\Windows\system32\Mdodbf32.exe
        103⤵
        System Location Discovery: System Language Discovery
        
        PID:4300
        
        C:\Windows\SysWOW64\Mjiloqjb.exe
        
        C:\Windows\system32\Mjiloqjb.exe
        104⤵
        Drops file in System32 directory
        
        PID:4332
        
        C:\Windows\SysWOW64\Mpedgghj.exe
        
        C:\Windows\system32\Mpedgghj.exe
        105⤵
        Modifies registry class
        
        PID:4392
        
        C:\Windows\SysWOW64\Mfomda32.exe
        
        C:\Windows\system32\Mfomda32.exe
        106⤵
        
        PID:1696
        
        C:\Windows\SysWOW64\Mmiealgc.exe
        
        C:\Windows\system32\Mmiealgc.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3428
        
        C:\Windows\SysWOW64\Mdcmnfop.exe
        
        C:\Windows\system32\Mdcmnfop.exe
        108⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Njmejp32.exe
        
        C:\Windows\system32\Njmejp32.exe
        109⤵
        System Location Discovery: System Language Discovery
        
        PID:1440
        
        C:\Windows\SysWOW64\Npjnbg32.exe
        
        C:\Windows\system32\Npjnbg32.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2784
        
        C:\Windows\SysWOW64\Nfdfoala.exe
        
        C:\Windows\system32\Nfdfoala.exe
        111⤵
        
        PID:540
        
        C:\Windows\SysWOW64\Nmnnlk32.exe
        
        C:\Windows\system32\Nmnnlk32.exe
        112⤵
        
        PID:3828
        
        C:\Windows\SysWOW64\Ndhgie32.exe
        
        C:\Windows\system32\Ndhgie32.exe
        113⤵
        System Location Discovery: System Language Discovery
        
        PID:3196
        
        C:\Windows\SysWOW64\Nieoal32.exe
        
        C:\Windows\system32\Nieoal32.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5076
        
        C:\Windows\SysWOW64\Npognfpo.exe
        
        C:\Windows\system32\Npognfpo.exe
        115⤵
        
        PID:2740
        
        C:\Windows\SysWOW64\Ngipjp32.exe
        
        C:\Windows\system32\Ngipjp32.exe
        116⤵
        System Location Discovery: System Language Discovery
        
        PID:5992
        
        C:\Windows\SysWOW64\Nmbhgjoi.exe
        
        C:\Windows\system32\Nmbhgjoi.exe
        117⤵
        Drops file in System32 directory
        
        PID:4240
        
        C:\Windows\SysWOW64\Nhhldc32.exe
        
        C:\Windows\system32\Nhhldc32.exe
        118⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1352
        
        C:\Windows\SysWOW64\Naqqmieo.exe
        
        C:\Windows\system32\Naqqmieo.exe
        119⤵
        
        PID:4388
        
        C:\Windows\SysWOW64\Ohkijc32.exe
        
        C:\Windows\system32\Ohkijc32.exe
        120⤵
        
        PID:2168
        
        C:\Windows\SysWOW64\Oacmchcl.exe
        
        C:\Windows\system32\Oacmchcl.exe
        121⤵
        System Location Discovery: System Language Discovery
        
        PID:2384
        
        C:\Windows\SysWOW64\Ogpfko32.exe
        
        C:\Windows\system32\Ogpfko32.exe
        122⤵
        
        PID:4860
        
        C:\Windows\SysWOW64\Oinbgk32.exe
        
        C:\Windows\system32\Oinbgk32.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1176
        
        C:\Windows\SysWOW64\Oaejhh32.exe
        
        C:\Windows\system32\Oaejhh32.exe
        124⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Ogbbqo32.exe
        
        C:\Windows\system32\Ogbbqo32.exe
        125⤵
        
        PID:3080
        
        C:\Windows\SysWOW64\Oahgnh32.exe
        
        C:\Windows\system32\Oahgnh32.exe
        126⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3784
        
        C:\Windows\SysWOW64\Ohaokbfd.exe
        
        C:\Windows\system32\Ohaokbfd.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1940
        
        C:\Windows\SysWOW64\Onngci32.exe
        
        C:\Windows\system32\Onngci32.exe
        128⤵
        System Location Discovery: System Language Discovery
        
        PID:6080
        
        C:\Windows\SysWOW64\Odhppclh.exe
        
        C:\Windows\system32\Odhppclh.exe
        129⤵
        System Location Discovery: System Language Discovery
        
        PID:432
        
        C:\Windows\SysWOW64\Okbhlm32.exe
        
        C:\Windows\system32\Okbhlm32.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4212
        
        C:\Windows\SysWOW64\Opopdd32.exe
        
        C:\Windows\system32\Opopdd32.exe
        131⤵
        
        PID:4736
        
        C:\Windows\SysWOW64\Phfhfa32.exe
        
        C:\Windows\system32\Phfhfa32.exe
        132⤵
        
        PID:3160
        
        C:\Windows\SysWOW64\Pjgemi32.exe
        
        C:\Windows\system32\Pjgemi32.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5568
        
        C:\Windows\SysWOW64\Ppamjcpj.exe
        
        C:\Windows\system32\Ppamjcpj.exe
        134⤵
        
        PID:2688
        
        C:\Windows\SysWOW64\Pgkegn32.exe
        
        C:\Windows\system32\Pgkegn32.exe
        135⤵
        Drops file in System32 directory
        
        PID:4456
        
        C:\Windows\SysWOW64\Pnenchoc.exe
        
        C:\Windows\system32\Pnenchoc.exe
        136⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2660
        
        C:\Windows\SysWOW64\Phkaqqoi.exe
        
        C:\Windows\system32\Phkaqqoi.exe
        137⤵
        Modifies registry class
        
        PID:3868
        
        C:\Windows\SysWOW64\Pkinmlnm.exe
        
        C:\Windows\system32\Pkinmlnm.exe
        138⤵
        
        PID:1156
        
        C:\Windows\SysWOW64\Ppffec32.exe
        
        C:\Windows\system32\Ppffec32.exe
        139⤵
        System Location Discovery: System Language Discovery
        
        PID:4876
        
        C:\Windows\SysWOW64\Pgpobmca.exe
        
        C:\Windows\system32\Pgpobmca.exe
        140⤵
        
        PID:3436
        
        C:\Windows\SysWOW64\Pnjgog32.exe
        
        C:\Windows\system32\Pnjgog32.exe
        141⤵
        Drops file in System32 directory
        
        PID:6008
        
        C:\Windows\SysWOW64\Phpklp32.exe
        
        C:\Windows\system32\Phpklp32.exe
        142⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2588
        
        C:\Windows\SysWOW64\Pknghk32.exe
        
        C:\Windows\system32\Pknghk32.exe
        143⤵
        
        PID:4484
        
        C:\Windows\SysWOW64\Qpkppbho.exe
        
        C:\Windows\system32\Qpkppbho.exe
        144⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Qgehml32.exe
        
        C:\Windows\system32\Qgehml32.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3644
        
        C:\Windows\SysWOW64\Qnopjfgi.exe
        
        C:\Windows\system32\Qnopjfgi.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5700
        
        C:\Windows\SysWOW64\Qdihfq32.exe
        
        C:\Windows\system32\Qdihfq32.exe
        147⤵
        
        PID:4476
        
        C:\Windows\SysWOW64\Qkcackeb.exe
        
        C:\Windows\system32\Qkcackeb.exe
        148⤵
        
        PID:248
        
        C:\Windows\SysWOW64\Qnamofdf.exe
        
        C:\Windows\system32\Qnamofdf.exe
        149⤵
        Modifies registry class
        
        PID:3880
        
        C:\Windows\SysWOW64\Adkelplc.exe
        
        C:\Windows\system32\Adkelplc.exe
        150⤵
        System Location Discovery: System Language Discovery
        
        PID:3272
        
        C:\Windows\SysWOW64\Akenij32.exe
        
        C:\Windows\system32\Akenij32.exe
        151⤵
        
        PID:3228
        
        C:\Windows\SysWOW64\Aqbfaa32.exe
        
        C:\Windows\system32\Aqbfaa32.exe
        152⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1080
        
        C:\Windows\SysWOW64\Akgjnj32.exe
        
        C:\Windows\system32\Akgjnj32.exe
        153⤵
        System Location Discovery: System Language Discovery
        
        PID:1224
        
        C:\Windows\SysWOW64\Ababkdij.exe
        
        C:\Windows\system32\Ababkdij.exe
        154⤵
        Drops file in System32 directory
        
        PID:6172
        
        C:\Windows\SysWOW64\Ahkkhnpg.exe
        
        C:\Windows\system32\Ahkkhnpg.exe
        155⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Ajmgof32.exe
        
        C:\Windows\system32\Ajmgof32.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6252
        
        C:\Windows\SysWOW64\Aqfolqna.exe
        
        C:\Windows\system32\Aqfolqna.exe
        157⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Aklciimh.exe
        
        C:\Windows\system32\Aklciimh.exe
        158⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Anjpeelk.exe
        
        C:\Windows\system32\Anjpeelk.exe
        159⤵
        Modifies registry class
        
        PID:6372
        
        C:\Windows\SysWOW64\Agcdnjcl.exe
        
        C:\Windows\system32\Agcdnjcl.exe
        160⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Anmmkd32.exe
        
        C:\Windows\system32\Anmmkd32.exe
        161⤵
        Drops file in System32 directory
        
        PID:6448
        
        C:\Windows\SysWOW64\Bhbahm32.exe
        
        C:\Windows\system32\Bhbahm32.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6488
        
        C:\Windows\SysWOW64\Bkamdi32.exe
        
        C:\Windows\system32\Bkamdi32.exe
        163⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Bqnemp32.exe
        
        C:\Windows\system32\Bqnemp32.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6564
        
        C:\Windows\SysWOW64\Bhennm32.exe
        
        C:\Windows\system32\Bhennm32.exe
        165⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Bnaffdfc.exe
        
        C:\Windows\system32\Bnaffdfc.exe
        166⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6636
        
        C:\Windows\SysWOW64\Bdlncn32.exe
        
        C:\Windows\system32\Bdlncn32.exe
        167⤵
        System Location Discovery: System Language Discovery
        
        PID:6676
        
        C:\Windows\SysWOW64\Bkefphem.exe
        
        C:\Windows\system32\Bkefphem.exe
        168⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6712
        
        C:\Windows\SysWOW64\Bdnkhn32.exe
        
        C:\Windows\system32\Bdnkhn32.exe
        169⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6752
        
        C:\Windows\SysWOW64\Bkhceh32.exe
        
        C:\Windows\system32\Bkhceh32.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6792
        
        C:\Windows\SysWOW64\Bdphnmjk.exe
        
        C:\Windows\system32\Bdphnmjk.exe
        171⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Bkjpkg32.exe
        
        C:\Windows\system32\Bkjpkg32.exe
        172⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6868
        
        C:\Windows\SysWOW64\Cbdhgaid.exe
        
        C:\Windows\system32\Cbdhgaid.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6904
        
        C:\Windows\SysWOW64\Cinpdl32.exe
        
        C:\Windows\system32\Cinpdl32.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6948
        
        C:\Windows\SysWOW64\Cnkilbni.exe
        
        C:\Windows\system32\Cnkilbni.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6988
        
        C:\Windows\SysWOW64\Ceeaim32.exe
        
        C:\Windows\system32\Ceeaim32.exe
        176⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Cjaiac32.exe
        
        C:\Windows\system32\Cjaiac32.exe
        177⤵
        System Location Discovery: System Language Discovery
        
        PID:7068
        
        C:\Windows\SysWOW64\Cbiabq32.exe
        
        C:\Windows\system32\Cbiabq32.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7104
        
        C:\Windows\SysWOW64\Cicjokll.exe
        
        C:\Windows\system32\Cicjokll.exe
        179⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7144
        
        C:\Windows\SysWOW64\Cjdfgc32.exe
        
        C:\Windows\system32\Cjdfgc32.exe
        180⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Cejjdlap.exe
        
        C:\Windows\system32\Cejjdlap.exe
        181⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Cghgpgqd.exe
        
        C:\Windows\system32\Cghgpgqd.exe
        182⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Capkim32.exe
        
        C:\Windows\system32\Capkim32.exe
        183⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Cgjcfgoa.exe
        
        C:\Windows\system32\Cgjcfgoa.exe
        184⤵
        System Location Discovery: System Language Discovery
        
        PID:6420
        
        C:\Windows\SysWOW64\Dndlba32.exe
        
        C:\Windows\system32\Dndlba32.exe
        185⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Dendok32.exe
        
        C:\Windows\system32\Dendok32.exe
        186⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Dgmpkg32.exe
        
        C:\Windows\system32\Dgmpkg32.exe
        187⤵
        Modifies registry class
        
        PID:6628
        
        C:\Windows\SysWOW64\Dnghhqdk.exe
        
        C:\Windows\system32\Dnghhqdk.exe
        188⤵
        Modifies registry class
        
        PID:6684
        
        C:\Windows\SysWOW64\Dilmeida.exe
        
        C:\Windows\system32\Dilmeida.exe
        189⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Dnienqbi.exe
        
        C:\Windows\system32\Dnienqbi.exe
        190⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Decmjjie.exe
        
        C:\Windows\system32\Decmjjie.exe
        191⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Djpfbahm.exe
        
        C:\Windows\system32\Djpfbahm.exe
        192⤵
        Modifies registry class
        
        PID:6944
        
        C:\Windows\SysWOW64\Dajnol32.exe
        
        C:\Windows\system32\Dajnol32.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7008
        
        C:\Windows\SysWOW64\Dlobmd32.exe
        
        C:\Windows\system32\Dlobmd32.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7084
        
        C:\Windows\SysWOW64\Dnnoip32.exe
        
        C:\Windows\system32\Dnnoip32.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7140
        
        C:\Windows\SysWOW64\Dehgejep.exe
        
        C:\Windows\system32\Dehgejep.exe
        196⤵
        Drops file in System32 directory
        
        PID:6208
        
        C:\Windows\SysWOW64\Elaobdmm.exe
        
        C:\Windows\system32\Elaobdmm.exe
        197⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Eieplhlf.exe
        
        C:\Windows\system32\Eieplhlf.exe
        198⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Enbhdojn.exe
        
        C:\Windows\system32\Enbhdojn.exe
        199⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Eelpqi32.exe
        
        C:\Windows\system32\Eelpqi32.exe
        200⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Ejiiippb.exe
        
        C:\Windows\system32\Ejiiippb.exe
        201⤵
        Modifies registry class
        
        PID:6768
        
        C:\Windows\SysWOW64\Eijigg32.exe
        
        C:\Windows\system32\Eijigg32.exe
        202⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Ejkenpnp.exe
        
        C:\Windows\system32\Ejkenpnp.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6996
        
        C:\Windows\SysWOW64\Ebbmpmnb.exe
        
        C:\Windows\system32\Ebbmpmnb.exe
        204⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7112
        
        C:\Windows\SysWOW64\Eimelg32.exe
        
        C:\Windows\system32\Eimelg32.exe
        205⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Eoindndf.exe
        
        C:\Windows\system32\Eoindndf.exe
        206⤵
        System Location Discovery: System Language Discovery
        
        PID:6424
        
        C:\Windows\SysWOW64\Eecfah32.exe
        
        C:\Windows\system32\Eecfah32.exe
        207⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Fjpoio32.exe
        
        C:\Windows\system32\Fjpoio32.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6764
        
        C:\Windows\SysWOW64\Fbggkl32.exe
        
        C:\Windows\system32\Fbggkl32.exe
        209⤵
        System Location Discovery: System Language Discovery
        
        PID:6924
        
        C:\Windows\SysWOW64\Fhdocc32.exe
        
        C:\Windows\system32\Fhdocc32.exe
        210⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Fongpm32.exe
        
        C:\Windows\system32\Fongpm32.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6380
        
        C:\Windows\SysWOW64\Falcli32.exe
        
        C:\Windows\system32\Falcli32.exe
        212⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Fhflhcfa.exe
        
        C:\Windows\system32\Fhflhcfa.exe
        213⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Fkehdnee.exe
        
        C:\Windows\system32\Fkehdnee.exe
        214⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6476
        
        C:\Windows\SysWOW64\Fejlbgek.exe
        
        C:\Windows\system32\Fejlbgek.exe
        215⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Fhiinbdo.exe
        
        C:\Windows\system32\Fhiinbdo.exe
        216⤵
        Drops file in System32 directory
        
        PID:6576
        
        C:\Windows\SysWOW64\Fbnmkk32.exe
        
        C:\Windows\system32\Fbnmkk32.exe
        217⤵
        System Location Discovery: System Language Discovery
        
        PID:6936
        
        C:\Windows\SysWOW64\Fiheheka.exe
        
        C:\Windows\system32\Fiheheka.exe
        218⤵
        Modifies registry class
        
        PID:7180
        
        C:\Windows\SysWOW64\Fkiapn32.exe
        
        C:\Windows\system32\Fkiapn32.exe
        219⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Feofmf32.exe
        
        C:\Windows\system32\Feofmf32.exe
        220⤵
        System Location Discovery: System Language Discovery
        
        PID:7252
        
        C:\Windows\SysWOW64\Ghmbib32.exe
        
        C:\Windows\system32\Ghmbib32.exe
        221⤵
        System Location Discovery: System Language Discovery
        
        PID:7288
        
        C:\Windows\SysWOW64\Gbcffk32.exe
        
        C:\Windows\system32\Gbcffk32.exe
        222⤵
        Modifies registry class
        
        PID:7324
        
        C:\Windows\SysWOW64\Ghpooanf.exe
        
        C:\Windows\system32\Ghpooanf.exe
        223⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7360
        
        C:\Windows\SysWOW64\Gojgkl32.exe
        
        C:\Windows\system32\Gojgkl32.exe
        224⤵
        System Location Discovery: System Language Discovery
        
        PID:7396
        
        C:\Windows\SysWOW64\Giokid32.exe
        
        C:\Windows\system32\Giokid32.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7432
        
        C:\Windows\SysWOW64\Gkqhpmkg.exe
        
        C:\Windows\system32\Gkqhpmkg.exe
        226⤵
        System Location Discovery: System Language Discovery
        
        PID:7468
        
        C:\Windows\SysWOW64\Gbhpajlj.exe
        
        C:\Windows\system32\Gbhpajlj.exe
        227⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Giahndcf.exe
        
        C:\Windows\system32\Giahndcf.exe
        228⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Glpdjpbj.exe
        
        C:\Windows\system32\Glpdjpbj.exe
        229⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7580
        
        C:\Windows\SysWOW64\Gammbfqa.exe
        
        C:\Windows\system32\Gammbfqa.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7616
        
        C:\Windows\SysWOW64\Giddddad.exe
        
        C:\Windows\system32\Giddddad.exe
        231⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7656
        
        C:\Windows\SysWOW64\Gkeakl32.exe
        
        C:\Windows\system32\Gkeakl32.exe
        232⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Gclimi32.exe
        
        C:\Windows\system32\Gclimi32.exe
        233⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Gekeie32.exe
        
        C:\Windows\system32\Gekeie32.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7764
        
        C:\Windows\SysWOW64\Hleneo32.exe
        
        C:\Windows\system32\Hleneo32.exe
        235⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7800
        
        C:\Windows\SysWOW64\Haafnf32.exe
        
        C:\Windows\system32\Haafnf32.exe
        236⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Hkjjfkcm.exe
        
        C:\Windows\system32\Hkjjfkcm.exe
        237⤵
        System Location Discovery: System Language Discovery
        
        PID:7872
        
        C:\Windows\SysWOW64\Hadcce32.exe
        
        C:\Windows\system32\Hadcce32.exe
        238⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Hikkdc32.exe
        
        C:\Windows\system32\Hikkdc32.exe
        239⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7940
        
        C:\Windows\SysWOW64\Hligqnjp.exe
        
        C:\Windows\system32\Hligqnjp.exe
        240⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Himgjbii.exe
        
        C:\Windows\system32\Himgjbii.exe
        241⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Hllcfnhm.exe
        
        C:\Windows\system32\Hllcfnhm.exe
        242⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Hcflch32.exe
        
        C:\Windows\system32\Hcflch32.exe
        243⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Hipdpbgf.exe
        
        C:\Windows\system32\Hipdpbgf.exe
        244⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Hkaqgjme.exe
        
        C:\Windows\system32\Hkaqgjme.exe
        245⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Hchihhng.exe
        
        C:\Windows\system32\Hchihhng.exe
        246⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:8164
        
        C:\Windows\SysWOW64\Iibaeb32.exe
        
        C:\Windows\system32\Iibaeb32.exe
        247⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7172
        
        C:\Windows\SysWOW64\Ikcmmjkb.exe
        
        C:\Windows\system32\Ikcmmjkb.exe
        248⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Ieiajckh.exe
        
        C:\Windows\system32\Ieiajckh.exe
        249⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7284
        
        C:\Windows\SysWOW64\Ihgnfnjl.exe
        
        C:\Windows\system32\Ihgnfnjl.exe
        250⤵
        Modifies registry class
        
        PID:7348
        
        C:\Windows\SysWOW64\Ioafchai.exe
        
        C:\Windows\system32\Ioafchai.exe
        251⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7404
        
        C:\Windows\SysWOW64\Iapbodql.exe
        
        C:\Windows\system32\Iapbodql.exe
        252⤵
        System Location Discovery: System Language Discovery
        
        PID:7456
        
        C:\Windows\SysWOW64\Ihjjln32.exe
        
        C:\Windows\system32\Ihjjln32.exe
        253⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Ijigfaol.exe
        
        C:\Windows\system32\Ijigfaol.exe
        254⤵
        Modifies registry class
        
        PID:7572
        
        C:\Windows\SysWOW64\Iofpnhmc.exe
        
        C:\Windows\system32\Iofpnhmc.exe
        255⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7636
        
        C:\Windows\SysWOW64\Iadljc32.exe
        
        C:\Windows\system32\Iadljc32.exe
        256⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Iljpgl32.exe
        
        C:\Windows\system32\Iljpgl32.exe
        257⤵
        System Location Discovery: System Language Discovery
        
        PID:7752
        
        C:\Windows\SysWOW64\Icdhdfcj.exe
        
        C:\Windows\system32\Icdhdfcj.exe
        258⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Jfbdpabn.exe
        
        C:\Windows\system32\Jfbdpabn.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7860
        
        C:\Windows\SysWOW64\Jllmml32.exe
        
        C:\Windows\system32\Jllmml32.exe
        260⤵
        Drops file in System32 directory
        
        PID:7928
        
        C:\Windows\SysWOW64\Jokiig32.exe
        
        C:\Windows\system32\Jokiig32.exe
        261⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Jfdafa32.exe
        
        C:\Windows\system32\Jfdafa32.exe
        262⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8060
        
        C:\Windows\SysWOW64\Jhcmbm32.exe
        
        C:\Windows\system32\Jhcmbm32.exe
        263⤵
        Modifies registry class
        
        PID:8120
        
        C:\Windows\SysWOW64\Jchaoe32.exe
        
        C:\Windows\system32\Jchaoe32.exe
        264⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Jfgnka32.exe
        
        C:\Windows\system32\Jfgnka32.exe
        265⤵
        System Location Discovery: System Language Discovery
        
        PID:7268
        
        C:\Windows\SysWOW64\Jlafhkfe.exe
        
        C:\Windows\system32\Jlafhkfe.exe
        266⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Jcknee32.exe
        
        C:\Windows\system32\Jcknee32.exe
        267⤵
        
        PID:3692
        
        C:\Windows\SysWOW64\Jfikaqme.exe
        
        C:\Windows\system32\Jfikaqme.exe
        268⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7588
        
        C:\Windows\SysWOW64\Jhhgmlli.exe
        
        C:\Windows\system32\Jhhgmlli.exe
        269⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Jcmkjeko.exe
        
        C:\Windows\system32\Jcmkjeko.exe
        270⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Jflgfpkc.exe
        
        C:\Windows\system32\Jflgfpkc.exe
        271⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7916
        
        C:\Windows\SysWOW64\Jhjcbljf.exe
        
        C:\Windows\system32\Jhjcbljf.exe
        272⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8044
        
        C:\Windows\SysWOW64\Jodlof32.exe
        
        C:\Windows\system32\Jodlof32.exe
        273⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\Kfndlphp.exe
        
        C:\Windows\system32\Kfndlphp.exe
        274⤵
        System Location Discovery: System Language Discovery
        
        PID:7336
        
        C:\Windows\SysWOW64\Kilphk32.exe
        
        C:\Windows\system32\Kilphk32.exe
        275⤵
        
        PID:1712
        
        C:\Windows\SysWOW64\Kofheeoq.exe
        
        C:\Windows\system32\Kofheeoq.exe
        276⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7716
        
        C:\Windows\SysWOW64\Kfpqap32.exe
        
        C:\Windows\system32\Kfpqap32.exe
        277⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Kkmijf32.exe
        
        C:\Windows\system32\Kkmijf32.exe
        278⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Kbgafqla.exe
        
        C:\Windows\system32\Kbgafqla.exe
        279⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Kiajck32.exe
        
        C:\Windows\system32\Kiajck32.exe
        280⤵
        Modifies registry class
        
        PID:8028
        
        C:\Windows\SysWOW64\Kokbpe32.exe
        
        C:\Windows\system32\Kokbpe32.exe
        281⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Kjqfmn32.exe
        
        C:\Windows\system32\Kjqfmn32.exe
        282⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Kcikfcab.exe
        
        C:\Windows\system32\Kcikfcab.exe
        283⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8208
        
        C:\Windows\SysWOW64\Kfggbope.exe
        
        C:\Windows\system32\Kfggbope.exe
        284⤵
        Drops file in System32 directory
        
        PID:8240
        
        C:\Windows\SysWOW64\Kkdoje32.exe
        
        C:\Windows\system32\Kkdoje32.exe
        285⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Lbnggpfj.exe
        
        C:\Windows\system32\Lbnggpfj.exe
        286⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\Lihpdj32.exe
        
        C:\Windows\system32\Lihpdj32.exe
        287⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8336
        
        C:\Windows\SysWOW64\Lcndab32.exe
        
        C:\Windows\system32\Lcndab32.exe
        288⤵
        Modifies registry class
        
        PID:8368
        
        C:\Windows\SysWOW64\Lflpmn32.exe
        
        C:\Windows\system32\Lflpmn32.exe
        289⤵
        Modifies registry class
        
        PID:8400
        
        C:\Windows\SysWOW64\Lijlii32.exe
        
        C:\Windows\system32\Lijlii32.exe
        290⤵
        Modifies registry class
        
        PID:8432
        
        C:\Windows\SysWOW64\Lpdefc32.exe
        
        C:\Windows\system32\Lpdefc32.exe
        291⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Lfnmcnjn.exe
        
        C:\Windows\system32\Lfnmcnjn.exe
        292⤵
        System Location Discovery: System Language Discovery
        
        PID:8496
        
        C:\Windows\SysWOW64\Lmheph32.exe
        
        C:\Windows\system32\Lmheph32.exe
        293⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Lpgalc32.exe
        
        C:\Windows\system32\Lpgalc32.exe
        294⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Lfqjhmhk.exe
        
        C:\Windows\system32\Lfqjhmhk.exe
        295⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\Lpinac32.exe
        
        C:\Windows\system32\Lpinac32.exe
        296⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8624
        
        C:\Windows\SysWOW64\Lfcfnm32.exe
        
        C:\Windows\system32\Lfcfnm32.exe
        297⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Llpofd32.exe
        
        C:\Windows\system32\Llpofd32.exe
        298⤵
        Drops file in System32 directory
        
        PID:8688
        
        C:\Windows\SysWOW64\Mcggga32.exe
        
        C:\Windows\system32\Mcggga32.exe
        299⤵
        System Location Discovery: System Language Discovery
        
        PID:8720
        
        C:\Windows\SysWOW64\Mjaodkmo.exe
        
        C:\Windows\system32\Mjaodkmo.exe
        300⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Mlbllc32.exe
        
        C:\Windows\system32\Mlbllc32.exe
        301⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8784
        
        C:\Windows\SysWOW64\Mbldhn32.exe
        
        C:\Windows\system32\Mbldhn32.exe
        302⤵
        System Location Discovery: System Language Discovery
        
        PID:8816
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8816 -s 448
        303⤵
        Program crash
        
        PID:8908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 8816 -ip 8816
1⤵
PID:8888

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
PID:6848
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:6264

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:8540

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:6392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 607B
SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
MD5 76b78ed7ff6273215b134d6a6488035d
SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
TLSH
T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
MD5 SHA1 SHA512 TLSH

Submit Download

Bbbblhnc.exe

Path C:\Windows\SysWOW64\Bbbblhnc.exe
Size 320KB
SHA256 ac22b273823c5087043a394a151df6b1448701709a25dd6fc5d7ba6c36768044
MD5 33a690934f8c4f45d6c9b69830e4c65c
SHA1 edb6c932d3e927b790956190a27a451d3da62671
SHA512 1e37a0744e8ae90791c1ab107bb76529e9d610835c855132464477c91994ac402dc86e7fd5a2b38e7175a310ba9a506681d0e3116112a3119fb036264e7ab830
SSDEEP 3072:QaVVS8HK+mXu3m3L38twS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:QpAm738tV/Ah1G/AcQ///NR5fn
TLSH
T1AD643119163409FACDED1FB5AC1249D9A281E9F014F1E13E6223DFDCD8E8DA6D816F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bflagg32.exe

Path C:\Windows\SysWOW64\Bflagg32.exe
Size 320KB
SHA256 cebd7215968fb9579250fb29e24bd38062f6b1f6a8cffe0d7b8c84dd237955ce
MD5 4de4b41be0ecbb5a157b5a5c487dd862
SHA1 7834b045145bc5356158e15bb8497a65d8cb051c
SHA512 28c706d9688fb153a9dcb0167e06c43c9c448db559c4731a3cfcd075ee7adf8e8dc8b664af67d0abe2bb4db2b9c6b0c16c047a25d6cbb59da465535c5c518b25
SSDEEP 3072:nETJq0+2wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:640+2V/Ah1G/AcQ///NR5fn
TLSH
T115641D1A6E300DEAEEED1BB5AD5249D85141EAF014F1E13E6123DFDCC8E4DA6D809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bpfcelml.exe

Path C:\Windows\SysWOW64\Bpfcelml.exe
Size 320KB
SHA256 6ce7088171ec00715641ecd97b1a288f59a722ee533b3d0309fa038ebb667264
MD5 547b804e78af606a0a3123c8ae9df3a1
SHA1 1eab7181aa7b1d5e6c4ca3550c21891e69a1f554
SHA512 1dd85f3733f4f55f147de200cb3818ffb07249b75d70997bfb58ee141ba54c0ef1aee6d28fb8b34317795232a8dac49cb1cb56fef141972562a6f7eddcd833c0
SSDEEP 3072:SbHpCqwYzGWzwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:SbXzV/Ah1G/AcQ///NR5fn
TLSH
T16A64205A6A3409EACDEE1FB5AC1349D8A141E9F014F1E27E6123DFDCD8E4DA6C805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cbqonf32.exe

Path C:\Windows\SysWOW64\Cbqonf32.exe
Size 320KB
SHA256 c97c309acd48a05ce76745e66f9c21511b1aa94177b0d08c7b56c1b8a2e4b2f1
MD5 c5de9264524fd0783bb272878ad3627e
SHA1 e8b4214c329721e667b148025b9a336aba8a02b9
SHA512 3b5602ef8f28b733ad75c5fbf02086e0e273ce5daefbc2d04b2c06be7b80e2bd95a93da61b3f9615a1402effeef0fe6aa7b860b0260f946b8d55875918c4a280
SSDEEP 3072:hpfrKD3ZzJDRgGrVeyDEwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:f63dJDTrVeMEV/Ah1G/AcQ///NR5fn
TLSH
T19964301956340EEACEED2FB5AD1249D89141E8F014F1E13E6127DFECD8E4EA2D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cejaobel.exe

Path C:\Windows\SysWOW64\Cejaobel.exe
Size 320KB
SHA256 683164cec1c43ad08037cb885c5b77bb470424363b3e21266b5fbed59ea700c1
MD5 62f6563dab0f0204949de3f011aee4cd
SHA1 583afb28a2e83e9509062ed9d9b8786c60247c22
SHA512 7bef0fa6cdab1c1d5624bc637dfd5aed05d286d50c15396e257b10fb17e8b11a32de7ad1b18b94181c74542d913bebb7419568aee9c7825ad8380dcd5c2f2230
SSDEEP 3072:W7kpuqrpb8uf7w+MXnwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:WiTrpbDf7NMXnV/Ah1G/AcQ///NR5fn
TLSH
T18A644F19263459EACDED9FF6AC1259D85181E8F014F0E13E2123DFDCD8E4EA2D899F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cfbhhfbg.exe

Path C:\Windows\SysWOW64\Cfbhhfbg.exe
Size 320KB
SHA256 ff39d4704db5de9532951c6d4fcdf24e5a5df1f7bbe710bac1b84f04e1dea21e
MD5 8dcd6a2c052ff07ac3432488fab129f7
SHA1 bea609b330b79ef18014062f5e5854b8593fc1c5
SHA512 e603bd77649ad6203b2f6dffb72cdd1872fce11a9b537a7d9b702840066ca010d8c874879514814a3cd0722f5abb9174b3c8c12fa2e46a169f63fd8e44309a69
SSDEEP 3072:HVEy2Xmqa6AuwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:qycJAuV/Ah1G/AcQ///NR5fn
TLSH
T149643E192B7409EACDED1BB9AC0249DC9191E9F024F5E23E6123DFDDD8E4DA6D804F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cgagjo32.exe

Path C:\Windows\SysWOW64\Cgagjo32.exe
Size 320KB
SHA256 e6633d79760799cb7d4583af0841034cc817e953e0ac51e42c33cba8daf73658
MD5 762f4f427afdcf30b1a941ffd4c5cd26
SHA1 4d6c1668d9b8336f0d564651c3697331594b67e4
SHA512 4a21e234274a0e8acfb140060761c0bf746b66db2b6d5037d9e2e60b3871d53f401116cc455d54f94ec6125620beae666bdc413d7d2f4e1be339fc44c22135eb
SSDEEP 3072:W+Y3sGuSe6cxrKvDDnlwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:W+SdreeDjlV/Ah1G/AcQ///NR5fn
TLSH
T1186441192A3409EACDED1FB6AC0249DD9181E4F015F5E13E6223EFDCD8E4DA2D825F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Chddpn32.exe

Path C:\Windows\SysWOW64\Chddpn32.exe
Size 320KB
SHA256 077f2add2d91dfaf3797164e1373dbec7f75fd2b6d8444f7188237bbfa9bd768
MD5 0cff82b679134c21e534e62c59b039b9
SHA1 30ba666c0c53e9c9e44384bd5e2ccf3f47267933
SHA512 7090c44f5c37c8cb4411aaf2a2017eccf00ae60ce651dcea41810ea2cecbf2887d4f306a30c1fa038a2175a4b0c77265975713ad2b5708a2d0b41f238abcbf45
SSDEEP 3072:Q7zl2Q10kSR1pDt0wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Q75z1mX0V/Ah1G/AcQ///NR5fn
TLSH
T15E641E196A380DEACEED1BF5AC1289D85181EAF014F1E13E6523DFDCD8E4DA2D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Chfaenfb.exe

Path C:\Windows\SysWOW64\Chfaenfb.exe
Size 320KB
SHA256 c3f90cf420b5a7bc37bd5d651f13b11d447f73d37e8a87048bf6fa88d4ab3b13
MD5 892dfb2c691e687f2ee763088d9c854f
SHA1 731684096afcfbc528ec1def57c02e13c5066f39
SHA512 68a22ff5fb2ee73f66fe777263956b860914e9a78d527635b5a034448b7a88755cc02e606ead2d20d79a3f2b8744708bc43838801f462386c1f61185b6e5e5cb
SSDEEP 3072:XZqaw/ypKNwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:XHw6pKNV/Ah1G/AcQ///NR5fn
TLSH
T14264FB191A304DEADEED1BF5AC0249D94182E8F015F5E13EA523DFDDE8E4DA2D809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cldjkl32.exe

Path C:\Windows\SysWOW64\Cldjkl32.exe
Size 320KB
SHA256 fbf1da52bdd165a3a7f99b827f8e81b99116228b7865c983b8ccf352080a2e1c
MD5 5ec8b80a22bc5da00ff29a1b2c95315d
SHA1 763e2565da24325fc76f99d2817012f978d26fef
SHA512 f5e9dd4277f4c909aa31f54563d17dea437622b81460276a74e037f60844455c25ed969761ec31f2c1956258fecf2ae9374c4ee678f98b4b7a509c5fa25e28fc
SSDEEP 3072:zQnZNUKUck7HIjI/HsfwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:zQZueIMfV/Ah1G/AcQ///NR5fn
TLSH
T1DE64FC1E2A3409EACDFD5BB5AC1249D89181EAF014F1E13EA123DFDCD8E4DA6D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cnlpgibd.exe

Path C:\Windows\SysWOW64\Cnlpgibd.exe
Size 320KB
SHA256 d2a277723a9ef0d87b3526e191fa4885ea04a6fc2f1936f9783e9ef0a0a08922
MD5 eaeb18d3847877b278f2e705dd320f04
SHA1 8130cd47590b1b6c31533480c3118bf54e8ad7ce
SHA512 eba6871592eb1cba5ddd12db7c359c001ee1eda3ac5f9593c12cb00e8e612615c1200c461bfa3b4a1c7e03723a05824fda3a6b5cb2e6f87f0eaf4581accc04c7
SSDEEP 3072:J2kQKvypkeFs51d3P3fP/YMwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:+7pkeFs51dPPQMV/Ah1G/AcQ///NR5fn
TLSH
T170641D1926301DEACEED1BB5AC4259D89186E8F014F1E17E6133DFEDD8E4DA2D818F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cpbbak32.exe

Path C:\Windows\SysWOW64\Cpbbak32.exe
Size 320KB
SHA256 817d2675500b216e0fa74af8bf80678678f79f5885e801851e486b747aff98ca
MD5 d7f04e4931b10524df7e1cabb0ed49ff
SHA1 35c7789371210b694fddf5b0fd09838a13b7fb15
SHA512 8c871b051ba66654da9aea7b7d24d1cea3b0714f4d81c22efcc2b1203166c0be5c61956bb9d79e03dace100fb5f2f179793555dda072476ca0c6756b3c1bdffe
SSDEEP 3072:NHobP4zBtMwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:ebwNtMV/Ah1G/AcQ///NR5fn
TLSH
T1CD6420192A3409EACEED1BB5BC1249D8D142E8F054F1E53EA123DFDCD8E4DA2D919F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Deokja32.exe

Path C:\Windows\SysWOW64\Deokja32.exe
Size 320KB
SHA256 efeda71a5933760ead945de82a42fe1faa0a7ac6288293304372310b9a379521
MD5 86bdb23162dc7537f13d504aff16666d
SHA1 e23af4e932863af6aaa0c79a9ef412deb12f5a50
SHA512 d6633386b6aaead8d6772287f4c88f625bc5a9378d86ae1bb5c859c1dafa95297bd57e2561deae90b8fcfd3e0912ed8954bfd67208fc08225076d5bef199c3fb
SSDEEP 3072:D2Jv2mOpZwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:DCv21ZV/Ah1G/AcQ///NR5fn
TLSH
T1A1642F196B3049EACEED1BB5AC1349D99541E5F118F1E13E6123DFDCC8E4DA2E80AF81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dfcqod32.exe

Path C:\Windows\SysWOW64\Dfcqod32.exe
Size 320KB
SHA256 44ca214a1fedd97057a43312f0fffcb54a00e48cc5c99ae6eb5524fe52257e06
MD5 401282a2c8413187afad434a16abc662
SHA1 044db134b7cee3d4f58450088d86580b674d475e
SHA512 5e0702c16de7262698cee0cee5f59251f1065ce7d005c857ac0078ef517d267e795ba4764259eca224ff32d5812a80bd1620c821e4fdddbd6db162cbaf771f34
SSDEEP 3072:NLCq//8DFV4krPLYiOgfGawS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:wCi0iDGaV/Ah1G/AcQ///NR5fn
TLSH
T117640E192A3409EADEED1BB5AC1349DC5141E9F014F1E27E6623DFECD8E4DA2C819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dhgjll32.exe

Path C:\Windows\SysWOW64\Dhgjll32.exe
Size 320KB
SHA256 16575a7d2aa0b9fba5917a1eb39a25633e098f0839f13ae4e15f8a28057a7a47
MD5 f3ec568dca6cd8b66ae8eaaa17ecbc28
SHA1 b848e830213294fc10adbf47571c10146f1bb4ea
SHA512 06035279ee7fe0aaa26f86f6d587787ffc5a0ddc42366e24e3ed4b82461470d5e465a3013d853219dc734a9589482896431841dedce5414627ea754ba6d36490
SSDEEP 3072:p6TfdfYonW/h14wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:pefdfYxn4V/Ah1G/AcQ///NR5fn
TLSH
T1C6642E1A263409EACEED9BF5AC5249D89141E9F414F1E13E6123DFDCD8E4DA2CC29F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dngobghg.exe

Path C:\Windows\SysWOW64\Dngobghg.exe
Size 320KB
SHA256 64445b91e30d99c994fcb0bed5a6a76c18f73913394b4fb308a4685ef6177127
MD5 7b3ff30b73e41679d5f7f87dacd62190
SHA1 c460b3878b6c427e3f100358b19dfdfa705ca57d
SHA512 517a8a31deb74dd6f07d246b63e0b4ce63b03c0b3e669fa374e1f284bb0779b92010e4f121294922e3f24e7f2a9ab0b4a81cb2eabfbb715a8e29a0ce7e6b1fb2
SSDEEP 3072:QvNNxFMFM7ws7wg8wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:QdwPgwg8V/Ah1G/AcQ///NR5fn
TLSH
T174644F192A3809EACDED2FB5EC024AD89141E9F114F1E23E6127DFDCD9E5DA2C905F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Doqbifpl.exe

Path C:\Windows\SysWOW64\Doqbifpl.exe
Size 320KB
SHA256 7e5d2c85f10486639a08def9bbfcf74e9efb3fc5e095bb22154a8c6ecf416cbf
MD5 33cf220177a7b33044fe372a921eb5fd
SHA1 f7a260575bb04281108bfb4306c74cd9cbacdfdc
SHA512 1b488e4ba3ecb7c2499a814e46608c2129174766a1fddcf7cfa218bad04ee36daf6a40fb3da8d270f2f7c0d4167b55f9f90e7c7ca995360dacbc289fc8a106f3
SSDEEP 3072:s2D4daPiprkaR+wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:s7aPip7+V/Ah1G/AcQ///NR5fn
TLSH
T193641F1A263509EACDED1BB5AC0249D89141E9F424F1E13E6137DFECD8E4EA2DC19F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dpglmjoj.exe

Path C:\Windows\SysWOW64\Dpglmjoj.exe
Size 320KB
SHA256 6c232f0558f1ebc927bc217fcf034ce1ac021b63bc754fc783997ef85fdbce1c
MD5 d645f734f6237dd7e79ad55e9862cbb7
SHA1 159dcfd0525161df0525c3be65d784471538e8dd
SHA512 1b5fd71dd1ba6a3f18d6df68f987a3777937dc56e273bc916158a3419ba99d16eea92d8b55519c8ae30601e21062c16997712d129c2b65f03538bfffd2c86638
SSDEEP 3072:cUco4ryHJiWBrwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:XT4OZrV/Ah1G/AcQ///NR5fn
TLSH
T1FC642F5A2A3409EADDED1FB6AC1249D85181F9F414F1E13E6123DFECC8E4DA6D805F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dpihbjmg.exe

Path C:\Windows\SysWOW64\Dpihbjmg.exe
Size 320KB
SHA256 4d88122b395d02174c9484091740549aeae055278592ab68917749afd6709c87
MD5 7de7ea0e57f8d941435e424331310d50
SHA1 16325270c30537792246390797ef5f8acea59cab
SHA512 196d57bad7050f6ccbc394342d396535f6b0c11d63eb5984cf846d226987947cdc9a46b168e0c0486ed12ae3e61bd0251503d1c5e420f435709ba25d0448e2c0
SSDEEP 3072:Myw7p0JuikS9RvPRwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:MyxHkivPRV/Ah1G/AcQ///NR5fn
TLSH
T1B5643019163019EACEED1FB5AC1249EC9182E9F014F1E17E6123DFECD8E4DA6D825F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eeaqfo32.exe

Path C:\Windows\SysWOW64\Eeaqfo32.exe
Size 320KB
SHA256 8d91704f35481300a305a7524e8bd50c9225cdf193af7f51a13e5797f5d09a8d
MD5 96363e56fbc9158666dc5fec13a66cc5
SHA1 f80356da4cc6cb5b62de81fa62c4f802b95b1631
SHA512 9850d78ee9d7aa9ed64ec82cc0790f3b478af8073b7ea3e73b3c14c0a37904f973a78c45b33aad9389b7da8361452e93cf301164749ec818ddfbee4125bbf876
SSDEEP 3072:CGn0OkDxlRRR+EwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:gOk1yEV/Ah1G/AcQ///NR5fn
TLSH
T18064511A2A3409EACEED1FB5AC0289D84141E9F419F1E13E6127DFDCD8E4DA6DD09F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Efhjjcpo.exe

Path C:\Windows\SysWOW64\Efhjjcpo.exe
Size 320KB
SHA256 1470515414e8b86f82f1070c9ef9db833780ce2fa41e369252b2437975c4cdb1
MD5 00a43663bcd0b869ab0449a069decfdc
SHA1 55f76d137d83e318d5a8cb2b23a7eb3c29bf317f
SHA512 1c4ced0baec2e9debf1d01f543c988733cb9335fa3bb25686388a51732b2804c69f1ad723118ec5854eaa644a4fcc1e62df8fa671a5b5d54cba6d3235a3858cf
SSDEEP 3072:3alhlVC4y4fwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Yndy4fV/Ah1G/AcQ///NR5fn
TLSH
T168643E592A3109EACDED9FB5EC0249D85281E8F414F5E13E6223DFDCD9E4DA2C819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Efjgpc32.exe

Path C:\Windows\SysWOW64\Efjgpc32.exe
Size 320KB
SHA256 52a549cb525a84355ed8f6933eefb72fa2034d773285b9a73c5a27867186c1f7
MD5 93a20d69b30abebf9ac080501c1de3dd
SHA1 ec20ffea2f2a2bbddf41b6bb6a4de606abda3340
SHA512 9db0f44831d84b957066c539c86ad42c0e607c06d68166a2b4c78ef70ea5257c71f804ed09279a1973cb5ed09437aba55e497e99db2f0277a4bbc6e42c6b337e
SSDEEP 3072:LbfyyaR5ojcwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:XfyXR5wcV/Ah1G/AcQ///NR5fn
TLSH
T11964311A1A3409EACDED1FB5AC1249D89246E8F214F1E13F6563DFDCE8E4D62D818F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ehnpmkbg.exe

Path C:\Windows\SysWOW64\Ehnpmkbg.exe
Size 320KB
SHA256 69279c386f1b42a18cea634f2192a8ba9df41e77fdf0abe904aa9973eedb309b
MD5 8891ca7beecb6a5f846d98586e213f06
SHA1 241d966c27ac75f6df990957569d137b1b55b2d3
SHA512 d104bbc71f7fffde95e02db87d4bde064306f65526d22b0b06c76b17a308f290a9c2d7aedcfcedc594b8db1052914fac9a17907f0ab1239d92eda632dd923f30
SSDEEP 3072:z9US1i2vhwg6x++++HTwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:zCS1i2vhITV/Ah1G/AcQ///NR5fn
TLSH
T1FE6430192A7449EACEED1FB5AC1249D85542F8F214F1E23E6123DFDCD8E8DA2C815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eifffoob.exe

Path C:\Windows\SysWOW64\Eifffoob.exe
Size 320KB
SHA256 aecc5d76eeea02381c0114babb03c2a4ddb155019a86d9baa618a769f0a48361
MD5 9508ad967ba2325c63c3d70b70519e72
SHA1 822dd6d5b7354ad7d2ae6d1d595e8e53cf4eeda7
SHA512 a676e612d2fcc53ab4a011225d41f2f5719f7c06b14406284576744d969f6a1ea2bcffad7e0e5bf124849662fd43ebe5e25aab9e701ed75a05bfb634255a2743
SSDEEP 3072:6yviOs2JtIJwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:rqOttIJV/Ah1G/AcQ///NR5fn
TLSH
T124641F19263409EACDEE5BF5AC1249E89145F9F014F5E23EA123DFDCC8E4DA6D818F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eojeodga.exe

Path C:\Windows\SysWOW64\Eojeodga.exe
Size 320KB
SHA256 a79f2db83bfcf9201fb2625fb570baf7b185454f96c2a5b3ab7051dfebe14bfa
MD5 9d24dd4915cbe7a1bff04d04daa262cf
SHA1 51f1111563de3a561e3c83f2f083f3f66ddabfd3
SHA512 68046052abec5cc34f905debd9f22c6f369ce56134d62c7ce099704d33c0cbf7c9ee93c3d8478d2925e825207de1a7fac56d4b94fde58e8f22494849832137fc
SSDEEP 3072:6AFqa3KmO0bdrSewwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:ZU0bFLwV/Ah1G/AcQ///NR5fn
TLSH
T1F1643EA9363009EACEED1BB5AC524DD8A181E9F114F1E13E6123DFDCD8E4DA2C815F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Epbkhhel.exe

Path C:\Windows\SysWOW64\Epbkhhel.exe
Size 320KB
SHA256 b9140c3a921241df623d1b8a7ca57eb0d6ca45c922af657f45e7b7aa128e9c83
MD5 23395438a7803bd4a820fa57393c6750
SHA1 62e97028fcc0f24679a482900e99ef6b1f0ae114
SHA512 0934a4c214e6e4a77e829bf465246484ecc4d7b065e72b4a2e4ff615e5d51b98abda3bda64396dc10d23227eeb1bd58b95798cd85927e785cc58a990455df7fa
SSDEEP 6144:FRaHsfgw9XmnL/ZV/Ah1G/AcQ///NR5fn:FRKBw9XmnLk/Nv
TLSH
T13E6440192A3009EACEED1FB6AC1249D89181E8F154F1E53E6137DFDCD8E4DAAC815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Epiaig32.exe

Path C:\Windows\SysWOW64\Epiaig32.exe
Size 320KB
SHA256 48e5e3441ce0955786f5ac674ba5af2a12041ac5ddb77ed4e6fe62b0e62af900
MD5 a24a0c60dc0a8b5e31d89964de77eea8
SHA1 1683e64d863da3e12b93f5b71dc450884aef7196
SHA512 68fe63a1a75e23ea67407af4e6fc88c4142df5522646aae29cc52d2431203bee43d18fa117ca9af18a9c1758ac92692f945bba250908be4ddd52fc5286dc00d5
SSDEEP 3072:7VmKrZNwYbjiHjQ3E+3wwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:ZmKrbHR/wV/Ah1G/AcQ///NR5fn
TLSH
T1AC644129263409EACEFE1BB6BC4289D89141E5F414F1E23E6523DFDDC8E4DA2D914F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fekclnif.exe

Path C:\Windows\SysWOW64\Fekclnif.exe
Size 320KB
SHA256 a7bd1b5757bd1bf1d0c9e4139fa90591f3096463282ac461e45136b30eb772d1
MD5 e89248ceaf42b5dda56ef1115a57574c
SHA1 f2b9f0726d44b7b58c9c73935f8ad1200ecd2049
SHA512 2f8b88bc9cb0785ed9baf29289d3669f1401de03e0725d19beba8c750d1e4fe84887cfae6ed29c33b11f123dfb319d2e58c84ebc9e21938d8511b58ac81abae3
SSDEEP 3072:pcC6Q5y24cO1wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:pL6qb4cO1V/Ah1G/AcQ///NR5fn
TLSH
T19964EA2E6A300DEACDEE1BB5AC2249DC5141E9B014F1E57E6223DFDDD8E4DA2D805F90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fhiphi32.exe

Path C:\Windows\SysWOW64\Fhiphi32.exe
Size 320KB
SHA256 ea440c9421b94539fb16ccb6ee81a41a72ff1eaea8ebf6efd5ae73bae4c8f7d2
MD5 c401d6316adfde9d75ffaff4e059b5c4
SHA1 7699e43fd47b249c8ba586408eec78acca6433a4
SHA512 b307daea26a1099de551b1e45515cf87a789ed6572d93f7551c96f5e5d0209aca2d9cc0b1d27836ce65ad3eca5a8f6d6c1bec2be603faf7f7d6a71c1358f2147
SSDEEP 3072:4yXNkFYpoIlzbwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:rYIlzbV/Ah1G/AcQ///NR5fn
TLSH
T15F64311A2A7419EACEED1FB5BC1249D89181E9F114F1E13E6123DFDCD8E4DA6C809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fidbgm32.exe

Path C:\Windows\SysWOW64\Fidbgm32.exe
Size 320KB
SHA256 02fdbccae9fb7b7c60fd1d7c8857d3ea41b11f4b30a7d65c50477533fb95eb1d
MD5 1c9a69cd6420622a7d974377a7499668
SHA1 f7b939bd075cce46d8a247d53e8820dfcf6afef1
SHA512 597b45a7f4b2e7d42bb865aa38ec5d3080041ba8f64faf3bd005259e30d43f8648b2e70c261b9dd3c92a947d1f0c12387da569aef3197604ce2f7f5e302edc4d
SSDEEP 3072:EZfi+FIb9nO8vwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:EZfdIF5vV/Ah1G/AcQ///NR5fn
TLSH
T11C6421192A7009EACDED1FB5AD5249D85141E9F028F1E23FA123DFDCE8E4DA2D805F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fiilblom.exe

Path C:\Windows\SysWOW64\Fiilblom.exe
Size 320KB
SHA256 4f482b77358c906bf42ecebdd74f1ac9213de3a357c530496c839beacbb55404
MD5 dfd809e40319fd29a77d163ca8b7f690
SHA1 22e00cb51d531bb75e385b8990a6973a5d567952
SHA512 4006d892c278fd24379a538542bd0cf8925ece775a11d0f46e3ed9528f49fbf5e073dfbdf35a096ed03b1d8d9fa837cd741e0cc86cb946c15c7e0b73efba1058
SSDEEP 3072:mwalqobUWLmVHMArkgpwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:+QYAV/Ah1G/AcQ///NR5fn
TLSH
T1D864C81A2A3409EECEED1BB9AC1259D85142E9F418F1E13E6123DFDCD8E4DA6CD05F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Flghognq.exe

Path C:\Windows\SysWOW64\Flghognq.exe
Size 320KB
SHA256 3066966c58b35d229d80fb454a00313d749bd2ff6cc9fb2c8d68e3e6afb1260a
MD5 48de525e318c4b094e382dc0b4665d6f
SHA1 4b70d19fd492d719e778d8e27db5b63c554a9fc0
SHA512 730990b52172089176f935b5189cbbb50864afb4be4e1293f8b0237abd483c56a03862d63b0404b88adec71e21195432ac9273115e32a102498dc2b487d0bdea
SSDEEP 3072:GIP2JpZEK1A00wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:GIPCpCKC00V/Ah1G/AcQ///NR5fn
TLSH
T10664421A263409EADEED9FB5AC0249D89181F4F014F1E13E6527DFDCE8E4DA6D809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/108-182-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/456-176-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/624-330-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/892-147-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/972-217-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1064-310-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1092-57-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1252-385-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1284-203-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1288-91-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1292-506-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1292-49-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1336-127-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1400-275-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1476-450-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1524-98-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1564-501-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1632-133-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1700-430-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1832-240-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1840-360-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1976-370-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2008-245-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2080-77-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2124-1-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/2124-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2124-460-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2132-484-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2260-140-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2352-230-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2480-405-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2584-425-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2676-255-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2704-461-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2892-478-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2904-300-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2960-280-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2968-315-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2988-112-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3004-250-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3012-455-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3152-7-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3152-471-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3232-507-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3256-235-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3328-105-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3364-400-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3420-210-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3492-466-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3508-435-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3544-161-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3616-224-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3668-483-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3668-21-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3936-270-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3952-375-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3964-477-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3964-14-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4200-260-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4280-70-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4500-472-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4520-445-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4552-168-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4608-335-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4724-305-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4804-494-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4804-35-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4856-190-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4992-365-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5072-390-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5132-395-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5136-325-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5176-295-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5264-120-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5348-355-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5428-440-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5468-285-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5492-380-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5540-340-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5636-154-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5660-84-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5672-320-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5684-415-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5688-197-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5752-265-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5776-345-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5876-410-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5884-42-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5884-500-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5892-63-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5948-290-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5968-350-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6044-420-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6048-489-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6048-28-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6136-495-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6264-2342-0x000000000D9B0000-0x000000000E22B000-memory.dmp

Download

memory/6392-2343-0x000001A4E1CC0000-0x000001A4E1F7C000-memory.dmp

Download

memory/8540-2182-0x00000136001E0000-0x00000136002E0000-memory.dmp

Download

memory/8540-2181-0x00000136001E0000-0x00000136002E0000-memory.dmp

Download

memory/8540-2190-0x0000013603D10000-0x0000013603D30000-memory.dmp

Download

memory/8540-2188-0x0000013613D70000-0x0000013613E70000-memory.dmp

Download

memory/8540-2225-0x0000013614020000-0x0000013614040000-memory.dmp

Download

memory/8540-2187-0x0000013603930000-0x0000013603950000-memory.dmp

Download