berbew | 0a72d0b25e84fe072886d46acfee16ea96df88ea85d7f3067264b6facd5f394d

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 20:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_67c6b66f3f8ef45ae10a71933a85d588_elex_wannacry.exe
Size 320KB
Sample260810-y25ghaxeka
SHA256 0a72d0b25e84fe072886d46acfee16ea96df88ea85d7f3067264b6facd5f394d
MD5 67c6b66f3f8ef45ae10a71933a85d588
SHA1 282d3f7ff92374f784d8817a2c2bd34184a4a375
SHA512 e148586d8855966c8c7c7a158080d5b02506a7aaf5a7f3c4172c07207683f620acdf3cd791fcb3b6c829b148dbd589439196a54e3b4c1d13025a62da31d2e140
SSDEEP 3072:yWgwVqF59E6jksUEwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:yWgwU1EilUEV/Ah1G/AcQ///NR5fn
TLSH
T13F640C5A263409EACEFD2FB9AD1249D89181E9F014F1E13E6123DFDCD8E4DA2D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Noehlgol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfcqjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ebimqi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffgegh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hoglmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cimckcoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fdcjfg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cbnkhcha.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckclacmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ppgeqijb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qcbfjqkp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Llcoihmb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mlhidg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mbgjlq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfnqdale.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Foocegea.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fqpomo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Niipdpae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckfpai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aefjbo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebimqi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jljbogaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bganac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibdiln32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qlejnqbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngehoqdn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qmepkb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahbjij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jgmjfpco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkqahk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmkcjd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bpkllo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjoibadl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmodqdpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Akmbepke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dnhgcgbi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nobdlqnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmdlolmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gldpkfoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gihpejmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ejoogm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gmbmefob.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Palbpb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eilomd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncnook32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhbelp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fgldoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpdhdl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dieilepc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfimhkbo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Igabdekb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nhpijldj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nifldj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhnbkfek.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgmbmn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lcimmn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmcnlc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbihdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eeagnc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Miomnaip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfjofg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfjgjf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pakleh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oakbonkb.exe

Executes dropped EXE 64 IoCs

pid	Process
4868	Bganac32.exe
5896	Bmngjj32.exe
1560	Bmpcpjcd.exe
2228	Cclhbcho.exe
3136	Cdoegcfl.exe
2136	Cjkjjmlf.exe
4492	Ceqngekl.exe
5960	Cokpekpj.exe
1696	Dhcdnq32.exe
2232	Dopiqj32.exe
5368	Ddmaia32.exe
5068	Ddonnq32.exe
2836	Dmgbgf32.exe
4832	Eeagnc32.exe
2412	Eknpfj32.exe
4144	Ekpmljin.exe
4628	Edknjonl.exe
4372	Eaonccme.exe
5416	Egkgljkm.exe
6000	Fneohd32.exe
5564	Fdpgen32.exe
2828	Fnjhccnd.exe
1368	Fojenfeg.exe
868	Fefjpp32.exe
2700	Fggfghap.exe
5372	Gnaodbhl.exe
3048	Gdkgam32.exe
1576	Gkeonggf.exe
1508	Gekckpgl.exe
3204	Gfomfo32.exe
5036	Hfdfanoa.exe
900	Hnokeqll.exe
808	Hheoci32.exe
3276	Hkehdd32.exe
2608	Hnddqp32.exe
2792	Hocqkc32.exe
3116	Igoeoe32.exe
4600	Ibdiln32.exe
4796	Igabdekb.exe
5460	Ifbbbl32.exe
1264	Inmggo32.exe
2124	Ikagpcof.exe
3120	Ikcdfbmc.exe
4308	Ibnlbm32.exe
1620	Jkfakb32.exe
4164	Jkhnab32.exe
2876	Jilnjf32.exe
2604	Jpffgp32.exe
3580	Jiokpfee.exe
120	Jfbkijdo.exe
252	Jgdhab32.exe
4924	Kehhjfif.exe
5848	Kfgddi32.exe
3644	Kfiajinf.exe
5148	Khknaa32.exe
4280	Kijjldkh.exe
4244	Kpdbhn32.exe
4568	Kpfonnab.exe
1920	Lechfeoi.exe
5452	Lbghpinc.exe
552	Llpmhodc.exe
2056	Lhfmmp32.exe
5916	Lejngd32.exe
4544	Locbpi32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Nmdgbamf.exe	Nfjofg32.exe
File opened for modification	C:\Windows\SysWOW64\Gpaiadel.exe	Gihpejmo.exe
File opened for modification	C:\Windows\SysWOW64\Ocjgcd32.exe	Oomnmfid.exe
File created	C:\Windows\SysWOW64\Djnfppqi.exe	Doiabgqc.exe
File created	C:\Windows\SysWOW64\Fjhaml32.exe	Flgaodbm.exe
File created	C:\Windows\SysWOW64\Cnfahn32.exe	Cleeafbi.exe
File created	C:\Windows\SysWOW64\Pmnbpm32.exe	Phajgf32.exe
File created	C:\Windows\SysWOW64\Hjkije32.dll	Dbmfje32.exe
File created	C:\Windows\SysWOW64\Knkagdkl.dll	Hkehdd32.exe
File created	C:\Windows\SysWOW64\Gfibfmmi.dll	Inmggo32.exe
File opened for modification	C:\Windows\SysWOW64\Jgdhab32.exe	Jfbkijdo.exe
File created	C:\Windows\SysWOW64\Afinbdon.exe	Akcjel32.exe
File created	C:\Windows\SysWOW64\Oakhaadf.dll	Hlldaape.exe
File created	C:\Windows\SysWOW64\Igomeb32.exe	Iikmlnae.exe
File opened for modification	C:\Windows\SysWOW64\Jbgdelpe.exe	Ipihiaqa.exe
File created	C:\Windows\SysWOW64\Ekcqji32.dll	Ndcoeq32.exe
File created	C:\Windows\SysWOW64\Cbpedjip.dll	Onicbi32.exe
File opened for modification	C:\Windows\SysWOW64\Dbkpokhf.exe	Diclff32.exe
File created	C:\Windows\SysWOW64\Lcmkdd32.dll	Lmodqdpo.exe
File created	C:\Windows\SysWOW64\Mkhepqnd.dll	Afelal32.exe
File opened for modification	C:\Windows\SysWOW64\Mhjpnibf.exe	Lbngfbdo.exe
File created	C:\Windows\SysWOW64\Bcokah32.exe	Bhjgdplo.exe
File created	C:\Windows\SysWOW64\Hfmpgi32.dll	Hoglmg32.exe
File opened for modification	C:\Windows\SysWOW64\Hplbbipm.exe	Hiajeoip.exe
File created	C:\Windows\SysWOW64\Mmagah32.dll	Lcimmn32.exe
File created	C:\Windows\SysWOW64\Chfepa32.exe	Cponodge.exe
File opened for modification	C:\Windows\SysWOW64\Qlejnqbj.exe	Pcmeek32.exe
File created	C:\Windows\SysWOW64\Jqfejl32.exe	Jkimae32.exe
File created	C:\Windows\SysWOW64\Npepdl32.exe	Ncnook32.exe
File created	C:\Windows\SysWOW64\Hoebhpfd.dll	Noehlgol.exe
File created	C:\Windows\SysWOW64\Ncnook32.exe	Nmdgbamf.exe
File created	C:\Windows\SysWOW64\Jhdlncnl.exe	Jbgdelpe.exe
File created	C:\Windows\SysWOW64\Hpicnh32.dll	Mjneec32.exe
File created	C:\Windows\SysWOW64\Kglmbd32.exe	Kmfhelke.exe
File created	C:\Windows\SysWOW64\Nanmhf32.exe	Ngehoqdn.exe
File opened for modification	C:\Windows\SysWOW64\Edknjonl.exe	Ekpmljin.exe
File created	C:\Windows\SysWOW64\Ihdhon32.dll	Cbnkhcha.exe
File opened for modification	C:\Windows\SysWOW64\Hkehdd32.exe	Hheoci32.exe
File created	C:\Windows\SysWOW64\Hblaqjod.dll	Qhlamhkj.exe
File created	C:\Windows\SysWOW64\Dhjaoq32.dll	Nifldj32.exe
File created	C:\Windows\SysWOW64\Hodogb32.dll	Dbdjol32.exe
File created	C:\Windows\SysWOW64\Hlhife32.exe	Haceil32.exe
File created	C:\Windows\SysWOW64\Dbikdbnd.exe	Djnfppqi.exe
File opened for modification	C:\Windows\SysWOW64\Jjgcbb32.exe	Jcmkehcg.exe
File created	C:\Windows\SysWOW64\Eqkfapoe.exe	Eojijg32.exe
File created	C:\Windows\SysWOW64\Kkfnlack.dll	Cjkjjmlf.exe
File created	C:\Windows\SysWOW64\Mnkmlhab.dll	Menimfnd.exe
File created	C:\Windows\SysWOW64\Kakjpb32.dll	Kcmmap32.exe
File created	C:\Windows\SysWOW64\Qfhdnb32.exe	Qdjgbg32.exe
File created	C:\Windows\SysWOW64\Ibdiln32.exe	Igoeoe32.exe
File created	C:\Windows\SysWOW64\Iqmdhonl.dll	Jmbhhkoa.exe
File created	C:\Windows\SysWOW64\Dqhicdkm.dll	Lagekp32.exe
File created	C:\Windows\SysWOW64\Gfkbnk32.exe	Gmbmefob.exe
File created	C:\Windows\SysWOW64\Blbodh32.exe	Aamkgpbi.exe
File created	C:\Windows\SysWOW64\Poackh32.dll	Jiokpfee.exe
File opened for modification	C:\Windows\SysWOW64\Dfcqjg32.exe	Cafhap32.exe
File created	C:\Windows\SysWOW64\Pakleh32.exe	Piphaf32.exe
File created	C:\Windows\SysWOW64\Dflmep32.exe	Dmdhmj32.exe
File created	C:\Windows\SysWOW64\Lqdakjak.exe	Kglmbd32.exe
File created	C:\Windows\SysWOW64\Bfdkoabk.dll	Pmnbpm32.exe
File created	C:\Windows\SysWOW64\Ciolccoc.dll	Bgnkamef.exe
File opened for modification	C:\Windows\SysWOW64\Cjcmognb.exe	Bqkifb32.exe
File opened for modification	C:\Windows\SysWOW64\Kgopbj32.exe	Kbbhjc32.exe
File created	C:\Windows\SysWOW64\Blgiphni.exe	Baadbo32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7092	6976	WerFault.exe	718

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hnkonpeo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hgghdp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oeccijoh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbcfan32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcdlil32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgbhbm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eeagnc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afelal32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kelkkpae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmbflc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmlkaela.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gldgflba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbnhhp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjjjhifm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qejkfp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chepehne.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oafido32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Heegjj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cclhbcho.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfjgjf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngaihcli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ikagpcof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fojenfeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iklgkmop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aklmjfad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baadbo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfbcek32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbkpokhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gflhie32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ggilbb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oldagc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fmjqjqao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljnloi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdhmjc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dqmjqb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Locbpi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmabpmjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djnfppqi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kcpjgo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmblkmcd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngehoqdn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahpmckpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Blbodh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnokhonp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Himqjpme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mfjfoidl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpkddd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gnmblb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mpghel32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bpkllo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mbgjlq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eidlhj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eodjdocj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjcmognb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbikdbnd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fdepaa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hdehho32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjkjjmlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocjgcd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mecjbl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmooak32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hlldaape.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmepkb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaibcn32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Efdjqeni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Glbakchp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njkklk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdahkafp.dll"	Bdbndjld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjgljffm.dll"	Igajka32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Amnlfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eeagnc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kfbeee32.dll"	Bhqmdoef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gpnfak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kfgpblda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfdppn32.dll"	Dkcnnk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mflgff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Efdjqeni.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fdepaa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oeccijoh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cgdlqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajgehh32.dll"	Hnddqp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kfgddi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gggigpnm.dll"	Aafefq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Baohmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ineilini.dll"	Qdldgg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cofnba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Icaegiab.dll"	Fbpcah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Emoanbll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ibadoc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lnmbjd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kalepg32.dll"	Pehekgmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhaicomh.dll"	Hginoiic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ahggbded.dll"	Ckclacmi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mfqlph32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gnaodbhl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kpfonnab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hpofbobf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbdpkadl.dll"	Dndnjllg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fmancbji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pinfef32.dll"	Nnojad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eqkfapoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pilgmk32.dll"	Boabkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Olmdln32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnodmijd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fjhaml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lijoklol.dll"	Afddge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjiipd32.dll"	Ccinggcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kaibifja.dll"	Dhnbkfek.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fnpmej32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jhdlncnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fggfghap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plnple32.dll"	Dakampio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Danlilhh.dll"	Nobdlqnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlhoildi.dll"	Knoonphp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ngehoqdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljkdbnkl.dll"	Cfipol32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pndlca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dkcnnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Japphf32.dll"	Flgaodbm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gbnobf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plcbgiaq.dll"	Dmgbgf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qhjegh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dndnjllg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pihggn32.dll"	Qfhdnb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ekpmljin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ijadljdg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dkeoeg32.dll"	Igpdph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gldgflba.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 4868	4248	2026-08-10_67c6b66f3f8ef45ae10a71933a85d588_elex_wannacry.exe	89
PID 4868 wrote to memory of 5896	4868	Bganac32.exe	90
PID 5896 wrote to memory of 1560	5896	Bmngjj32.exe	91
PID 1560 wrote to memory of 2228	1560	Bmpcpjcd.exe	92
PID 2228 wrote to memory of 3136	2228	Cclhbcho.exe	93
PID 3136 wrote to memory of 2136	3136	Cdoegcfl.exe	94
PID 2136 wrote to memory of 4492	2136	Cjkjjmlf.exe	95
PID 4492 wrote to memory of 5960	4492	Ceqngekl.exe	96
PID 5960 wrote to memory of 1696	5960	Cokpekpj.exe	97
PID 1696 wrote to memory of 2232	1696	Dhcdnq32.exe	98
PID 2232 wrote to memory of 5368	2232	Dopiqj32.exe	99
PID 5368 wrote to memory of 5068	5368	Ddmaia32.exe	100
PID 5068 wrote to memory of 2836	5068	Ddonnq32.exe	101
PID 2836 wrote to memory of 4832	2836	Dmgbgf32.exe	102
PID 4832 wrote to memory of 2412	4832	Eeagnc32.exe	103
PID 2412 wrote to memory of 4144	2412	Eknpfj32.exe	104
PID 4144 wrote to memory of 4628	4144	Ekpmljin.exe	105
PID 4628 wrote to memory of 4372	4628	Edknjonl.exe	106
PID 4372 wrote to memory of 5416	4372	Eaonccme.exe	107
PID 5416 wrote to memory of 6000	5416	Egkgljkm.exe	108
PID 6000 wrote to memory of 5564	6000	Fneohd32.exe	109
PID 5564 wrote to memory of 2828	5564	Fdpgen32.exe	110
PID 2828 wrote to memory of 1368	2828	Fnjhccnd.exe	111
PID 1368 wrote to memory of 868	1368	Fojenfeg.exe	112
PID 868 wrote to memory of 2700	868	Fefjpp32.exe	113
PID 2700 wrote to memory of 5372	2700	Fggfghap.exe	114
PID 5372 wrote to memory of 3048	5372	Gnaodbhl.exe	115
PID 3048 wrote to memory of 1576	3048	Gdkgam32.exe	116
PID 1576 wrote to memory of 1508	1576	Gkeonggf.exe	117
PID 1508 wrote to memory of 3204	1508	Gekckpgl.exe	118
PID 3204 wrote to memory of 5036	3204	Gfomfo32.exe	119
PID 5036 wrote to memory of 900	5036	Hfdfanoa.exe	120
PID 900 wrote to memory of 808	900	Hnokeqll.exe	121
PID 808 wrote to memory of 3276	808	Hheoci32.exe	122
PID 3276 wrote to memory of 2608	3276	Hkehdd32.exe	123
PID 2608 wrote to memory of 2792	2608	Hnddqp32.exe	124
PID 2792 wrote to memory of 3116	2792	Hocqkc32.exe	125
PID 3116 wrote to memory of 4600	3116	Igoeoe32.exe	126
PID 4600 wrote to memory of 4796	4600	Ibdiln32.exe	127
PID 4796 wrote to memory of 5460	4796	Igabdekb.exe	128
PID 5460 wrote to memory of 1264	5460	Ifbbbl32.exe	129
PID 1264 wrote to memory of 2124	1264	Inmggo32.exe	130
PID 2124 wrote to memory of 3120	2124	Ikagpcof.exe	131
PID 3120 wrote to memory of 4308	3120	Ikcdfbmc.exe	132
PID 4308 wrote to memory of 1620	4308	Ibnlbm32.exe	133
PID 1620 wrote to memory of 4164	1620	Jkfakb32.exe	134
PID 4164 wrote to memory of 2876	4164	Jkhnab32.exe	135
PID 2876 wrote to memory of 2604	2876	Jilnjf32.exe	136
PID 2604 wrote to memory of 3580	2604	Jpffgp32.exe	137
PID 3580 wrote to memory of 120	3580	Jiokpfee.exe	138
PID 120 wrote to memory of 252	120	Jfbkijdo.exe	139
PID 252 wrote to memory of 4924	252	Jgdhab32.exe	140
PID 4924 wrote to memory of 5848	4924	Kehhjfif.exe	141
PID 5848 wrote to memory of 3644	5848	Kfgddi32.exe	142
PID 3644 wrote to memory of 5148	3644	Kfiajinf.exe	143
PID 5148 wrote to memory of 4280	5148	Khknaa32.exe	144
PID 4280 wrote to memory of 4244	4280	Kijjldkh.exe	145
PID 4244 wrote to memory of 4568	4244	Kpdbhn32.exe	146
PID 4568 wrote to memory of 1920	4568	Kpfonnab.exe	147
PID 1920 wrote to memory of 5452	1920	Lechfeoi.exe	148
PID 5452 wrote to memory of 552	5452	Lbghpinc.exe	149
PID 552 wrote to memory of 2056	552	Llpmhodc.exe	150
PID 2056 wrote to memory of 5916	2056	Lhfmmp32.exe	151
PID 5916 wrote to memory of 4544	5916	Lejngd32.exe	152

C:\Users\Admin\AppData\Local\Temp\2026-08-10_67c6b66f3f8ef45ae10a71933a85d588_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_67c6b66f3f8ef45ae10a71933a85d588_elex_wannacry.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Windows\SysWOW64\Bganac32.exe
  C:\Windows\system32\Bganac32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Windows\SysWOW64\Bmngjj32.exe
    C:\Windows\system32\Bmngjj32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5896
  - - C:\Windows\SysWOW64\Bmpcpjcd.exe
      C:\Windows\system32\Bmpcpjcd.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1560
    - - C:\Windows\SysWOW64\Cclhbcho.exe
        
        C:\Windows\system32\Cclhbcho.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2228
      - C:\Windows\SysWOW64\Cdoegcfl.exe
        
        C:\Windows\system32\Cdoegcfl.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3136
        
        C:\Windows\SysWOW64\Cjkjjmlf.exe
        
        C:\Windows\system32\Cjkjjmlf.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2136
        
        C:\Windows\SysWOW64\Ceqngekl.exe
        
        C:\Windows\system32\Ceqngekl.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4492
        
        C:\Windows\SysWOW64\Cokpekpj.exe
        
        C:\Windows\system32\Cokpekpj.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5960
        
        C:\Windows\SysWOW64\Dhcdnq32.exe
        
        C:\Windows\system32\Dhcdnq32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1696
        
        C:\Windows\SysWOW64\Dopiqj32.exe
        
        C:\Windows\system32\Dopiqj32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2232
        
        C:\Windows\SysWOW64\Ddmaia32.exe
        
        C:\Windows\system32\Ddmaia32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5368
        
        C:\Windows\SysWOW64\Ddonnq32.exe
        
        C:\Windows\system32\Ddonnq32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5068
        
        C:\Windows\SysWOW64\Dmgbgf32.exe
        
        C:\Windows\system32\Dmgbgf32.exe
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2836
        
        C:\Windows\SysWOW64\Eeagnc32.exe
        
        C:\Windows\system32\Eeagnc32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4832
        
        C:\Windows\SysWOW64\Eknpfj32.exe
        
        C:\Windows\system32\Eknpfj32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2412
        
        C:\Windows\SysWOW64\Ekpmljin.exe
        
        C:\Windows\system32\Ekpmljin.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4144
        
        C:\Windows\SysWOW64\Edknjonl.exe
        
        C:\Windows\system32\Edknjonl.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4628
        
        C:\Windows\SysWOW64\Eaonccme.exe
        
        C:\Windows\system32\Eaonccme.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4372
        
        C:\Windows\SysWOW64\Egkgljkm.exe
        
        C:\Windows\system32\Egkgljkm.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5416
        
        C:\Windows\SysWOW64\Fneohd32.exe
        
        C:\Windows\system32\Fneohd32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6000
        
        C:\Windows\SysWOW64\Fdpgen32.exe
        
        C:\Windows\system32\Fdpgen32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5564
        
        C:\Windows\SysWOW64\Fnjhccnd.exe
        
        C:\Windows\system32\Fnjhccnd.exe
        23⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2828
        
        C:\Windows\SysWOW64\Fojenfeg.exe
        
        C:\Windows\system32\Fojenfeg.exe
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1368
        
        C:\Windows\SysWOW64\Fefjpp32.exe
        
        C:\Windows\system32\Fefjpp32.exe
        25⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:868
        
        C:\Windows\SysWOW64\Fggfghap.exe
        
        C:\Windows\system32\Fggfghap.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2700
        
        C:\Windows\SysWOW64\Gnaodbhl.exe
        
        C:\Windows\system32\Gnaodbhl.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5372
        
        C:\Windows\SysWOW64\Gdkgam32.exe
        
        C:\Windows\system32\Gdkgam32.exe
        28⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3048
        
        C:\Windows\SysWOW64\Gkeonggf.exe
        
        C:\Windows\system32\Gkeonggf.exe
        29⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1576
        
        C:\Windows\SysWOW64\Gekckpgl.exe
        
        C:\Windows\system32\Gekckpgl.exe
        30⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1508
        
        C:\Windows\SysWOW64\Gfomfo32.exe
        
        C:\Windows\system32\Gfomfo32.exe
        31⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3204
        
        C:\Windows\SysWOW64\Hfdfanoa.exe
        
        C:\Windows\system32\Hfdfanoa.exe
        32⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5036
        
        C:\Windows\SysWOW64\Hnokeqll.exe
        
        C:\Windows\system32\Hnokeqll.exe
        33⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:900
        
        C:\Windows\SysWOW64\Hheoci32.exe
        
        C:\Windows\system32\Hheoci32.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:808
        
        C:\Windows\SysWOW64\Hkehdd32.exe
        
        C:\Windows\system32\Hkehdd32.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3276
        
        C:\Windows\SysWOW64\Hnddqp32.exe
        
        C:\Windows\system32\Hnddqp32.exe
        36⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2608
        
        C:\Windows\SysWOW64\Hocqkc32.exe
        
        C:\Windows\system32\Hocqkc32.exe
        37⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2792
        
        C:\Windows\SysWOW64\Igoeoe32.exe
        
        C:\Windows\system32\Igoeoe32.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3116
        
        C:\Windows\SysWOW64\Ibdiln32.exe
        
        C:\Windows\system32\Ibdiln32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4600
        
        C:\Windows\SysWOW64\Igabdekb.exe
        
        C:\Windows\system32\Igabdekb.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4796
        
        C:\Windows\SysWOW64\Ifbbbl32.exe
        
        C:\Windows\system32\Ifbbbl32.exe
        41⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5460
        
        C:\Windows\SysWOW64\Inmggo32.exe
        
        C:\Windows\system32\Inmggo32.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1264
        
        C:\Windows\SysWOW64\Ikagpcof.exe
        
        C:\Windows\system32\Ikagpcof.exe
        43⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2124
        
        C:\Windows\SysWOW64\Ikcdfbmc.exe
        
        C:\Windows\system32\Ikcdfbmc.exe
        44⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3120
        
        C:\Windows\SysWOW64\Ibnlbm32.exe
        
        C:\Windows\system32\Ibnlbm32.exe
        45⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4308
        
        C:\Windows\SysWOW64\Jkfakb32.exe
        
        C:\Windows\system32\Jkfakb32.exe
        46⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1620
        
        C:\Windows\SysWOW64\Jkhnab32.exe
        
        C:\Windows\system32\Jkhnab32.exe
        47⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4164
        
        C:\Windows\SysWOW64\Jilnjf32.exe
        
        C:\Windows\system32\Jilnjf32.exe
        48⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2876
        
        C:\Windows\SysWOW64\Jpffgp32.exe
        
        C:\Windows\system32\Jpffgp32.exe
        49⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2604
        
        C:\Windows\SysWOW64\Jiokpfee.exe
        
        C:\Windows\system32\Jiokpfee.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3580
        
        C:\Windows\SysWOW64\Jfbkijdo.exe
        
        C:\Windows\system32\Jfbkijdo.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:120
        
        C:\Windows\SysWOW64\Jgdhab32.exe
        
        C:\Windows\system32\Jgdhab32.exe
        52⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:252
        
        C:\Windows\SysWOW64\Kehhjfif.exe
        
        C:\Windows\system32\Kehhjfif.exe
        53⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4924
        
        C:\Windows\SysWOW64\Kfgddi32.exe
        
        C:\Windows\system32\Kfgddi32.exe
        54⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5848
        
        C:\Windows\SysWOW64\Kfiajinf.exe
        
        C:\Windows\system32\Kfiajinf.exe
        55⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3644
        
        C:\Windows\SysWOW64\Khknaa32.exe
        
        C:\Windows\system32\Khknaa32.exe
        56⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5148
        
        C:\Windows\SysWOW64\Kijjldkh.exe
        
        C:\Windows\system32\Kijjldkh.exe
        57⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4280
        
        C:\Windows\SysWOW64\Kpdbhn32.exe
        
        C:\Windows\system32\Kpdbhn32.exe
        58⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4244
        
        C:\Windows\SysWOW64\Kpfonnab.exe
        
        C:\Windows\system32\Kpfonnab.exe
        59⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4568
        
        C:\Windows\SysWOW64\Lechfeoi.exe
        
        C:\Windows\system32\Lechfeoi.exe
        60⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1920
        
        C:\Windows\SysWOW64\Lbghpinc.exe
        
        C:\Windows\system32\Lbghpinc.exe
        61⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5452
        
        C:\Windows\SysWOW64\Llpmhodc.exe
        
        C:\Windows\system32\Llpmhodc.exe
        62⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:552
        
        C:\Windows\SysWOW64\Lhfmmp32.exe
        
        C:\Windows\system32\Lhfmmp32.exe
        63⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2056
        
        C:\Windows\SysWOW64\Lejngd32.exe
        
        C:\Windows\system32\Lejngd32.exe
        64⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5916
        
        C:\Windows\SysWOW64\Locbpi32.exe
        
        C:\Windows\system32\Locbpi32.exe
        65⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4544
        
        C:\Windows\SysWOW64\Llgcin32.exe
        
        C:\Windows\system32\Llgcin32.exe
        66⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Mflgff32.exe
        
        C:\Windows\system32\Mflgff32.exe
        67⤵
        Modifies registry class
        
        PID:4140
        
        C:\Windows\SysWOW64\Mbchkg32.exe
        
        C:\Windows\system32\Mbchkg32.exe
        68⤵
        
        PID:2536
        
        C:\Windows\SysWOW64\Mpghel32.exe
        
        C:\Windows\system32\Mpghel32.exe
        69⤵
        System Location Discovery: System Language Discovery
        
        PID:1076
        
        C:\Windows\SysWOW64\Miomnaip.exe
        
        C:\Windows\system32\Miomnaip.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3088
        
        C:\Windows\SysWOW64\Molefh32.exe
        
        C:\Windows\system32\Molefh32.exe
        71⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\Miaica32.exe
        
        C:\Windows\system32\Miaica32.exe
        72⤵
        
        PID:3608
        
        C:\Windows\SysWOW64\Mehjhbma.exe
        
        C:\Windows\system32\Mehjhbma.exe
        73⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\Nekgna32.exe
        
        C:\Windows\system32\Nekgna32.exe
        74⤵
        
        PID:564
        
        C:\Windows\SysWOW64\Niipdpae.exe
        
        C:\Windows\system32\Niipdpae.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5712
        
        C:\Windows\SysWOW64\Noehlgol.exe
        
        C:\Windows\system32\Noehlgol.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5072
        
        C:\Windows\SysWOW64\Npedfjfo.exe
        
        C:\Windows\system32\Npedfjfo.exe
        77⤵
        
        PID:2416
        
        C:\Windows\SysWOW64\Nhpijldj.exe
        
        C:\Windows\system32\Nhpijldj.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3284
        
        C:\Windows\SysWOW64\Ngaihcli.exe
        
        C:\Windows\system32\Ngaihcli.exe
        79⤵
        System Location Discovery: System Language Discovery
        
        PID:2592
        
        C:\Windows\SysWOW64\Oomnmfid.exe
        
        C:\Windows\system32\Oomnmfid.exe
        80⤵
        Drops file in System32 directory
        
        PID:4812
        
        C:\Windows\SysWOW64\Ocjgcd32.exe
        
        C:\Windows\system32\Ocjgcd32.exe
        81⤵
        System Location Discovery: System Language Discovery
        
        PID:5988
        
        C:\Windows\SysWOW64\Ocmchdmh.exe
        
        C:\Windows\system32\Ocmchdmh.exe
        82⤵
        
        PID:3952
        
        C:\Windows\SysWOW64\Oocdme32.exe
        
        C:\Windows\system32\Oocdme32.exe
        83⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\Ocamcc32.exe
        
        C:\Windows\system32\Ocamcc32.exe
        84⤵
        
        PID:2428
        
        C:\Windows\SysWOW64\Ohnelj32.exe
        
        C:\Windows\system32\Ohnelj32.exe
        85⤵
        
        PID:2928
        
        C:\Windows\SysWOW64\Pokjnd32.exe
        
        C:\Windows\system32\Pokjnd32.exe
        86⤵
        
        PID:4708
        
        C:\Windows\SysWOW64\Pjpokm32.exe
        
        C:\Windows\system32\Pjpokm32.exe
        87⤵
        
        PID:2452
        
        C:\Windows\SysWOW64\Pomgcc32.exe
        
        C:\Windows\system32\Pomgcc32.exe
        88⤵
        
        PID:1664
        
        C:\Windows\SysWOW64\Pjehflie.exe
        
        C:\Windows\system32\Pjehflie.exe
        89⤵
        
        PID:4720
        
        C:\Windows\SysWOW64\Pgihppgo.exe
        
        C:\Windows\system32\Pgihppgo.exe
        90⤵
        
        PID:3372
        
        C:\Windows\SysWOW64\Qhjegh32.exe
        
        C:\Windows\system32\Qhjegh32.exe
        91⤵
        Modifies registry class
        
        PID:5252
        
        C:\Windows\SysWOW64\Qcpieamc.exe
        
        C:\Windows\system32\Qcpieamc.exe
        92⤵
        
        PID:3684
        
        C:\Windows\SysWOW64\Qhlamhkj.exe
        
        C:\Windows\system32\Qhlamhkj.exe
        93⤵
        Drops file in System32 directory
        
        PID:4908
        
        C:\Windows\SysWOW64\Qcbfjqkp.exe
        
        C:\Windows\system32\Qcbfjqkp.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1816
        
        C:\Windows\SysWOW64\Amjjcf32.exe
        
        C:\Windows\system32\Amjjcf32.exe
        95⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Agpoqoaf.exe
        
        C:\Windows\system32\Agpoqoaf.exe
        96⤵
        
        PID:2716
        
        C:\Windows\SysWOW64\Ammgifpn.exe
        
        C:\Windows\system32\Ammgifpn.exe
        97⤵
        
        PID:1204
        
        C:\Windows\SysWOW64\Afelal32.exe
        
        C:\Windows\system32\Afelal32.exe
        98⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4068
        
        C:\Windows\SysWOW64\Aqjpod32.exe
        
        C:\Windows\system32\Aqjpod32.exe
        99⤵
        
        PID:1176
        
        C:\Windows\SysWOW64\Ajcdhj32.exe
        
        C:\Windows\system32\Ajcdhj32.exe
        100⤵
        
        PID:2088
        
        C:\Windows\SysWOW64\Aqmldddb.exe
        
        C:\Windows\system32\Aqmldddb.exe
        101⤵
        
        PID:4852
        
        C:\Windows\SysWOW64\Aqoijcbo.exe
        
        C:\Windows\system32\Aqoijcbo.exe
        102⤵
        
        PID:1184
        
        C:\Windows\SysWOW64\Aflabj32.exe
        
        C:\Windows\system32\Aflabj32.exe
        103⤵
        
        PID:1800
        
        C:\Windows\SysWOW64\Bcpblo32.exe
        
        C:\Windows\system32\Bcpblo32.exe
        104⤵
        
        PID:1856
        
        C:\Windows\SysWOW64\Bjjjhifm.exe
        
        C:\Windows\system32\Bjjjhifm.exe
        105⤵
        System Location Discovery: System Language Discovery
        
        PID:1848
        
        C:\Windows\SysWOW64\Bgnkamef.exe
        
        C:\Windows\system32\Bgnkamef.exe
        106⤵
        Drops file in System32 directory
        
        PID:1260
        
        C:\Windows\SysWOW64\Bmkcjd32.exe
        
        C:\Windows\system32\Bmkcjd32.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5640
        
        C:\Windows\SysWOW64\Bfchcijo.exe
        
        C:\Windows\system32\Bfchcijo.exe
        108⤵
        
        PID:1332
        
        C:\Windows\SysWOW64\Bpkllo32.exe
        
        C:\Windows\system32\Bpkllo32.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4296
        
        C:\Windows\SysWOW64\Bjaqih32.exe
        
        C:\Windows\system32\Bjaqih32.exe
        110⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\Bqkifb32.exe
        
        C:\Windows\system32\Bqkifb32.exe
        111⤵
        Drops file in System32 directory
        
        PID:4092
        
        C:\Windows\SysWOW64\Cjcmognb.exe
        
        C:\Windows\system32\Cjcmognb.exe
        112⤵
        System Location Discovery: System Language Discovery
        
        PID:476
        
        C:\Windows\SysWOW64\Cppfgnlj.exe
        
        C:\Windows\system32\Cppfgnlj.exe
        113⤵
        
        PID:980
        
        C:\Windows\SysWOW64\Cfjnch32.exe
        
        C:\Windows\system32\Cfjnch32.exe
        114⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\Ccnnmmbp.exe
        
        C:\Windows\system32\Ccnnmmbp.exe
        115⤵
        
        PID:4116
        
        C:\Windows\SysWOW64\Cmfcfb32.exe
        
        C:\Windows\system32\Cmfcfb32.exe
        116⤵
        
        PID:3268
        
        C:\Windows\SysWOW64\Cglgck32.exe
        
        C:\Windows\system32\Cglgck32.exe
        117⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Cimckcoe.exe
        
        C:\Windows\system32\Cimckcoe.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4168
        
        C:\Windows\SysWOW64\Ccbhhl32.exe
        
        C:\Windows\system32\Ccbhhl32.exe
        119⤵
        
        PID:1220
        
        C:\Windows\SysWOW64\Cafhap32.exe
        
        C:\Windows\system32\Cafhap32.exe
        120⤵
        Drops file in System32 directory
        
        PID:3368
        
        C:\Windows\SysWOW64\Dfcqjg32.exe
        
        C:\Windows\system32\Dfcqjg32.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1244
        
        C:\Windows\SysWOW64\Dgcmdj32.exe
        
        C:\Windows\system32\Dgcmdj32.exe
        122⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Dakampio.exe
        
        C:\Windows\system32\Dakampio.exe
        123⤵
        Modifies registry class
        
        PID:5124
        
        C:\Windows\SysWOW64\Diffabgj.exe
        
        C:\Windows\system32\Diffabgj.exe
        124⤵
        
        PID:1944
        
        C:\Windows\SysWOW64\Dfjgjf32.exe
        
        C:\Windows\system32\Dfjgjf32.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3044
        
        C:\Windows\SysWOW64\Dapkho32.exe
        
        C:\Windows\system32\Dapkho32.exe
        126⤵
        
        PID:3716
        
        C:\Windows\SysWOW64\Dfmcpf32.exe
        
        C:\Windows\system32\Dfmcpf32.exe
        127⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Edqdij32.exe
        
        C:\Windows\system32\Edqdij32.exe
        128⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Epgenk32.exe
        
        C:\Windows\system32\Epgenk32.exe
        129⤵
        
        PID:2888
        
        C:\Windows\SysWOW64\Emkeho32.exe
        
        C:\Windows\system32\Emkeho32.exe
        130⤵
        
        PID:1788
        
        C:\Windows\SysWOW64\Efdjqeni.exe
        
        C:\Windows\system32\Efdjqeni.exe
        131⤵
        Modifies registry class
        
        PID:4316
        
        C:\Windows\SysWOW64\Edhjji32.exe
        
        C:\Windows\system32\Edhjji32.exe
        132⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Empococc.exe
        
        C:\Windows\system32\Empococc.exe
        133⤵
        
        PID:3032
        
        C:\Windows\SysWOW64\Ehecpgbi.exe
        
        C:\Windows\system32\Ehecpgbi.exe
        134⤵
        
        PID:2968
        
        C:\Windows\SysWOW64\Eangimij.exe
        
        C:\Windows\system32\Eangimij.exe
        135⤵
        
        PID:3064
        
        C:\Windows\SysWOW64\Fmehnn32.exe
        
        C:\Windows\system32\Fmehnn32.exe
        136⤵
        
        PID:2464
        
        C:\Windows\SysWOW64\Ffmmgceo.exe
        
        C:\Windows\system32\Ffmmgceo.exe
        137⤵
        
        PID:3480
        
        C:\Windows\SysWOW64\Fkkemble.exe
        
        C:\Windows\system32\Fkkemble.exe
        138⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Fdcjfg32.exe
        
        C:\Windows\system32\Fdcjfg32.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6216
        
        C:\Windows\SysWOW64\Fmlnomif.exe
        
        C:\Windows\system32\Fmlnomif.exe
        140⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Fibocnnj.exe
        
        C:\Windows\system32\Fibocnnj.exe
        141⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Ghdoae32.exe
        
        C:\Windows\system32\Ghdoae32.exe
        142⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Gmqgjl32.exe
        
        C:\Windows\system32\Gmqgjl32.exe
        143⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Ggilbb32.exe
        
        C:\Windows\system32\Ggilbb32.exe
        144⤵
        System Location Discovery: System Language Discovery
        
        PID:6440
        
        C:\Windows\SysWOW64\Gpaqkgba.exe
        
        C:\Windows\system32\Gpaqkgba.exe
        145⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Gkgeipah.exe
        
        C:\Windows\system32\Gkgeipah.exe
        146⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Gpcmagpo.exe
        
        C:\Windows\system32\Gpcmagpo.exe
        147⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Gkianp32.exe
        
        C:\Windows\system32\Gkianp32.exe
        148⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Gdafgefe.exe
        
        C:\Windows\system32\Gdafgefe.exe
        149⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Gjnnoldm.exe
        
        C:\Windows\system32\Gjnnoldm.exe
        150⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Hgdlnp32.exe
        
        C:\Windows\system32\Hgdlnp32.exe
        151⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Hgghdp32.exe
        
        C:\Windows\system32\Hgghdp32.exe
        152⤵
        System Location Discovery: System Language Discovery
        
        PID:6816
        
        C:\Windows\SysWOW64\Halmaiog.exe
        
        C:\Windows\system32\Halmaiog.exe
        153⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Hkeajn32.exe
        
        C:\Windows\system32\Hkeajn32.exe
        154⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Hdmecdlh.exe
        
        C:\Windows\system32\Hdmecdlh.exe
        155⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Inejlibi.exe
        
        C:\Windows\system32\Inejlibi.exe
        156⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Ignndo32.exe
        
        C:\Windows\system32\Ignndo32.exe
        157⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Iacbbh32.exe
        
        C:\Windows\system32\Iacbbh32.exe
        158⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Iklgkmop.exe
        
        C:\Windows\system32\Iklgkmop.exe
        159⤵
        System Location Discovery: System Language Discovery
        
        PID:7088
        
        C:\Windows\SysWOW64\Iqipcd32.exe
        
        C:\Windows\system32\Iqipcd32.exe
        160⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Ijadljdg.exe
        
        C:\Windows\system32\Ijadljdg.exe
        161⤵
        Modifies registry class
        
        PID:7164
        
        C:\Windows\SysWOW64\Ihbdja32.exe
        
        C:\Windows\system32\Ihbdja32.exe
        162⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Inombh32.exe
        
        C:\Windows\system32\Inombh32.exe
        163⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Iggakn32.exe
        
        C:\Windows\system32\Iggakn32.exe
        164⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Jdkadb32.exe
        
        C:\Windows\system32\Jdkadb32.exe
        165⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Jbobnf32.exe
        
        C:\Windows\system32\Jbobnf32.exe
        166⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Jglkfmmi.exe
        
        C:\Windows\system32\Jglkfmmi.exe
        167⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Jhlgpp32.exe
        
        C:\Windows\system32\Jhlgpp32.exe
        168⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Jbdliejl.exe
        
        C:\Windows\system32\Jbdliejl.exe
        169⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Jklpakam.exe
        
        C:\Windows\system32\Jklpakam.exe
        170⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Jdddjq32.exe
        
        C:\Windows\system32\Jdddjq32.exe
        171⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Knmicfnn.exe
        
        C:\Windows\system32\Knmicfnn.exe
        172⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Kibmqond.exe
        
        C:\Windows\system32\Kibmqond.exe
        173⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Kqnbea32.exe
        
        C:\Windows\system32\Kqnbea32.exe
        174⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Kkcfbj32.exe
        
        C:\Windows\system32\Kkcfbj32.exe
        175⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Kelkkpae.exe
        
        C:\Windows\system32\Kelkkpae.exe
        176⤵
        System Location Discovery: System Language Discovery
        
        PID:7104
        
        C:\Windows\SysWOW64\Kjhccf32.exe
        
        C:\Windows\system32\Kjhccf32.exe
        177⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Kijcanhl.exe
        
        C:\Windows\system32\Kijcanhl.exe
        178⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Kbbhjc32.exe
        
        C:\Windows\system32\Kbbhjc32.exe
        179⤵
        Drops file in System32 directory
        
        PID:6344
        
        C:\Windows\SysWOW64\Kgopbj32.exe
        
        C:\Windows\system32\Kgopbj32.exe
        180⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Lagekp32.exe
        
        C:\Windows\system32\Lagekp32.exe
        181⤵
        Drops file in System32 directory
        
        PID:6584
        
        C:\Windows\SysWOW64\Lgamhjja.exe
        
        C:\Windows\system32\Lgamhjja.exe
        182⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Lnkedd32.exe
        
        C:\Windows\system32\Lnkedd32.exe
        183⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Lgcjmjho.exe
        
        C:\Windows\system32\Lgcjmjho.exe
        184⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Lnmbjd32.exe
        
        C:\Windows\system32\Lnmbjd32.exe
        185⤵
        Modifies registry class
        
        PID:7072
        
        C:\Windows\SysWOW64\Ljdboe32.exe
        
        C:\Windows\system32\Ljdboe32.exe
        186⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Llcoihmb.exe
        
        C:\Windows\system32\Llcoihmb.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6412
        
        C:\Windows\SysWOW64\Lbngfbdo.exe
        
        C:\Windows\system32\Lbngfbdo.exe
        188⤵
        Drops file in System32 directory
        
        PID:6652
        
        C:\Windows\SysWOW64\Mhjpnibf.exe
        
        C:\Windows\system32\Mhjpnibf.exe
        189⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Mbpdkabl.exe
        
        C:\Windows\system32\Mbpdkabl.exe
        190⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Mlhidg32.exe
        
        C:\Windows\system32\Mlhidg32.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6428
        
        C:\Windows\SysWOW64\Maealn32.exe
        
        C:\Windows\system32\Maealn32.exe
        192⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Mjneec32.exe
        
        C:\Windows\system32\Mjneec32.exe
        193⤵
        Drops file in System32 directory
        
        PID:1340
        
        C:\Windows\SysWOW64\Mecjbl32.exe
        
        C:\Windows\system32\Mecjbl32.exe
        194⤵
        System Location Discovery: System Language Discovery
        
        PID:4640
        
        C:\Windows\SysWOW64\Mbgjlq32.exe
        
        C:\Windows\system32\Mbgjlq32.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6368
        
        C:\Windows\SysWOW64\Mjbopcip.exe
        
        C:\Windows\system32\Mjbopcip.exe
        196⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Nlbkjf32.exe
        
        C:\Windows\system32\Nlbkjf32.exe
        197⤵
        
        PID:3060
        
        C:\Windows\SysWOW64\Nifldj32.exe
        
        C:\Windows\system32\Nifldj32.exe
        198⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7200
        
        C:\Windows\SysWOW64\Nobdlqnc.exe
        
        C:\Windows\system32\Nobdlqnc.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7236
        
        C:\Windows\SysWOW64\Nihiiimi.exe
        
        C:\Windows\system32\Nihiiimi.exe
        200⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Nacmnlkd.exe
        
        C:\Windows\system32\Nacmnlkd.exe
        201⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Nogngp32.exe
        
        C:\Windows\system32\Nogngp32.exe
        202⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Nlknqd32.exe
        
        C:\Windows\system32\Nlknqd32.exe
        203⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Oeccijoh.exe
        
        C:\Windows\system32\Oeccijoh.exe
        204⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7424
        
        C:\Windows\SysWOW64\Oajcnkdl.exe
        
        C:\Windows\system32\Oajcnkdl.exe
        205⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Olphlcdb.exe
        
        C:\Windows\system32\Olphlcdb.exe
        206⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Ohfhqd32.exe
        
        C:\Windows\system32\Ohfhqd32.exe
        207⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\Oblmnmjl.exe
        
        C:\Windows\system32\Oblmnmjl.exe
        208⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Oldagc32.exe
        
        C:\Windows\system32\Oldagc32.exe
        209⤵
        System Location Discovery: System Language Discovery
        
        PID:7624
        
        C:\Windows\SysWOW64\Ohkbldfa.exe
        
        C:\Windows\system32\Ohkbldfa.exe
        210⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Phnoac32.exe
        
        C:\Windows\system32\Phnoac32.exe
        211⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Peaokh32.exe
        
        C:\Windows\system32\Peaokh32.exe
        212⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Pojccmii.exe
        
        C:\Windows\system32\Pojccmii.exe
        213⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Piphaf32.exe
        
        C:\Windows\system32\Piphaf32.exe
        214⤵
        Drops file in System32 directory
        
        PID:7812
        
        C:\Windows\SysWOW64\Pakleh32.exe
        
        C:\Windows\system32\Pakleh32.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7852
        
        C:\Windows\SysWOW64\Plpqba32.exe
        
        C:\Windows\system32\Plpqba32.exe
        216⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Pehekgmp.exe
        
        C:\Windows\system32\Pehekgmp.exe
        217⤵
        Modifies registry class
        
        PID:7928
        
        C:\Windows\SysWOW64\Pcmeek32.exe
        
        C:\Windows\system32\Pcmeek32.exe
        218⤵
        Drops file in System32 directory
        
        PID:7968
        
        C:\Windows\SysWOW64\Qlejnqbj.exe
        
        C:\Windows\system32\Qlejnqbj.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8020
        
        C:\Windows\SysWOW64\Qoecol32.exe
        
        C:\Windows\system32\Qoecol32.exe
        220⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Ahnghafl.exe
        
        C:\Windows\system32\Ahnghafl.exe
        221⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Aebhaede.exe
        
        C:\Windows\system32\Aebhaede.exe
        222⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Akoqjl32.exe
        
        C:\Windows\system32\Akoqjl32.exe
        223⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Afddge32.exe
        
        C:\Windows\system32\Afddge32.exe
        224⤵
        Modifies registry class
        
        PID:7208
        
        C:\Windows\SysWOW64\Akamol32.exe
        
        C:\Windows\system32\Akamol32.exe
        225⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Afgame32.exe
        
        C:\Windows\system32\Afgame32.exe
        226⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Akcjel32.exe
        
        C:\Windows\system32\Akcjel32.exe
        227⤵
        Drops file in System32 directory
        
        PID:7420
        
        C:\Windows\SysWOW64\Afinbdon.exe
        
        C:\Windows\system32\Afinbdon.exe
        228⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Boabkj32.exe
        
        C:\Windows\system32\Boabkj32.exe
        229⤵
        Modifies registry class
        
        PID:7584
        
        C:\Windows\SysWOW64\Bhjgdplo.exe
        
        C:\Windows\system32\Bhjgdplo.exe
        230⤵
        Drops file in System32 directory
        
        PID:7640
        
        C:\Windows\SysWOW64\Bcokah32.exe
        
        C:\Windows\system32\Bcokah32.exe
        231⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Boflfiai.exe
        
        C:\Windows\system32\Boflfiai.exe
        232⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Bhnqoo32.exe
        
        C:\Windows\system32\Bhnqoo32.exe
        233⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Bhqmdoef.exe
        
        C:\Windows\system32\Bhqmdoef.exe
        234⤵
        Modifies registry class
        
        PID:7920
        
        C:\Windows\SysWOW64\Bfenncdp.exe
        
        C:\Windows\system32\Bfenncdp.exe
        235⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Ccinggcj.exe
        
        C:\Windows\system32\Ccinggcj.exe
        236⤵
        Modifies registry class
        
        PID:8060
        
        C:\Windows\SysWOW64\Cmabpmjj.exe
        
        C:\Windows\system32\Cmabpmjj.exe
        237⤵
        System Location Discovery: System Language Discovery
        
        PID:8128
        
        C:\Windows\SysWOW64\Cbnkhcha.exe
        
        C:\Windows\system32\Cbnkhcha.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7188
        
        C:\Windows\SysWOW64\Ckfpai32.exe
        
        C:\Windows\system32\Ckfpai32.exe
        239⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7300
        
        C:\Windows\SysWOW64\Cjgpoq32.exe
        
        C:\Windows\system32\Cjgpoq32.exe
        240⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Codhgg32.exe
        
        C:\Windows\system32\Codhgg32.exe
        241⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Cfnqdale.exe
        
        C:\Windows\system32\Cfnqdale.exe
        242⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7632
        
        C:\Windows\SysWOW64\Ccbanfko.exe
        
        C:\Windows\system32\Ccbanfko.exe
        243⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Doiabgqc.exe
        
        C:\Windows\system32\Doiabgqc.exe
        244⤵
        Drops file in System32 directory
        
        PID:7824
        
        C:\Windows\SysWOW64\Djnfppqi.exe
        
        C:\Windows\system32\Djnfppqi.exe
        245⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7912
        
        C:\Windows\SysWOW64\Dbikdbnd.exe
        
        C:\Windows\system32\Dbikdbnd.exe
        246⤵
        System Location Discovery: System Language Discovery
        
        PID:7980
        
        C:\Windows\SysWOW64\Dmooak32.exe
        
        C:\Windows\system32\Dmooak32.exe
        247⤵
        System Location Discovery: System Language Discovery
        
        PID:8112
        
        C:\Windows\SysWOW64\Djcoko32.exe
        
        C:\Windows\system32\Djcoko32.exe
        248⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Dckdddcd.exe
        
        C:\Windows\system32\Dckdddcd.exe
        249⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Dmdhmj32.exe
        
        C:\Windows\system32\Dmdhmj32.exe
        250⤵
        Drops file in System32 directory
        
        PID:5104
        
        C:\Windows\SysWOW64\Dflmep32.exe
        
        C:\Windows\system32\Dflmep32.exe
        251⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Epdaneff.exe
        
        C:\Windows\system32\Epdaneff.exe
        252⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Eimegk32.exe
        
        C:\Windows\system32\Eimegk32.exe
        253⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Efafqolp.exe
        
        C:\Windows\system32\Efafqolp.exe
        254⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Elnoifjg.exe
        
        C:\Windows\system32\Elnoifjg.exe
        255⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Ejoogm32.exe
        
        C:\Windows\system32\Ejoogm32.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1088
        
        C:\Windows\SysWOW64\Ecgcpc32.exe
        
        C:\Windows\system32\Ecgcpc32.exe
        257⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Eidlhj32.exe
        
        C:\Windows\system32\Eidlhj32.exe
        258⤵
        System Location Discovery: System Language Discovery
        
        PID:8052
        
        C:\Windows\SysWOW64\Ecipeb32.exe
        
        C:\Windows\system32\Ecipeb32.exe
        259⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\Ejchbmna.exe
        
        C:\Windows\system32\Ejchbmna.exe
        260⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Fppqjcli.exe
        
        C:\Windows\system32\Fppqjcli.exe
        261⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Ffjignde.exe
        
        C:\Windows\system32\Ffjignde.exe
        262⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Flgaodbm.exe
        
        C:\Windows\system32\Flgaodbm.exe
        263⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8344
        
        C:\Windows\SysWOW64\Fjhaml32.exe
        
        C:\Windows\system32\Fjhaml32.exe
        264⤵
        Modifies registry class
        
        PID:8376
        
        C:\Windows\SysWOW64\Fbcfan32.exe
        
        C:\Windows\system32\Fbcfan32.exe
        265⤵
        System Location Discovery: System Language Discovery
        
        PID:8408
        
        C:\Windows\SysWOW64\Fllkjd32.exe
        
        C:\Windows\system32\Fllkjd32.exe
        266⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Fipkch32.exe
        
        C:\Windows\system32\Fipkch32.exe
        267⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Fdepaa32.exe
        
        C:\Windows\system32\Fdepaa32.exe
        268⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8552
        
        C:\Windows\SysWOW64\Ffclml32.exe
        
        C:\Windows\system32\Ffclml32.exe
        269⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Glpdecjb.exe
        
        C:\Windows\system32\Glpdecjb.exe
        270⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\Gjadck32.exe
        
        C:\Windows\system32\Gjadck32.exe
        271⤵
        
        PID:8648
        
        C:\Windows\SysWOW64\Glbakchp.exe
        
        C:\Windows\system32\Glbakchp.exe
        272⤵
        Modifies registry class
        
        PID:8680
        
        C:\Windows\SysWOW64\Gbmigm32.exe
        
        C:\Windows\system32\Gbmigm32.exe
        273⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\Gmbmefob.exe
        
        C:\Windows\system32\Gmbmefob.exe
        274⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8744
        
        C:\Windows\SysWOW64\Gfkbnk32.exe
        
        C:\Windows\system32\Gfkbnk32.exe
        275⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Gmdjjemp.exe
        
        C:\Windows\system32\Gmdjjemp.exe
        276⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Gkhkdjli.exe
        
        C:\Windows\system32\Gkhkdjli.exe
        277⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Gljgkb32.exe
        
        C:\Windows\system32\Gljgkb32.exe
        278⤵
        
        PID:8876
        
        C:\Windows\SysWOW64\Hlldaape.exe
        
        C:\Windows\system32\Hlldaape.exe
        279⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8908
        
        C:\Windows\SysWOW64\Hkmdoi32.exe
        
        C:\Windows\system32\Hkmdoi32.exe
        280⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Hdehho32.exe
        
        C:\Windows\system32\Hdehho32.exe
        281⤵
        System Location Discovery: System Language Discovery
        
        PID:9008
        
        C:\Windows\SysWOW64\Hlqmla32.exe
        
        C:\Windows\system32\Hlqmla32.exe
        282⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Hckeikcl.exe
        
        C:\Windows\system32\Hckeikcl.exe
        283⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Hienee32.exe
        
        C:\Windows\system32\Hienee32.exe
        284⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Hpofbobf.exe
        
        C:\Windows\system32\Hpofbobf.exe
        285⤵
        Modifies registry class
        
        PID:9136
        
        C:\Windows\SysWOW64\Hginoiic.exe
        
        C:\Windows\system32\Hginoiic.exe
        286⤵
        Modifies registry class
        
        PID:9168
        
        C:\Windows\SysWOW64\Hmbflc32.exe
        
        C:\Windows\system32\Hmbflc32.exe
        287⤵
        System Location Discovery: System Language Discovery
        
        PID:9200
        
        C:\Windows\SysWOW64\Igkkdigp.exe
        
        C:\Windows\system32\Igkkdigp.exe
        288⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\Inecac32.exe
        
        C:\Windows\system32\Inecac32.exe
        289⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Igmgji32.exe
        
        C:\Windows\system32\Igmgji32.exe
        290⤵
        
        PID:8352
        
        C:\Windows\SysWOW64\Iljpbp32.exe
        
        C:\Windows\system32\Iljpbp32.exe
        291⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Igpdph32.exe
        
        C:\Windows\system32\Igpdph32.exe
        292⤵
        Modifies registry class
        
        PID:8460
        
        C:\Windows\SysWOW64\Illmho32.exe
        
        C:\Windows\system32\Illmho32.exe
        293⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Igbaeh32.exe
        
        C:\Windows\system32\Igbaeh32.exe
        294⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Iloimopp.exe
        
        C:\Windows\system32\Iloimopp.exe
        295⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Ilafcomm.exe
        
        C:\Windows\system32\Ilafcomm.exe
        296⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Jnqbmadp.exe
        
        C:\Windows\system32\Jnqbmadp.exe
        297⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Jcmkehcg.exe
        
        C:\Windows\system32\Jcmkehcg.exe
        298⤵
        Drops file in System32 directory
        
        PID:8836
        
        C:\Windows\SysWOW64\Jjgcbb32.exe
        
        C:\Windows\system32\Jjgcbb32.exe
        299⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Jlfpnn32.exe
        
        C:\Windows\system32\Jlfpnn32.exe
        300⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Jgkdkg32.exe
        
        C:\Windows\system32\Jgkdkg32.exe
        301⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\Jpdhdl32.exe
        
        C:\Windows\system32\Jpdhdl32.exe
        302⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9060
        
        C:\Windows\SysWOW64\Jkimae32.exe
        
        C:\Windows\system32\Jkimae32.exe
        303⤵
        Drops file in System32 directory
        
        PID:9120
        
        C:\Windows\SysWOW64\Jqfejl32.exe
        
        C:\Windows\system32\Jqfejl32.exe
        304⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Jjoibadl.exe
        
        C:\Windows\system32\Jjoibadl.exe
        305⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8268
        
        C:\Windows\SysWOW64\Jqhaolli.exe
        
        C:\Windows\system32\Jqhaolli.exe
        306⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Kknfmdko.exe
        
        C:\Windows\system32\Kknfmdko.exe
        307⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Kgefae32.exe
        
        C:\Windows\system32\Kgefae32.exe
        308⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Knoonphp.exe
        
        C:\Windows\system32\Knoonphp.exe
        309⤵
        Modifies registry class
        
        PID:8736
        
        C:\Windows\SysWOW64\Kckgff32.exe
        
        C:\Windows\system32\Kckgff32.exe
        310⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Kmdlolmg.exe
        
        C:\Windows\system32\Kmdlolmg.exe
        311⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8988
        
        C:\Windows\SysWOW64\Kcndlf32.exe
        
        C:\Windows\system32\Kcndlf32.exe
        312⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Kmfhelke.exe
        
        C:\Windows\system32\Kmfhelke.exe
        313⤵
        Drops file in System32 directory
        
        PID:8204
        
        C:\Windows\SysWOW64\Kglmbd32.exe
        
        C:\Windows\system32\Kglmbd32.exe
        314⤵
        Drops file in System32 directory
        
        PID:8432
        
        C:\Windows\SysWOW64\Lqdakjak.exe
        
        C:\Windows\system32\Lqdakjak.exe
        315⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Lgnihd32.exe
        
        C:\Windows\system32\Lgnihd32.exe
        316⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Lqfnqjpi.exe
        
        C:\Windows\system32\Lqfnqjpi.exe
        317⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\Lklbnb32.exe
        
        C:\Windows\system32\Lklbnb32.exe
        318⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Lddgghfo.exe
        
        C:\Windows\system32\Lddgghfo.exe
        319⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Lnmkpm32.exe
        
        C:\Windows\system32\Lnmkpm32.exe
        320⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Lkqliaki.exe
        
        C:\Windows\system32\Lkqliaki.exe
        321⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\Lclpmdhd.exe
        
        C:\Windows\system32\Lclpmdhd.exe
        322⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Lnadkmhj.exe
        
        C:\Windows\system32\Lnadkmhj.exe
        323⤵
        
        PID:9288
        
        C:\Windows\SysWOW64\Mekmgg32.exe
        
        C:\Windows\system32\Mekmgg32.exe
        324⤵
        
        PID:9320
        
        C:\Windows\SysWOW64\Menimfnd.exe
        
        C:\Windows\system32\Menimfnd.exe
        325⤵
        Drops file in System32 directory
        
        PID:9352
        
        C:\Windows\SysWOW64\Mnfnfl32.exe
        
        C:\Windows\system32\Mnfnfl32.exe
        326⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\Mccfnc32.exe
        
        C:\Windows\system32\Mccfnc32.exe
        327⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Mnhkklbb.exe
        
        C:\Windows\system32\Mnhkklbb.exe
        328⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Maggggaf.exe
        
        C:\Windows\system32\Maggggaf.exe
        329⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\Mmnglh32.exe
        
        C:\Windows\system32\Mmnglh32.exe
        330⤵
        
        PID:9516
        
        C:\Windows\SysWOW64\Mlohjpoi.exe
        
        C:\Windows\system32\Mlohjpoi.exe
        331⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\Nmpdbh32.exe
        
        C:\Windows\system32\Nmpdbh32.exe
        332⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\Ngehoqdn.exe
        
        C:\Windows\system32\Ngehoqdn.exe
        333⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9612
        
        C:\Windows\SysWOW64\Nanmhf32.exe
        
        C:\Windows\system32\Nanmhf32.exe
        334⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Nhheepbk.exe
        
        C:\Windows\system32\Nhheepbk.exe
        335⤵
        
        PID:9676
        
        C:\Windows\SysWOW64\Ncofjaho.exe
        
        C:\Windows\system32\Ncofjaho.exe
        336⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Nmgjbg32.exe
        
        C:\Windows\system32\Nmgjbg32.exe
        337⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Njkklk32.exe
        
        C:\Windows\system32\Njkklk32.exe
        338⤵
        Modifies registry class
        
        PID:9772
        
        C:\Windows\SysWOW64\Ndcoeq32.exe
        
        C:\Windows\system32\Ndcoeq32.exe
        339⤵
        Drops file in System32 directory
        
        PID:9804
        
        C:\Windows\SysWOW64\Onicbi32.exe
        
        C:\Windows\system32\Onicbi32.exe
        340⤵
        Drops file in System32 directory
        
        PID:9836
        
        C:\Windows\SysWOW64\Olmdln32.exe
        
        C:\Windows\system32\Olmdln32.exe
        341⤵
        Modifies registry class
        
        PID:9872
        
        C:\Windows\SysWOW64\Oajmdd32.exe
        
        C:\Windows\system32\Oajmdd32.exe
        342⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\Oloaamqf.exe
        
        C:\Windows\system32\Oloaamqf.exe
        343⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\Oegejc32.exe
        
        C:\Windows\system32\Oegejc32.exe
        344⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\Oopjchnh.exe
        
        C:\Windows\system32\Oopjchnh.exe
        345⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\Oejbpb32.exe
        
        C:\Windows\system32\Oejbpb32.exe
        346⤵
        
        PID:10036
        
        C:\Windows\SysWOW64\Oaqbdc32.exe
        
        C:\Windows\system32\Oaqbdc32.exe
        347⤵
        
        PID:10068
        
        C:\Windows\SysWOW64\Pkigmiai.exe
        
        C:\Windows\system32\Pkigmiai.exe
        348⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\Pdalfo32.exe
        
        C:\Windows\system32\Pdalfo32.exe
        349⤵
        
        PID:10132
        
        C:\Windows\SysWOW64\Pogpcghp.exe
        
        C:\Windows\system32\Pogpcghp.exe
        350⤵
        
        PID:10164
        
        C:\Windows\SysWOW64\Peahpa32.exe
        
        C:\Windows\system32\Peahpa32.exe
        351⤵
        
        PID:10196
        
        C:\Windows\SysWOW64\Poimigfm.exe
        
        C:\Windows\system32\Poimigfm.exe
        352⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Pecefa32.exe
        
        C:\Windows\system32\Pecefa32.exe
        353⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Plmmbkdf.exe
        
        C:\Windows\system32\Plmmbkdf.exe
        354⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\Pajekb32.exe
        
        C:\Windows\system32\Pajekb32.exe
        355⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\Pkbjchio.exe
        
        C:\Windows\system32\Pkbjchio.exe
        356⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\Palbpb32.exe
        
        C:\Windows\system32\Palbpb32.exe
        357⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9508
        
        C:\Windows\SysWOW64\Pdkolm32.exe
        
        C:\Windows\system32\Pdkolm32.exe
        358⤵
        
        PID:9572
        
        C:\Windows\SysWOW64\Qkegiggl.exe
        
        C:\Windows\system32\Qkegiggl.exe
        359⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\Qejkfp32.exe
        
        C:\Windows\system32\Qejkfp32.exe
        360⤵
        System Location Discovery: System Language Discovery
        
        PID:9700
        
        C:\Windows\SysWOW64\Qldccjno.exe
        
        C:\Windows\system32\Qldccjno.exe
        361⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Qmepkb32.exe
        
        C:\Windows\system32\Qmepkb32.exe
        362⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9860
        
        C:\Windows\SysWOW64\Alfpijll.exe
        
        C:\Windows\system32\Alfpijll.exe
        363⤵
        
        PID:9948
        
        C:\Windows\SysWOW64\Aachaa32.exe
        
        C:\Windows\system32\Aachaa32.exe
        364⤵
        
        PID:10012
        
        C:\Windows\SysWOW64\Aklmjfad.exe
        
        C:\Windows\system32\Aklmjfad.exe
        365⤵
        System Location Discovery: System Language Discovery
        
        PID:10076
        
        C:\Windows\SysWOW64\Aafefq32.exe
        
        C:\Windows\system32\Aafefq32.exe
        366⤵
        Modifies registry class
        
        PID:10140
        
        C:\Windows\SysWOW64\Ahpmckpn.exe
        
        C:\Windows\system32\Ahpmckpn.exe
        367⤵
        System Location Discovery: System Language Discovery
        
        PID:10204
        
        C:\Windows\SysWOW64\Aahblp32.exe
        
        C:\Windows\system32\Aahblp32.exe
        368⤵
        
        PID:9280
        
        C:\Windows\SysWOW64\Ahbjij32.exe
        
        C:\Windows\system32\Ahbjij32.exe
        369⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9404
        
        C:\Windows\SysWOW64\Aolbedeh.exe
        
        C:\Windows\system32\Aolbedeh.exe
        370⤵
        
        PID:9524
        
        C:\Windows\SysWOW64\Aefjbo32.exe
        
        C:\Windows\system32\Aefjbo32.exe
        371⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9652
        
        C:\Windows\SysWOW64\Alpboida.exe
        
        C:\Windows\system32\Alpboida.exe
        372⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Aamkgpbi.exe
        
        C:\Windows\system32\Aamkgpbi.exe
        373⤵
        Drops file in System32 directory
        
        PID:364
        
        C:\Windows\SysWOW64\Blbodh32.exe
        
        C:\Windows\system32\Blbodh32.exe
        374⤵
        System Location Discovery: System Language Discovery
        
        PID:9996
        
        C:\Windows\SysWOW64\Baohmo32.exe
        
        C:\Windows\system32\Baohmo32.exe
        375⤵
        Modifies registry class
        
        PID:10056
        
        C:\Windows\SysWOW64\Bldljh32.exe
        
        C:\Windows\system32\Bldljh32.exe
        376⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\Baadbo32.exe
        
        C:\Windows\system32\Baadbo32.exe
        377⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:9308
        
        C:\Windows\SysWOW64\Blgiphni.exe
        
        C:\Windows\system32\Blgiphni.exe
        378⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Bnhegp32.exe
        
        C:\Windows\system32\Bnhegp32.exe
        379⤵
        
        PID:124
        
        C:\Windows\SysWOW64\Bdbndjld.exe
        
        C:\Windows\system32\Bdbndjld.exe
        380⤵
        Modifies registry class
        
        PID:9992
        
        C:\Windows\SysWOW64\Bohbackj.exe
        
        C:\Windows\system32\Bohbackj.exe
        381⤵
        
        PID:10124
        
        C:\Windows\SysWOW64\Beajnm32.exe
        
        C:\Windows\system32\Beajnm32.exe
        382⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\Bllbkg32.exe
        
        C:\Windows\system32\Bllbkg32.exe
        383⤵
        
        PID:260
        
        C:\Windows\SysWOW64\Bahkcn32.exe
        
        C:\Windows\system32\Bahkcn32.exe
        384⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Chbcphph.exe
        
        C:\Windows\system32\Chbcphph.exe
        385⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\Cnokhonp.exe
        
        C:\Windows\system32\Cnokhonp.exe
        386⤵
        System Location Discovery: System Language Discovery
        
        PID:3428
        
        C:\Windows\SysWOW64\Chepehne.exe
        
        C:\Windows\system32\Chepehne.exe
        387⤵
        System Location Discovery: System Language Discovery
        
        PID:2044
        
        C:\Windows\SysWOW64\Ckclacmi.exe
        
        C:\Windows\system32\Ckclacmi.exe
        388⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9800
        
        C:\Windows\SysWOW64\Cfipol32.exe
        
        C:\Windows\system32\Cfipol32.exe
        389⤵
        Modifies registry class
        
        PID:10252
        
        C:\Windows\SysWOW64\Coadgacp.exe
        
        C:\Windows\system32\Coadgacp.exe
        390⤵
        
        PID:10292
        
        C:\Windows\SysWOW64\Cdnmphag.exe
        
        C:\Windows\system32\Cdnmphag.exe
        391⤵
        
        PID:10324
        
        C:\Windows\SysWOW64\Cleeafbi.exe
        
        C:\Windows\system32\Cleeafbi.exe
        392⤵
        Drops file in System32 directory
        
        PID:10372
        
        C:\Windows\SysWOW64\Cnfahn32.exe
        
        C:\Windows\system32\Cnfahn32.exe
        393⤵
        
        PID:10440
        
        C:\Windows\SysWOW64\Cdpjeh32.exe
        
        C:\Windows\system32\Cdpjeh32.exe
        394⤵
        
        PID:10472
        
        C:\Windows\SysWOW64\Cofnba32.exe
        
        C:\Windows\system32\Cofnba32.exe
        395⤵
        Modifies registry class
        
        PID:10504
        
        C:\Windows\SysWOW64\Dbdjol32.exe
        
        C:\Windows\system32\Dbdjol32.exe
        396⤵
        Drops file in System32 directory
        
        PID:10544
        
        C:\Windows\SysWOW64\Dhnbkfek.exe
        
        C:\Windows\system32\Dhnbkfek.exe
        397⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10576
        
        C:\Windows\SysWOW64\Dohkhq32.exe
        
        C:\Windows\system32\Dohkhq32.exe
        398⤵
        
        PID:10608
        
        C:\Windows\SysWOW64\Dfbcek32.exe
        
        C:\Windows\system32\Dfbcek32.exe
        399⤵
        System Location Discovery: System Language Discovery
        
        PID:10640
        
        C:\Windows\SysWOW64\Dmlkaela.exe
        
        C:\Windows\system32\Dmlkaela.exe
        400⤵
        System Location Discovery: System Language Discovery
        
        PID:10680
        
        C:\Windows\SysWOW64\Dnmhim32.exe
        
        C:\Windows\system32\Dnmhim32.exe
        401⤵
        
        PID:10720
        
        C:\Windows\SysWOW64\Diclff32.exe
        
        C:\Windows\system32\Diclff32.exe
        402⤵
        Drops file in System32 directory
        
        PID:10752
        
        C:\Windows\SysWOW64\Dbkpokhf.exe
        
        C:\Windows\system32\Dbkpokhf.exe
        403⤵
        System Location Discovery: System Language Discovery
        
        PID:10784
        
        C:\Windows\SysWOW64\Dieilepc.exe
        
        C:\Windows\system32\Dieilepc.exe
        404⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10820
        
        C:\Windows\SysWOW64\Dbnmek32.exe
        
        C:\Windows\system32\Dbnmek32.exe
        405⤵
        
        PID:10860
        
        C:\Windows\SysWOW64\Digeaenp.exe
        
        C:\Windows\system32\Digeaenp.exe
        406⤵
        
        PID:10896
        
        C:\Windows\SysWOW64\Dndnjllg.exe
        
        C:\Windows\system32\Dndnjllg.exe
        407⤵
        Modifies registry class
        
        PID:10928
        
        C:\Windows\SysWOW64\Eijbge32.exe
        
        C:\Windows\system32\Eijbge32.exe
        408⤵
        
        PID:10968
        
        C:\Windows\SysWOW64\Eodjdocj.exe
        
        C:\Windows\system32\Eodjdocj.exe
        409⤵
        System Location Discovery: System Language Discovery
        
        PID:11000
        
        C:\Windows\SysWOW64\Eilomd32.exe
        
        C:\Windows\system32\Eilomd32.exe
        410⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11040
        
        C:\Windows\SysWOW64\Enigek32.exe
        
        C:\Windows\system32\Enigek32.exe
        411⤵
        
        PID:11096
        
        C:\Windows\SysWOW64\Emjgcc32.exe
        
        C:\Windows\system32\Emjgcc32.exe
        412⤵
        
        PID:11216
        
        C:\Windows\SysWOW64\Ebgpkj32.exe
        
        C:\Windows\system32\Ebgpkj32.exe
        413⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\Ekoddodi.exe
        
        C:\Windows\system32\Ekoddodi.exe
        414⤵
        
        PID:4356
        
        C:\Windows\SysWOW64\Ebimqi32.exe
        
        C:\Windows\system32\Ebimqi32.exe
        415⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10276
        
        C:\Windows\SysWOW64\Emoanbll.exe
        
        C:\Windows\system32\Emoanbll.exe
        416⤵
        Modifies registry class
        
        PID:10348
        
        C:\Windows\SysWOW64\Fnpmej32.exe
        
        C:\Windows\system32\Fnpmej32.exe
        417⤵
        Modifies registry class
        
        PID:10368
        
        C:\Windows\SysWOW64\Ffgegh32.exe
        
        C:\Windows\system32\Ffgegh32.exe
        418⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10424
        
        C:\Windows\SysWOW64\Fmancbji.exe
        
        C:\Windows\system32\Fmancbji.exe
        419⤵
        Modifies registry class
        
        PID:10468
        
        C:\Windows\SysWOW64\Fbnflihq.exe
        
        C:\Windows\system32\Fbnflihq.exe
        420⤵
        
        PID:10532
        
        C:\Windows\SysWOW64\Fihnhc32.exe
        
        C:\Windows\system32\Fihnhc32.exe
        421⤵
        
        PID:10572
        
        C:\Windows\SysWOW64\Fbpcah32.exe
        
        C:\Windows\system32\Fbpcah32.exe
        422⤵
        Modifies registry class
        
        PID:10656
        
        C:\Windows\SysWOW64\Fijknbmk.exe
        
        C:\Windows\system32\Fijknbmk.exe
        423⤵
        
        PID:10688
        
        C:\Windows\SysWOW64\Fngcfikb.exe
        
        C:\Windows\system32\Fngcfikb.exe
        424⤵
        
        PID:10740
        
        C:\Windows\SysWOW64\Fealcc32.exe
        
        C:\Windows\system32\Fealcc32.exe
        425⤵
        
        PID:10804
        
        C:\Windows\SysWOW64\Fmhcda32.exe
        
        C:\Windows\system32\Fmhcda32.exe
        426⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Fnipliip.exe
        
        C:\Windows\system32\Fnipliip.exe
        427⤵
        
        PID:10884
        
        C:\Windows\SysWOW64\Fmjqjqao.exe
        
        C:\Windows\system32\Fmjqjqao.exe
        428⤵
        System Location Discovery: System Language Discovery
        
        PID:10936
        
        C:\Windows\SysWOW64\Gfcebf32.exe
        
        C:\Windows\system32\Gfcebf32.exe
        429⤵
        
        PID:10992
        
        C:\Windows\SysWOW64\Glpmkm32.exe
        
        C:\Windows\system32\Glpmkm32.exe
        430⤵
        
        PID:3540
        
        C:\Windows\SysWOW64\Gpnfak32.exe
        
        C:\Windows\system32\Gpnfak32.exe
        431⤵
        Modifies registry class
        
        PID:11204
        
        C:\Windows\SysWOW64\Gfgnnedj.exe
        
        C:\Windows\system32\Gfgnnedj.exe
        432⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Gldgflba.exe
        
        C:\Windows\system32\Gldgflba.exe
        433⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2924
        
        C:\Windows\SysWOW64\Gbnobf32.exe
        
        C:\Windows\system32\Gbnobf32.exe
        434⤵
        Modifies registry class
        
        PID:4312
        
        C:\Windows\SysWOW64\Gihgoq32.exe
        
        C:\Windows\system32\Gihgoq32.exe
        435⤵
        
        PID:10384
        
        C:\Windows\SysWOW64\Gpbplkhh.exe
        
        C:\Windows\system32\Gpbplkhh.exe
        436⤵
        
        PID:10464
        
        C:\Windows\SysWOW64\Gflhie32.exe
        
        C:\Windows\system32\Gflhie32.exe
        437⤵
        System Location Discovery: System Language Discovery
        
        PID:10564
        
        C:\Windows\SysWOW64\Hoglmg32.exe
        
        C:\Windows\system32\Hoglmg32.exe
        438⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1568
        
        C:\Windows\SysWOW64\Himqjpme.exe
        
        C:\Windows\system32\Himqjpme.exe
        439⤵
        System Location Discovery: System Language Discovery
        
        PID:1296
        
        C:\Windows\SysWOW64\Hfaaddlo.exe
        
        C:\Windows\system32\Hfaaddlo.exe
        440⤵
        
        PID:10776
        
        C:\Windows\SysWOW64\Hmkiqn32.exe
        
        C:\Windows\system32\Hmkiqn32.exe
        441⤵
        
        PID:10852
        
        C:\Windows\SysWOW64\Holfhfij.exe
        
        C:\Windows\system32\Holfhfij.exe
        442⤵
        
        PID:10888
        
        C:\Windows\SysWOW64\Hiajeoip.exe
        
        C:\Windows\system32\Hiajeoip.exe
        443⤵
        Drops file in System32 directory
        
        PID:1624
        
        C:\Windows\SysWOW64\Hplbbipm.exe
        
        C:\Windows\system32\Hplbbipm.exe
        444⤵
        
        PID:5044
        
        C:\Windows\SysWOW64\Hidgko32.exe
        
        C:\Windows\system32\Hidgko32.exe
        445⤵
        
        PID:3884
        
        C:\Windows\SysWOW64\Hoaocf32.exe
        
        C:\Windows\system32\Hoaocf32.exe
        446⤵
        
        PID:11104
        
        C:\Windows\SysWOW64\Imbpam32.exe
        
        C:\Windows\system32\Imbpam32.exe
        447⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\Ibadoc32.exe
        
        C:\Windows\system32\Ibadoc32.exe
        448⤵
        Modifies registry class
        
        PID:10364
        
        C:\Windows\SysWOW64\Iikmlnae.exe
        
        C:\Windows\system32\Iikmlnae.exe
        449⤵
        Drops file in System32 directory
        
        PID:608
        
        C:\Windows\SysWOW64\Igomeb32.exe
        
        C:\Windows\system32\Igomeb32.exe
        450⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\Illfmi32.exe
        
        C:\Windows\system32\Illfmi32.exe
        451⤵
        
        PID:708
        
        C:\Windows\SysWOW64\Igajka32.exe
        
        C:\Windows\system32\Igajka32.exe
        452⤵
        Modifies registry class
        
        PID:1732
        
        C:\Windows\SysWOW64\Imkbglei.exe
        
        C:\Windows\system32\Imkbglei.exe
        453⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\Ichkpb32.exe
        
        C:\Windows\system32\Ichkpb32.exe
        454⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\Iibclmkn.exe
        
        C:\Windows\system32\Iibclmkn.exe
        455⤵
        
        PID:2376
        
        C:\Windows\SysWOW64\Jplkig32.exe
        
        C:\Windows\system32\Jplkig32.exe
        456⤵
        
        PID:11088
        
        C:\Windows\SysWOW64\Jgfcfajg.exe
        
        C:\Windows\system32\Jgfcfajg.exe
        457⤵
        
        PID:11128
        
        C:\Windows\SysWOW64\Jlclnhho.exe
        
        C:\Windows\system32\Jlclnhho.exe
        458⤵
        
        PID:11180
        
        C:\Windows\SysWOW64\Jghpkq32.exe
        
        C:\Windows\system32\Jghpkq32.exe
        459⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Jmbhhkoa.exe
        
        C:\Windows\system32\Jmbhhkoa.exe
        460⤵
        Drops file in System32 directory
        
        PID:10248
        
        C:\Windows\SysWOW64\Jpqedfne.exe
        
        C:\Windows\system32\Jpqedfne.exe
        461⤵
        
        PID:5024
        
        C:\Windows\SysWOW64\Jenmlmll.exe
        
        C:\Windows\system32\Jenmlmll.exe
        462⤵
        
        PID:10432
        
        C:\Windows\SysWOW64\Jpcajflb.exe
        
        C:\Windows\system32\Jpcajflb.exe
        463⤵
        
        PID:3660
        
        C:\Windows\SysWOW64\Jgmjfpco.exe
        
        C:\Windows\system32\Jgmjfpco.exe
        464⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3184
        
        C:\Windows\SysWOW64\Jljbogaf.exe
        
        C:\Windows\system32\Jljbogaf.exe
        465⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5892
        
        C:\Windows\SysWOW64\Kllodfpd.exe
        
        C:\Windows\system32\Kllodfpd.exe
        466⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Kjponk32.exe
        
        C:\Windows\system32\Kjponk32.exe
        467⤵
        
        PID:2368
        
        C:\Windows\SysWOW64\Kpjgjefj.exe
        
        C:\Windows\system32\Kpjgjefj.exe
        468⤵
        
        PID:10448
        
        C:\Windows\SysWOW64\Kfgpblda.exe
        
        C:\Windows\system32\Kfgpblda.exe
        469⤵
        Modifies registry class
        
        PID:3792
        
        C:\Windows\SysWOW64\Klahof32.exe
        
        C:\Windows\system32\Klahof32.exe
        470⤵
        
        PID:3836
        
        C:\Windows\SysWOW64\Koodka32.exe
        
        C:\Windows\system32\Koodka32.exe
        471⤵
        
        PID:568
        
        C:\Windows\SysWOW64\Kfimhkbo.exe
        
        C:\Windows\system32\Kfimhkbo.exe
        472⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1408
        
        C:\Windows\SysWOW64\Klceeejl.exe
        
        C:\Windows\system32\Klceeejl.exe
        473⤵
        
        PID:624
        
        C:\Windows\SysWOW64\Kcmmap32.exe
        
        C:\Windows\system32\Kcmmap32.exe
        474⤵
        Drops file in System32 directory
        
        PID:5240
        
        C:\Windows\SysWOW64\Kjgenjhe.exe
        
        C:\Windows\system32\Kjgenjhe.exe
        475⤵
        
        PID:4172
        
        C:\Windows\SysWOW64\Kleajegi.exe
        
        C:\Windows\system32\Kleajegi.exe
        476⤵
        
        PID:2396
        
        C:\Windows\SysWOW64\Kcpjgo32.exe
        
        C:\Windows\system32\Kcpjgo32.exe
        477⤵
        System Location Discovery: System Language Discovery
        
        PID:6112
        
        C:\Windows\SysWOW64\Lfnfck32.exe
        
        C:\Windows\system32\Lfnfck32.exe
        478⤵
        
        PID:5048
        
        C:\Windows\SysWOW64\Llhnpe32.exe
        
        C:\Windows\system32\Llhnpe32.exe
        479⤵
        
        PID:3348
        
        C:\Windows\SysWOW64\Lgmbmn32.exe
        
        C:\Windows\system32\Lgmbmn32.exe
        480⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4240
        
        C:\Windows\SysWOW64\Ljloii32.exe
        
        C:\Windows\system32\Ljloii32.exe
        481⤵
        
        PID:4340
        
        C:\Windows\SysWOW64\Loigap32.exe
        
        C:\Windows\system32\Loigap32.exe
        482⤵
        
        PID:4920
        
        C:\Windows\SysWOW64\Ljnloi32.exe
        
        C:\Windows\system32\Ljnloi32.exe
        483⤵
        System Location Discovery: System Language Discovery
        
        PID:4824
        
        C:\Windows\SysWOW64\Lokdgpqe.exe
        
        C:\Windows\system32\Lokdgpqe.exe
        484⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\Lmodqdpo.exe
        
        C:\Windows\system32\Lmodqdpo.exe
        485⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1744
        
        C:\Windows\SysWOW64\Lcimmn32.exe
        
        C:\Windows\system32\Lcimmn32.exe
        486⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5980
        
        C:\Windows\SysWOW64\Mfjfoidl.exe
        
        C:\Windows\system32\Mfjfoidl.exe
        487⤵
        System Location Discovery: System Language Discovery
        
        PID:2296
        
        C:\Windows\SysWOW64\Mmcnlc32.exe
        
        C:\Windows\system32\Mmcnlc32.exe
        488⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4124
        
        C:\Windows\SysWOW64\Mgibil32.exe
        
        C:\Windows\system32\Mgibil32.exe
        489⤵
        
        PID:11012
        
        C:\Windows\SysWOW64\Mncjffbl.exe
        
        C:\Windows\system32\Mncjffbl.exe
        490⤵
        
        PID:11164
        
        C:\Windows\SysWOW64\Mcpcnm32.exe
        
        C:\Windows\system32\Mcpcnm32.exe
        491⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\Mnegkf32.exe
        
        C:\Windows\system32\Mnegkf32.exe
        492⤵
        
        PID:2504
        
        C:\Windows\SysWOW64\Mogccnfg.exe
        
        C:\Windows\system32\Mogccnfg.exe
        493⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Mfqlph32.exe
        
        C:\Windows\system32\Mfqlph32.exe
        494⤵
        Modifies registry class
        
        PID:11076
        
        C:\Windows\SysWOW64\Mqfpma32.exe
        
        C:\Windows\system32\Mqfpma32.exe
        495⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Mcdlil32.exe
        
        C:\Windows\system32\Mcdlil32.exe
        496⤵
        System Location Discovery: System Language Discovery
        
        PID:3728
        
        C:\Windows\SysWOW64\Mnjqfeld.exe
        
        C:\Windows\system32\Mnjqfeld.exe
        497⤵
        
        PID:3536
        
        C:\Windows\SysWOW64\Mokmnm32.exe
        
        C:\Windows\system32\Mokmnm32.exe
        498⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Ngbeok32.exe
        
        C:\Windows\system32\Ngbeok32.exe
        499⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Nqkihpie.exe
        
        C:\Windows\system32\Nqkihpie.exe
        500⤵
        
        PID:2480
        
        C:\Windows\SysWOW64\Ngeaej32.exe
        
        C:\Windows\system32\Ngeaej32.exe
        501⤵
        
        PID:4472
        
        C:\Windows\SysWOW64\Nnojad32.exe
        
        C:\Windows\system32\Nnojad32.exe
        502⤵
        Modifies registry class
        
        PID:1656
        
        C:\Windows\SysWOW64\Nppfimnm.exe
        
        C:\Windows\system32\Nppfimnm.exe
        503⤵
        
        PID:3512
        
        C:\Windows\SysWOW64\Nfjofg32.exe
        
        C:\Windows\system32\Nfjofg32.exe
        504⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4520
        
        C:\Windows\SysWOW64\Nmdgbamf.exe
        
        C:\Windows\system32\Nmdgbamf.exe
        505⤵
        Drops file in System32 directory
        
        PID:1388
        
        C:\Windows\SysWOW64\Ncnook32.exe
        
        C:\Windows\system32\Ncnook32.exe
        506⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11344
        
        C:\Windows\SysWOW64\Npepdl32.exe
        
        C:\Windows\system32\Npepdl32.exe
        507⤵
        
        PID:11424
        
        C:\Windows\SysWOW64\Nmipnp32.exe
        
        C:\Windows\system32\Nmipnp32.exe
        508⤵
        
        PID:11460
        
        C:\Windows\SysWOW64\Ogndki32.exe
        
        C:\Windows\system32\Ogndki32.exe
        509⤵
        
        PID:11492
        
        C:\Windows\SysWOW64\Onhmhc32.exe
        
        C:\Windows\system32\Onhmhc32.exe
        510⤵
        
        PID:11532
        
        C:\Windows\SysWOW64\Oafido32.exe
        
        C:\Windows\system32\Oafido32.exe
        511⤵
        System Location Discovery: System Language Discovery
        
        PID:11564
        
        C:\Windows\SysWOW64\Ogqaqigd.exe
        
        C:\Windows\system32\Ogqaqigd.exe
        512⤵
        
        PID:11604
        
        C:\Windows\SysWOW64\Oaifin32.exe
        
        C:\Windows\system32\Oaifin32.exe
        513⤵
        
        PID:11644
        
        C:\Windows\SysWOW64\Ogcnfheb.exe
        
        C:\Windows\system32\Ogcnfheb.exe
        514⤵
        
        PID:11684
        
        C:\Windows\SysWOW64\Oakbonkb.exe
        
        C:\Windows\system32\Oakbonkb.exe
        515⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11724
        
        C:\Windows\SysWOW64\Ofhkgeij.exe
        
        C:\Windows\system32\Ofhkgeij.exe
        516⤵
        
        PID:11756
        
        C:\Windows\SysWOW64\Opqopj32.exe
        
        C:\Windows\system32\Opqopj32.exe
        517⤵
        
        PID:11804
        
        C:\Windows\SysWOW64\Pndlca32.exe
        
        C:\Windows\system32\Pndlca32.exe
        518⤵
        Modifies registry class
        
        PID:11840
        
        C:\Windows\SysWOW64\Ppeikjle.exe
        
        C:\Windows\system32\Ppeikjle.exe
        519⤵
        
        PID:11876
        
        C:\Windows\SysWOW64\Pfoahd32.exe
        
        C:\Windows\system32\Pfoahd32.exe
        520⤵
        
        PID:11908
        
        C:\Windows\SysWOW64\Ppgeqijb.exe
        
        C:\Windows\system32\Ppgeqijb.exe
        521⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11948
        
        C:\Windows\SysWOW64\Pjmjnb32.exe
        
        C:\Windows\system32\Pjmjnb32.exe
        522⤵
        
        PID:12088
        
        C:\Windows\SysWOW64\Phajgf32.exe
        
        C:\Windows\system32\Phajgf32.exe
        523⤵
        Drops file in System32 directory
        
        PID:12132
        
        C:\Windows\SysWOW64\Pmnbpm32.exe
        
        C:\Windows\system32\Pmnbpm32.exe
        524⤵
        Drops file in System32 directory
        
        PID:12164
        
        C:\Windows\SysWOW64\Pffghc32.exe
        
        C:\Windows\system32\Pffghc32.exe
        525⤵
        
        PID:12196
        
        C:\Windows\SysWOW64\Pmpoemef.exe
        
        C:\Windows\system32\Pmpoemef.exe
        526⤵
        
        PID:12236
        
        C:\Windows\SysWOW64\Qdjgbg32.exe
        
        C:\Windows\system32\Qdjgbg32.exe
        527⤵
        Drops file in System32 directory
        
        PID:12268
        
        C:\Windows\SysWOW64\Qfhdnb32.exe
        
        C:\Windows\system32\Qfhdnb32.exe
        528⤵
        Modifies registry class
        
        PID:2468
        
        C:\Windows\SysWOW64\Qmblkmcd.exe
        
        C:\Windows\system32\Qmblkmcd.exe
        529⤵
        System Location Discovery: System Language Discovery
        
        PID:11304
        
        C:\Windows\SysWOW64\Qdldgg32.exe
        
        C:\Windows\system32\Qdldgg32.exe
        530⤵
        Modifies registry class
        
        PID:11296
        
        C:\Windows\SysWOW64\Qobhepjf.exe
        
        C:\Windows\system32\Qobhepjf.exe
        531⤵
        
        PID:11368
        
        C:\Windows\SysWOW64\Apcemh32.exe
        
        C:\Windows\system32\Apcemh32.exe
        532⤵
        
        PID:11392
        
        C:\Windows\SysWOW64\Afmmibga.exe
        
        C:\Windows\system32\Afmmibga.exe
        533⤵
        
        PID:11432
        
        C:\Windows\SysWOW64\Amgefl32.exe
        
        C:\Windows\system32\Amgefl32.exe
        534⤵
        
        PID:11500
        
        C:\Windows\SysWOW64\Adanbffk.exe
        
        C:\Windows\system32\Adanbffk.exe
        535⤵
        
        PID:11552
        
        C:\Windows\SysWOW64\Akkfop32.exe
        
        C:\Windows\system32\Akkfop32.exe
        536⤵
        
        PID:11600
        
        C:\Windows\SysWOW64\Aaenlj32.exe
        
        C:\Windows\system32\Aaenlj32.exe
        537⤵
        
        PID:11664
        
        C:\Windows\SysWOW64\Akmbepke.exe
        
        C:\Windows\system32\Akmbepke.exe
        538⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11704
        
        C:\Windows\SysWOW64\Aagkaj32.exe
        
        C:\Windows\system32\Aagkaj32.exe
        539⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Agdcja32.exe
        
        C:\Windows\system32\Agdcja32.exe
        540⤵
        
        PID:3092
        
        C:\Windows\SysWOW64\Amnlfk32.exe
        
        C:\Windows\system32\Amnlfk32.exe
        541⤵
        Modifies registry class
        
        PID:11864
        
        C:\Windows\SysWOW64\Agfpoqog.exe
        
        C:\Windows\system32\Agfpoqog.exe
        542⤵
        
        PID:12072
        
        C:\Windows\SysWOW64\Bdjqienq.exe
        
        C:\Windows\system32\Bdjqienq.exe
        543⤵
        
        PID:12084
        
        C:\Windows\SysWOW64\Bkdieo32.exe
        
        C:\Windows\system32\Bkdieo32.exe
        544⤵
        
        PID:3696
        
        C:\Windows\SysWOW64\Bpaanfce.exe
        
        C:\Windows\system32\Bpaanfce.exe
        545⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Bgkijp32.exe
        
        C:\Windows\system32\Bgkijp32.exe
        546⤵
        
        PID:1600
        
        C:\Windows\SysWOW64\Bmeagjbo.exe
        
        C:\Windows\system32\Bmeagjbo.exe
        547⤵
        
        PID:3300
        
        C:\Windows\SysWOW64\Bdojdd32.exe
        
        C:\Windows\system32\Bdojdd32.exe
        548⤵
        
        PID:11288
        
        C:\Windows\SysWOW64\Bngnmjql.exe
        
        C:\Windows\system32\Bngnmjql.exe
        549⤵
        
        PID:3340
        
        C:\Windows\SysWOW64\Bgpceogl.exe
        
        C:\Windows\system32\Bgpceogl.exe
        550⤵
        
        PID:11404
        
        C:\Windows\SysWOW64\Bnjkbi32.exe
        
        C:\Windows\system32\Bnjkbi32.exe
        551⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Bddcocff.exe
        
        C:\Windows\system32\Bddcocff.exe
        552⤵
        
        PID:11516
        
        C:\Windows\SysWOW64\Coigllel.exe
        
        C:\Windows\system32\Coigllel.exe
        553⤵
        
        PID:11584
        
        C:\Windows\SysWOW64\Cpkddd32.exe
        
        C:\Windows\system32\Cpkddd32.exe
        554⤵
        System Location Discovery: System Language Discovery
        
        PID:11640
        
        C:\Windows\SysWOW64\Cgdlqo32.exe
        
        C:\Windows\system32\Cgdlqo32.exe
        555⤵
        Modifies registry class
        
        PID:11692
        
        C:\Windows\SysWOW64\Cnodmijd.exe
        
        C:\Windows\system32\Cnodmijd.exe
        556⤵
        Modifies registry class
        
        PID:11764
        
        C:\Windows\SysWOW64\Cdhmjc32.exe
        
        C:\Windows\system32\Cdhmjc32.exe
        557⤵
        System Location Discovery: System Language Discovery
        
        PID:2320
        
        C:\Windows\SysWOW64\Ckbegmin.exe
        
        C:\Windows\system32\Ckbegmin.exe
        558⤵
        
        PID:11848
        
        C:\Windows\SysWOW64\Cponodge.exe
        
        C:\Windows\system32\Cponodge.exe
        559⤵
        Drops file in System32 directory
        
        PID:11940
        
        C:\Windows\SysWOW64\Chfepa32.exe
        
        C:\Windows\system32\Chfepa32.exe
        560⤵
        
        PID:11980
        
        C:\Windows\SysWOW64\Cncnhh32.exe
        
        C:\Windows\system32\Cncnhh32.exe
        561⤵
        
        PID:4224
        
        C:\Windows\SysWOW64\Chkokq32.exe
        
        C:\Windows\system32\Chkokq32.exe
        562⤵
        
        PID:1092
        
        C:\Windows\SysWOW64\Dnhgcgbi.exe
        
        C:\Windows\system32\Dnhgcgbi.exe
        563⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11320
        
        C:\Windows\SysWOW64\Ddbppa32.exe
        
        C:\Windows\system32\Ddbppa32.exe
        564⤵
        
        PID:692
        
        C:\Windows\SysWOW64\Dklhmlac.exe
        
        C:\Windows\system32\Dklhmlac.exe
        565⤵
        
        PID:1028
        
        C:\Windows\SysWOW64\Dqipeboj.exe
        
        C:\Windows\system32\Dqipeboj.exe
        566⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\Dgbhbm32.exe
        
        C:\Windows\system32\Dgbhbm32.exe
        567⤵
        System Location Discovery: System Language Discovery
        
        PID:2756
        
        C:\Windows\SysWOW64\Dnmaog32.exe
        
        C:\Windows\system32\Dnmaog32.exe
        568⤵
        
        PID:11672
        
        C:\Windows\SysWOW64\Dhbelp32.exe
        
        C:\Windows\system32\Dhbelp32.exe
        569⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5780
        
        C:\Windows\SysWOW64\Dkqahk32.exe
        
        C:\Windows\system32\Dkqahk32.exe
        570⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11836
        
        C:\Windows\SysWOW64\Dqmjqb32.exe
        
        C:\Windows\system32\Dqmjqb32.exe
        571⤵
        System Location Discovery: System Language Discovery
        
        PID:11868
        
        C:\Windows\SysWOW64\Dhdaao32.exe
        
        C:\Windows\system32\Dhdaao32.exe
        572⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Dkcnnk32.exe
        
        C:\Windows\system32\Dkcnnk32.exe
        573⤵
        Modifies registry class
        
        PID:3948
        
        C:\Windows\SysWOW64\Dbmfje32.exe
        
        C:\Windows\system32\Dbmfje32.exe
        574⤵
        Drops file in System32 directory
        
        PID:12004
        
        C:\Windows\SysWOW64\Ddkbfp32.exe
        
        C:\Windows\system32\Ddkbfp32.exe
        575⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Egjobl32.exe
        
        C:\Windows\system32\Egjobl32.exe
        576⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\Eqbclagp.exe
        
        C:\Windows\system32\Eqbclagp.exe
        577⤵
        
        PID:2880
        
        C:\Windows\SysWOW64\Eglkhk32.exe
        
        C:\Windows\system32\Eglkhk32.exe
        578⤵
        
        PID:12160
        
        C:\Windows\SysWOW64\Enfceefi.exe
        
        C:\Windows\system32\Enfceefi.exe
        579⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Edplapnf.exe
        
        C:\Windows\system32\Edplapnf.exe
        580⤵
        
        PID:11268
        
        C:\Windows\SysWOW64\Ekjdnj32.exe
        
        C:\Windows\system32\Ekjdnj32.exe
        581⤵
        
        PID:384
        
        C:\Windows\SysWOW64\Eqgmgq32.exe
        
        C:\Windows\system32\Eqgmgq32.exe
        582⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Eojijg32.exe
        
        C:\Windows\system32\Eojijg32.exe
        583⤵
        Drops file in System32 directory
        
        PID:11956
        
        C:\Windows\SysWOW64\Eqkfapoe.exe
        
        C:\Windows\system32\Eqkfapoe.exe
        584⤵
        Modifies registry class
        
        PID:11988
        
        C:\Windows\SysWOW64\Fgenoj32.exe
        
        C:\Windows\system32\Fgenoj32.exe
        585⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Fnofkdno.exe
        
        C:\Windows\system32\Fnofkdno.exe
        586⤵
        
        PID:12116
        
        C:\Windows\SysWOW64\Fdiohnek.exe
        
        C:\Windows\system32\Fdiohnek.exe
        587⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\Foocegea.exe
        
        C:\Windows\system32\Foocegea.exe
        588⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5624
        
        C:\Windows\SysWOW64\Fqpomo32.exe
        
        C:\Windows\system32\Fqpomo32.exe
        589⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5424
        
        C:\Windows\SysWOW64\Figgnm32.exe
        
        C:\Windows\system32\Figgnm32.exe
        590⤵
        
        PID:1428
        
        C:\Windows\SysWOW64\Fkfcjh32.exe
        
        C:\Windows\system32\Fkfcjh32.exe
        591⤵
        
        PID:11504
        
        C:\Windows\SysWOW64\Fqblbo32.exe
        
        C:\Windows\system32\Fqblbo32.exe
        592⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Fgldoi32.exe
        
        C:\Windows\system32\Fgldoi32.exe
        593⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:756
        
        C:\Windows\SysWOW64\Fnfmlchf.exe
        
        C:\Windows\system32\Fnfmlchf.exe
        594⤵
        
        PID:4332
        
        C:\Windows\SysWOW64\Fgoadi32.exe
        
        C:\Windows\system32\Fgoadi32.exe
        595⤵
        
        PID:4856
        
        C:\Windows\SysWOW64\Fbdeba32.exe
        
        C:\Windows\system32\Fbdeba32.exe
        596⤵
        
        PID:2808
        
        C:\Windows\SysWOW64\Ginnokej.exe
        
        C:\Windows\system32\Ginnokej.exe
        597⤵
        
        PID:12000
        
        C:\Windows\SysWOW64\Gohfkemf.exe
        
        C:\Windows\system32\Gohfkemf.exe
        598⤵
        
        PID:12064
        
        C:\Windows\SysWOW64\Gaibcn32.exe
        
        C:\Windows\system32\Gaibcn32.exe
        599⤵
        System Location Discovery: System Language Discovery
        
        PID:12128
        
        C:\Windows\SysWOW64\Ggcjphja.exe
        
        C:\Windows\system32\Ggcjphja.exe
        600⤵
        
        PID:2952
        
        C:\Windows\SysWOW64\Gnmblb32.exe
        
        C:\Windows\system32\Gnmblb32.exe
        601⤵
        System Location Discovery: System Language Discovery
        
        PID:3624
        
        C:\Windows\SysWOW64\Gegkilik.exe
        
        C:\Windows\system32\Gegkilik.exe
        602⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Gldpkfoe.exe
        
        C:\Windows\system32\Gldpkfoe.exe
        603⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12016
        
        C:\Windows\SysWOW64\Gbnhhp32.exe
        
        C:\Windows\system32\Gbnhhp32.exe
        604⤵
        System Location Discovery: System Language Discovery
        
        PID:5864
        
        C:\Windows\SysWOW64\Gihpejmo.exe
        
        C:\Windows\system32\Gihpejmo.exe
        605⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:12184
        
        C:\Windows\SysWOW64\Gpaiadel.exe
        
        C:\Windows\system32\Gpaiadel.exe
        606⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Haceil32.exe
        
        C:\Windows\system32\Haceil32.exe
        607⤵
        Drops file in System32 directory
        
        PID:2712
        
        C:\Windows\SysWOW64\Hlhife32.exe
        
        C:\Windows\system32\Hlhife32.exe
        608⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Haebol32.exe
        
        C:\Windows\system32\Haebol32.exe
        609⤵
        
        PID:11812
        
        C:\Windows\SysWOW64\Hhojlfpd.exe
        
        C:\Windows\system32\Hhojlfpd.exe
        610⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Hnibhp32.exe
        
        C:\Windows\system32\Hnibhp32.exe
        611⤵
        
        PID:4380
        
        C:\Windows\SysWOW64\Hagodlge.exe
        
        C:\Windows\system32\Hagodlge.exe
        612⤵
        
        PID:12056
        
        C:\Windows\SysWOW64\Hlmbadfk.exe
        
        C:\Windows\system32\Hlmbadfk.exe
        613⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Hnkonpeo.exe
        
        C:\Windows\system32\Hnkonpeo.exe
        614⤵
        System Location Discovery: System Language Discovery
        
        PID:6212
        
        C:\Windows\SysWOW64\Heegjj32.exe
        
        C:\Windows\system32\Heegjj32.exe
        615⤵
        System Location Discovery: System Language Discovery
        
        PID:3336
        
        C:\Windows\SysWOW64\Hlppgddh.exe
        
        C:\Windows\system32\Hlppgddh.exe
        616⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Hbihdn32.exe
        
        C:\Windows\system32\Hbihdn32.exe
        617⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11800
        
        C:\Windows\SysWOW64\Hhfplejl.exe
        
        C:\Windows\system32\Hhfplejl.exe
        618⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Hnphio32.exe
        
        C:\Windows\system32\Hnphio32.exe
        619⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Iifmfh32.exe
        
        C:\Windows\system32\Iifmfh32.exe
        620⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Iobeno32.exe
        
        C:\Windows\system32\Iobeno32.exe
        621⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Ielmki32.exe
        
        C:\Windows\system32\Ielmki32.exe
        622⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Ilfehcnp.exe
        
        C:\Windows\system32\Ilfehcnp.exe
        623⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Ibcjjm32.exe
        
        C:\Windows\system32\Ibcjjm32.exe
        624⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Ilkocb32.exe
        
        C:\Windows\system32\Ilkocb32.exe
        625⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Iecclhak.exe
        
        C:\Windows\system32\Iecclhak.exe
        626⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Ipihiaqa.exe
        
        C:\Windows\system32\Ipihiaqa.exe
        627⤵
        Drops file in System32 directory
        
        PID:6648
        
        C:\Windows\SysWOW64\Jbgdelpe.exe
        
        C:\Windows\system32\Jbgdelpe.exe
        628⤵
        Drops file in System32 directory
        
        PID:3248
        
        C:\Windows\SysWOW64\Jhdlncnl.exe
        
        C:\Windows\system32\Jhdlncnl.exe
        629⤵
        Modifies registry class
        
        PID:6288
        
        C:\Windows\SysWOW64\Jpkdoq32.exe
        
        C:\Windows\system32\Jpkdoq32.exe
        630⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6976 -s 448
        631⤵
        Program crash
        
        PID:7092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 6976 -ip 6976
1⤵
PID:6956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Bganac32.exe

Path C:\Windows\SysWOW64\Bganac32.exe
Size 320KB
SHA256 fa4f0ad2528ad2279a07fee203859b9f4a9638f996197999b5366b5bb66235ac
MD5 9a773ed3b2b2e0e3a3c9b903989c6ed1
SHA1 e0e06af4197ce5956ccd5d6e097ecfc47af95701
SHA512 07f2be8af18588ca4d5697afd22f2264e616ae5d6dcf2109f15d5fdb730ec39636f7b77c7262af44f6efd9017f74322c36b49fb2fe5c3072be747ff05e12ced6
SSDEEP 3072:mJLZtXfuS7wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:qLn2S7V/Ah1G/AcQ///NR5fn
TLSH
T10964225626340AEACDED1BB5AC0259D85141E9F818F1E13EB123DFDCD8E8DB2D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bmngjj32.exe

Path C:\Windows\SysWOW64\Bmngjj32.exe
Size 320KB
SHA256 eb30a51411e88739e9b53011f7a3fec9b47e9a781684f23c68e8d4496cf03d9c
MD5 39ef7ee9e72c925c82b2bf3f360cbca4
SHA1 5837ef3c1ad086d6bf41da8b91a6682d66262f53
SHA512 2a4acf567ee07b1b5032ce04b82ede1234c6f67d9b7151575a8d4e760ee281ccc5cdbdaf70ec8b05254df4a8fd3adfd998516d696d542e22b5438165cba0c2e2
SSDEEP 3072:oJFUANmvS2wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:oJrj2V/Ah1G/AcQ///NR5fn
TLSH
T1036430192A3009EACEED1BB5AD034BD85181E8F414F1E13E65A3DFDDE8E4DA2C915F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bmpcpjcd.exe

Path C:\Windows\SysWOW64\Bmpcpjcd.exe
Size 320KB
SHA256 3d8844e38ca868cc54dd6ac50ed05be347e1b4c0ac4633d981b7de10fee2150d
MD5 d074c686c95fcb6ee237ed0bfaddab1e
SHA1 625e8e540e469608581bb2d214a9736dd3157ba3
SHA512 88befd517a9681c733f9ddd1ba0a24bf800932efd1868f8a92486a31d52b99811d327aab9b2d23c115f141cc1383384281f9c631966e6a8416b8f85747d227ed
SSDEEP 6144:BB+9fPAU6F1EHpGL7PgNgV/Ah1G/AcQ///NR5fn:Bk/Nv
TLSH
T135642E192A3409EACEED1BB5AC124DD89152E8F414F1E23E6523DFDCC8F4EA6C855F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cclhbcho.exe

Path C:\Windows\SysWOW64\Cclhbcho.exe
Size 320KB
SHA256 6b9b5943504cc6f38b5b25c513e02ef4bd92cc8a2c63ff32da6ad9f58c2dd643
MD5 4ff5beda2e0ec548da1063cf777a93a3
SHA1 2ddb9bc2e2c5e51457d9bf4d33e57810e5953e40
SHA512 7ce22797b6f3dd8ac78d17ece51ca78281f9a1c2d75ca4c42130a3e1cafd7bc6fd8bc37147eb4a436c3efa89a5b86a99e5269896b864486dd51c62dd373e026f
SSDEEP 3072:xktZci/lVWOt1E+f/4KcqByUwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:xk/xh6zUV/Ah1G/AcQ///NR5fn
TLSH
T129642D1A267009EACDED6FB6AC1249D94581E8F019F1E13E6163DFECD9E4DA2C814FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cdoegcfl.exe

Path C:\Windows\SysWOW64\Cdoegcfl.exe
Size 320KB
SHA256 6df2870374813b9a39160855d9992533a4ba6e6494638ab22b40f44266beca06
MD5 18a90cfaed604128bd8eef1b42d2b40b
SHA1 acd3d2d09313a3e79ab51bf35b76effebdca1e86
SHA512 6d91ba965090746cf7120674db201c14abbaafed75442bbf043909642b3b4425102011fb13c9581b2057fa15b33f84d6678a1360c94024dd44d263968d1d834c
SSDEEP 3072:FSzKQ2MmWe3bM2t7wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:FSGQDmWhE7V/Ah1G/AcQ///NR5fn
TLSH
T131642E15663009EACEED5BFAAD0249D85182E8F016F1E13E5123EFDDC8E8DA6DC15F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ceqngekl.exe

Path C:\Windows\SysWOW64\Ceqngekl.exe
Size 320KB
SHA256 60b850becf5ce0b52562b8cde159ad9102eb0f60fbc299ba88b3c86c28ce9878
MD5 adb29d56edc45793db11eedd756358e4
SHA1 2b1ff3a12b8b818abce8bffd155203eaedfb4bbf
SHA512 9a7a5080731ead40682b885967db60a5ed7f456eed8a963cfcbbf83a38af08cf6eb855d3a73e97299aa180e5e60b87d35bc3553b15f7f89bac1ee6cd65295ec1
SSDEEP 3072:63XnxSmwacT3lwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:633xSmwRlV/Ah1G/AcQ///NR5fn
TLSH
T1EB64C91926740AEACEED1FB5AC028ED85146E8B114F1E13E6523DFDCD8E5DA2CC19F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cjkjjmlf.exe

Path C:\Windows\SysWOW64\Cjkjjmlf.exe
Size 320KB
SHA256 0d95f232288f6103dbbb4c5be959da9808eb79715a9a03517149987816d969df
MD5 37a34ffeed64e68ed48214dc5a621b18
SHA1 c47d189d96e071ef65f05cfb7d1160bc4864861a
SHA512 1f3e02a6defc15101bc6b69ad7ebe7be7b34627fc58c9ab3f6f1c5f8086848aab5d1ce0e17cad62b64e3eee21f4582cfb2e22fce86e082234401d93d6732e8d7
SSDEEP 3072:dJqTa6OUVm/tVwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:XqT4UVUtVV/Ah1G/AcQ///NR5fn
TLSH
T148640E2A2A3409EACEEE1FB5AC1249DC5541E4F014F1E23E6523DFDDC8E4DA6D816F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cokpekpj.exe

Path C:\Windows\SysWOW64\Cokpekpj.exe
Size 320KB
SHA256 d5942dce71a02d89466a401fe7366ff6ff34f828b3e429c4902a330510f9c8e2
MD5 631d38a5039034d79067d2496f725ffa
SHA1 6e7f6fb82c8d88ca152e99b624c2d7abc66cd836
SHA512 2198303ac307edfa12b2eb3df3475966107cee4139b87eb1fac6dbd7955d9c44abfc3455ba45a4f14dbe09a697007ee533c1847572a2baa85e9f617302ba3aef
SSDEEP 3072:wpWrxm7c8gDwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:wIrx9DV/Ah1G/AcQ///NR5fn
TLSH
T19F643119263419EACDED1FB9AC024AD85181E8F014F1E13EA123DFDDE8E4FA2D915F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ddmaia32.exe

Path C:\Windows\SysWOW64\Ddmaia32.exe
Size 320KB
SHA256 657a7544e69a9ecef612b025a0b598f7a6f53fb7d6554596b0c83b238450bf7f
MD5 e5284c6ce07b29ed0c22c8e3c97a9b15
SHA1 77ddd3d0afc05d78cac2f13cdf89c1474e1e5906
SHA512 ff4a6e23b2517eee0530665e6344d83377dca18ad6fe40df1a5312afbff4d7a1cacdac9322c229e0aaf0da20cca87ee60a34c35473454b7ca514e63a3c0171d3
SSDEEP 3072:6hPrs2afAKTwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:6Vs2aIKTV/Ah1G/AcQ///NR5fn
TLSH
T1FD64111A263809EACDED5FB5BC124AD89181E9F014F1E13E6123DFDCD8E4EA6D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ddonnq32.exe

Path C:\Windows\SysWOW64\Ddonnq32.exe
Size 320KB
SHA256 1b0e2e304cbaf56cbcb690f85dfccb14871910c120e621e6e2ee01acac901008
MD5 b4ec6eb64cec5ba8e0b0ff4efb08ff4a
SHA1 0b586a7abf7c5a86b503b5b0ec0276928ed95c4e
SHA512 976676be5d323e2279953a673be54fc6999499fadab3c7ceea30c055c373e7bdd025e964dd4ae934153150ca1053d4310e6a12b519544eafc0bf1b3afc7850fa
SSDEEP 3072:3T9Um6cqUg2RzwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:DOm6ca2RzV/Ah1G/AcQ///NR5fn
TLSH
T1B164C92926700EEACEED1BB5AC0249D89181E9B614F1E13E5133DFDCD9F4DA2D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dhcdnq32.exe

Path C:\Windows\SysWOW64\Dhcdnq32.exe
Size 320KB
SHA256 efb8b983bd05a0dccc155d13c0efd0e7b8564fe4308fdafe83a48ce827b4070b
MD5 9999b52613e55a27179d05d72c177945
SHA1 d58f592c5a5ab5ecad45af7f5db0ebefc9e4c2e7
SHA512 0bdafa41cd3951aeb1c05e1b99d4b18173fc0b3389ee10e98fae1e0e8fd68011d0dab728215031d7c69ae41c75cef533c79d2d9c88bd8123ea0cacdf05019906
SSDEEP 3072:KjyptUdzp1C12wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:KjyptUhpa2V/Ah1G/AcQ///NR5fn
TLSH
T17564411916744AEACDEE2BB5AC0249EC9142E4F154F1E13E6923DFDCD8E4DA6C818FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dmgbgf32.exe

Path C:\Windows\SysWOW64\Dmgbgf32.exe
Size 320KB
SHA256 7d8b0f9af8651dbf61b88fc0bcf451ebc13dd5c4e201f45eee00b17fe517494c
MD5 20bafffc2660ef9b0083dab1d171f24e
SHA1 40e52decd0e6b6385acf0607cf818a47590d0ccb
SHA512 8d5b713c707b0999415018608dd9953ed4b5d25f6e8c57fc7274523e2632459fa8d36d803602f8856cca4ecfd09eda29b3c27d622c649e5a99f94dc87b0ce918
SSDEEP 3072:ZkCnZ4EmdOwsnwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:ZHZHwsnV/Ah1G/AcQ///NR5fn
TLSH
T11264FD29163009EACDED1FB5AE524AD85141F8F014F1E13E6127DFECD8E4EA6D81AF81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dopiqj32.exe

Path C:\Windows\SysWOW64\Dopiqj32.exe
Size 320KB
SHA256 1375c41a863776a39af7956b5b22698d1983644967fb9d4598e0babcae1dfd61
MD5 2ee3e3c9a37cd74cfe59fc5c820fa44b
SHA1 7e907115196277ea348819548142ca333616624f
SHA512 9f842d079e46491f3c7cb1aef85a54e223fe705b9a8d27af30be468b211ebd23fefb3f08267f3fd19410a88c5ba159ce38f861e759617f00f81aeee3658b8b8e
SSDEEP 3072:/qH+ekiG/BtdNnRwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:/Fp9ntRV/Ah1G/AcQ///NR5fn
TLSH
T166641E192A740AEBCEED1FB5AC1259D85141E9F014F1E13E6123EFDCD8E4DA6D809F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eaonccme.exe

Path C:\Windows\SysWOW64\Eaonccme.exe
Size 320KB
SHA256 01399506550d5175e17be11d9fb2830f246d255e14a88683856572d39db70134
MD5 d13ef3d11ce4af5e987aaecdc09e830e
SHA1 1e8c0144e5c2678774bcc7362828e0579185b4e4
SHA512 f6ce2916a325c7595a6f05059f95ac7b3d010f995b5acd48804bce91d0979a788f07c69276cff5b1dc8e1bc5df82d48151d3117018a1b5c6cbbfe8859cc71b1f
SSDEEP 3072:QHS9i6lahc9MhLwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Qy9VlahakLV/Ah1G/AcQ///NR5fn
TLSH
T11D64311916340DEACEED2BB5AC1259DC9181E9F415F1E17E6223DFDEC8E4DA2C818F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Edknjonl.exe

Path C:\Windows\SysWOW64\Edknjonl.exe
Size 320KB
SHA256 f905a2c76136eb5340eec5dc038afd468cc4436ba1db82c4248fae57f909a668
MD5 741e997dbbb07025421df752eb2fec6c
SHA1 f762686be61a7929f10fa6b43c838bb09276b3ca
SHA512 2fcc3a8a0c205fcf4f348495d53823152a5ff6aa6b455311445b5c7ef8bdb42ff705e3dc1616bc4dedd6b02f06248ecf738957ec99f5b2c24bc2947c0042b1ce
SSDEEP 3072:RIjdxTsbwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:RsdxQbV/Ah1G/AcQ///NR5fn
TLSH
T17D64DC19263809EACDED1BB5ED5249D89146E6B014F2E13E6133EFECD8E4DB6C805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eeagnc32.exe

Path C:\Windows\SysWOW64\Eeagnc32.exe
Size 320KB
SHA256 ecf6a149795e916a1f1b9d51a4e064e5353a6ab8bf20b259bdee170f0b6ea501
MD5 6eb8f17332324d82ddbe18ad1dfb2473
SHA1 8c916cdf499b590b10a8edb970253f41cd8a90c4
SHA512 1a575a04d1dcc1e404af17f26167ee876ceb78b812129f5d6d311bfc6e56f06f838cd43c23b6125a675fea49661ce26830571c33cd4bc6bcfc14eca62573e2f4
SSDEEP 3072:qpd/hUW2A3L263WNzwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:qpl2Ab2XNzV/Ah1G/AcQ///NR5fn
TLSH
T1A064FD192A3409EACEED1FB5AC1249D85141E9F014F1E13EA223DFDCD8E4DA6E909FC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Egkgljkm.exe

Path C:\Windows\SysWOW64\Egkgljkm.exe
Size 320KB
SHA256 edd68ce466369b15a0cc9fe47cb075843a44d4262ed0c42528a7e64255dc2ce3
MD5 d402c6ed57b8f07a4b4d77074c3b2817
SHA1 674325de6e6bdf764295c9abf88a6c5ff77a4f1d
SHA512 b427026b5d9de5bab8b763bb719a36c9a147ad0f6524e9d922f9e426c89712e1a5bcf837bdd578a61091960eaa83c0d83c3b698384bd8e0ae1998aac5cc65e30
SSDEEP 3072:UuASXrFsd5G62Q0gPR1nwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Uu5yd5N2QNnV/Ah1G/AcQ///NR5fn
TLSH
T1ED640F191A3419EACDED1BB6AC1249D86142F8F214F2E13E6563EFDCD8E4DA6C805FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eknpfj32.exe

Path C:\Windows\SysWOW64\Eknpfj32.exe
Size 320KB
SHA256 c9e4df9616f565ad583cee76b4170f5d908c5ad7af75baea4b974b22d2904a2d
MD5 fe47cedab39dbcf30ff28a263e837646
SHA1 8fa9c2e8a03259b5b0463a1eb50d70535a8da550
SHA512 b76a8bdb71a684b236a2065e2e679003b2f435d35058e3d9954c4bce1ed63a933727ef1fe8ff6ead0210fe922caeb1378cf3bff85ce75dd1179c3529b42d2318
SSDEEP 6144:yxAdY2/jjjXQ1Pu51vKV/Ah1G/AcQ///NR5fn:4439/Nv
TLSH
T13A642F19263049EACEEE1FB6AC6249E85241E8F014F5E13E6123DFDCDCE4DA2D815F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ekpmljin.exe

Path C:\Windows\SysWOW64\Ekpmljin.exe
Size 320KB
SHA256 da557fca77d5722decc236824fbe87c58aac14d38cee62868f59f132f1a2d3b4
MD5 62f25f928400e4dd31985f7d0586ffcb
SHA1 394f4e434d6757dc711e31aca38b4c9e680856c9
SHA512 cc03448be51586d360e107f451c53628fcd932e8b36e060b7200990987723921e4333b67bcd1fe65f2ad6d3cb0a174c9170faf3a98da190fd67667a6af96c953
SSDEEP 3072:PV7f8fKG3xgGSYKUSRMEe7TwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:PV7QKqgGD2RM7TV/Ah1G/AcQ///NR5fn
TLSH
T1A864D91A26340AEADEED1BB5AC425DDC6141F9B114F1E13E6123DFECD8E4DA2C819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fdpgen32.exe

Path C:\Windows\SysWOW64\Fdpgen32.exe
Size 320KB
SHA256 81c590756097453f722305ebec0bb98ac46879615435e99fbfa16a383ddceafb
MD5 edcdccfd8e4e9adc0c5f2fce19ae0141
SHA1 89d88f5edd6d81947607731c5a2277cc00ad01df
SHA512 9097400f9f25f2bdda7efbc6c5e5a19c3579c8a7f7d10777e9ba01f2e5fb046347794de97519faab888bbe46185000c61da68e859e1097e527db0020cbc67b22
SSDEEP 3072:ruZUJi17XvYiY4r64wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:ruZDVd24V/Ah1G/AcQ///NR5fn
TLSH
T1BA64301B263009EACDED2BB5AD1249D89941E8F014F1E53E6127DFDDC8E5EA2E805FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fefjpp32.exe

Path C:\Windows\SysWOW64\Fefjpp32.exe
Size 320KB
SHA256 729218e291cfad003d44a8b11826fb87d9fe262acfff821cdbd7d98f5cc3860b
MD5 673e92546029532285c166151a25d530
SHA1 37f02b2bbd3fcea2da6983dc96d61f6ecdc89a98
SHA512 6a37bbb7a475ec936a56a9b5a4251dbff5cef83979ecfbb1c67a663b6fad93f377354dfdf0694db126e8a9f90c4e7a545d8539c5723bf32fc090d0b8d1a59646
SSDEEP 3072:HyQJ/78bgE/vwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Su/ozvV/Ah1G/AcQ///NR5fn
TLSH
T192643D192A3009EADEED5BF5AD1249D89181E9F054F1E13E6123DFDCC9E4DB2C829F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fggfghap.exe

Path C:\Windows\SysWOW64\Fggfghap.exe
Size 320KB
SHA256 3d29803493f32396e620265660bb35301c3494e224f8c9456c6a8c08e1273d05
MD5 6394df700c13101b4297498dbd3d89fd
SHA1 d5b330561f830fda04df885b4d26fbd312d2e6a3
SHA512 abd190e3fadbd311d3673f0853081a2b064e8224d6153a03a43570535884935c39770c1672e0b6b325ae079d5316d7f63e56ff8a4118594e3f19a334d2bcf406
SSDEEP 3072:cRr1xM3SmDJcaIO9wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:YoSmDJcat9V/Ah1G/AcQ///NR5fn
TLSH
T177642D692A350AEACDED1FB5AC024DD95191E8F014F1E13E6523DFDCC8E4EA2D849F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fneohd32.exe

Path C:\Windows\SysWOW64\Fneohd32.exe
Size 320KB
SHA256 76ce93a679efa67f39a2c607649071610787b396867f1463ee08c35e9df6df5d
MD5 3e16e09ae49681922b7a3735048f770e
SHA1 1c050cc607ab18b3a6f8b8940fe3887b08a15104
SHA512 eb75d8230177e5007335bbaf940cab01b41f78c1d04f0205f1ad47f4cb3769513d469b536815a562462c26340939fc723027fe410b0055ce22b0b5bc3dc67a61
SSDEEP 3072:bFChdgIuYqvNADAF7FwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:bghdlwdFV/Ah1G/AcQ///NR5fn
TLSH
T14C640E1A16340EEACDED1BB5AC1259D99142E9F018F1E13E6133EFDCD8E4DA6D804F86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fnjhccnd.exe

Path C:\Windows\SysWOW64\Fnjhccnd.exe
Size 320KB
SHA256 1d0cdbe6bfcaa731cc6162593f7bcff0effa929ce302cc4012a9f9b6f9658515
MD5 6521f47ae39af20911b30b7ccb2e93d7
SHA1 7df0b31b4d2e688155fd68f084b7917d50f82f82
SHA512 ecc2a95fd181c883e4c95929011376d37b6b41ef587ea163938d9bdb1066905c31ab9e9ccb6ed8a5bb5cb1067cc24fe924f38c3d9f50dbff6f7b1917b545dc77
SSDEEP 3072:H/0064OQFDJolVcvMwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:f006lQBJolVcvMV/Ah1G/AcQ///NR5fn
TLSH
T1E96430592A700AFACEED1BB5AE0249D95581EDF114F1E53E6123DFECD8E4DA2C804F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fojenfeg.exe

Path C:\Windows\SysWOW64\Fojenfeg.exe
Size 320KB
SHA256 26c5c6ed07e85fd9831ed3ca29cc688cec9feb5b221fe26a81cfcfd716260fdf
MD5 488b8b9cc9ccef5c7e4d1d7995ea6de9
SHA1 f64938aae39901515c6c9d5e0a0f8dc8222fb690
SHA512 b63a254301e9ed007eff563efd864c57e751d13d8290ce178cf90a2ddabf1098296ff1c80cc1a3c1a15618eab6018296b5f33398cc0da8b22ae4e2daae643c69
SSDEEP 3072:Sp5VHmvnNv/V2wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:YvuV2V/Ah1G/AcQ///NR5fn
TLSH
T1ED641D1A263149EAEEED1BB5AC1249D89181E9F014F1F13E2123DFDCDCE5DA6E814F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gdkgam32.exe

Path C:\Windows\SysWOW64\Gdkgam32.exe
Size 320KB
SHA256 cc4835bd658caf71c8f6d8113076bdd2d1804d71bf44c9ef2e4047b33db8ec4d
MD5 698f8f91ce46b4d0024dab8b6d8ce6d6
SHA1 02948e1042ef185a565836f638d0b87e3f410eb5
SHA512 49c3264154db00bedf3f8bf1d89217ee2a634a187cd796dd25d2222e059569ad90b82a57d3739fc82b8a5cbe134f50ca2247bd68031c70557bd31784a0200bd9
SSDEEP 3072:tZOoY9VevNUXzY8vMwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:tZhNGRMV/Ah1G/AcQ///NR5fn
TLSH
T17D641D1A1A3419EADEEE1BB5EC0249DA5141E9F015F1F13E6223DFDCC8E4DA2D806F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gekckpgl.exe

Path C:\Windows\SysWOW64\Gekckpgl.exe
Size 320KB
SHA256 c5591deb030bfef0eca51cc7a4a24ffe2a0d1ad2e562b20d990ae56898bbeab1
MD5 b6b9eea1f63bcefd3758d30a39929b40
SHA1 314cc22fa7b35ca67373f42473478724b9c558ca
SHA512 fa786656241597679454c659f196bff3ed32ed6bd09f06cdb27ae98da71b4880c77d7f25fb016411c0495301e50b473c777f212f123166072af41600943fb39b
SSDEEP 3072:nYmID+yjjmDwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:nYZPjjmDV/Ah1G/AcQ///NR5fn
TLSH
T17B640E59663019EACDED1BB6AC1249D85241E8F015F1E23E6623DFDCE8F4DA6CC19F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gfomfo32.exe

Path C:\Windows\SysWOW64\Gfomfo32.exe
Size 320KB
SHA256 0a755c76a06fe9e63283b6e7882837054f24558da81d06078cc5246629d054c8
MD5 42f0edae69908b78a878a1ec5ba93a61
SHA1 519ea66e4d78121bab5223ab434ab4631a049dab
SHA512 ae809aa5bbe82b2e58f46a22bb18447422dfed315239317e70882119d6f2bbf5f325ab6e9b1901c71b75037d06ef742541fd29eae98e276220c84812188c0374
SSDEEP 3072:Pqiaaqth2swS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Pqiaai2sV/Ah1G/AcQ///NR5fn
TLSH
T11C641F19263009EACDED2BB9AD1249DE5181E8F114F1E13EA123EFDCC8E5DA6DC05F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gkeonggf.exe

Path C:\Windows\SysWOW64\Gkeonggf.exe
Size 320KB
SHA256 429c47515245437efe10924c0ba7c3cb97c347034ae39f5ea2a0d318b95e8ebd
MD5 43579b1732693ebdc3137c1fcefef821
SHA1 6400d5a6927e20377a037ed1789977b3ac35c03b
SHA512 3b711dbf6a67bbf28c88abdd78d69199137eee15f8d84586f8753167b463cba0536977e1f6f88fe62f342a740be6a53beee883865f3764f9620a324b926045b9
SSDEEP 3072:4my18z47nuRPM9SSwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:VyGz4pSSV/Ah1G/AcQ///NR5fn
TLSH
T1E864411A2A3809EADDED1FB5AC224DD85145E9F014F1E23E6523DFDCD8E4DA2C909F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gnaodbhl.exe

Path C:\Windows\SysWOW64\Gnaodbhl.exe
Size 320KB
SHA256 9f5d19067a5deb650d942077b9b686f1fd3cfb56f601a2fcd768552f28b4eb27
MD5 835f13f137ec287845a3ccdda574723f
SHA1 d9b74dc4dfb420254bfbec2ae3d75ab975649bbd
SHA512 394e0a5941906949b44426998fc0e525a337fb25b56eb49f7137e099192746e3ffca814e9cc61c02b78ddad45fc1a068e994c25750d44209bffea842fd6df07f
SSDEEP 3072:Ur9fSE5cFq/bwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:UBfL5cFq/bV/Ah1G/AcQ///NR5fn
TLSH
T1D0642F59263009EAEEED1FB6AC1249D85181E8F014F1E13E6567DFDCD8E8DA2C81DF81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hfdfanoa.exe

Path C:\Windows\SysWOW64\Hfdfanoa.exe
Size 320KB
SHA256 86a64229a4fe3069baf7d77112eda60e1b13962970f0bc3172719cfeed6c9189
MD5 fd3f433627a6d5995a2f336fe46af779
SHA1 fae88cd2ccdc5dd991c8ab28a829e843a830f07c
SHA512 a1181ba37d6c322b75a7cabaddcbfc63f33d43e0fc12268e6965af15d934b0d6a9e217cdc12686bc172bea0ba79b8969aeca0b4a9c0de1a133f61edabee1c694
SSDEEP 3072:32d1mkzdH77SwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:38fz577SV/Ah1G/AcQ///NR5fn
TLSH
T19D641E196A340DEACEED1BB5AC1349D89182E9F014F1E13E6123DFDCD8E4DA6D815F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hnokeqll.exe

Path C:\Windows\SysWOW64\Hnokeqll.exe
Size 320KB
SHA256 e1f453afad69269dab3f7a5bf51dba844ab93ab3868f4035d00d221ba728b68b
MD5 09775b1b0f4f9009a8da0044094918b6
SHA1 15b2de436bf511e0dd75c904f93bf931592fa8ae
SHA512 43c6bea1160f50298e05332f9c1cb983cbfbc3e0c82e66d81bd34aab223c9b1c8ff772ca2e8d963d0961fa9030cf8b449a06b0599e378402de704b7a9aeb4000
SSDEEP 3072:eFnCWMgIpjlXRgYpETRyTnQwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:ATtIptRgYGTRsQV/Ah1G/AcQ///NR5fn
TLSH
T13264FB69263409EBDDED1BB6AC1249D851C1E8B024F1E13E6173DFECD8E4DA2D805FA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/120-315-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/252-320-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/552-370-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/564-430-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/808-233-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/868-168-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/900-224-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1076-405-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1264-270-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1368-161-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1508-203-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1560-21-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1560-483-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1576-196-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1620-290-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1696-63-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1920-362-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2056-375-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2124-275-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2136-42-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2136-501-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2228-28-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2228-489-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2232-70-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2412-105-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2416-445-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2428-484-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2452-502-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2536-400-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2592-455-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2604-305-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2608-240-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2700-175-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2792-245-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2828-154-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2836-91-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2876-300-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2928-490-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3048-189-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3088-410-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3116-250-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3120-280-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3136-35-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3136-495-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3204-210-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3276-235-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3284-450-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3580-310-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3608-420-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3644-335-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3952-472-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3964-415-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4140-395-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4144-112-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4164-295-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4244-350-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4248-460-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4248-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4248-1-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/4280-345-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4308-285-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4372-126-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4492-49-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4492-507-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4544-385-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4568-355-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4600-255-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4628-119-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4708-496-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4796-260-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4812-461-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4832-98-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4868-471-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4868-7-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4924-325-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4984-425-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5036-217-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5068-84-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5072-440-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5096-478-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5148-340-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5368-77-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5372-182-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5416-133-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5452-365-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5460-265-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5476-390-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5564-148-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5712-435-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5848-330-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5896-477-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5896-14-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5916-383-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5960-56-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5988-466-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6000-140-0x0000000000400000-0x000000000046D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads