berbew | fee9d1aeff0f6b3bfa951cb39ab69440f03a52de1339bd584bcbf1adff246e25

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 21:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_e58709f09342068c8fdfb4c958cb4bb7_elex_wannacry.exe
Size 320KB
Sample260728-1sb5psywct
SHA256 fee9d1aeff0f6b3bfa951cb39ab69440f03a52de1339bd584bcbf1adff246e25
MD5 e58709f09342068c8fdfb4c958cb4bb7
SHA1 daab3664f62be098920d917fd7085cdd812d39e7
SHA512 94c8198a596e53e59f6071b1b9ad065e36fcfa9b1a9ea4332acef7552687713cdf77f071b0b7bc896fd9577daa0d1b6c2f74a53772c1d13a634c0b64590edb9d
SSDEEP 3072:cIK9MTOQrZyXSnIT29xwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:cf9lQFIMlxV/Ah1G/AcQ///NR5fn
TLSH
T107644219263409EBCEED5FB9AC1289D89161E4F018F1E13E6523EFDCD8E4DA6D805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmdkmnkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fjnjjlog.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmclgghc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lnccmnak.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mddbjg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdpnpe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hodgei32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmijliej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Medggidb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndmepe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkgqpaed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dccbln32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kifhkkci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngdmhimb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfeiedhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njcpok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqbagd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbhmnhcm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpojml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eqalfgll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jpgdlm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llngmeja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmoabn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbhmnhcm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lijdbofo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fchdnkpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lffhpnhe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jibejb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdhkefnj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkjmea32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkopgn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gcmnijkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klimbf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgokflpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odhman32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gimjag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpkbohhd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Peimcaae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlnpdc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjnipc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmangnmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Liekgo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Immaimnj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imdgjlgb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnbeie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojjoedfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pflpfcbe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmaihekc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mddbjg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajfobfaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Baepjpea.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Elbmebbj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmknkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lboeknkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chmehhpn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eefhcimp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifefbbdj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndfqlnno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ifmcmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dampal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Midmcgif.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfeqnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Odidld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cbefkp32.exe

Executes dropped EXE 64 IoCs

pid	Process
5024	Eqalfgll.exe
2936	Fofigd32.exe
2240	Fjnjjlog.exe
944	Fjqgpl32.exe
4912	Fomohc32.exe
2948	Fbnhjn32.exe
2552	Gmclgghc.exe
5252	Gbcaemdg.exe
3352	Gimjag32.exe
3432	Giacmggo.exe
2720	Gcggjp32.exe
4860	Hmaihekc.exe
236	Hapancai.exe
5648	Habndbpf.exe
1108	Icedkn32.exe
5588	Immhdc32.exe
4528	Iannpa32.exe
2864	Ifjfhh32.exe
2088	Ifmcmg32.exe
3568	Jjklcf32.exe
1392	Jpgdlm32.exe
4204	Jbhmnhcm.exe
3136	Jibejb32.exe
1384	Jpojml32.exe
3184	Kkdnjd32.exe
1352	Kapclned.exe
2896	Kbapdfkb.exe
5216	Kkihedld.exe
1644	Kcfiof32.exe
2488	Lgdbedmc.exe
5508	Liekgo32.exe
920	Lnccmnak.exe
3040	Lcpledob.exe
4192	Lijdbofo.exe
1940	Mjnnmn32.exe
2724	Mddbjg32.exe
2360	Mpkbohhd.exe
1304	Mdhkefnj.exe
4180	Mjednmla.exe
704	Mdkhkflh.exe
4184	Ndmepe32.exe
5248	Nkgmmpab.exe
808	Nqdeefpi.exe
4668	Ncenga32.exe
4168	Nddkaddm.exe
6140	Njacikbd.exe
2044	Ncihbaie.exe
1100	Njcpok32.exe
2580	Odidld32.exe
2780	Okcmingd.exe
4556	Okeinn32.exe
1780	Oqbagd32.exe
3456	Okgfdm32.exe
4308	Occkhp32.exe
5620	Ocegnoog.exe
884	Ojopki32.exe
3756	Pkoldl32.exe
3880	Pcjaio32.exe
5000	Pnoefg32.exe
4560	Peimcaae.exe
2940	Pbmnlf32.exe
5780	Pjhbah32.exe
4820	Pabknbef.exe
5656	Qaegcb32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Gmclgghc.exe	Fbnhjn32.exe
File created	C:\Windows\SysWOW64\Glojgg32.dll	Jibejb32.exe
File created	C:\Windows\SysWOW64\Peimcaae.exe	Pnoefg32.exe
File opened for modification	C:\Windows\SysWOW64\Pabknbef.exe	Pjhbah32.exe
File opened for modification	C:\Windows\SysWOW64\Eddodfhp.exe	Dccbln32.exe
File opened for modification	C:\Windows\SysWOW64\Jeolonem.exe	Jcnpgf32.exe
File opened for modification	C:\Windows\SysWOW64\Ldjhib32.exe	Lmppmh32.exe
File created	C:\Windows\SysWOW64\Njacikbd.exe	Nddkaddm.exe
File created	C:\Windows\SysWOW64\Okjnpija.dll	Eolpfo32.exe
File created	C:\Windows\SysWOW64\Mljficpd.exe	Lepnli32.exe
File opened for modification	C:\Windows\SysWOW64\Ncdgmkio.exe	Nljopa32.exe
File created	C:\Windows\SysWOW64\Onneeceo.exe	Ngdmhimb.exe
File opened for modification	C:\Windows\SysWOW64\Pmdkmnkd.exe	Pggbdgmm.exe
File opened for modification	C:\Windows\SysWOW64\Hapancai.exe	Hmaihekc.exe
File opened for modification	C:\Windows\SysWOW64\Liekgo32.exe	Lgdbedmc.exe
File created	C:\Windows\SysWOW64\Fkdhjjqh.dll	Lgdbedmc.exe
File created	C:\Windows\SysWOW64\Dbbdnb32.dll	Lijdbofo.exe
File created	C:\Windows\SysWOW64\Jgioia32.dll	Qaegcb32.exe
File created	C:\Windows\SysWOW64\Aalndaml.exe	Abfqbdhd.exe
File created	C:\Windows\SysWOW64\Dacebkko.exe	Dkjmea32.exe
File opened for modification	C:\Windows\SysWOW64\Keoeel32.exe	Kdnincal.exe
File opened for modification	C:\Windows\SysWOW64\Nddkaddm.exe	Ncenga32.exe
File opened for modification	C:\Windows\SysWOW64\Dkedjbgg.exe	Dampal32.exe
File created	C:\Windows\SysWOW64\Iaobiplh.dll	Foebmn32.exe
File created	C:\Windows\SysWOW64\Kmdqai32.exe	Kfjhdobb.exe
File created	C:\Windows\SysWOW64\Lefkfk32.exe	Llngmeja.exe
File created	C:\Windows\SysWOW64\Nfeqnf32.exe	Nphhfp32.exe
File created	C:\Windows\SysWOW64\Fcdamkaj.dll	Ofijifbj.exe
File created	C:\Windows\SysWOW64\Mjjqmgmj.dll	Kkihedld.exe
File opened for modification	C:\Windows\SysWOW64\Qgalelin.exe	Qbddmejf.exe
File created	C:\Windows\SysWOW64\Dkhokeah.dll	Dlijodjd.exe
File created	C:\Windows\SysWOW64\Dcakmhde.dll	Ahffqk32.exe
File created	C:\Windows\SysWOW64\Chmehhpn.exe	Cbqlpabf.exe
File created	C:\Windows\SysWOW64\Jedodcbl.dll	Kdiobd32.exe
File opened for modification	C:\Windows\SysWOW64\Kmijliej.exe	Kfoapo32.exe
File created	C:\Windows\SysWOW64\Ngjdfn32.dll	Kmijliej.exe
File created	C:\Windows\SysWOW64\Lmppmh32.exe	Lffhpnhe.exe
File opened for modification	C:\Windows\SysWOW64\Bjbnndgl.exe	Boknic32.exe
File opened for modification	C:\Windows\SysWOW64\Ddpeigle.exe	Dkgqpaed.exe
File created	C:\Windows\SysWOW64\Qcnhngkp.dll	Hckjjh32.exe
File opened for modification	C:\Windows\SysWOW64\Kfoapo32.exe	Klimbf32.exe
File created	C:\Windows\SysWOW64\Qfolkcpb.exe	Pmfhbm32.exe
File opened for modification	C:\Windows\SysWOW64\Jjklcf32.exe	Ifmcmg32.exe
File created	C:\Windows\SysWOW64\Aoebkabl.dll	Dkedjbgg.exe
File created	C:\Windows\SysWOW64\Ciinhk32.dll	Dkjmea32.exe
File created	C:\Windows\SysWOW64\Lebgfqmp.dll	Eedkniob.exe
File created	C:\Windows\SysWOW64\Elbmebbj.exe	Eamhhjbd.exe
File created	C:\Windows\SysWOW64\Jmmjpjpg.exe	Jfcbcp32.exe
File created	C:\Windows\SysWOW64\Clopal32.dll	Jbjciano.exe
File opened for modification	C:\Windows\SysWOW64\Kfjhdobb.exe	Kppphe32.exe
File opened for modification	C:\Windows\SysWOW64\Giacmggo.exe	Gimjag32.exe
File created	C:\Windows\SysWOW64\Habndbpf.exe	Hapancai.exe
File opened for modification	C:\Windows\SysWOW64\Ajfobfaj.exe	Aanjiqki.exe
File opened for modification	C:\Windows\SysWOW64\Dkgqpaed.exe	Ddmhcg32.exe
File created	C:\Windows\SysWOW64\Foebmn32.exe	Fdpnpe32.exe
File created	C:\Windows\SysWOW64\Cckaddao.dll	Lifqbi32.exe
File opened for modification	C:\Windows\SysWOW64\Liimgh32.exe	Lboeknkf.exe
File created	C:\Windows\SysWOW64\Emfnpejl.dll	Nconal32.exe
File created	C:\Windows\SysWOW64\Jjklcf32.exe	Ifmcmg32.exe
File created	C:\Windows\SysWOW64\Dccbln32.exe	Dlijodjd.exe
File created	C:\Windows\SysWOW64\Jpdqlgdc.exe	Jeolonem.exe
File created	C:\Windows\SysWOW64\Kifhkkci.exe	Kdiobd32.exe
File created	C:\Windows\SysWOW64\Kfanen32.exe	Kmijliej.exe
File opened for modification	C:\Windows\SysWOW64\Mibpng32.exe	Mchhamcl.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7700	7600	WerFault.exe	307

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eqalfgll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdkhkflh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ndmepe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ekhjgoga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ffpjihee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gfngke32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jbeinb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfcbcp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lcpledob.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mpkbohhd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qaegcb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Clfdcgkj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lefkfk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldjhib32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mibpng32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjbnndgl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Elpppcdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hoakpi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcnpgf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klimbf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddpeigle.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Heochp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mljficpd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofqpje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmfhbm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbnhjn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbcaemdg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jjklcf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jbhmnhcm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kmdqai32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nphhfp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocegnoog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aalndaml.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahffqk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dampal32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbdgpfni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jeaidn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lffhpnhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bniacddk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Boknic32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Behbkmgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkopgn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kppphe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keoeel32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pflpfcbe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fklcbocl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmaihekc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hapancai.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Habndbpf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jibejb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qbddmejf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fchdnkpi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fdiafc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Liekgo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eolpfo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fdpnpe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gmjlmo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Imdgjlgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpdqlgdc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jmpgfjmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njnpie32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ifmcmg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nqdeefpi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojopki32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hoakpi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pcjaio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bcmbia32.dll"	Pbmnlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfldfk32.dll"	Pjhbah32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bniacddk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dacebkko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fdiafc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Beoqlipd.dll"	Ghjfaa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jpdqlgdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jckcfocl.dll"	Immhdc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kapclned.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oebljagh.dll"	Bniacddk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lplpcc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpiaolnn.dll"	Mljficpd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnbeie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncakglka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agagab32.dll"	Pfeiedhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Denihh32.dll"	Jjklcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jibejb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njcpok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ddpeigle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjcjlgma.dll"	Dccbln32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hoakpi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ifjoma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kfjhdobb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dphfhmme.dll"	Pkoldl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Edngdafi.dll"	Gofkckoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ldoadabi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lepnli32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mlnpdc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ndfqlnno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pmdkmnkd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oqbagd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjhbah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Femcnc32.dll"	Ngdmhimb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eolpfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjjqmgmj.dll"	Kkihedld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mddbjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dkhokeah.dll"	Dlijodjd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ldoadabi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mljficpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ojgbpd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fjnjjlog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Okcmingd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fddnkoig.dll"	2026-07-28_e58709f09342068c8fdfb4c958cb4bb7_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ahjoljqc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjgedjco.dll"	Boknic32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cellfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnoqeq32.dll"	Ekngqqol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clolpq32.dll"	Mibpng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjmpcb32.dll"	Pqhammje.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ojopki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlegjk32.dll"	Ddpeigle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Foebmn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jcnpgf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jeolonem.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fofigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnbjbbqj.dll"	Qgalelin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hfemkdbm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcblakmh.dll"	Imonol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mdjapphl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjnijb32.dll"	Dacebkko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffmkieab.dll"	Elpppcdl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nphhfp32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4232 wrote to memory of 5024	4232	2026-07-28_e58709f09342068c8fdfb4c958cb4bb7_elex_wannacry.exe	89
PID 5024 wrote to memory of 2936	5024	Eqalfgll.exe	90
PID 2936 wrote to memory of 2240	2936	Fofigd32.exe	91
PID 2240 wrote to memory of 944	2240	Fjnjjlog.exe	92
PID 944 wrote to memory of 4912	944	Fjqgpl32.exe	93
PID 4912 wrote to memory of 2948	4912	Fomohc32.exe	94
PID 2948 wrote to memory of 2552	2948	Fbnhjn32.exe	95
PID 2552 wrote to memory of 5252	2552	Gmclgghc.exe	96
PID 5252 wrote to memory of 3352	5252	Gbcaemdg.exe	97
PID 3352 wrote to memory of 3432	3352	Gimjag32.exe	98
PID 3432 wrote to memory of 2720	3432	Giacmggo.exe	99
PID 2720 wrote to memory of 4860	2720	Gcggjp32.exe	100
PID 4860 wrote to memory of 236	4860	Hmaihekc.exe	101
PID 236 wrote to memory of 5648	236	Hapancai.exe	102
PID 5648 wrote to memory of 1108	5648	Habndbpf.exe	103
PID 1108 wrote to memory of 5588	1108	Icedkn32.exe	104
PID 5588 wrote to memory of 4528	5588	Immhdc32.exe	105
PID 4528 wrote to memory of 2864	4528	Iannpa32.exe	106
PID 2864 wrote to memory of 2088	2864	Ifjfhh32.exe	107
PID 2088 wrote to memory of 3568	2088	Ifmcmg32.exe	108
PID 3568 wrote to memory of 1392	3568	Jjklcf32.exe	109
PID 1392 wrote to memory of 4204	1392	Jpgdlm32.exe	110
PID 4204 wrote to memory of 3136	4204	Jbhmnhcm.exe	111
PID 3136 wrote to memory of 1384	3136	Jibejb32.exe	112
PID 1384 wrote to memory of 3184	1384	Jpojml32.exe	113
PID 3184 wrote to memory of 1352	3184	Kkdnjd32.exe	114
PID 1352 wrote to memory of 2896	1352	Kapclned.exe	115
PID 2896 wrote to memory of 5216	2896	Kbapdfkb.exe	116
PID 5216 wrote to memory of 1644	5216	Kkihedld.exe	117
PID 1644 wrote to memory of 2488	1644	Kcfiof32.exe	118
PID 2488 wrote to memory of 5508	2488	Lgdbedmc.exe	119
PID 5508 wrote to memory of 920	5508	Liekgo32.exe	120
PID 920 wrote to memory of 3040	920	Lnccmnak.exe	121
PID 3040 wrote to memory of 4192	3040	Lcpledob.exe	122
PID 4192 wrote to memory of 1940	4192	Lijdbofo.exe	123
PID 1940 wrote to memory of 2724	1940	Mjnnmn32.exe	124
PID 2724 wrote to memory of 2360	2724	Mddbjg32.exe	125
PID 2360 wrote to memory of 1304	2360	Mpkbohhd.exe	126
PID 1304 wrote to memory of 4180	1304	Mdhkefnj.exe	127
PID 4180 wrote to memory of 704	4180	Mjednmla.exe	128
PID 704 wrote to memory of 4184	704	Mdkhkflh.exe	129
PID 4184 wrote to memory of 5248	4184	Ndmepe32.exe	130
PID 5248 wrote to memory of 808	5248	Nkgmmpab.exe	131
PID 808 wrote to memory of 4668	808	Nqdeefpi.exe	132
PID 4668 wrote to memory of 4168	4668	Ncenga32.exe	133
PID 4168 wrote to memory of 6140	4168	Nddkaddm.exe	134
PID 6140 wrote to memory of 2044	6140	Njacikbd.exe	135
PID 2044 wrote to memory of 1100	2044	Ncihbaie.exe	136
PID 1100 wrote to memory of 2580	1100	Njcpok32.exe	137
PID 2580 wrote to memory of 2780	2580	Odidld32.exe	138
PID 2780 wrote to memory of 4556	2780	Okcmingd.exe	139
PID 4556 wrote to memory of 1780	4556	Okeinn32.exe	140
PID 1780 wrote to memory of 3456	1780	Oqbagd32.exe	141
PID 3456 wrote to memory of 4308	3456	Okgfdm32.exe	142
PID 4308 wrote to memory of 5620	4308	Occkhp32.exe	143
PID 5620 wrote to memory of 884	5620	Ocegnoog.exe	144
PID 884 wrote to memory of 3756	884	Ojopki32.exe	145
PID 3756 wrote to memory of 3880	3756	Pkoldl32.exe	146
PID 3880 wrote to memory of 5000	3880	Pcjaio32.exe	147
PID 5000 wrote to memory of 4560	5000	Pnoefg32.exe	148
PID 4560 wrote to memory of 2940	4560	Peimcaae.exe	149
PID 2940 wrote to memory of 5780	2940	Pbmnlf32.exe	150
PID 5780 wrote to memory of 4820	5780	Pjhbah32.exe	151
PID 4820 wrote to memory of 5656	4820	Pabknbef.exe	152

C:\Users\Admin\AppData\Local\Temp\2026-07-28_e58709f09342068c8fdfb4c958cb4bb7_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_e58709f09342068c8fdfb4c958cb4bb7_elex_wannacry.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Windows\SysWOW64\Eqalfgll.exe
  C:\Windows\system32\Eqalfgll.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Windows\SysWOW64\Fofigd32.exe
    C:\Windows\system32\Fofigd32.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2936
  - - C:\Windows\SysWOW64\Fjnjjlog.exe
      C:\Windows\system32\Fjnjjlog.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2240
    - - C:\Windows\SysWOW64\Fjqgpl32.exe
        
        C:\Windows\system32\Fjqgpl32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:944
      - C:\Windows\SysWOW64\Fomohc32.exe
        
        C:\Windows\system32\Fomohc32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4912
        
        C:\Windows\SysWOW64\Fbnhjn32.exe
        
        C:\Windows\system32\Fbnhjn32.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2948
        
        C:\Windows\SysWOW64\Gmclgghc.exe
        
        C:\Windows\system32\Gmclgghc.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2552
        
        C:\Windows\SysWOW64\Gbcaemdg.exe
        
        C:\Windows\system32\Gbcaemdg.exe
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5252
        
        C:\Windows\SysWOW64\Gimjag32.exe
        
        C:\Windows\system32\Gimjag32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3352
        
        C:\Windows\SysWOW64\Giacmggo.exe
        
        C:\Windows\system32\Giacmggo.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3432
        
        C:\Windows\SysWOW64\Gcggjp32.exe
        
        C:\Windows\system32\Gcggjp32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2720
        
        C:\Windows\SysWOW64\Hmaihekc.exe
        
        C:\Windows\system32\Hmaihekc.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4860
        
        C:\Windows\SysWOW64\Hapancai.exe
        
        C:\Windows\system32\Hapancai.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:236
        
        C:\Windows\SysWOW64\Habndbpf.exe
        
        C:\Windows\system32\Habndbpf.exe
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5648
        
        C:\Windows\SysWOW64\Icedkn32.exe
        
        C:\Windows\system32\Icedkn32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1108
        
        C:\Windows\SysWOW64\Immhdc32.exe
        
        C:\Windows\system32\Immhdc32.exe
        17⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5588
        
        C:\Windows\SysWOW64\Iannpa32.exe
        
        C:\Windows\system32\Iannpa32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4528
        
        C:\Windows\SysWOW64\Ifjfhh32.exe
        
        C:\Windows\system32\Ifjfhh32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2864
        
        C:\Windows\SysWOW64\Ifmcmg32.exe
        
        C:\Windows\system32\Ifmcmg32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2088
        
        C:\Windows\SysWOW64\Jjklcf32.exe
        
        C:\Windows\system32\Jjklcf32.exe
        21⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3568
        
        C:\Windows\SysWOW64\Jpgdlm32.exe
        
        C:\Windows\system32\Jpgdlm32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1392
        
        C:\Windows\SysWOW64\Jbhmnhcm.exe
        
        C:\Windows\system32\Jbhmnhcm.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4204
        
        C:\Windows\SysWOW64\Jibejb32.exe
        
        C:\Windows\system32\Jibejb32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3136
        
        C:\Windows\SysWOW64\Jpojml32.exe
        
        C:\Windows\system32\Jpojml32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1384
        
        C:\Windows\SysWOW64\Kkdnjd32.exe
        
        C:\Windows\system32\Kkdnjd32.exe
        26⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3184
        
        C:\Windows\SysWOW64\Kapclned.exe
        
        C:\Windows\system32\Kapclned.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1352
        
        C:\Windows\SysWOW64\Kbapdfkb.exe
        
        C:\Windows\system32\Kbapdfkb.exe
        28⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2896
        
        C:\Windows\SysWOW64\Kkihedld.exe
        
        C:\Windows\system32\Kkihedld.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5216
        
        C:\Windows\SysWOW64\Kcfiof32.exe
        
        C:\Windows\system32\Kcfiof32.exe
        30⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1644
        
        C:\Windows\SysWOW64\Lgdbedmc.exe
        
        C:\Windows\system32\Lgdbedmc.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2488
        
        C:\Windows\SysWOW64\Liekgo32.exe
        
        C:\Windows\system32\Liekgo32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5508
        
        C:\Windows\SysWOW64\Lnccmnak.exe
        
        C:\Windows\system32\Lnccmnak.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:920
        
        C:\Windows\SysWOW64\Lcpledob.exe
        
        C:\Windows\system32\Lcpledob.exe
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3040
        
        C:\Windows\SysWOW64\Lijdbofo.exe
        
        C:\Windows\system32\Lijdbofo.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4192
        
        C:\Windows\SysWOW64\Mjnnmn32.exe
        
        C:\Windows\system32\Mjnnmn32.exe
        36⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1940
        
        C:\Windows\SysWOW64\Mddbjg32.exe
        
        C:\Windows\system32\Mddbjg32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2724
        
        C:\Windows\SysWOW64\Mpkbohhd.exe
        
        C:\Windows\system32\Mpkbohhd.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2360
        
        C:\Windows\SysWOW64\Mdhkefnj.exe
        
        C:\Windows\system32\Mdhkefnj.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1304
        
        C:\Windows\SysWOW64\Mjednmla.exe
        
        C:\Windows\system32\Mjednmla.exe
        40⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4180
        
        C:\Windows\SysWOW64\Mdkhkflh.exe
        
        C:\Windows\system32\Mdkhkflh.exe
        41⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:704
        
        C:\Windows\SysWOW64\Ndmepe32.exe
        
        C:\Windows\system32\Ndmepe32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4184
        
        C:\Windows\SysWOW64\Nkgmmpab.exe
        
        C:\Windows\system32\Nkgmmpab.exe
        43⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5248
        
        C:\Windows\SysWOW64\Nqdeefpi.exe
        
        C:\Windows\system32\Nqdeefpi.exe
        44⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:808
        
        C:\Windows\SysWOW64\Ncenga32.exe
        
        C:\Windows\system32\Ncenga32.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4668
        
        C:\Windows\SysWOW64\Nddkaddm.exe
        
        C:\Windows\system32\Nddkaddm.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4168
        
        C:\Windows\SysWOW64\Njacikbd.exe
        
        C:\Windows\system32\Njacikbd.exe
        47⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6140
        
        C:\Windows\SysWOW64\Ncihbaie.exe
        
        C:\Windows\system32\Ncihbaie.exe
        48⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2044
        
        C:\Windows\SysWOW64\Njcpok32.exe
        
        C:\Windows\system32\Njcpok32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1100
        
        C:\Windows\SysWOW64\Odidld32.exe
        
        C:\Windows\system32\Odidld32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2580
        
        C:\Windows\SysWOW64\Okcmingd.exe
        
        C:\Windows\system32\Okcmingd.exe
        51⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2780
        
        C:\Windows\SysWOW64\Okeinn32.exe
        
        C:\Windows\system32\Okeinn32.exe
        52⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4556
        
        C:\Windows\SysWOW64\Oqbagd32.exe
        
        C:\Windows\system32\Oqbagd32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1780
        
        C:\Windows\SysWOW64\Okgfdm32.exe
        
        C:\Windows\system32\Okgfdm32.exe
        54⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3456
        
        C:\Windows\SysWOW64\Occkhp32.exe
        
        C:\Windows\system32\Occkhp32.exe
        55⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4308
        
        C:\Windows\SysWOW64\Ocegnoog.exe
        
        C:\Windows\system32\Ocegnoog.exe
        56⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5620
        
        C:\Windows\SysWOW64\Ojopki32.exe
        
        C:\Windows\system32\Ojopki32.exe
        57⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:884
        
        C:\Windows\SysWOW64\Pkoldl32.exe
        
        C:\Windows\system32\Pkoldl32.exe
        58⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3756
        
        C:\Windows\SysWOW64\Pcjaio32.exe
        
        C:\Windows\system32\Pcjaio32.exe
        59⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3880
        
        C:\Windows\SysWOW64\Pnoefg32.exe
        
        C:\Windows\system32\Pnoefg32.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5000
        
        C:\Windows\SysWOW64\Peimcaae.exe
        
        C:\Windows\system32\Peimcaae.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4560
        
        C:\Windows\SysWOW64\Pbmnlf32.exe
        
        C:\Windows\system32\Pbmnlf32.exe
        62⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2940
        
        C:\Windows\SysWOW64\Pjhbah32.exe
        
        C:\Windows\system32\Pjhbah32.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5780
        
        C:\Windows\SysWOW64\Pabknbef.exe
        
        C:\Windows\system32\Pabknbef.exe
        64⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4820
        
        C:\Windows\SysWOW64\Qaegcb32.exe
        
        C:\Windows\system32\Qaegcb32.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5656
        
        C:\Windows\SysWOW64\Qbddmejf.exe
        
        C:\Windows\system32\Qbddmejf.exe
        66⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1260
        
        C:\Windows\SysWOW64\Qgalelin.exe
        
        C:\Windows\system32\Qgalelin.exe
        67⤵
        Modifies registry class
        
        PID:5996
        
        C:\Windows\SysWOW64\Abfqbdhd.exe
        
        C:\Windows\system32\Abfqbdhd.exe
        68⤵
        Drops file in System32 directory
        
        PID:4108
        
        C:\Windows\SysWOW64\Aalndaml.exe
        
        C:\Windows\system32\Aalndaml.exe
        69⤵
        System Location Discovery: System Language Discovery
        
        PID:6116
        
        C:\Windows\SysWOW64\Ahffqk32.exe
        
        C:\Windows\system32\Ahffqk32.exe
        70⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1528
        
        C:\Windows\SysWOW64\Aanjiqki.exe
        
        C:\Windows\system32\Aanjiqki.exe
        71⤵
        Drops file in System32 directory
        
        PID:1264
        
        C:\Windows\SysWOW64\Ajfobfaj.exe
        
        C:\Windows\system32\Ajfobfaj.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2984
        
        C:\Windows\SysWOW64\Ahjoljqc.exe
        
        C:\Windows\system32\Ahjoljqc.exe
        73⤵
        Modifies registry class
        
        PID:2732
        
        C:\Windows\SysWOW64\Aenpeoom.exe
        
        C:\Windows\system32\Aenpeoom.exe
        74⤵
        
        PID:1612
        
        C:\Windows\SysWOW64\Baepjpea.exe
        
        C:\Windows\system32\Baepjpea.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2372
        
        C:\Windows\SysWOW64\Bniacddk.exe
        
        C:\Windows\system32\Bniacddk.exe
        76⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2484
        
        C:\Windows\SysWOW64\Bdfilkbb.exe
        
        C:\Windows\system32\Bdfilkbb.exe
        77⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Boknic32.exe
        
        C:\Windows\system32\Boknic32.exe
        78⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1284
        
        C:\Windows\SysWOW64\Bjbnndgl.exe
        
        C:\Windows\system32\Bjbnndgl.exe
        79⤵
        System Location Discovery: System Language Discovery
        
        PID:4492
        
        C:\Windows\SysWOW64\Behbkmgb.exe
        
        C:\Windows\system32\Behbkmgb.exe
        80⤵
        System Location Discovery: System Language Discovery
        
        PID:1236
        
        C:\Windows\SysWOW64\Cldgmgml.exe
        
        C:\Windows\system32\Cldgmgml.exe
        81⤵
        
        PID:912
        
        C:\Windows\SysWOW64\Cellfm32.exe
        
        C:\Windows\system32\Cellfm32.exe
        82⤵
        Modifies registry class
        
        PID:3408
        
        C:\Windows\SysWOW64\Clfdcgkj.exe
        
        C:\Windows\system32\Clfdcgkj.exe
        83⤵
        System Location Discovery: System Language Discovery
        
        PID:5040
        
        C:\Windows\SysWOW64\Cbqlpabf.exe
        
        C:\Windows\system32\Cbqlpabf.exe
        84⤵
        Drops file in System32 directory
        
        PID:5724
        
        C:\Windows\SysWOW64\Chmehhpn.exe
        
        C:\Windows\system32\Chmehhpn.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1076
        
        C:\Windows\SysWOW64\Cbefkp32.exe
        
        C:\Windows\system32\Cbefkp32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3236
        
        C:\Windows\SysWOW64\Cdfbbhdp.exe
        
        C:\Windows\system32\Cdfbbhdp.exe
        87⤵
        
        PID:628
        
        C:\Windows\SysWOW64\Dampal32.exe
        
        C:\Windows\system32\Dampal32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3948
        
        C:\Windows\SysWOW64\Dkedjbgg.exe
        
        C:\Windows\system32\Dkedjbgg.exe
        89⤵
        Drops file in System32 directory
        
        PID:4968
        
        C:\Windows\SysWOW64\Ddmhcg32.exe
        
        C:\Windows\system32\Ddmhcg32.exe
        90⤵
        Drops file in System32 directory
        
        PID:4632
        
        C:\Windows\SysWOW64\Dkgqpaed.exe
        
        C:\Windows\system32\Dkgqpaed.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3804
        
        C:\Windows\SysWOW64\Ddpeigle.exe
        
        C:\Windows\system32\Ddpeigle.exe
        92⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2620
        
        C:\Windows\SysWOW64\Dkjmea32.exe
        
        C:\Windows\system32\Dkjmea32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6024
        
        C:\Windows\SysWOW64\Dacebkko.exe
        
        C:\Windows\system32\Dacebkko.exe
        94⤵
        Modifies registry class
        
        PID:5616
        
        C:\Windows\SysWOW64\Dlijodjd.exe
        
        C:\Windows\system32\Dlijodjd.exe
        95⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3316
        
        C:\Windows\SysWOW64\Dccbln32.exe
        
        C:\Windows\system32\Dccbln32.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:1892
        
        C:\Windows\SysWOW64\Eddodfhp.exe
        
        C:\Windows\system32\Eddodfhp.exe
        97⤵
        
        PID:3212
        
        C:\Windows\SysWOW64\Ekngqqol.exe
        
        C:\Windows\system32\Ekngqqol.exe
        98⤵
        Modifies registry class
        
        PID:4700
        
        C:\Windows\SysWOW64\Eedkniob.exe
        
        C:\Windows\system32\Eedkniob.exe
        99⤵
        Drops file in System32 directory
        
        PID:4404
        
        C:\Windows\SysWOW64\Eolpfo32.exe
        
        C:\Windows\system32\Eolpfo32.exe
        100⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4416
        
        C:\Windows\SysWOW64\Eefhcimp.exe
        
        C:\Windows\system32\Eefhcimp.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3960
        
        C:\Windows\SysWOW64\Elpppcdl.exe
        
        C:\Windows\system32\Elpppcdl.exe
        102⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5984
        
        C:\Windows\SysWOW64\Eamhhjbd.exe
        
        C:\Windows\system32\Eamhhjbd.exe
        103⤵
        Drops file in System32 directory
        
        PID:6100
        
        C:\Windows\SysWOW64\Elbmebbj.exe
        
        C:\Windows\system32\Elbmebbj.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2376
        
        C:\Windows\SysWOW64\Ecmebm32.exe
        
        C:\Windows\system32\Ecmebm32.exe
        105⤵
        
        PID:4732
        
        C:\Windows\SysWOW64\Ekhjgoga.exe
        
        C:\Windows\system32\Ekhjgoga.exe
        106⤵
        System Location Discovery: System Language Discovery
        
        PID:4608
        
        C:\Windows\SysWOW64\Fdpnpe32.exe
        
        C:\Windows\system32\Fdpnpe32.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3908
        
        C:\Windows\SysWOW64\Foebmn32.exe
        
        C:\Windows\system32\Foebmn32.exe
        108⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4844
        
        C:\Windows\SysWOW64\Ffpjihee.exe
        
        C:\Windows\system32\Ffpjihee.exe
        109⤵
        System Location Discovery: System Language Discovery
        
        PID:732
        
        C:\Windows\SysWOW64\Fklcbocl.exe
        
        C:\Windows\system32\Fklcbocl.exe
        110⤵
        System Location Discovery: System Language Discovery
        
        PID:1840
        
        C:\Windows\SysWOW64\Ffbgog32.exe
        
        C:\Windows\system32\Ffbgog32.exe
        111⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Fkopgn32.exe
        
        C:\Windows\system32\Fkopgn32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6120
        
        C:\Windows\SysWOW64\Fdgdpdgj.exe
        
        C:\Windows\system32\Fdgdpdgj.exe
        113⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Fchdnkpi.exe
        
        C:\Windows\system32\Fchdnkpi.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5516
        
        C:\Windows\SysWOW64\Fdiafc32.exe
        
        C:\Windows\system32\Fdiafc32.exe
        115⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4620
        
        C:\Windows\SysWOW64\Fkcibnmd.exe
        
        C:\Windows\system32\Fkcibnmd.exe
        116⤵
        
        PID:4188
        
        C:\Windows\SysWOW64\Gfimpfmj.exe
        
        C:\Windows\system32\Gfimpfmj.exe
        117⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\Glcelq32.exe
        
        C:\Windows\system32\Glcelq32.exe
        118⤵
        
        PID:1096
        
        C:\Windows\SysWOW64\Gcmnijkd.exe
        
        C:\Windows\system32\Gcmnijkd.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5756
        
        C:\Windows\SysWOW64\Ghjfaa32.exe
        
        C:\Windows\system32\Ghjfaa32.exe
        120⤵
        Modifies registry class
        
        PID:1832
        
        C:\Windows\SysWOW64\Gfngke32.exe
        
        C:\Windows\system32\Gfngke32.exe
        121⤵
        System Location Discovery: System Language Discovery
        
        PID:3232
        
        C:\Windows\SysWOW64\Gofkckoe.exe
        
        C:\Windows\system32\Gofkckoe.exe
        122⤵
        Modifies registry class
        
        PID:2848
        
        C:\Windows\SysWOW64\Gbdgpfni.exe
        
        C:\Windows\system32\Gbdgpfni.exe
        123⤵
        System Location Discovery: System Language Discovery
        
        PID:3016
        
        C:\Windows\SysWOW64\Gmjlmo32.exe
        
        C:\Windows\system32\Gmjlmo32.exe
        124⤵
        System Location Discovery: System Language Discovery
        
        PID:1532
        
        C:\Windows\SysWOW64\Gcddjiel.exe
        
        C:\Windows\system32\Gcddjiel.exe
        125⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\Gmlhbo32.exe
        
        C:\Windows\system32\Gmlhbo32.exe
        126⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Hfemkdbm.exe
        
        C:\Windows\system32\Hfemkdbm.exe
        127⤵
        Modifies registry class
        
        PID:4228
        
        C:\Windows\SysWOW64\Hkaedk32.exe
        
        C:\Windows\system32\Hkaedk32.exe
        128⤵
        
        PID:252
        
        C:\Windows\SysWOW64\Hiefmp32.exe
        
        C:\Windows\system32\Hiefmp32.exe
        129⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Hckjjh32.exe
        
        C:\Windows\system32\Hckjjh32.exe
        130⤵
        Drops file in System32 directory
        
        PID:5036
        
        C:\Windows\SysWOW64\Hihbco32.exe
        
        C:\Windows\system32\Hihbco32.exe
        131⤵
        
        PID:3412
        
        C:\Windows\SysWOW64\Hoakpi32.exe
        
        C:\Windows\system32\Hoakpi32.exe
        132⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4764
        
        C:\Windows\SysWOW64\Heochp32.exe
        
        C:\Windows\system32\Heochp32.exe
        133⤵
        System Location Discovery: System Language Discovery
        
        PID:4304
        
        C:\Windows\SysWOW64\Hodgei32.exe
        
        C:\Windows\system32\Hodgei32.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2444
        
        C:\Windows\SysWOW64\Hillnoif.exe
        
        C:\Windows\system32\Hillnoif.exe
        135⤵
        
        PID:584
        
        C:\Windows\SysWOW64\Ibeqgdpf.exe
        
        C:\Windows\system32\Ibeqgdpf.exe
        136⤵
        
        PID:2100
        
        C:\Windows\SysWOW64\Ikmepj32.exe
        
        C:\Windows\system32\Ikmepj32.exe
        137⤵
        
        PID:2584
        
        C:\Windows\SysWOW64\Ifcimb32.exe
        
        C:\Windows\system32\Ifcimb32.exe
        138⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\Immaimnj.exe
        
        C:\Windows\system32\Immaimnj.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5716
        
        C:\Windows\SysWOW64\Ifefbbdj.exe
        
        C:\Windows\system32\Ifefbbdj.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2392
        
        C:\Windows\SysWOW64\Imonol32.exe
        
        C:\Windows\system32\Imonol32.exe
        141⤵
        Modifies registry class
        
        PID:5964
        
        C:\Windows\SysWOW64\Iciflfcd.exe
        
        C:\Windows\system32\Iciflfcd.exe
        142⤵
        
        PID:5028
        
        C:\Windows\SysWOW64\Imakdl32.exe
        
        C:\Windows\system32\Imakdl32.exe
        143⤵
        
        PID:4840
        
        C:\Windows\SysWOW64\Ifjoma32.exe
        
        C:\Windows\system32\Ifjoma32.exe
        144⤵
        Modifies registry class
        
        PID:3416
        
        C:\Windows\SysWOW64\Imdgjlgb.exe
        
        C:\Windows\system32\Imdgjlgb.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6152
        
        C:\Windows\SysWOW64\Jcnpgf32.exe
        
        C:\Windows\system32\Jcnpgf32.exe
        146⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6196
        
        C:\Windows\SysWOW64\Jeolonem.exe
        
        C:\Windows\system32\Jeolonem.exe
        147⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6236
        
        C:\Windows\SysWOW64\Jpdqlgdc.exe
        
        C:\Windows\system32\Jpdqlgdc.exe
        148⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6276
        
        C:\Windows\SysWOW64\Jeaidn32.exe
        
        C:\Windows\system32\Jeaidn32.exe
        149⤵
        System Location Discovery: System Language Discovery
        
        PID:6324
        
        C:\Windows\SysWOW64\Jbeinb32.exe
        
        C:\Windows\system32\Jbeinb32.exe
        150⤵
        System Location Discovery: System Language Discovery
        
        PID:6364
        
        C:\Windows\SysWOW64\Jmknkk32.exe
        
        C:\Windows\system32\Jmknkk32.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6404
        
        C:\Windows\SysWOW64\Jfcbcp32.exe
        
        C:\Windows\system32\Jfcbcp32.exe
        152⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6452
        
        C:\Windows\SysWOW64\Jmmjpjpg.exe
        
        C:\Windows\system32\Jmmjpjpg.exe
        153⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Jbjciano.exe
        
        C:\Windows\system32\Jbjciano.exe
        154⤵
        Drops file in System32 directory
        
        PID:6532
        
        C:\Windows\SysWOW64\Jmpgfjmd.exe
        
        C:\Windows\system32\Jmpgfjmd.exe
        155⤵
        System Location Discovery: System Language Discovery
        
        PID:6572
        
        C:\Windows\SysWOW64\Kdiobd32.exe
        
        C:\Windows\system32\Kdiobd32.exe
        156⤵
        Drops file in System32 directory
        
        PID:6620
        
        C:\Windows\SysWOW64\Kifhkkci.exe
        
        C:\Windows\system32\Kifhkkci.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6660
        
        C:\Windows\SysWOW64\Kppphe32.exe
        
        C:\Windows\system32\Kppphe32.exe
        158⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6700
        
        C:\Windows\SysWOW64\Kfjhdobb.exe
        
        C:\Windows\system32\Kfjhdobb.exe
        159⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6740
        
        C:\Windows\SysWOW64\Kmdqai32.exe
        
        C:\Windows\system32\Kmdqai32.exe
        160⤵
        System Location Discovery: System Language Discovery
        
        PID:6784
        
        C:\Windows\SysWOW64\Kdnincal.exe
        
        C:\Windows\system32\Kdnincal.exe
        161⤵
        Drops file in System32 directory
        
        PID:6820
        
        C:\Windows\SysWOW64\Keoeel32.exe
        
        C:\Windows\system32\Keoeel32.exe
        162⤵
        System Location Discovery: System Language Discovery
        
        PID:6864
        
        C:\Windows\SysWOW64\Klimbf32.exe
        
        C:\Windows\system32\Klimbf32.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6900
        
        C:\Windows\SysWOW64\Kfoapo32.exe
        
        C:\Windows\system32\Kfoapo32.exe
        164⤵
        Drops file in System32 directory
        
        PID:6936
        
        C:\Windows\SysWOW64\Kmijliej.exe
        
        C:\Windows\system32\Kmijliej.exe
        165⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6972
        
        C:\Windows\SysWOW64\Kfanen32.exe
        
        C:\Windows\system32\Kfanen32.exe
        166⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Llngmeja.exe
        
        C:\Windows\system32\Llngmeja.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7048
        
        C:\Windows\SysWOW64\Lefkfk32.exe
        
        C:\Windows\system32\Lefkfk32.exe
        168⤵
        System Location Discovery: System Language Discovery
        
        PID:7088
        
        C:\Windows\SysWOW64\Lplpcc32.exe
        
        C:\Windows\system32\Lplpcc32.exe
        169⤵
        Modifies registry class
        
        PID:7124
        
        C:\Windows\SysWOW64\Lffhpnhe.exe
        
        C:\Windows\system32\Lffhpnhe.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3764
        
        C:\Windows\SysWOW64\Lmppmh32.exe
        
        C:\Windows\system32\Lmppmh32.exe
        171⤵
        Drops file in System32 directory
        
        PID:6208
        
        C:\Windows\SysWOW64\Ldjhib32.exe
        
        C:\Windows\system32\Ldjhib32.exe
        172⤵
        System Location Discovery: System Language Discovery
        
        PID:6264
        
        C:\Windows\SysWOW64\Lifqbi32.exe
        
        C:\Windows\system32\Lifqbi32.exe
        173⤵
        Drops file in System32 directory
        
        PID:6316
        
        C:\Windows\SysWOW64\Lboeknkf.exe
        
        C:\Windows\system32\Lboeknkf.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6384
        
        C:\Windows\SysWOW64\Liimgh32.exe
        
        C:\Windows\system32\Liimgh32.exe
        175⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Ldoadabi.exe
        
        C:\Windows\system32\Ldoadabi.exe
        176⤵
        Modifies registry class
        
        PID:6500
        
        C:\Windows\SysWOW64\Lepnli32.exe
        
        C:\Windows\system32\Lepnli32.exe
        177⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6564
        
        C:\Windows\SysWOW64\Mljficpd.exe
        
        C:\Windows\system32\Mljficpd.exe
        178⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6612
        
        C:\Windows\SysWOW64\Mgokflpj.exe
        
        C:\Windows\system32\Mgokflpj.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6672
        
        C:\Windows\SysWOW64\Mllcocna.exe
        
        C:\Windows\system32\Mllcocna.exe
        180⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Medggidb.exe
        
        C:\Windows\system32\Medggidb.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6792
        
        C:\Windows\SysWOW64\Mlnpdc32.exe
        
        C:\Windows\system32\Mlnpdc32.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6852
        
        C:\Windows\SysWOW64\Mchhamcl.exe
        
        C:\Windows\system32\Mchhamcl.exe
        183⤵
        Drops file in System32 directory
        
        PID:6912
        
        C:\Windows\SysWOW64\Mibpng32.exe
        
        C:\Windows\system32\Mibpng32.exe
        184⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6988
        
        C:\Windows\SysWOW64\Mdhdkp32.exe
        
        C:\Windows\system32\Mdhdkp32.exe
        185⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Midmcgif.exe
        
        C:\Windows\system32\Midmcgif.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7112
        
        C:\Windows\SysWOW64\Mdjapphl.exe
        
        C:\Windows\system32\Mdjapphl.exe
        187⤵
        Modifies registry class
        
        PID:7164
        
        C:\Windows\SysWOW64\Meknhh32.exe
        
        C:\Windows\system32\Meknhh32.exe
        188⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Nnbeie32.exe
        
        C:\Windows\system32\Nnbeie32.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6360
        
        C:\Windows\SysWOW64\Nconal32.exe
        
        C:\Windows\system32\Nconal32.exe
        190⤵
        Drops file in System32 directory
        
        PID:6464
        
        C:\Windows\SysWOW64\Nneboemj.exe
        
        C:\Windows\system32\Nneboemj.exe
        191⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Ncakglka.exe
        
        C:\Windows\system32\Ncakglka.exe
        192⤵
        Modifies registry class
        
        PID:6668
        
        C:\Windows\SysWOW64\Nljopa32.exe
        
        C:\Windows\system32\Nljopa32.exe
        193⤵
        Drops file in System32 directory
        
        PID:6776
        
        C:\Windows\SysWOW64\Ncdgmkio.exe
        
        C:\Windows\system32\Ncdgmkio.exe
        194⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Njnpie32.exe
        
        C:\Windows\system32\Njnpie32.exe
        195⤵
        System Location Discovery: System Language Discovery
        
        PID:7000
        
        C:\Windows\SysWOW64\Nphhfp32.exe
        
        C:\Windows\system32\Nphhfp32.exe
        196⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7104
        
        C:\Windows\SysWOW64\Nfeqnf32.exe
        
        C:\Windows\system32\Nfeqnf32.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6192
        
        C:\Windows\SysWOW64\Ndfqlnno.exe
        
        C:\Windows\system32\Ndfqlnno.exe
        198⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6432
        
        C:\Windows\SysWOW64\Ngdmhimb.exe
        
        C:\Windows\system32\Ngdmhimb.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6588
        
        C:\Windows\SysWOW64\Onneeceo.exe
        
        C:\Windows\system32\Onneeceo.exe
        200⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Odhman32.exe
        
        C:\Windows\system32\Odhman32.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6980
        
        C:\Windows\SysWOW64\Ofijifbj.exe
        
        C:\Windows\system32\Ofijifbj.exe
        202⤵
        Drops file in System32 directory
        
        PID:6164
        
        C:\Windows\SysWOW64\Opongobp.exe
        
        C:\Windows\system32\Opongobp.exe
        203⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Ojgbpd32.exe
        
        C:\Windows\system32\Ojgbpd32.exe
        204⤵
        Modifies registry class
        
        PID:6872
        
        C:\Windows\SysWOW64\Oqakln32.exe
        
        C:\Windows\system32\Oqakln32.exe
        205⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Ojjoedfn.exe
        
        C:\Windows\system32\Ojjoedfn.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6860
        
        C:\Windows\SysWOW64\Odocbmfd.exe
        
        C:\Windows\system32\Odocbmfd.exe
        207⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Ofqpje32.exe
        
        C:\Windows\system32\Ofqpje32.exe
        208⤵
        System Location Discovery: System Language Discovery
        
        PID:6688
        
        C:\Windows\SysWOW64\Oqfdgn32.exe
        
        C:\Windows\system32\Oqfdgn32.exe
        209⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Pjnipc32.exe
        
        C:\Windows\system32\Pjnipc32.exe
        210⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7232
        
        C:\Windows\SysWOW64\Pqhammje.exe
        
        C:\Windows\system32\Pqhammje.exe
        211⤵
        Modifies registry class
        
        PID:7268
        
        C:\Windows\SysWOW64\Pfeiedhm.exe
        
        C:\Windows\system32\Pfeiedhm.exe
        212⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7304
        
        C:\Windows\SysWOW64\Pmoabn32.exe
        
        C:\Windows\system32\Pmoabn32.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7344
        
        C:\Windows\SysWOW64\Pgefogop.exe
        
        C:\Windows\system32\Pgefogop.exe
        214⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Pmangnmg.exe
        
        C:\Windows\system32\Pmangnmg.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7416
        
        C:\Windows\SysWOW64\Pggbdgmm.exe
        
        C:\Windows\system32\Pggbdgmm.exe
        216⤵
        Drops file in System32 directory
        
        PID:7452
        
        C:\Windows\SysWOW64\Pmdkmnkd.exe
        
        C:\Windows\system32\Pmdkmnkd.exe
        217⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7492
        
        C:\Windows\SysWOW64\Pflpfcbe.exe
        
        C:\Windows\system32\Pflpfcbe.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7528
        
        C:\Windows\SysWOW64\Pmfhbm32.exe
        
        C:\Windows\system32\Pmfhbm32.exe
        219⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7564
        
        C:\Windows\SysWOW64\Qfolkcpb.exe
        
        C:\Windows\system32\Qfolkcpb.exe
        220⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7600 -s 448
        221⤵
        Program crash
        
        PID:7700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 7600 -ip 7600
1⤵
PID:7676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Eqalfgll.exe

Path C:\Windows\SysWOW64\Eqalfgll.exe
Size 320KB
SHA256 1edc12da2b5655c45a868d6aa2eb85be134e50b821490c8843dbcc0a36c7040f
MD5 3d08929ec0f909274131e67832d51eb2
SHA1 b539fada5e8d2ca43d26b7f6f58b7d91a852a183
SHA512 eefe3d7d99c0f7a7f0bc5c031900b000118b8cda9c1dd063cd7fbc2ae1e262acd2293a585cd9ce76fb0fe592d396aecdf1d66d7f395d06dfe71d0e67187c4fe6
SSDEEP 3072:FkgFETllh7pZAAfwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:6KEpl1zAAfV/Ah1G/AcQ///NR5fn
TLSH
T1A264101D2A340AEACDED1BB5AC1349D95581E6F024F1E13E6523EFECD8E4DA2C815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fbnhjn32.exe

Path C:\Windows\SysWOW64\Fbnhjn32.exe
Size 320KB
SHA256 6f6344bacdd3e8f96c9a059e1737d79caf3a8a67304765666a9debb35cdbf806
MD5 0f67c2623da4c5a5d9a10e519bd4615b
SHA1 1675d8ad15b4029cb9d5a79e400d63b29d52fee8
SHA512 8c9ee5e37fd64f4ede5a124a472c2284f335f277e0225751afee13893762600c11010c29941934673ef60277d0a53b34245cd0c8b6e2f275ba769ae5155aa0e0
SSDEEP 3072:5KZWSgP8PKc3gwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:0WAvgV/Ah1G/AcQ///NR5fn
TLSH
T1B0640C192A3049EACEED1BF5AC1249D8A141E9F014F5E13E6523DFDCDCE8DA6C815F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fjnjjlog.exe

Path C:\Windows\SysWOW64\Fjnjjlog.exe
Size 320KB
SHA256 f241f73296756a7a60c0e6c6ad3e9e4a8b3240a9fa3cc30dcce6ae902d7c18e1
MD5 d553e4b8610cf08595e9507207f22fda
SHA1 0a8691bec573a16b4f2bac2443c6afb46113b76f
SHA512 7f6f818519b204b871a436e86ba0939767fa653f01e4dcbf43bff2e2e4a5ca2a1c491458dbcfe8c5b6e2a43082d3403407f0a13a1e97120526bf81b728067a32
SSDEEP 3072:NFImsGrOVNntwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:NFImsWkntV/Ah1G/AcQ///NR5fn
TLSH
T16C64DB1A2A3449EACEED1BB5AC1249D85141F9F014F1E17E6923DFDCE8E4DA6CC24F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fjqgpl32.exe

Path C:\Windows\SysWOW64\Fjqgpl32.exe
Size 320KB
SHA256 9a94dfce7ec8d54ec9732dfd141e72233d2e0fb9e7c41f45cb8ec984a7e2adee
MD5 94eef6b14671dbd0611b2aabda285d71
SHA1 2db4abed009cc84a1ef98727d8c64edec49878df
SHA512 78cdbaa0b6fcf5d23a84578f7d2b582e5291ffff669bc33c95b8ad2796259aaf70cfbdb6cf42fef7afdd10ded0817ac24930b80c031d1294654ccf588631bbf5
SSDEEP 3072:I011YoYkCfkrVhhOOwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:LqoY/fkNOOV/Ah1G/AcQ///NR5fn
TLSH
T17F645F1926300AEADEEE1BB6AC0349D85581E9F154F1E57E6123DFDCD9E4EA6CC04F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fofigd32.exe

Path C:\Windows\SysWOW64\Fofigd32.exe
Size 320KB
SHA256 5a79a21e3a15db11ec0f1180a953aa1e94125f9738e1ae80e7e60694bdf7cc6b
MD5 eab56f0d5ec5e3e8135178fd0c977c84
SHA1 65dd001b8f367eb1eb3f28cb2b09451f2bc066f7
SHA512 4c770cf1be489dd18d524e686f5f8ca335b52e4f8ac76bf21940f1e603424edc6a82b86a1401fd9e8b2ac6e88edc669d08743d6f2d056bf22ea0269214e2f009
SSDEEP 3072:Cwglgout0EwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:elc0EV/Ah1G/AcQ///NR5fn
TLSH
T1A36411192A340AEACDED1BB5AC1249D86141E9F11CF1F13EA223DFDCD8E4D66D825F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fomohc32.exe

Path C:\Windows\SysWOW64\Fomohc32.exe
Size 320KB
SHA256 38e6a5241daff43a2cfdaa703a69ada7fa2504bcf9855e80ea83170742f9faa5
MD5 85005f84499234c5ddf2b39b58a76c86
SHA1 97e98cfea92186ebb0caafc9701d48368784f02c
SHA512 a83b105795937b26ac1637c467510a08b0ac0e659eb79bd69568053599e8c1ba446c0304206d84495d1905ed3af4bcb817bbf2f9cab1ba72c996b266eb38a6b0
SSDEEP 3072:zL9syWPN14HWTwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:zL9s5PgHWTV/Ah1G/AcQ///NR5fn
TLSH
T1C1641E1A2A3409FAEEED1BB5AD1249D89141E9F018F1E13F6123DFDDD8E4DA2D805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gbcaemdg.exe

Path C:\Windows\SysWOW64\Gbcaemdg.exe
Size 320KB
SHA256 6b0eb90d8faf5e457f8c9d134f328dddfbfe6d36fc71b40891ffa4c218d7abfb
MD5 e4ab14edfb37132d4ac4fc8ba8c930bf
SHA1 4402a44c3c35c5e399a07a88bf68cc6ff96427c1
SHA512 10e9919d5428626ba1bfcb9b8d336919557625df9e64d45715aa4c628418eb4e32b9f49ab402315505321c0f972c859a07a9f9d6ad7c051ff87932f86a19aa0b
SSDEEP 3072:30jGaBwu20Ev4MxW45xwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:EjLO/dxV/Ah1G/AcQ///NR5fn
TLSH
T19E644F5A263109EACEED1FB6AC2249DC9141E9F014F1E17E6123DFDCD8E4DA2D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gcggjp32.exe

Path C:\Windows\SysWOW64\Gcggjp32.exe
Size 320KB
SHA256 a216df90e48e9d6fb88973271c0560db15fc75cee87ee8cef0589b67a5a611f2
MD5 0a58ed732c3f4b519138696e947b9da9
SHA1 42b16497b5c40cbc922a8e9e95c1b9480106829a
SHA512 55e5f50a684a70ba62b131d0448515700acb777d3c893d23765c71a08e418e24cfb303c11433fad224866b914c80e6669994106dbf9883dbc03c3ea72220ddc3
SSDEEP 3072:daTVjwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:QTVjV/Ah1G/AcQ///NR5fn
TLSH
T1E5645029163089EACEED5FB5AC025ADA4181E9F154F1E53E2123DFECDCE5DA2D804F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Giacmggo.exe

Path C:\Windows\SysWOW64\Giacmggo.exe
Size 320KB
SHA256 bddf748e22b515aa4499011173ee02278bace08b78097e31047233474214ae7a
MD5 4ee1c98d6ca53da15ef9e55e4be7fe77
SHA1 8e96257c581474231ba0b6a8cd6005ab62848996
SHA512 7a9a6c5d48420c38a3bebf184809e97adb8b80465870fbe13d98c8a7e6f88775f80f07868fb040a8a36c53a3447c6c72d5a7f4e226043c291d02f2987ecd64f0
SSDEEP 3072:tVsXSE9+mF+UOzzIVAs+jmdTuPXYwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:tRE93GXYV/Ah1G/AcQ///NR5fn
TLSH
T1076420192A3009EACEED1BB5EC2249D8A141E9F514F1E13E6123DFDCD8E4DAACD15F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gimjag32.exe

Path C:\Windows\SysWOW64\Gimjag32.exe
Size 320KB
SHA256 3b1b433538229e704ea2b32d9e12823aece07ff9cdb6abccac03ea12ceefca26
MD5 e5ba8e3395ff3c8f707766584c394cbc
SHA1 f37c2c5e3fab8abacb90a036bb036ad30cd68bb5
SHA512 3951f7d47245a2c7b025a050f71d0be49e22f7c8dee087e26225a57df999bce10ba2c6d06ce81f56a1295a7c9377dbee45e86a1a5a20677d9d9b726939e00b98
SSDEEP 3072:kdMj4lItBOMwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:kOjpOMV/Ah1G/AcQ///NR5fn
TLSH
T130642E1A163409EADEFE1BB9AC124AD85181E9F054F1E13E6123DFDCC8E4EA2DC15F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gmclgghc.exe

Path C:\Windows\SysWOW64\Gmclgghc.exe
Size 320KB
SHA256 cbbe633aa728483fecb2fc103cea4b38fd334d11093cb4f9f63921854e92e53f
MD5 3b4deb9b6c4e938d187dab7da70df035
SHA1 2704d3ccf52fcfe55cba808feb14a669c03389e3
SHA512 aae446deb961334b6eef5f6cb8d933151b76d665670ff187d08e9d7ed0ad4ecfede951382883a00a7e3b8524d07526af124de15b1a1fdb0f2a398d0135ce6247
SSDEEP 6144:IpvbCulnP81fhXSV/Ah1G/AcQ///NR5fn:IpvbCW8PX/Nv
TLSH
T1B864521A26300AEACDED1FB5AC1259D89191E9F018F1E13E6563DFDCD8E4DA2E805FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Habndbpf.exe

Path C:\Windows\SysWOW64\Habndbpf.exe
Size 320KB
SHA256 81a9459103173ea00e301461048bec90af2002ffff8db31bc429a6559d69f4da
MD5 94b02736e38074ce5aea4e387f31bb2f
SHA1 429e41a5fac9e9519f7115fc2f237feb62fe1447
SHA512 994b26a39b0ce745ac33059101355e324e3c965c28147a2ed912d615a7003ee287188e4b254025851995c1ab4d8b0adec5c20e211b9117ead42ffbb616fb7a36
SSDEEP 3072:AgjD4Sh/Cij8zfRIpwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:HZFZepIpV/Ah1G/AcQ///NR5fn
TLSH
T1DF64EA2A263009EADDED1FB6AC1249DA9141E9F014F1E13E7123DFDCD8E4EA6C915F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hapancai.exe

Path C:\Windows\SysWOW64\Hapancai.exe
Size 320KB
SHA256 8cc2844b9457a1ebaee75549ed61b536351812b9496e3a078db5c9707b0eeb96
MD5 2ebcc1c1316ac58b6a990e01349ae338
SHA1 9b16f87c706b2abcf82a8ac43fb80f7a11ad34f7
SHA512 5c81043eabd5907d85bab9316b8942eebba1213a7b420a0331f8bb2335b9dbb8a2867d47ef2f75a2f86595d80bd76b256610bd11abf994c787cbc7f81e0cd614
SSDEEP 6144:DqcfHNQw+IS1ccccgnpMrV/Ah1G/AcQ///NR5fn:OI+IS1ccccgnpV/Nv
TLSH
T14D640E19263009EACEED1BF5AC1289D89141E9F118F1E13E9523EFDCD8E4EA6DC15F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hmaihekc.exe

Path C:\Windows\SysWOW64\Hmaihekc.exe
Size 320KB
SHA256 ad7f9c89cf97e07bea7e5f679caa4f331ee7b90c69551a2f5a100c886fa01141
MD5 6289eef1d903d519ff724a2a749382f6
SHA1 6e30fb91f9194d4010b3aa858fc70b01d8165126
SHA512 8f002903047c0f54d86971d08a6f40241ab9730bfdc985abd5ecf36954201aad511be6cbe3ef538a50d71bed47ca97c13ba22f48e12b2c43e3ddc1d47eeb6385
SSDEEP 3072:9MXJjjbzmG7Kx19zKrwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:9MXB3zmwKDwrV/Ah1G/AcQ///NR5fn
TLSH
T18D641D192A3009FADDED1BB5AE124AD89181E8F014F1E13E6523DFDCD8E4DA2D859FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Iannpa32.exe

Path C:\Windows\SysWOW64\Iannpa32.exe
Size 320KB
SHA256 a223fd87ed1046ac85556a0a09c08f069646cb027e4de5301c2f34e0c0a542fa
MD5 fc1ddd7b6844cbe03ba464bc15d79e28
SHA1 fbced8630141ba1fc6e2de1b7fccd2e635047165
SHA512 14b5f41077b69b111b2180c819f0a824dd156809a50a4c3ee7051f97aaf39548a5bd4574b50873e485c3607eb4c95f181b386bd65f6bdf5deb5f09131fe345ad
SSDEEP 3072:ie3ylZTOM9feNCh8s9G6FwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:iIyvT8Ch8s9G6FV/Ah1G/AcQ///NR5fn
TLSH
T1E06440592A3409EACEED1FB5AC1259E89191E8F024F1E13E6123DFDDDDE4DA2C805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Icedkn32.exe

Path C:\Windows\SysWOW64\Icedkn32.exe
Size 320KB
SHA256 b667eb649447b8f9e6103b25ff79be026551dc54661a9ae4d591c3cbaa2bf46d
MD5 1aa0804d96ebe9e3603add68379a47c6
SHA1 8d0510bbce1e13f14d9084340b1b3cfd4fe78571
SHA512 ddbdfb2b488d473a94f884d8b07f807880d54073126549405369d3994f377df21b338a0f5a24b4d26cda00027e73bdd3f8ab9807df182e830ca048e4f66b826f
SSDEEP 3072:p+WXXJubdzb/kDAwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:p9JOzbCAV/Ah1G/AcQ///NR5fn
TLSH
T15F6431191A3019EACEED1FB9EC1289D89181E9F454F1E13E6623DFDCC8E4DA6D814F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ifjfhh32.exe

Path C:\Windows\SysWOW64\Ifjfhh32.exe
Size 320KB
SHA256 3e39e97b4a2ccdeab6adee486ffddad174c4019adac507a28009c698a8595134
MD5 a24a93bd1a6238e012607ec643a8eea0
SHA1 564c75692b843c6d6951fbb29de438677f2f2c9b
SHA512 7dcb27744fcd79377e3cd0ead37c2777eae3c7ba13679168d241e6188b308b3603f955ca1a874dfb1e3d88fb6af34398bcbe7778eb4ed18f43c966abeef3ccab
SSDEEP 3072:j2Gi6vLQw2B9OwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:j2Gi6vLQbB9OV/Ah1G/AcQ///NR5fn
TLSH
T10A64FD192A3409FACDED1BB5BC1269D85581E8F118F1E23E6123DFDCC8E4DA6D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ifmcmg32.exe

Path C:\Windows\SysWOW64\Ifmcmg32.exe
Size 320KB
SHA256 cbe0e19d62f5d82ef4605087f8c1f6f2eab93e3201afbb13cd3f319ea8c3832b
MD5 da34718f447588c76700f40994db13c3
SHA1 9ee15ad9fa00493f9e893b37f8ecff02ca654851
SHA512 22d4840d45849a3f1e8ce81fd288d9cbf1e31ee6c1afddc34759f0a79debdac1ac360312406f4410c284857601efd47aece1f020ed38a4d210d2d976118b5709
SSDEEP 3072:aexkg6jbOLSKOdwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:ZuBnOWPdV/Ah1G/AcQ///NR5fn
TLSH
T1DC6442192A3009EACEED1FB5AC1249DCA151E5F014F1E17EA523DFDCD8E4DAAC819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Immhdc32.exe

Path C:\Windows\SysWOW64\Immhdc32.exe
Size 320KB
SHA256 f3d01b89ffb1f1dc1d194a3daf39325817abb6c8b4a88c3b47543c15d9a37423
MD5 dd8fe06732ff40a52f94f8b30c1f48af
SHA1 33bb1bc9de18369a0682577c8488da2cbe110602
SHA512 b8eb22be792898177d6feb9a919199ef6ce3c263054ee3dc45865026f68bd70d4e491f44ec17002c25a569aa0086c78f4e96819800cbba510d0aa485f825d536
SSDEEP 3072:+ooxOdoDcxDwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:+ootDcxDV/Ah1G/AcQ///NR5fn
TLSH
T12C6433152A3009EECDED2FB6AC1289D85181E9F014F2E13E6523DFDDD8E4DA6C819F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jbhmnhcm.exe

Path C:\Windows\SysWOW64\Jbhmnhcm.exe
Size 320KB
SHA256 0f1e1810acab571d5dfadc5bd6acca50932b44c8b88a2cf7d0c27552fc1a9c95
MD5 90535a6b7f8da72d1b57dd4bee36509a
SHA1 f86dfeba83b13f3ccf00763cf9fd07e55b3714d6
SHA512 687045ff1a5143659bb008e64e5a702233f35882559dadb1740df8f698026f6e1113a4e98ebdf1f81254ad45524343854ebb8131fe09b14e27f62ffa613450d0
SSDEEP 3072:YLNNAcS4DEWW7pPmwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:qNNAcrVW7pPmV/Ah1G/AcQ///NR5fn
TLSH
T1E0640D596A3409EACEED1BB5AC0249D891C1E9F424F1E23E6123DFDCD9F4DA6D804F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jibejb32.exe

Path C:\Windows\SysWOW64\Jibejb32.exe
Size 320KB
SHA256 06dc326812fbc24f67249f8784947aa49a48872ca87bacfc4d40cdbdfef58dc6
MD5 895f1be6b966b5f4e16f858ede15ab7c
SHA1 3c03ef8a65df71080b4f6a8d9d95e70ca681be38
SHA512 ec46e1ce3e454743a199acd408808f8480fc277d496d01d1aa46566dce097ad4a963da0fa3986993145907ad06003711827840b60f8f8d1e762afe5eb08c72ec
SSDEEP 3072:tEGtj3TW21NhWwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:tEGd3jTWV/Ah1G/AcQ///NR5fn
TLSH
T12E64DB2A163409EACEED1BB5AC2249D991C1E9B014F1E13E6133DFDCE8F4DA6D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jjklcf32.exe

Path C:\Windows\SysWOW64\Jjklcf32.exe
Size 320KB
SHA256 9db7b51394243bcd030b03e4ba40305a33813ece512f55405d1592458a50883e
MD5 b01af8ea0e241812ba858439fd5678c2
SHA1 59ba8097df7a027d6327738008dc7554c9e95a79
SHA512 108add31f02d76913d1c159559edfe9e59c20c39391b49f16a5e44753d5af86e2eaa8cf157acb05fffc884dfbb0212664bf438d37319f61b22ad720350e32a1d
SSDEEP 3072:wBVQeWt7IRGdrrrZfOIXwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:oVQeiJXV/Ah1G/AcQ///NR5fn
TLSH
T126643119263409FADEED1FB6AC024AD89541E4F014F1E23EA523DFDCD8E4DA6E915F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jpgdlm32.exe

Path C:\Windows\SysWOW64\Jpgdlm32.exe
Size 320KB
SHA256 f59cb0913c205f8b2202f821f4ed8fdac73bfbb66218f5effc87838a8922dd16
MD5 318fa19e31cefbab0ebaf6cbe6cac93f
SHA1 718cf87d027ff30b65e851f6d06953c457071488
SHA512 acb9852d19c24c4cd6f022d18dbeac56a5be20dd9419e8b759f90268f484feed3ea09a8aba722e7ccd4398098c88c123de93eb56580dca4ee277ec63fa03e8d8
SSDEEP 6144:MX62pL1HDEFsRXmV/Ah1G/AcQ///NR5fn:MXb5SUL/Nv
TLSH
T10B64EA192A3409EACDED1BB5AD0249DDA151E9F019F1E13E6123DFDCD8E4DA2C825FC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jpojml32.exe

Path C:\Windows\SysWOW64\Jpojml32.exe
Size 320KB
SHA256 c7347c78d4a84c7b24d6e8ae3b10b94061c0c2beb1ff3333dc42a424253848bc
MD5 48ecd80b23a3a91c9a111a44802a77bf
SHA1 be1d2f9fc3ba6be7325f3cf82954173d8a9ff508
SHA512 7ff7106b4de7c46e423a8705bbb93e6ced3acaef18b7816ecc27cc93c23131ea530b4959f1313cd6a6d0f0d20770e8af94494702f02349b77c92eb821f3a5338
SSDEEP 3072:1dZi9idplPFp2ycdwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:zZprlPUdV/Ah1G/AcQ///NR5fn
TLSH
T1B564FA1A6A341BEACEED1BB5AC0259D89141E9F118F1E13E6123DFDCC8E4DA2C915FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kapclned.exe

Path C:\Windows\SysWOW64\Kapclned.exe
Size 320KB
SHA256 6145b634e1269e7e07a39ffb0f51933d8ad4707b32dc48c9750c527fd068d80d
MD5 5cf472c24ae8bbb12f7aeec6ef3705b8
SHA1 0005e0616589021db38cd273d185436c78be193e
SHA512 c62ab9d117c41e717d6a5582ac4ad713d43860e99c163b3e04dfe36e3c019dee99a69ad2c650bb24387cd4576a70c790dad26d0b8a52c553d4a6376520c56dea
SSDEEP 3072:5p8NxxY6vYvqbCVLbjGwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:5OXxGqbCVLbjGV/Ah1G/AcQ///NR5fn
TLSH
T19E64EB19163009EACDFD1BB5AC229ED85281E9B018F1E13E6123DFDCDAE4DA6DC15F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kbapdfkb.exe

Path C:\Windows\SysWOW64\Kbapdfkb.exe
Size 320KB
SHA256 16a7e93d30cf7499beef18f960811e89a35092ad964b34389bde09423c5cc812
MD5 2939047379b0b149fc98a4a3073d24cd
SHA1 63305dc878ba8548a06e1cdd2b1e52bf82c13aa4
SHA512 ab68e5ffb91059230b6bcdedaca7616e2ebe8ce58318dd2bbf3e4908b12b16ff6bce5f280ec9231c9833c55725dfb36469e32bdd724eea3577b4aaae39314d83
SSDEEP 3072:CAjcHnKEowS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:C9KEoV/Ah1G/AcQ///NR5fn
TLSH
T16A641D192A3009EADEFD5BB5AC124AD85141E8F014F1E63E6223DFDCD8E4DA2DD19F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kcfiof32.exe

Path C:\Windows\SysWOW64\Kcfiof32.exe
Size 320KB
SHA256 2aeed2f4bccc9f5211f8d7bfdd42f09c39e4f10e685578b00925ecd1769cf6b5
MD5 403f3fcf016a1411548e1bb2ada8821c
SHA1 746647711cc1258a2eda21f16285fa76325cec5f
SHA512 ee9337831b9c8c7c8fbd8916ca7768145aff7c2aad602a65abbb1be4bdf14562a6e02709824c3e8859071afb99c81067bd12d884de958dd5c8d6c11a0b6f0f3d
SSDEEP 3072:etEL0ONfbZ/gZr8wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:kELJaZr8V/Ah1G/AcQ///NR5fn
TLSH
T169645315263409EACEEE1FB5AC1269D89251F5F018F1E13E6523DFECE8E4DA2D804F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kkdnjd32.exe

Path C:\Windows\SysWOW64\Kkdnjd32.exe
Size 320KB
SHA256 d00b72b10fba40820ea73bd59613f02143927e78e67450b8d83f489d1932d5ea
MD5 a063941b11865717c6d3112999104ac5
SHA1 cd8641f4b7f6cf319fbea8fe0ffc682e17b0b9fb
SHA512 f642aaee66a9d38ceaa91d9a7c95ebc8675920b745b5169aa106da3137414292108910585d0a44db898178e74c0f48cd79ffd616fb9dc936d8d18a909edff0a5
SSDEEP 3072:fMaPCAsXGwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:fM4cGV/Ah1G/AcQ///NR5fn
TLSH
T17A64411926304AEACEED1FB5AC4249D8A181E9F115F1E13E6123DFDCD8E4DA6CC19F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kkihedld.exe

Path C:\Windows\SysWOW64\Kkihedld.exe
Size 320KB
SHA256 1aa4c746c0b24e0a7288b82965a035c6d3f662b2ff080f8d9f4ba1446afef9db
MD5 19b60d9f74f4c4975433ff1d2f0d73d3
SHA1 20b242db95594cac142858a1f544410e479e0811
SHA512 0371fd2feef670a49ba504ec942171c25715760ce884c06e0c3a305e198b27c71f74b6fd58e170a676ad8f102f4792beaf505321317f97df9d1e7fb395f8a135
SSDEEP 6144:UgF+aYqmzX5weUQQV/Ah1G/AcQ///NR5fn:U86d/Nv
TLSH
T1AD64211A263409EACEED1FB5AC1249D85151E8F014F2E23E6523DFDCD8E4DA6CC1AF91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lgdbedmc.exe

Path C:\Windows\SysWOW64\Lgdbedmc.exe
Size 320KB
SHA256 ed74cd03da1243ba57239433ecc742e50a5026308bf2fe7ef4cbf6fc1606d689
MD5 62d06ba380805e2682412b2c6c0536d2
SHA1 63dc233b677f24529fe8efa0553e54309b3169c8
SHA512 9f8266b0c7071a240f894406e2896046960903dfe67e267086503c3f337ffa2cca672d1fd87a8cfb14d75575c9d5ebfedf0f87b15f34415db0f43ab371de3abd
SSDEEP 3072:aXHSWaSQ/UiBu8rwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:KNF+rV/Ah1G/AcQ///NR5fn
TLSH
T1FD64DB1926380AEACDED1BB6AC1259D85241F8F114F1E13EA133DFDDD8E4DA2D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Liekgo32.exe

Path C:\Windows\SysWOW64\Liekgo32.exe
Size 320KB
SHA256 a254b34138067c5abfdeec5948958ea67075c4bd578d697575f514715d8f6681
MD5 52cf13657cdf1985df8eb4d2b8ba8a5e
SHA1 b2d1c0bc31e73665cce62b564e944d60e6aadc37
SHA512 e8228867b88884488bc9041bd41161d23c8f351d1cf40d273ba04824a63525cfc4c0e8d748a33fa5a034a72331a5f8400636540ad1d4dbb1bb0ed626faa80952
SSDEEP 3072:OzrYECNq/vQ6kdwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Onfiq/udV/Ah1G/AcQ///NR5fn
TLSH
T1DB64411A2A3409EACEED1FB5AC1249D85145E5F014F1E13F6223DFDCD8E4DA6D84AF82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lnccmnak.exe

Path C:\Windows\SysWOW64\Lnccmnak.exe
Size 320KB
SHA256 11851fbda5b6325a3f997c3509ea6dff065d238877ae3cc3d40b92f790e98c6b
MD5 50e4dc34cfd04e673cb36a0df506ef03
SHA1 80f49b2ef4f06c16a09a27c8377505e7bd5d062c
SHA512 449eee7d73ada00d7105dcf5e1324ba4dc7e2912ab6b5e763039e59762ba6612e54f4b9668c095524f060cf67ac785f38085b2ddf4df4c953260e73143fbec7f
SSDEEP 3072:R5+xLCdkmS+suEitrCLIhex3ZwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:joIktuLteLI03ZV/Ah1G/AcQ///NR5fn
TLSH
T18264202A3A3809EACDED1BB5AD0289D85141E9F014F1E13E6123DFDED8E4DA2DC15F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-91-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/628-502-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/704-265-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/808-280-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/884-345-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/912-466-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/920-225-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/944-28-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/944-489-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1076-490-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1100-305-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1108-105-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1236-461-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1260-390-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1264-415-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1284-450-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1304-255-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1352-182-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1384-168-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1392-147-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1528-410-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1612-430-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1644-203-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1780-325-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1940-240-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2044-300-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2088-133-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2240-483-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2240-21-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2360-250-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2372-435-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2484-440-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2488-211-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2552-49-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2552-507-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2580-313-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2720-78-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2724-245-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2732-425-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2780-315-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2864-126-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2896-189-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2936-14-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2936-477-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2940-370-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2948-42-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2948-501-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2984-420-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3040-230-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3136-161-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3184-175-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3236-496-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3352-63-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3408-476-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3432-70-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3456-330-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3568-140-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3756-350-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3880-355-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4108-400-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4168-290-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4180-263-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4184-270-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4192-235-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4204-154-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4232-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4232-1-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/4232-460-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4308-335-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4492-455-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4528-119-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4556-320-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4560-365-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4668-285-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4820-380-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4860-84-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4912-35-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4912-495-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5000-360-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5024-7-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5024-471-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5040-478-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5216-196-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5248-275-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5252-56-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5508-218-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5588-112-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5620-340-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5648-98-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5656-385-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5724-484-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5780-375-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5836-448-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5996-395-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6116-405-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6140-295-0x0000000000400000-0x000000000046D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads