berbew | 5e93073f03def1f3a54724be7734266fbcdee374358bd1043a5d9359ec0aee2a

Analysis

max time kernel
149s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-05_a3db2a48795cac7e26c7d667fb8002c3_elex_wannacry.exe
Size 429KB
Sample261006-wlrvcsby2w
SHA256 5e93073f03def1f3a54724be7734266fbcdee374358bd1043a5d9359ec0aee2a
MD5 a3db2a48795cac7e26c7d667fb8002c3
SHA1 a61c76dd0253d42a172d9c40675182a1a337111b
SHA512 ba4be702a41ce8bab2adbcf3599104e323b7ec7d19eb5ef5780416025d27d97a02a91d3288a8541a434cdbb3655abed07bca6728295ad16b48881d8bd7eac27a
SSDEEP 6144:+gdcV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:+w/NcZ7/N
TLSH
T1849461696A3019E6DDEE6BB5AC1249E88181E5B114F2F13E6633DFDDC8E4DA1DC04F80
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dflmep32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nljgfn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imfill32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njjdae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhfmic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gbpenpdp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibegpmah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bbbkmebo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Giinjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngehoqdn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mogccnfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Phcgmffo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ihkigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njkklk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Komhfa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bkdieo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehlhbn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Diafkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gifjjacn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebocpd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecgcpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gelddk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmcoflhh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hchickeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Icdhojka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ihbphcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fldnoo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jcoapami.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amloakki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aokkknbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fdiohnek.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fiodib32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mfchehla.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljmfdp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngehoqdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfgjcb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Maggggaf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mqhmbqlh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nqpccp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkcgdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pkbjchio.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mfqlph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njkklk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojcghc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gohfkemf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dldlbgbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oopjchnh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hiajeoip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llhnpe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhnlapbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ginnokej.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bbgehd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eiobmjkd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Knlbipjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oeloebcb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ekkkip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Coldbl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfekoc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hlbcgj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkgicccd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aachaa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmomga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnccmddi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbgnobpg.exe

Executes dropped EXE 64 IoCs

pid	Process
4224	Boabkj32.exe
2332	Bhjgdplo.exe
5704	Bbbkmebo.exe
5736	Bhldio32.exe
824	Bcahgh32.exe
4064	Bjlpcbqo.exe
4216	Bkmmkj32.exe
5388	Bbgehd32.exe
4296	Bhqmdoef.exe
4072	Bcfabgel.exe
5288	Bfenncdp.exe
2516	Combgh32.exe
3024	Cfgjcb32.exe
4260	Cmabpmjj.exe
1864	Cckkmg32.exe
1032	Cfigib32.exe
5092	Cmcoflhh.exe
1420	Cbphncfo.exe
4068	Cijpkmml.exe
3048	Codhgg32.exe
3536	Cfnqdale.exe
4836	Cmhial32.exe
3336	Cbeaib32.exe
3696	Cioifm32.exe
4648	Doiabgqc.exe
4684	Dbgnobpg.exe
4904	Diafkl32.exe
6020	Dcgjie32.exe
2960	Djqbeonf.exe
6000	Dkbomgde.exe
4668	Dblgja32.exe
5028	Difpflco.exe
1472	Dldlbgbb.exe
3308	Dbndoa32.exe
3908	Dihllkal.exe
2640	Dpbdiehi.exe
700	Dflmep32.exe
3232	Emfebjgb.exe
928	Ecpmod32.exe
4736	Ejjelnfl.exe
2460	Elkbcf32.exe
4532	Ebejpp32.exe
2868	Eiobmjkd.exe
4780	Epikid32.exe
1524	Efccfojn.exe
3164	Emmkci32.exe
5016	Ecgcpc32.exe
4820	Eidlhj32.exe
2920	Ecipeb32.exe
5532	Fifhmi32.exe
5196	Fppqjcli.exe
4956	Ffjignde.exe
3476	Fmdach32.exe
3400	Fdnipbbo.exe
4044	Fikbhiaf.exe
4632	Fpejec32.exe
5648	Ffobbmpp.exe
3192	Fmikoggm.exe
2352	Fdccka32.exe
1672	Ffaogm32.exe
2184	Fmkgdgej.exe
4556	Fbhplnca.exe
2768	Gmndjf32.exe
5944	Gbjlbm32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Mjeaph32.exe	Lckicnei.exe
File opened for modification	C:\Windows\SysWOW64\Gmggpekm.exe	Ggmock32.exe
File opened for modification	C:\Windows\SysWOW64\Maggggaf.exe	Mgoboake.exe
File created	C:\Windows\SysWOW64\Jdimjo32.dll	Jcmdkbok.exe
File created	C:\Windows\SysWOW64\Ekoniian.exe	Eddemo32.exe
File opened for modification	C:\Windows\SysWOW64\Hlefgphj.exe	Hginoiic.exe
File opened for modification	C:\Windows\SysWOW64\Lgqfmcge.exe	Lqfnqjpi.exe
File opened for modification	C:\Windows\SysWOW64\Palbpb32.exe	Pkbjchio.exe
File created	C:\Windows\SysWOW64\Dlfbgp32.dll	Iefgln32.exe
File created	C:\Windows\SysWOW64\Dgeegled.exe	Dqkmkb32.exe
File created	C:\Windows\SysWOW64\Ebejpp32.exe	Elkbcf32.exe
File created	C:\Windows\SysWOW64\Fgoadi32.exe	Faeihogj.exe
File created	C:\Windows\SysWOW64\Kjpaec32.dll	Kjhlipla.exe
File created	C:\Windows\SysWOW64\Qkgcog32.exe	Qdmkbmnl.exe
File opened for modification	C:\Windows\SysWOW64\Dmlkaela.exe	Dbfgdllk.exe
File opened for modification	C:\Windows\SysWOW64\Qdldgg32.exe	Qanhkk32.exe
File opened for modification	C:\Windows\SysWOW64\Cpmajdig.exe	Coldbl32.exe
File created	C:\Windows\SysWOW64\Ekladi32.exe	Edbhgokc.exe
File created	C:\Windows\SysWOW64\Kqbdej32.exe	Kjhlipla.exe
File created	C:\Windows\SysWOW64\Lqikfi32.exe	Lgqfmcge.exe
File created	C:\Windows\SysWOW64\Bojogb32.exe	Beajnm32.exe
File created	C:\Windows\SysWOW64\Ebiffc32.exe	Ekoniian.exe
File created	C:\Windows\SysWOW64\Difpflco.exe	Dblgja32.exe
File created	C:\Windows\SysWOW64\Cecdiafb.dll	Dldlbgbb.exe
File created	C:\Windows\SysWOW64\Hgahnjpk.exe	Hphpap32.exe
File opened for modification	C:\Windows\SysWOW64\Dkmogbeo.exe	Dbdjol32.exe
File created	C:\Windows\SysWOW64\Ppeikjle.exe	Pmgmonma.exe
File created	C:\Windows\SysWOW64\Kcndda32.dll	Fdiohnek.exe
File created	C:\Windows\SysWOW64\Jjgknf32.dll	Baadbo32.exe
File opened for modification	C:\Windows\SysWOW64\Eodjdocj.exe	Emenhcdf.exe
File created	C:\Windows\SysWOW64\Oggepi32.dll	Igajka32.exe
File opened for modification	C:\Windows\SysWOW64\Jlclnhho.exe	Jgfcfajg.exe
File created	C:\Windows\SysWOW64\Kfgpblda.exe	Komhfa32.exe
File opened for modification	C:\Windows\SysWOW64\Lokdgpqe.exe	Lnjgpgkf.exe
File created	C:\Windows\SysWOW64\Baanhi32.exe	Bgkijp32.exe
File opened for modification	C:\Windows\SysWOW64\Cmcoflhh.exe	Cfigib32.exe
File created	C:\Windows\SysWOW64\Iepepgmo.dll	Dkbomgde.exe
File opened for modification	C:\Windows\SysWOW64\Ljaooodf.exe	Lqikfi32.exe
File created	C:\Windows\SysWOW64\Mjbjci32.dll	Oopjchnh.exe
File created	C:\Windows\SysWOW64\Phaabm32.exe	Pmlmdd32.exe
File created	C:\Windows\SysWOW64\Hcnamm32.dll	Aachaa32.exe
File opened for modification	C:\Windows\SysWOW64\Efkfkilj.exe	Dkfanqmd.exe
File created	C:\Windows\SysWOW64\Hlbcgj32.exe	Hfekoc32.exe
File opened for modification	C:\Windows\SysWOW64\Difpflco.exe	Dblgja32.exe
File created	C:\Windows\SysWOW64\Ibgkdmmh.dll	Ngehoqdn.exe
File created	C:\Windows\SysWOW64\Kokkqbog.exe	Kjnbhkqp.exe
File created	C:\Windows\SysWOW64\Jkjhoebc.dll	Kfgpblda.exe
File created	C:\Windows\SysWOW64\Mdqpdcdl.dll	Nnccmddi.exe
File created	C:\Windows\SysWOW64\Efccfojn.exe	Epikid32.exe
File created	C:\Windows\SysWOW64\Mklkepal.exe	Maggggaf.exe
File created	C:\Windows\SysWOW64\Beniogkl.dll	Maggggaf.exe
File opened for modification	C:\Windows\SysWOW64\Ckaolcol.exe	Cdggoi32.exe
File opened for modification	C:\Windows\SysWOW64\Hpgigj32.exe	Headjael.exe
File created	C:\Windows\SysWOW64\Bphgoe32.exe	Bogkgmho.exe
File created	C:\Windows\SysWOW64\Fikbhiaf.exe	Fdnipbbo.exe
File created	C:\Windows\SysWOW64\Jlelbe32.dll	Gpcffalc.exe
File opened for modification	C:\Windows\SysWOW64\Kjhlipla.exe	Kcndlf32.exe
File opened for modification	C:\Windows\SysWOW64\Beajnm32.exe	Blieeglf.exe
File opened for modification	C:\Windows\SysWOW64\Omdpio32.exe	Oclkqihc.exe
File created	C:\Windows\SysWOW64\Nepmnppf.dll	Ehlhbn32.exe
File created	C:\Windows\SysWOW64\Fbdeba32.exe	Fgoadi32.exe
File created	C:\Windows\SysWOW64\Iaepea32.dll	Cckkmg32.exe
File opened for modification	C:\Windows\SysWOW64\Ejjelnfl.exe	Ecpmod32.exe
File created	C:\Windows\SysWOW64\Qlbfnk32.exe	Palbpb32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
11520	11440	WerFault.exe	537

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dldlbgbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nljgfn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baanhi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ihbphcpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Boabkj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hginoiic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ijnqld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Peokkbao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jiglgl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhphfppl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbcohl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mogccnfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmpoemef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aojepe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hlbcgj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hifcqo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nqpccp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afmmibga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahofidlb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipcomo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlcchn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Komhfa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncifdlii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qpolahdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ilnbch32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jofaeb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmaafcml.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Foapkfco.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fngcfikb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lqjqab32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbhplnca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fpejec32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldgclgcl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lkqliaki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ebocpd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hchickeo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmfalimb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlohjpoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fnegqjne.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caagofme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkhppgic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-05_a3db2a48795cac7e26c7d667fb8002c3_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bbbkmebo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbjlbm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hlefgphj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aehghn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iohede32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppjbfi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iljpbp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmpdbh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bncllqhm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mqafbaap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gpolld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iobeno32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhjgdplo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jnelha32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dieilepc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfigib32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmcoflhh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Codhgg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbofmmmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hnphio32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipihiaqa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cioifm32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ibadoc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdcbqcjc.dll"	Jikfbkbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlfbgp32.dll"	Iefgln32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	2026-10-05_a3db2a48795cac7e26c7d667fb8002c3_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbfdpb32.dll"	Jgkdkg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kqbdej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qglplfpi.dll"	Cmcoflhh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kdfjej32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kjccna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Paapjc32.dll"	Pmlmdd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ineilini.dll"	Qdldgg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dbgnobpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cecdiafb.dll"	Dldlbgbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jgkdkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmocmggl.dll"	Jgfcfajg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmjlfbjj.dll"	Kgkfhngo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lfeldj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lgdinmod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aoeooiqn.dll"	Dkikglce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dblgja32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ecgcpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hginoiic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Maggggaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Icneeq32.dll"	Nclida32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfcdmd32.dll"	Nljgfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ompmie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Headjael.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nfenmdkp.dll"	Nanmhf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chlffghn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chlffghn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lljked32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jlqohhja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jcoapami.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Knnhdied.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Llhnpe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Geohdago.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Imfill32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkgpig32.dll"	Iimjan32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mmkdlbea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Opiipkfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bkdieo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fammoofd.dll"	Dhphfppl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkeodcom.dll"	Djqbeonf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fppqjcli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Caciik32.dll"	Ijnqld32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Phaabm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hoobnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjoplkfh.dll"	Adfgne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dqpmeikh.dll"	Dbgnobpg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jdodekhg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppmammbl.dll"	Kjccna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ekkkip32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgkoolil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cbppah32.dll"	Bgkijp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ibqndm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lkchoaif.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aojepe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Igajka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lmaafcml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihbcjk32.dll"	Cggifn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddkbfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Faeihogj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Emfebjgb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mlohjpoi.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4056 wrote to memory of 4224	4056	2026-10-05_a3db2a48795cac7e26c7d667fb8002c3_elex_wannacry.exe	88
PID 4224 wrote to memory of 2332	4224	Boabkj32.exe	89
PID 2332 wrote to memory of 5704	2332	Bhjgdplo.exe	90
PID 5704 wrote to memory of 5736	5704	Bbbkmebo.exe	91
PID 5736 wrote to memory of 824	5736	Bhldio32.exe	92
PID 824 wrote to memory of 4064	824	Bcahgh32.exe	93
PID 4064 wrote to memory of 4216	4064	Bjlpcbqo.exe	94
PID 4216 wrote to memory of 5388	4216	Bkmmkj32.exe	95
PID 5388 wrote to memory of 4296	5388	Bbgehd32.exe	96
PID 4296 wrote to memory of 4072	4296	Bhqmdoef.exe	97
PID 4072 wrote to memory of 5288	4072	Bcfabgel.exe	98
PID 5288 wrote to memory of 2516	5288	Bfenncdp.exe	99
PID 2516 wrote to memory of 3024	2516	Combgh32.exe	100
PID 3024 wrote to memory of 4260	3024	Cfgjcb32.exe	101
PID 4260 wrote to memory of 1864	4260	Cmabpmjj.exe	102
PID 1864 wrote to memory of 1032	1864	Cckkmg32.exe	103
PID 1032 wrote to memory of 5092	1032	Cfigib32.exe	104
PID 5092 wrote to memory of 1420	5092	Cmcoflhh.exe	105
PID 1420 wrote to memory of 4068	1420	Cbphncfo.exe	106
PID 4068 wrote to memory of 3048	4068	Cijpkmml.exe	107
PID 3048 wrote to memory of 3536	3048	Codhgg32.exe	108
PID 3536 wrote to memory of 4836	3536	Cfnqdale.exe	109
PID 4836 wrote to memory of 3336	4836	Cmhial32.exe	110
PID 3336 wrote to memory of 3696	3336	Cbeaib32.exe	111
PID 3696 wrote to memory of 4648	3696	Cioifm32.exe	112
PID 4648 wrote to memory of 4684	4648	Doiabgqc.exe	113
PID 4684 wrote to memory of 4904	4684	Dbgnobpg.exe	114
PID 4904 wrote to memory of 6020	4904	Diafkl32.exe	115
PID 6020 wrote to memory of 2960	6020	Dcgjie32.exe	116
PID 2960 wrote to memory of 6000	2960	Djqbeonf.exe	117
PID 6000 wrote to memory of 4668	6000	Dkbomgde.exe	118
PID 4668 wrote to memory of 5028	4668	Dblgja32.exe	119
PID 5028 wrote to memory of 1472	5028	Difpflco.exe	120
PID 1472 wrote to memory of 3308	1472	Dldlbgbb.exe	121
PID 3308 wrote to memory of 3908	3308	Dbndoa32.exe	122
PID 3908 wrote to memory of 2640	3908	Dihllkal.exe	123
PID 2640 wrote to memory of 700	2640	Dpbdiehi.exe	124
PID 700 wrote to memory of 3232	700	Dflmep32.exe	125
PID 3232 wrote to memory of 928	3232	Emfebjgb.exe	126
PID 928 wrote to memory of 4736	928	Ecpmod32.exe	127
PID 4736 wrote to memory of 2460	4736	Ejjelnfl.exe	128
PID 2460 wrote to memory of 4532	2460	Elkbcf32.exe	129
PID 4532 wrote to memory of 2868	4532	Ebejpp32.exe	130
PID 2868 wrote to memory of 4780	2868	Eiobmjkd.exe	131
PID 4780 wrote to memory of 1524	4780	Epikid32.exe	132
PID 1524 wrote to memory of 3164	1524	Efccfojn.exe	133
PID 3164 wrote to memory of 5016	3164	Emmkci32.exe	134
PID 5016 wrote to memory of 4820	5016	Ecgcpc32.exe	135
PID 4820 wrote to memory of 2920	4820	Eidlhj32.exe	136
PID 2920 wrote to memory of 5532	2920	Ecipeb32.exe	137
PID 5532 wrote to memory of 5196	5532	Fifhmi32.exe	138
PID 5196 wrote to memory of 4956	5196	Fppqjcli.exe	139
PID 4956 wrote to memory of 3476	4956	Ffjignde.exe	140
PID 3476 wrote to memory of 3400	3476	Fmdach32.exe	141
PID 3400 wrote to memory of 4044	3400	Fdnipbbo.exe	142
PID 4044 wrote to memory of 4632	4044	Fikbhiaf.exe	143
PID 4632 wrote to memory of 5648	4632	Fpejec32.exe	144
PID 5648 wrote to memory of 3192	5648	Ffobbmpp.exe	145
PID 3192 wrote to memory of 2352	3192	Fmikoggm.exe	146
PID 2352 wrote to memory of 1672	2352	Fdccka32.exe	147
PID 1672 wrote to memory of 2184	1672	Ffaogm32.exe	148
PID 2184 wrote to memory of 4556	2184	Fmkgdgej.exe	149
PID 4556 wrote to memory of 2768	4556	Fbhplnca.exe	150
PID 2768 wrote to memory of 5944	2768	Gmndjf32.exe	151

C:\Users\Admin\AppData\Local\Temp\2026-10-05_a3db2a48795cac7e26c7d667fb8002c3_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-05_a3db2a48795cac7e26c7d667fb8002c3_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Windows\SysWOW64\Boabkj32.exe
  C:\Windows\system32\Boabkj32.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4224
- - C:\Windows\SysWOW64\Bhjgdplo.exe
    C:\Windows\system32\Bhjgdplo.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2332
  - - C:\Windows\SysWOW64\Bbbkmebo.exe
      C:\Windows\system32\Bbbkmebo.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5704
    - - C:\Windows\SysWOW64\Bhldio32.exe
        
        C:\Windows\system32\Bhldio32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5736
      - C:\Windows\SysWOW64\Bcahgh32.exe
        
        C:\Windows\system32\Bcahgh32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:824
        
        C:\Windows\SysWOW64\Bjlpcbqo.exe
        
        C:\Windows\system32\Bjlpcbqo.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4064
        
        C:\Windows\SysWOW64\Bkmmkj32.exe
        
        C:\Windows\system32\Bkmmkj32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4216
        
        C:\Windows\SysWOW64\Bbgehd32.exe
        
        C:\Windows\system32\Bbgehd32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5388
        
        C:\Windows\SysWOW64\Bhqmdoef.exe
        
        C:\Windows\system32\Bhqmdoef.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4296
        
        C:\Windows\SysWOW64\Bcfabgel.exe
        
        C:\Windows\system32\Bcfabgel.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4072
        
        C:\Windows\SysWOW64\Bfenncdp.exe
        
        C:\Windows\system32\Bfenncdp.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5288
        
        C:\Windows\SysWOW64\Combgh32.exe
        
        C:\Windows\system32\Combgh32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2516
        
        C:\Windows\SysWOW64\Cfgjcb32.exe
        
        C:\Windows\system32\Cfgjcb32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3024
        
        C:\Windows\SysWOW64\Cmabpmjj.exe
        
        C:\Windows\system32\Cmabpmjj.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4260
        
        C:\Windows\SysWOW64\Cckkmg32.exe
        
        C:\Windows\system32\Cckkmg32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1864
        
        C:\Windows\SysWOW64\Cfigib32.exe
        
        C:\Windows\system32\Cfigib32.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1032
        
        C:\Windows\SysWOW64\Cmcoflhh.exe
        
        C:\Windows\system32\Cmcoflhh.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5092
        
        C:\Windows\SysWOW64\Cbphncfo.exe
        
        C:\Windows\system32\Cbphncfo.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1420
        
        C:\Windows\SysWOW64\Cijpkmml.exe
        
        C:\Windows\system32\Cijpkmml.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4068
        
        C:\Windows\SysWOW64\Codhgg32.exe
        
        C:\Windows\system32\Codhgg32.exe
        21⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3048
        
        C:\Windows\SysWOW64\Cfnqdale.exe
        
        C:\Windows\system32\Cfnqdale.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3536
        
        C:\Windows\SysWOW64\Cmhial32.exe
        
        C:\Windows\system32\Cmhial32.exe
        23⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4836
        
        C:\Windows\SysWOW64\Cbeaib32.exe
        
        C:\Windows\system32\Cbeaib32.exe
        24⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3336
        
        C:\Windows\SysWOW64\Cioifm32.exe
        
        C:\Windows\system32\Cioifm32.exe
        25⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3696
        
        C:\Windows\SysWOW64\Doiabgqc.exe
        
        C:\Windows\system32\Doiabgqc.exe
        26⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4648
        
        C:\Windows\SysWOW64\Dbgnobpg.exe
        
        C:\Windows\system32\Dbgnobpg.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4684
        
        C:\Windows\SysWOW64\Diafkl32.exe
        
        C:\Windows\system32\Diafkl32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4904
        
        C:\Windows\SysWOW64\Dcgjie32.exe
        
        C:\Windows\system32\Dcgjie32.exe
        29⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6020
        
        C:\Windows\SysWOW64\Djqbeonf.exe
        
        C:\Windows\system32\Djqbeonf.exe
        30⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2960
        
        C:\Windows\SysWOW64\Dkbomgde.exe
        
        C:\Windows\system32\Dkbomgde.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:6000
        
        C:\Windows\SysWOW64\Dblgja32.exe
        
        C:\Windows\system32\Dblgja32.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4668
        
        C:\Windows\SysWOW64\Difpflco.exe
        
        C:\Windows\system32\Difpflco.exe
        33⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5028
        
        C:\Windows\SysWOW64\Dldlbgbb.exe
        
        C:\Windows\system32\Dldlbgbb.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1472
        
        C:\Windows\SysWOW64\Dbndoa32.exe
        
        C:\Windows\system32\Dbndoa32.exe
        35⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3308
        
        C:\Windows\SysWOW64\Dihllkal.exe
        
        C:\Windows\system32\Dihllkal.exe
        36⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3908
        
        C:\Windows\SysWOW64\Dpbdiehi.exe
        
        C:\Windows\system32\Dpbdiehi.exe
        37⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2640
        
        C:\Windows\SysWOW64\Dflmep32.exe
        
        C:\Windows\system32\Dflmep32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:700
        
        C:\Windows\SysWOW64\Emfebjgb.exe
        
        C:\Windows\system32\Emfebjgb.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3232
        
        C:\Windows\SysWOW64\Ecpmod32.exe
        
        C:\Windows\system32\Ecpmod32.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:928
        
        C:\Windows\SysWOW64\Ejjelnfl.exe
        
        C:\Windows\system32\Ejjelnfl.exe
        41⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4736
        
        C:\Windows\SysWOW64\Elkbcf32.exe
        
        C:\Windows\system32\Elkbcf32.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2460
        
        C:\Windows\SysWOW64\Ebejpp32.exe
        
        C:\Windows\system32\Ebejpp32.exe
        43⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4532
        
        C:\Windows\SysWOW64\Eiobmjkd.exe
        
        C:\Windows\system32\Eiobmjkd.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2868
        
        C:\Windows\SysWOW64\Epikid32.exe
        
        C:\Windows\system32\Epikid32.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4780
        
        C:\Windows\SysWOW64\Efccfojn.exe
        
        C:\Windows\system32\Efccfojn.exe
        46⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1524
        
        C:\Windows\SysWOW64\Emmkci32.exe
        
        C:\Windows\system32\Emmkci32.exe
        47⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3164
        
        C:\Windows\SysWOW64\Ecgcpc32.exe
        
        C:\Windows\system32\Ecgcpc32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5016
        
        C:\Windows\SysWOW64\Eidlhj32.exe
        
        C:\Windows\system32\Eidlhj32.exe
        49⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4820
        
        C:\Windows\SysWOW64\Ecipeb32.exe
        
        C:\Windows\system32\Ecipeb32.exe
        50⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2920
        
        C:\Windows\SysWOW64\Fifhmi32.exe
        
        C:\Windows\system32\Fifhmi32.exe
        51⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5532
        
        C:\Windows\SysWOW64\Fppqjcli.exe
        
        C:\Windows\system32\Fppqjcli.exe
        52⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5196
        
        C:\Windows\SysWOW64\Ffjignde.exe
        
        C:\Windows\system32\Ffjignde.exe
        53⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4956
        
        C:\Windows\SysWOW64\Fmdach32.exe
        
        C:\Windows\system32\Fmdach32.exe
        54⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3476
        
        C:\Windows\SysWOW64\Fdnipbbo.exe
        
        C:\Windows\system32\Fdnipbbo.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3400
        
        C:\Windows\SysWOW64\Fikbhiaf.exe
        
        C:\Windows\system32\Fikbhiaf.exe
        56⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4044
        
        C:\Windows\SysWOW64\Fpejec32.exe
        
        C:\Windows\system32\Fpejec32.exe
        57⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4632
        
        C:\Windows\SysWOW64\Ffobbmpp.exe
        
        C:\Windows\system32\Ffobbmpp.exe
        58⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5648
        
        C:\Windows\SysWOW64\Fmikoggm.exe
        
        C:\Windows\system32\Fmikoggm.exe
        59⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3192
        
        C:\Windows\SysWOW64\Fdccka32.exe
        
        C:\Windows\system32\Fdccka32.exe
        60⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2352
        
        C:\Windows\SysWOW64\Ffaogm32.exe
        
        C:\Windows\system32\Ffaogm32.exe
        61⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1672
        
        C:\Windows\SysWOW64\Fmkgdgej.exe
        
        C:\Windows\system32\Fmkgdgej.exe
        62⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2184
        
        C:\Windows\SysWOW64\Fbhplnca.exe
        
        C:\Windows\system32\Fbhplnca.exe
        63⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4556
        
        C:\Windows\SysWOW64\Gmndjf32.exe
        
        C:\Windows\system32\Gmndjf32.exe
        64⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2768
        
        C:\Windows\SysWOW64\Gbjlbm32.exe
        
        C:\Windows\system32\Gbjlbm32.exe
        65⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5944
        
        C:\Windows\SysWOW64\Gideogil.exe
        
        C:\Windows\system32\Gideogil.exe
        66⤵
        
        PID:2924
        
        C:\Windows\SysWOW64\Gdjilphb.exe
        
        C:\Windows\system32\Gdjilphb.exe
        67⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Gkdaij32.exe
        
        C:\Windows\system32\Gkdaij32.exe
        68⤵
        
        PID:3056
        
        C:\Windows\SysWOW64\Glenpb32.exe
        
        C:\Windows\system32\Glenpb32.exe
        69⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Gbofmmmj.exe
        
        C:\Windows\system32\Gbofmmmj.exe
        70⤵
        System Location Discovery: System Language Discovery
        
        PID:4800
        
        C:\Windows\SysWOW64\Giinjg32.exe
        
        C:\Windows\system32\Giinjg32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5756
        
        C:\Windows\SysWOW64\Gpcffalc.exe
        
        C:\Windows\system32\Gpcffalc.exe
        72⤵
        Drops file in System32 directory
        
        PID:1180
        
        C:\Windows\SysWOW64\Ggmock32.exe
        
        C:\Windows\system32\Ggmock32.exe
        73⤵
        Drops file in System32 directory
        
        PID:1484
        
        C:\Windows\SysWOW64\Gmggpekm.exe
        
        C:\Windows\system32\Gmggpekm.exe
        74⤵
        
        PID:3860
        
        C:\Windows\SysWOW64\Gbcohl32.exe
        
        C:\Windows\system32\Gbcohl32.exe
        75⤵
        System Location Discovery: System Language Discovery
        
        PID:792
        
        C:\Windows\SysWOW64\Hingefqa.exe
        
        C:\Windows\system32\Hingefqa.exe
        76⤵
        
        PID:3224
        
        C:\Windows\SysWOW64\Hphpap32.exe
        
        C:\Windows\system32\Hphpap32.exe
        77⤵
        Drops file in System32 directory
        
        PID:5492
        
        C:\Windows\SysWOW64\Hgahnjpk.exe
        
        C:\Windows\system32\Hgahnjpk.exe
        78⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\Hlnqfanb.exe
        
        C:\Windows\system32\Hlnqfanb.exe
        79⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Hchickeo.exe
        
        C:\Windows\system32\Hchickeo.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5624
        
        C:\Windows\SysWOW64\Hibape32.exe
        
        C:\Windows\system32\Hibape32.exe
        81⤵
        
        PID:2248
        
        C:\Windows\SysWOW64\Hdhemn32.exe
        
        C:\Windows\system32\Hdhemn32.exe
        82⤵
        
        PID:4660
        
        C:\Windows\SysWOW64\Hkbmjhdo.exe
        
        C:\Windows\system32\Hkbmjhdo.exe
        83⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Hpofbobf.exe
        
        C:\Windows\system32\Hpofbobf.exe
        84⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Hginoiic.exe
        
        C:\Windows\system32\Hginoiic.exe
        85⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4040
        
        C:\Windows\SysWOW64\Hlefgphj.exe
        
        C:\Windows\system32\Hlefgphj.exe
        86⤵
        System Location Discovery: System Language Discovery
        
        PID:1764
        
        C:\Windows\SysWOW64\Icoodj32.exe
        
        C:\Windows\system32\Icoodj32.exe
        87⤵
        
        PID:4308
        
        C:\Windows\SysWOW64\Iiigqdfd.exe
        
        C:\Windows\system32\Iiigqdfd.exe
        88⤵
        
        PID:2036
        
        C:\Windows\SysWOW64\Ipcomo32.exe
        
        C:\Windows\system32\Ipcomo32.exe
        89⤵
        System Location Discovery: System Language Discovery
        
        PID:1640
        
        C:\Windows\SysWOW64\Igmgji32.exe
        
        C:\Windows\system32\Igmgji32.exe
        90⤵
        
        PID:3528
        
        C:\Windows\SysWOW64\Iljpbp32.exe
        
        C:\Windows\system32\Iljpbp32.exe
        91⤵
        System Location Discovery: System Language Discovery
        
        PID:5100
        
        C:\Windows\SysWOW64\Icdhojka.exe
        
        C:\Windows\system32\Icdhojka.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5764
        
        C:\Windows\SysWOW64\Ijnqld32.exe
        
        C:\Windows\system32\Ijnqld32.exe
        93⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2844
        
        C:\Windows\SysWOW64\Iphihnjk.exe
        
        C:\Windows\system32\Iphihnjk.exe
        94⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\Jlcchn32.exe
        
        C:\Windows\system32\Jlcchn32.exe
        95⤵
        System Location Discovery: System Language Discovery
        
        PID:5776
        
        C:\Windows\SysWOW64\Jgkdkg32.exe
        
        C:\Windows\system32\Jgkdkg32.exe
        96⤵
        Modifies registry class
        
        PID:2576
        
        C:\Windows\SysWOW64\Jnelha32.exe
        
        C:\Windows\system32\Jnelha32.exe
        97⤵
        System Location Discovery: System Language Discovery
        
        PID:2672
        
        C:\Windows\SysWOW64\Jdodekhg.exe
        
        C:\Windows\system32\Jdodekhg.exe
        98⤵
        Modifies registry class
        
        PID:3240
        
        C:\Windows\SysWOW64\Jjlmmbfo.exe
        
        C:\Windows\system32\Jjlmmbfo.exe
        99⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Jqfejl32.exe
        
        C:\Windows\system32\Jqfejl32.exe
        100⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\Jkligd32.exe
        
        C:\Windows\system32\Jkligd32.exe
        101⤵
        
        PID:3564
        
        C:\Windows\SysWOW64\Jqhaolli.exe
        
        C:\Windows\system32\Jqhaolli.exe
        102⤵
        
        PID:2508
        
        C:\Windows\SysWOW64\Kgbjlf32.exe
        
        C:\Windows\system32\Kgbjlf32.exe
        103⤵
        
        PID:2452
        
        C:\Windows\SysWOW64\Knlbipjb.exe
        
        C:\Windows\system32\Knlbipjb.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:708
        
        C:\Windows\SysWOW64\Kdfjej32.exe
        
        C:\Windows\system32\Kdfjej32.exe
        105⤵
        Modifies registry class
        
        PID:4664
        
        C:\Windows\SysWOW64\Kjccna32.exe
        
        C:\Windows\system32\Kjccna32.exe
        106⤵
        Modifies registry class
        
        PID:1660
        
        C:\Windows\SysWOW64\Kqmkjk32.exe
        
        C:\Windows\system32\Kqmkjk32.exe
        107⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Kckgff32.exe
        
        C:\Windows\system32\Kckgff32.exe
        108⤵
        
        PID:2836
        
        C:\Windows\SysWOW64\Knaldo32.exe
        
        C:\Windows\system32\Knaldo32.exe
        109⤵
        
        PID:2496
        
        C:\Windows\SysWOW64\Kcndlf32.exe
        
        C:\Windows\system32\Kcndlf32.exe
        110⤵
        Drops file in System32 directory
        
        PID:6112
        
        C:\Windows\SysWOW64\Kjhlipla.exe
        
        C:\Windows\system32\Kjhlipla.exe
        111⤵
        Drops file in System32 directory
        
        PID:3320
        
        C:\Windows\SysWOW64\Kqbdej32.exe
        
        C:\Windows\system32\Kqbdej32.exe
        112⤵
        Modifies registry class
        
        PID:960
        
        C:\Windows\SysWOW64\Kkgicccd.exe
        
        C:\Windows\system32\Kkgicccd.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1504
        
        C:\Windows\SysWOW64\Lcbngeqo.exe
        
        C:\Windows\system32\Lcbngeqo.exe
        114⤵
        
        PID:4756
        
        C:\Windows\SysWOW64\Ljmfdp32.exe
        
        C:\Windows\system32\Ljmfdp32.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2800
        
        C:\Windows\SysWOW64\Lqfnqjpi.exe
        
        C:\Windows\system32\Lqfnqjpi.exe
        116⤵
        Drops file in System32 directory
        
        PID:5384
        
        C:\Windows\SysWOW64\Lgqfmcge.exe
        
        C:\Windows\system32\Lgqfmcge.exe
        117⤵
        Drops file in System32 directory
        
        PID:992
        
        C:\Windows\SysWOW64\Lqikfi32.exe
        
        C:\Windows\system32\Lqikfi32.exe
        118⤵
        Drops file in System32 directory
        
        PID:1904
        
        C:\Windows\SysWOW64\Ljaooodf.exe
        
        C:\Windows\system32\Ljaooodf.exe
        119⤵
        
        PID:3896
        
        C:\Windows\SysWOW64\Ldgclgcl.exe
        
        C:\Windows\system32\Ldgclgcl.exe
        120⤵
        System Location Discovery: System Language Discovery
        
        PID:1724
        
        C:\Windows\SysWOW64\Lkqliaki.exe
        
        C:\Windows\system32\Lkqliaki.exe
        121⤵
        System Location Discovery: System Language Discovery
        
        PID:1056
        
        C:\Windows\SysWOW64\Lmbhqj32.exe
        
        C:\Windows\system32\Lmbhqj32.exe
        122⤵
        
        PID:4784
        
        C:\Windows\SysWOW64\Lkchoaif.exe
        
        C:\Windows\system32\Lkchoaif.exe
        123⤵
        Modifies registry class
        
        PID:5752
        
        C:\Windows\SysWOW64\Mmdefi32.exe
        
        C:\Windows\system32\Mmdefi32.exe
        124⤵
        
        PID:4620
        
        C:\Windows\SysWOW64\Mcnmccfa.exe
        
        C:\Windows\system32\Mcnmccfa.exe
        125⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Mmfalimb.exe
        
        C:\Windows\system32\Mmfalimb.exe
        126⤵
        System Location Discovery: System Language Discovery
        
        PID:5376
        
        C:\Windows\SysWOW64\Mcqjhc32.exe
        
        C:\Windows\system32\Mcqjhc32.exe
        127⤵
        
        PID:4960
        
        C:\Windows\SysWOW64\Mminaikp.exe
        
        C:\Windows\system32\Mminaikp.exe
        128⤵
        
        PID:1320
        
        C:\Windows\SysWOW64\Mgoboake.exe
        
        C:\Windows\system32\Mgoboake.exe
        129⤵
        Drops file in System32 directory
        
        PID:6180
        
        C:\Windows\SysWOW64\Maggggaf.exe
        
        C:\Windows\system32\Maggggaf.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6220
        
        C:\Windows\SysWOW64\Mklkepal.exe
        
        C:\Windows\system32\Mklkepal.exe
        131⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Meepne32.exe
        
        C:\Windows\system32\Meepne32.exe
        132⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Mlohjpoi.exe
        
        C:\Windows\system32\Mlohjpoi.exe
        133⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6336
        
        C:\Windows\SysWOW64\Nmpdbh32.exe
        
        C:\Windows\system32\Nmpdbh32.exe
        134⤵
        System Location Discovery: System Language Discovery
        
        PID:6376
        
        C:\Windows\SysWOW64\Ngehoqdn.exe
        
        C:\Windows\system32\Ngehoqdn.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6416
        
        C:\Windows\SysWOW64\Nanmhf32.exe
        
        C:\Windows\system32\Nanmhf32.exe
        136⤵
        Modifies registry class
        
        PID:6456
        
        C:\Windows\SysWOW64\Nclida32.exe
        
        C:\Windows\system32\Nclida32.exe
        137⤵
        Modifies registry class
        
        PID:6496
        
        C:\Windows\SysWOW64\Njfaalao.exe
        
        C:\Windows\system32\Njfaalao.exe
        138⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Ncofjaho.exe
        
        C:\Windows\system32\Ncofjaho.exe
        139⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Njinfk32.exe
        
        C:\Windows\system32\Njinfk32.exe
        140⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Nenbdd32.exe
        
        C:\Windows\system32\Nenbdd32.exe
        141⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Njkklk32.exe
        
        C:\Windows\system32\Njkklk32.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6696
        
        C:\Windows\SysWOW64\Naecieef.exe
        
        C:\Windows\system32\Naecieef.exe
        143⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Nljgfn32.exe
        
        C:\Windows\system32\Nljgfn32.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6776
        
        C:\Windows\SysWOW64\Oagpne32.exe
        
        C:\Windows\system32\Oagpne32.exe
        145⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Olmdln32.exe
        
        C:\Windows\system32\Olmdln32.exe
        146⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Oajmdd32.exe
        
        C:\Windows\system32\Oajmdd32.exe
        147⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Oloaamqf.exe
        
        C:\Windows\system32\Oloaamqf.exe
        148⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Ompmie32.exe
        
        C:\Windows\system32\Ompmie32.exe
        149⤵
        Modifies registry class
        
        PID:6976
        
        C:\Windows\SysWOW64\Odjeepna.exe
        
        C:\Windows\system32\Odjeepna.exe
        150⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Oopjchnh.exe
        
        C:\Windows\system32\Oopjchnh.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7056
        
        C:\Windows\SysWOW64\Oejbpb32.exe
        
        C:\Windows\system32\Oejbpb32.exe
        152⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Ojgjhicl.exe
        
        C:\Windows\system32\Ojgjhicl.exe
        153⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Oeloebcb.exe
        
        C:\Windows\system32\Oeloebcb.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6160
        
        C:\Windows\SysWOW64\Podcnh32.exe
        
        C:\Windows\system32\Podcnh32.exe
        155⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Peokkbao.exe
        
        C:\Windows\system32\Peokkbao.exe
        156⤵
        System Location Discovery: System Language Discovery
        
        PID:6288
        
        C:\Windows\SysWOW64\Pogpcghp.exe
        
        C:\Windows\system32\Pogpcghp.exe
        157⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Pddhlnfg.exe
        
        C:\Windows\system32\Pddhlnfg.exe
        158⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Pmlmdd32.exe
        
        C:\Windows\system32\Pmlmdd32.exe
        159⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6508
        
        C:\Windows\SysWOW64\Phaabm32.exe
        
        C:\Windows\system32\Phaabm32.exe
        160⤵
        Modifies registry class
        
        PID:6572
        
        C:\Windows\SysWOW64\Pajekb32.exe
        
        C:\Windows\system32\Pajekb32.exe
        161⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Pkbjchio.exe
        
        C:\Windows\system32\Pkbjchio.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6708
        
        C:\Windows\SysWOW64\Palbpb32.exe
        
        C:\Windows\system32\Palbpb32.exe
        163⤵
        Drops file in System32 directory
        
        PID:6772
        
        C:\Windows\SysWOW64\Qlbfnk32.exe
        
        C:\Windows\system32\Qlbfnk32.exe
        164⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Qdmkbmnl.exe
        
        C:\Windows\system32\Qdmkbmnl.exe
        165⤵
        Drops file in System32 directory
        
        PID:6892
        
        C:\Windows\SysWOW64\Qkgcog32.exe
        
        C:\Windows\system32\Qkgcog32.exe
        166⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Qaalkamf.exe
        
        C:\Windows\system32\Qaalkamf.exe
        167⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Alfpijll.exe
        
        C:\Windows\system32\Alfpijll.exe
        168⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Aachaa32.exe
        
        C:\Windows\system32\Aachaa32.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7132
        
        C:\Windows\SysWOW64\Alimnj32.exe
        
        C:\Windows\system32\Alimnj32.exe
        170⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Anjifbpg.exe
        
        C:\Windows\system32\Anjifbpg.exe
        171⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Ahpmckpn.exe
        
        C:\Windows\system32\Ahpmckpn.exe
        172⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Aojepe32.exe
        
        C:\Windows\system32\Aojepe32.exe
        173⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6524
        
        C:\Windows\SysWOW64\Aecnmo32.exe
        
        C:\Windows\system32\Aecnmo32.exe
        174⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Aolbedeh.exe
        
        C:\Windows\system32\Aolbedeh.exe
        175⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Adiknkco.exe
        
        C:\Windows\system32\Adiknkco.exe
        176⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Aonokdce.exe
        
        C:\Windows\system32\Aonokdce.exe
        177⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Aehghn32.exe
        
        C:\Windows\system32\Aehghn32.exe
        178⤵
        System Location Discovery: System Language Discovery
        
        PID:7052
        
        C:\Windows\SysWOW64\Bkeppeii.exe
        
        C:\Windows\system32\Bkeppeii.exe
        179⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Bncllqhm.exe
        
        C:\Windows\system32\Bncllqhm.exe
        180⤵
        System Location Discovery: System Language Discovery
        
        PID:6320
        
        C:\Windows\SysWOW64\Bldljh32.exe
        
        C:\Windows\system32\Bldljh32.exe
        181⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Baadbo32.exe
        
        C:\Windows\system32\Baadbo32.exe
        182⤵
        Drops file in System32 directory
        
        PID:6788
        
        C:\Windows\SysWOW64\Bhkmoifp.exe
        
        C:\Windows\system32\Bhkmoifp.exe
        183⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Bnhegp32.exe
        
        C:\Windows\system32\Bnhegp32.exe
        184⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Bdbndjld.exe
        
        C:\Windows\system32\Bdbndjld.exe
        185⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Blieeglf.exe
        
        C:\Windows\system32\Blieeglf.exe
        186⤵
        Drops file in System32 directory
        
        PID:6852
        
        C:\Windows\SysWOW64\Beajnm32.exe
        
        C:\Windows\system32\Beajnm32.exe
        187⤵
        Drops file in System32 directory
        
        PID:6236
        
        C:\Windows\SysWOW64\Bojogb32.exe
        
        C:\Windows\system32\Bojogb32.exe
        188⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Cdggoi32.exe
        
        C:\Windows\system32\Cdggoi32.exe
        189⤵
        Drops file in System32 directory
        
        PID:6384
        
        C:\Windows\SysWOW64\Ckaolcol.exe
        
        C:\Windows\system32\Ckaolcol.exe
        190⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Cffcilob.exe
        
        C:\Windows\system32\Cffcilob.exe
        191⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Cnahmo32.exe
        
        C:\Windows\system32\Cnahmo32.exe
        192⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Cdlpjicj.exe
        
        C:\Windows\system32\Cdlpjicj.exe
        193⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Coadgacp.exe
        
        C:\Windows\system32\Coadgacp.exe
        194⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Cbpacmbc.exe
        
        C:\Windows\system32\Cbpacmbc.exe
        195⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Cleeafbi.exe
        
        C:\Windows\system32\Cleeafbi.exe
        196⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Cocamaam.exe
        
        C:\Windows\system32\Cocamaam.exe
        197⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Chlffghn.exe
        
        C:\Windows\system32\Chlffghn.exe
        198⤵
        Modifies registry class
        
        PID:7452
        
        C:\Windows\SysWOW64\Dbdjol32.exe
        
        C:\Windows\system32\Dbdjol32.exe
        199⤵
        Drops file in System32 directory
        
        PID:7496
        
        C:\Windows\SysWOW64\Dkmogbeo.exe
        
        C:\Windows\system32\Dkmogbeo.exe
        200⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Dbfgdllk.exe
        
        C:\Windows\system32\Dbfgdllk.exe
        201⤵
        Drops file in System32 directory
        
        PID:7580
        
        C:\Windows\SysWOW64\Dmlkaela.exe
        
        C:\Windows\system32\Dmlkaela.exe
        202⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Dfdpjj32.exe
        
        C:\Windows\system32\Dfdpjj32.exe
        203⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Dmnhgdjo.exe
        
        C:\Windows\system32\Dmnhgdjo.exe
        204⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Dnpdom32.exe
        
        C:\Windows\system32\Dnpdom32.exe
        205⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Dieilepc.exe
        
        C:\Windows\system32\Dieilepc.exe
        206⤵
        System Location Discovery: System Language Discovery
        
        PID:7780
        
        C:\Windows\SysWOW64\Dbnmek32.exe
        
        C:\Windows\system32\Dbnmek32.exe
        207⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\Dkfanqmd.exe
        
        C:\Windows\system32\Dkfanqmd.exe
        208⤵
        Drops file in System32 directory
        
        PID:7856
        
        C:\Windows\SysWOW64\Efkfkilj.exe
        
        C:\Windows\system32\Efkfkilj.exe
        209⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Emenhcdf.exe
        
        C:\Windows\system32\Emenhcdf.exe
        210⤵
        Drops file in System32 directory
        
        PID:7928
        
        C:\Windows\SysWOW64\Eodjdocj.exe
        
        C:\Windows\system32\Eodjdocj.exe
        211⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Eeqclfaa.exe
        
        C:\Windows\system32\Eeqclfaa.exe
        212⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Ekkkip32.exe
        
        C:\Windows\system32\Ekkkip32.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8040
        
        C:\Windows\SysWOW64\Ebdcejpk.exe
        
        C:\Windows\system32\Ebdcejpk.exe
        214⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Eiokbd32.exe
        
        C:\Windows\system32\Eiokbd32.exe
        215⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Ebgpkj32.exe
        
        C:\Windows\system32\Ebgpkj32.exe
        216⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Emldhb32.exe
        
        C:\Windows\system32\Emldhb32.exe
        217⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Ennqpkcm.exe
        
        C:\Windows\system32\Ennqpkcm.exe
        218⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Eehime32.exe
        
        C:\Windows\system32\Eehime32.exe
        219⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Ekaaio32.exe
        
        C:\Windows\system32\Ekaaio32.exe
        220⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Ffgegh32.exe
        
        C:\Windows\system32\Ffgegh32.exe
        221⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Fldnoo32.exe
        
        C:\Windows\system32\Fldnoo32.exe
        222⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7468
        
        C:\Windows\SysWOW64\Fbnflihq.exe
        
        C:\Windows\system32\Fbnflihq.exe
        223⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Fmcjiagf.exe
        
        C:\Windows\system32\Fmcjiagf.exe
        224⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Fnegqjne.exe
        
        C:\Windows\system32\Fnegqjne.exe
        225⤵
        System Location Discovery: System Language Discovery
        
        PID:7644
        
        C:\Windows\SysWOW64\Fijknbmk.exe
        
        C:\Windows\system32\Fijknbmk.exe
        226⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Fngcfikb.exe
        
        C:\Windows\system32\Fngcfikb.exe
        227⤵
        System Location Discovery: System Language Discovery
        
        PID:7768
        
        C:\Windows\SysWOW64\Flkdpnjl.exe
        
        C:\Windows\system32\Flkdpnjl.exe
        228⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Fbellhbi.exe
        
        C:\Windows\system32\Fbellhbi.exe
        229⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Fiodib32.exe
        
        C:\Windows\system32\Fiodib32.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7952
        
        C:\Windows\SysWOW64\Gpimflqb.exe
        
        C:\Windows\system32\Gpimflqb.exe
        231⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Giaaoa32.exe
        
        C:\Windows\system32\Giaaoa32.exe
        232⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Gpkiklop.exe
        
        C:\Windows\system32\Gpkiklop.exe
        233⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Gehbcb32.exe
        
        C:\Windows\system32\Gehbcb32.exe
        234⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Glbjpmdd.exe
        
        C:\Windows\system32\Glbjpmdd.exe
        235⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\Gifjjacn.exe
        
        C:\Windows\system32\Gifjjacn.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7404
        
        C:\Windows\SysWOW64\Gbnobf32.exe
        
        C:\Windows\system32\Gbnobf32.exe
        237⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Gmdcpoid.exe
        
        C:\Windows\system32\Gmdcpoid.exe
        238⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Gbqlhfgk.exe
        
        C:\Windows\system32\Gbqlhfgk.exe
        239⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Geohdago.exe
        
        C:\Windows\system32\Geohdago.exe
        240⤵
        Modifies registry class
        
        PID:7808
        
        C:\Windows\SysWOW64\Hlipal32.exe
        
        C:\Windows\system32\Hlipal32.exe
        241⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Headjael.exe
        
        C:\Windows\system32\Headjael.exe
        242⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8000
        
        C:\Windows\SysWOW64\Hpgigj32.exe
        
        C:\Windows\system32\Hpgigj32.exe
        243⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Hiomppkc.exe
        
        C:\Windows\system32\Hiomppkc.exe
        244⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Holfhfij.exe
        
        C:\Windows\system32\Holfhfij.exe
        245⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Hiajeoip.exe
        
        C:\Windows\system32\Hiajeoip.exe
        246⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7560
        
        C:\Windows\SysWOW64\Hoobnf32.exe
        
        C:\Windows\system32\Hoobnf32.exe
        247⤵
        Modifies registry class
        
        PID:7736
        
        C:\Windows\SysWOW64\Hfekoc32.exe
        
        C:\Windows\system32\Hfekoc32.exe
        248⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7944
        
        C:\Windows\SysWOW64\Hlbcgj32.exe
        
        C:\Windows\system32\Hlbcgj32.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8140
        
        C:\Windows\SysWOW64\Hblkddmn.exe
        
        C:\Windows\system32\Hblkddmn.exe
        250⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Hifcqo32.exe
        
        C:\Windows\system32\Hifcqo32.exe
        251⤵
        System Location Discovery: System Language Discovery
        
        PID:7776
        
        C:\Windows\SysWOW64\Ipplmh32.exe
        
        C:\Windows\system32\Ipplmh32.exe
        252⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Iiipfnch.exe
        
        C:\Windows\system32\Iiipfnch.exe
        253⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Ilglbjbl.exe
        
        C:\Windows\system32\Ilglbjbl.exe
        254⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Ibadoc32.exe
        
        C:\Windows\system32\Ibadoc32.exe
        255⤵
        Modifies registry class
        
        PID:8208
        
        C:\Windows\SysWOW64\Imfill32.exe
        
        C:\Windows\system32\Imfill32.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8240
        
        C:\Windows\SysWOW64\Iohede32.exe
        
        C:\Windows\system32\Iohede32.exe
        257⤵
        System Location Discovery: System Language Discovery
        
        PID:8272
        
        C:\Windows\SysWOW64\Iimjan32.exe
        
        C:\Windows\system32\Iimjan32.exe
        258⤵
        Modifies registry class
        
        PID:8304
        
        C:\Windows\SysWOW64\Ipgbngfp.exe
        
        C:\Windows\system32\Ipgbngfp.exe
        259⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Igajka32.exe
        
        C:\Windows\system32\Igajka32.exe
        260⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8368
        
        C:\Windows\SysWOW64\Ilnbch32.exe
        
        C:\Windows\system32\Ilnbch32.exe
        261⤵
        System Location Discovery: System Language Discovery
        
        PID:8400
        
        C:\Windows\SysWOW64\Ichkpb32.exe
        
        C:\Windows\system32\Ichkpb32.exe
        262⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Iefgln32.exe
        
        C:\Windows\system32\Iefgln32.exe
        263⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8464
        
        C:\Windows\SysWOW64\Jlqohhja.exe
        
        C:\Windows\system32\Jlqohhja.exe
        264⤵
        Modifies registry class
        
        PID:8496
        
        C:\Windows\SysWOW64\Jgfcfajg.exe
        
        C:\Windows\system32\Jgfcfajg.exe
        265⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8528
        
        C:\Windows\SysWOW64\Jlclnhho.exe
        
        C:\Windows\system32\Jlclnhho.exe
        266⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Jcmdkbok.exe
        
        C:\Windows\system32\Jcmdkbok.exe
        267⤵
        Drops file in System32 directory
        
        PID:8596
        
        C:\Windows\SysWOW64\Jiglgl32.exe
        
        C:\Windows\system32\Jiglgl32.exe
        268⤵
        System Location Discovery: System Language Discovery
        
        PID:8628
        
        C:\Windows\SysWOW64\Jleicg32.exe
        
        C:\Windows\system32\Jleicg32.exe
        269⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Jcoapami.exe
        
        C:\Windows\system32\Jcoapami.exe
        270⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8692
        
        C:\Windows\SysWOW64\Jndenjmo.exe
        
        C:\Windows\system32\Jndenjmo.exe
        271⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Jofaeb32.exe
        
        C:\Windows\system32\Jofaeb32.exe
        272⤵
        System Location Discovery: System Language Discovery
        
        PID:8756
        
        C:\Windows\SysWOW64\Jikfbkbc.exe
        
        C:\Windows\system32\Jikfbkbc.exe
        273⤵
        Modifies registry class
        
        PID:8788
        
        C:\Windows\SysWOW64\Jcdjka32.exe
        
        C:\Windows\system32\Jcdjka32.exe
        274⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Kjnbhkqp.exe
        
        C:\Windows\system32\Kjnbhkqp.exe
        275⤵
        Drops file in System32 directory
        
        PID:8852
        
        C:\Windows\SysWOW64\Kokkqbog.exe
        
        C:\Windows\system32\Kokkqbog.exe
        276⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\Kedcml32.exe
        
        C:\Windows\system32\Kedcml32.exe
        277⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Komhfa32.exe
        
        C:\Windows\system32\Komhfa32.exe
        278⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8948
        
        C:\Windows\SysWOW64\Kfgpblda.exe
        
        C:\Windows\system32\Kfgpblda.exe
        279⤵
        Drops file in System32 directory
        
        PID:8980
        
        C:\Windows\SysWOW64\Knnhdied.exe
        
        C:\Windows\system32\Knnhdied.exe
        280⤵
        Modifies registry class
        
        PID:9012
        
        C:\Windows\SysWOW64\Kckqlpck.exe
        
        C:\Windows\system32\Kckqlpck.exe
        281⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Kjeiij32.exe
        
        C:\Windows\system32\Kjeiij32.exe
        282⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Kpoaed32.exe
        
        C:\Windows\system32\Kpoaed32.exe
        283⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Kgiibnib.exe
        
        C:\Windows\system32\Kgiibnib.exe
        284⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Kleajegi.exe
        
        C:\Windows\system32\Kleajegi.exe
        285⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Kgkfhngo.exe
        
        C:\Windows\system32\Kgkfhngo.exe
        286⤵
        Modifies registry class
        
        PID:9204
        
        C:\Windows\SysWOW64\Llhnpe32.exe
        
        C:\Windows\system32\Llhnpe32.exe
        287⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8228
        
        C:\Windows\SysWOW64\Lgmbmn32.exe
        
        C:\Windows\system32\Lgmbmn32.exe
        288⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Lljked32.exe
        
        C:\Windows\system32\Lljked32.exe
        289⤵
        Modifies registry class
        
        PID:8360
        
        C:\Windows\SysWOW64\Lcdcbokq.exe
        
        C:\Windows\system32\Lcdcbokq.exe
        290⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Lnjgpgkf.exe
        
        C:\Windows\system32\Lnjgpgkf.exe
        291⤵
        Drops file in System32 directory
        
        PID:8484
        
        C:\Windows\SysWOW64\Lokdgpqe.exe
        
        C:\Windows\system32\Lokdgpqe.exe
        292⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Lfeldj32.exe
        
        C:\Windows\system32\Lfeldj32.exe
        293⤵
        Modifies registry class
        
        PID:8616
        
        C:\Windows\SysWOW64\Lqjqab32.exe
        
        C:\Windows\system32\Lqjqab32.exe
        294⤵
        System Location Discovery: System Language Discovery
        
        PID:8684
        
        C:\Windows\SysWOW64\Lgdinmod.exe
        
        C:\Windows\system32\Lgdinmod.exe
        295⤵
        Modifies registry class
        
        PID:8748
        
        C:\Windows\SysWOW64\Lmaafcml.exe
        
        C:\Windows\system32\Lmaafcml.exe
        296⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8808
        
        C:\Windows\SysWOW64\Lckicnei.exe
        
        C:\Windows\system32\Lckicnei.exe
        297⤵
        Drops file in System32 directory
        
        PID:8872
        
        C:\Windows\SysWOW64\Mjeaph32.exe
        
        C:\Windows\system32\Mjeaph32.exe
        298⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Mqojlbcb.exe
        
        C:\Windows\system32\Mqojlbcb.exe
        299⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Mgibil32.exe
        
        C:\Windows\system32\Mgibil32.exe
        300⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Mqafbaap.exe
        
        C:\Windows\system32\Mqafbaap.exe
        301⤵
        System Location Discovery: System Language Discovery
        
        PID:9132
        
        C:\Windows\SysWOW64\Mgkoolil.exe
        
        C:\Windows\system32\Mgkoolil.exe
        302⤵
        Modifies registry class
        
        PID:9196
        
        C:\Windows\SysWOW64\Mnegkf32.exe
        
        C:\Windows\system32\Mnegkf32.exe
        303⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Mogccnfg.exe
        
        C:\Windows\system32\Mogccnfg.exe
        304⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8396
        
        C:\Windows\SysWOW64\Mfqlph32.exe
        
        C:\Windows\system32\Mfqlph32.exe
        305⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8524
        
        C:\Windows\SysWOW64\Mmkdlbea.exe
        
        C:\Windows\system32\Mmkdlbea.exe
        306⤵
        Modifies registry class
        
        PID:8656
        
        C:\Windows\SysWOW64\Moiphnde.exe
        
        C:\Windows\system32\Moiphnde.exe
        307⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Mfchehla.exe
        
        C:\Windows\system32\Mfchehla.exe
        308⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8924
        
        C:\Windows\SysWOW64\Mqhmbqlh.exe
        
        C:\Windows\system32\Mqhmbqlh.exe
        309⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9052
        
        C:\Windows\SysWOW64\Nfeekgjo.exe
        
        C:\Windows\system32\Nfeekgjo.exe
        310⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Nmomga32.exe
        
        C:\Windows\system32\Nmomga32.exe
        311⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8356
        
        C:\Windows\SysWOW64\Ncifdlii.exe
        
        C:\Windows\system32\Ncifdlii.exe
        312⤵
        System Location Discovery: System Language Discovery
        
        PID:8636
        
        C:\Windows\SysWOW64\Nqmfnp32.exe
        
        C:\Windows\system32\Nqmfnp32.exe
        313⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Nfjofg32.exe
        
        C:\Windows\system32\Nfjofg32.exe
        314⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Nqpccp32.exe
        
        C:\Windows\system32\Nqpccp32.exe
        315⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8556
        
        C:\Windows\SysWOW64\Ngikpjml.exe
        
        C:\Windows\system32\Ngikpjml.exe
        316⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Nnccmddi.exe
        
        C:\Windows\system32\Nnccmddi.exe
        317⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8860
        
        C:\Windows\SysWOW64\Npepdl32.exe
        
        C:\Windows\system32\Npepdl32.exe
        318⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Njjdae32.exe
        
        C:\Windows\system32\Njjdae32.exe
        319⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9236
        
        C:\Windows\SysWOW64\Npgmjl32.exe
        
        C:\Windows\system32\Npgmjl32.exe
        320⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\Ogndki32.exe
        
        C:\Windows\system32\Ogndki32.exe
        321⤵
        
        PID:9300
        
        C:\Windows\SysWOW64\Onhmhc32.exe
        
        C:\Windows\system32\Onhmhc32.exe
        322⤵
        
        PID:9332
        
        C:\Windows\SysWOW64\Opiipkfb.exe
        
        C:\Windows\system32\Opiipkfb.exe
        323⤵
        Modifies registry class
        
        PID:9364
        
        C:\Windows\SysWOW64\Ofcale32.exe
        
        C:\Windows\system32\Ofcale32.exe
        324⤵
        
        PID:9396
        
        C:\Windows\SysWOW64\Ommjipel.exe
        
        C:\Windows\system32\Ommjipel.exe
        325⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\Ocgbej32.exe
        
        C:\Windows\system32\Ocgbej32.exe
        326⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\Ojajbdde.exe
        
        C:\Windows\system32\Ojajbdde.exe
        327⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\Ocjokijf.exe
        
        C:\Windows\system32\Ocjokijf.exe
        328⤵
        
        PID:9524
        
        C:\Windows\SysWOW64\Ojcghc32.exe
        
        C:\Windows\system32\Ojcghc32.exe
        329⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9556
        
        C:\Windows\SysWOW64\Oclkqihc.exe
        
        C:\Windows\system32\Oclkqihc.exe
        330⤵
        Drops file in System32 directory
        
        PID:9588
        
        C:\Windows\SysWOW64\Omdpio32.exe
        
        C:\Windows\system32\Omdpio32.exe
        331⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\Pcnhfi32.exe
        
        C:\Windows\system32\Pcnhfi32.exe
        332⤵
        
        PID:9652
        
        C:\Windows\SysWOW64\Pfmdbd32.exe
        
        C:\Windows\system32\Pfmdbd32.exe
        333⤵
        
        PID:9684
        
        C:\Windows\SysWOW64\Pmgmonma.exe
        
        C:\Windows\system32\Pmgmonma.exe
        334⤵
        Drops file in System32 directory
        
        PID:9716
        
        C:\Windows\SysWOW64\Ppeikjle.exe
        
        C:\Windows\system32\Ppeikjle.exe
        335⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\Pfoahd32.exe
        
        C:\Windows\system32\Pfoahd32.exe
        336⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Pmiidnko.exe
        
        C:\Windows\system32\Pmiidnko.exe
        337⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Phombg32.exe
        
        C:\Windows\system32\Phombg32.exe
        338⤵
        
        PID:9848
        
        C:\Windows\SysWOW64\Pnifoaba.exe
        
        C:\Windows\system32\Pnifoaba.exe
        339⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Ppjbfi32.exe
        
        C:\Windows\system32\Ppjbfi32.exe
        340⤵
        System Location Discovery: System Language Discovery
        
        PID:9912
        
        C:\Windows\SysWOW64\Pfdjccol.exe
        
        C:\Windows\system32\Pfdjccol.exe
        341⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\Pmnbpm32.exe
        
        C:\Windows\system32\Pmnbpm32.exe
        342⤵
        
        PID:9976
        
        C:\Windows\SysWOW64\Phcgmffo.exe
        
        C:\Windows\system32\Phcgmffo.exe
        343⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10008
        
        C:\Windows\SysWOW64\Pmpoemef.exe
        
        C:\Windows\system32\Pmpoemef.exe
        344⤵
        System Location Discovery: System Language Discovery
        
        PID:10040
        
        C:\Windows\SysWOW64\Qpolahdj.exe
        
        C:\Windows\system32\Qpolahdj.exe
        345⤵
        System Location Discovery: System Language Discovery
        
        PID:10072
        
        C:\Windows\SysWOW64\Qjdpoacp.exe
        
        C:\Windows\system32\Qjdpoacp.exe
        346⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Qanhkk32.exe
        
        C:\Windows\system32\Qanhkk32.exe
        347⤵
        Drops file in System32 directory
        
        PID:10136
        
        C:\Windows\SysWOW64\Qdldgg32.exe
        
        C:\Windows\system32\Qdldgg32.exe
        348⤵
        Modifies registry class
        
        PID:10168
        
        C:\Windows\SysWOW64\Qobhepjf.exe
        
        C:\Windows\system32\Qobhepjf.exe
        349⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\Adoamfhn.exe
        
        C:\Windows\system32\Adoamfhn.exe
        350⤵
        
        PID:10232
        
        C:\Windows\SysWOW64\Afmmibga.exe
        
        C:\Windows\system32\Afmmibga.exe
        351⤵
        System Location Discovery: System Language Discovery
        
        PID:9264
        
        C:\Windows\SysWOW64\Aabafkgh.exe
        
        C:\Windows\system32\Aabafkgh.exe
        352⤵
        
        PID:9328
        
        C:\Windows\SysWOW64\Adanbffk.exe
        
        C:\Windows\system32\Adanbffk.exe
        353⤵
        
        PID:9360
        
        C:\Windows\SysWOW64\Aphngglp.exe
        
        C:\Windows\system32\Aphngglp.exe
        354⤵
        
        PID:9424
        
        C:\Windows\SysWOW64\Ahofidlb.exe
        
        C:\Windows\system32\Ahofidlb.exe
        355⤵
        System Location Discovery: System Language Discovery
        
        PID:9488
        
        C:\Windows\SysWOW64\Amloakki.exe
        
        C:\Windows\system32\Amloakki.exe
        356⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9552
        
        C:\Windows\SysWOW64\Adfgne32.exe
        
        C:\Windows\system32\Adfgne32.exe
        357⤵
        Modifies registry class
        
        PID:9616
        
        C:\Windows\SysWOW64\Aokkknbl.exe
        
        C:\Windows\system32\Aokkknbl.exe
        358⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9680
        
        C:\Windows\SysWOW64\Aajggjap.exe
        
        C:\Windows\system32\Aajggjap.exe
        359⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\Ahdpdd32.exe
        
        C:\Windows\system32\Ahdpdd32.exe
        360⤵
        
        PID:9836
        
        C:\Windows\SysWOW64\Bonhqnpi.exe
        
        C:\Windows\system32\Bonhqnpi.exe
        361⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\Bhfmic32.exe
        
        C:\Windows\system32\Bhfmic32.exe
        362⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9968
        
        C:\Windows\SysWOW64\Bkdieo32.exe
        
        C:\Windows\system32\Bkdieo32.exe
        363⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10028
        
        C:\Windows\SysWOW64\Banabi32.exe
        
        C:\Windows\system32\Banabi32.exe
        364⤵
        
        PID:10092
        
        C:\Windows\SysWOW64\Bgkijp32.exe
        
        C:\Windows\system32\Bgkijp32.exe
        365⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10156
        
        C:\Windows\SysWOW64\Baanhi32.exe
        
        C:\Windows\system32\Baanhi32.exe
        366⤵
        System Location Discovery: System Language Discovery
        
        PID:4168
        
        C:\Windows\SysWOW64\Bkibqnah.exe
        
        C:\Windows\system32\Bkibqnah.exe
        367⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\Bdagidhi.exe
        
        C:\Windows\system32\Bdagidhi.exe
        368⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Bogkgmho.exe
        
        C:\Windows\system32\Bogkgmho.exe
        369⤵
        Drops file in System32 directory
        
        PID:9548
        
        C:\Windows\SysWOW64\Bphgoe32.exe
        
        C:\Windows\system32\Bphgoe32.exe
        370⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Cahdhhep.exe
        
        C:\Windows\system32\Cahdhhep.exe
        371⤵
        
        PID:10036
        
        C:\Windows\SysWOW64\Cgdlqo32.exe
        
        C:\Windows\system32\Cgdlqo32.exe
        372⤵
        
        PID:10164
        
        C:\Windows\SysWOW64\Coldbl32.exe
        
        C:\Windows\system32\Coldbl32.exe
        373⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9324
        
        C:\Windows\SysWOW64\Cpmajdig.exe
        
        C:\Windows\system32\Cpmajdig.exe
        374⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Cggifn32.exe
        
        C:\Windows\system32\Cggifn32.exe
        375⤵
        Modifies registry class
        
        PID:9808
        
        C:\Windows\SysWOW64\Calmcg32.exe
        
        C:\Windows\system32\Calmcg32.exe
        376⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\Chfepa32.exe
        
        C:\Windows\system32\Chfepa32.exe
        377⤵
        
        PID:10132
        
        C:\Windows\SysWOW64\Caojigoh.exe
        
        C:\Windows\system32\Caojigoh.exe
        378⤵
        
        PID:9516
        
        C:\Windows\SysWOW64\Cglbanmo.exe
        
        C:\Windows\system32\Cglbanmo.exe
        379⤵
        
        PID:9868
        
        C:\Windows\SysWOW64\Caagofme.exe
        
        C:\Windows\system32\Caagofme.exe
        380⤵
        System Location Discovery: System Language Discovery
        
        PID:9244
        
        C:\Windows\SysWOW64\Cdpckbli.exe
        
        C:\Windows\system32\Cdpckbli.exe
        381⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\Dkikglce.exe
        
        C:\Windows\system32\Dkikglce.exe
        382⤵
        Modifies registry class
        
        PID:9612
        
        C:\Windows\SysWOW64\Daccdf32.exe
        
        C:\Windows\system32\Daccdf32.exe
        383⤵
        
        PID:10268
        
        C:\Windows\SysWOW64\Dhnlapbo.exe
        
        C:\Windows\system32\Dhnlapbo.exe
        384⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10300
        
        C:\Windows\SysWOW64\Dnjdigpf.exe
        
        C:\Windows\system32\Dnjdigpf.exe
        385⤵
        
        PID:10332
        
        C:\Windows\SysWOW64\Dhphfppl.exe
        
        C:\Windows\system32\Dhphfppl.exe
        386⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:10364
        
        C:\Windows\SysWOW64\Dnmaog32.exe
        
        C:\Windows\system32\Dnmaog32.exe
        387⤵
        
        PID:10396
        
        C:\Windows\SysWOW64\Dqkmkb32.exe
        
        C:\Windows\system32\Dqkmkb32.exe
        388⤵
        Drops file in System32 directory
        
        PID:10428
        
        C:\Windows\SysWOW64\Dgeegled.exe
        
        C:\Windows\system32\Dgeegled.exe
        389⤵
        
        PID:10460
        
        C:\Windows\SysWOW64\Dnondf32.exe
        
        C:\Windows\system32\Dnondf32.exe
        390⤵
        
        PID:10492
        
        C:\Windows\SysWOW64\Dkcnnk32.exe
        
        C:\Windows\system32\Dkcnnk32.exe
        391⤵
        
        PID:10596
        
        C:\Windows\SysWOW64\Dbmfje32.exe
        
        C:\Windows\system32\Dbmfje32.exe
        392⤵
        
        PID:10628
        
        C:\Windows\SysWOW64\Ddkbfp32.exe
        
        C:\Windows\system32\Ddkbfp32.exe
        393⤵
        Modifies registry class
        
        PID:10660
        
        C:\Windows\SysWOW64\Eoagdi32.exe
        
        C:\Windows\system32\Eoagdi32.exe
        394⤵
        
        PID:10692
        
        C:\Windows\SysWOW64\Ebocpd32.exe
        
        C:\Windows\system32\Ebocpd32.exe
        395⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:10728
        
        C:\Windows\SysWOW64\Ednolp32.exe
        
        C:\Windows\system32\Ednolp32.exe
        396⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\Ebapednb.exe
        
        C:\Windows\system32\Ebapednb.exe
        397⤵
        
        PID:10792
        
        C:\Windows\SysWOW64\Ehlhbn32.exe
        
        C:\Windows\system32\Ehlhbn32.exe
        398⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10824
        
        C:\Windows\SysWOW64\Eoepohml.exe
        
        C:\Windows\system32\Eoepohml.exe
        399⤵
        
        PID:10856
        
        C:\Windows\SysWOW64\Edbhgokc.exe
        
        C:\Windows\system32\Edbhgokc.exe
        400⤵
        Drops file in System32 directory
        
        PID:10888
        
        C:\Windows\SysWOW64\Ekladi32.exe
        
        C:\Windows\system32\Ekladi32.exe
        401⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\Ebfiqcjm.exe
        
        C:\Windows\system32\Ebfiqcjm.exe
        402⤵
        
        PID:10952
        
        C:\Windows\SysWOW64\Eddemo32.exe
        
        C:\Windows\system32\Eddemo32.exe
        403⤵
        Drops file in System32 directory
        
        PID:10984
        
        C:\Windows\SysWOW64\Ekoniian.exe
        
        C:\Windows\system32\Ekoniian.exe
        404⤵
        Drops file in System32 directory
        
        PID:11016
        
        C:\Windows\SysWOW64\Ebiffc32.exe
        
        C:\Windows\system32\Ebiffc32.exe
        405⤵
        
        PID:11048
        
        C:\Windows\SysWOW64\Fgenoj32.exe
        
        C:\Windows\system32\Fgenoj32.exe
        406⤵
        
        PID:11088
        
        C:\Windows\SysWOW64\Fbkblb32.exe
        
        C:\Windows\system32\Fbkblb32.exe
        407⤵
        
        PID:11120
        
        C:\Windows\SysWOW64\Fdiohnek.exe
        
        C:\Windows\system32\Fdiohnek.exe
        408⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11152
        
        C:\Windows\SysWOW64\Fkcgdh32.exe
        
        C:\Windows\system32\Fkcgdh32.exe
        409⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11184
        
        C:\Windows\SysWOW64\Felkmnci.exe
        
        C:\Windows\system32\Felkmnci.exe
        410⤵
        
        PID:11216
        
        C:\Windows\SysWOW64\Foapkfco.exe
        
        C:\Windows\system32\Foapkfco.exe
        411⤵
        System Location Discovery: System Language Discovery
        
        PID:11248
        
        C:\Windows\SysWOW64\Fenhcnaf.exe
        
        C:\Windows\system32\Fenhcnaf.exe
        412⤵
        
        PID:10276
        
        C:\Windows\SysWOW64\Fkhppgic.exe
        
        C:\Windows\system32\Fkhppgic.exe
        413⤵
        System Location Discovery: System Language Discovery
        
        PID:10340
        
        C:\Windows\SysWOW64\Faeihogj.exe
        
        C:\Windows\system32\Faeihogj.exe
        414⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10392
        
        C:\Windows\SysWOW64\Fgoadi32.exe
        
        C:\Windows\system32\Fgoadi32.exe
        415⤵
        Drops file in System32 directory
        
        PID:10456
        
        C:\Windows\SysWOW64\Fbdeba32.exe
        
        C:\Windows\system32\Fbdeba32.exe
        416⤵
        
        PID:10520
        
        C:\Windows\SysWOW64\Ginnokej.exe
        
        C:\Windows\system32\Ginnokej.exe
        417⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10516
        
        C:\Windows\SysWOW64\Gohfkemf.exe
        
        C:\Windows\system32\Gohfkemf.exe
        418⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10572
        
        C:\Windows\SysWOW64\Geenclkn.exe
        
        C:\Windows\system32\Geenclkn.exe
        419⤵
        
        PID:10648
        
        C:\Windows\SysWOW64\Gpkbaekd.exe
        
        C:\Windows\system32\Gpkbaekd.exe
        420⤵
        
        PID:10716
        
        C:\Windows\SysWOW64\Galoin32.exe
        
        C:\Windows\system32\Galoin32.exe
        421⤵
        
        PID:10780
        
        C:\Windows\SysWOW64\Ggfgegho.exe
        
        C:\Windows\system32\Ggfgegho.exe
        422⤵
        
        PID:10848
        
        C:\Windows\SysWOW64\Gbkkbp32.exe
        
        C:\Windows\system32\Gbkkbp32.exe
        423⤵
        
        PID:10908
        
        C:\Windows\SysWOW64\Giecojpb.exe
        
        C:\Windows\system32\Giecojpb.exe
        424⤵
        
        PID:10976
        
        C:\Windows\SysWOW64\Gpolld32.exe
        
        C:\Windows\system32\Gpolld32.exe
        425⤵
        System Location Discovery: System Language Discovery
        
        PID:11036
        
        C:\Windows\SysWOW64\Gelddk32.exe
        
        C:\Windows\system32\Gelddk32.exe
        426⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11108
        
        C:\Windows\SysWOW64\Glfmaemc.exe
        
        C:\Windows\system32\Glfmaemc.exe
        427⤵
        
        PID:11172
        
        C:\Windows\SysWOW64\Gbpenpdp.exe
        
        C:\Windows\system32\Gbpenpdp.exe
        428⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11236
        
        C:\Windows\SysWOW64\Hlhife32.exe
        
        C:\Windows\system32\Hlhife32.exe
        429⤵
        
        PID:10324
        
        C:\Windows\SysWOW64\Heqnokaq.exe
        
        C:\Windows\system32\Heqnokaq.exe
        430⤵
        
        PID:10436
        
        C:\Windows\SysWOW64\Hnibhp32.exe
        
        C:\Windows\system32\Hnibhp32.exe
        431⤵
        
        PID:10504
        
        C:\Windows\SysWOW64\Hecjej32.exe
        
        C:\Windows\system32\Hecjej32.exe
        432⤵
        
        PID:10616
        
        C:\Windows\SysWOW64\Hpiobc32.exe
        
        C:\Windows\system32\Hpiobc32.exe
        433⤵
        
        PID:10724
        
        C:\Windows\SysWOW64\Heegjj32.exe
        
        C:\Windows\system32\Heegjj32.exe
        434⤵
        
        PID:10852
        
        C:\Windows\SysWOW64\Hlppgddh.exe
        
        C:\Windows\system32\Hlppgddh.exe
        435⤵
        
        PID:10980
        
        C:\Windows\SysWOW64\Halhpkbp.exe
        
        C:\Windows\system32\Halhpkbp.exe
        436⤵
        
        PID:11116
        
        C:\Windows\SysWOW64\Hhfplejl.exe
        
        C:\Windows\system32\Hhfplejl.exe
        437⤵
        
        PID:11244
        
        C:\Windows\SysWOW64\Hnphio32.exe
        
        C:\Windows\system32\Hnphio32.exe
        438⤵
        System Location Discovery: System Language Discovery
        
        PID:10452
        
        C:\Windows\SysWOW64\Iaodek32.exe
        
        C:\Windows\system32\Iaodek32.exe
        439⤵
        
        PID:10624
        
        C:\Windows\SysWOW64\Iobeno32.exe
        
        C:\Windows\system32\Iobeno32.exe
        440⤵
        System Location Discovery: System Language Discovery
        
        PID:10884
        
        C:\Windows\SysWOW64\Ihkigd32.exe
        
        C:\Windows\system32\Ihkigd32.exe
        441⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11148
        
        C:\Windows\SysWOW64\Ibqndm32.exe
        
        C:\Windows\system32\Ibqndm32.exe
        442⤵
        Modifies registry class
        
        PID:10532
        
        C:\Windows\SysWOW64\Iijfagmj.exe
        
        C:\Windows\system32\Iijfagmj.exe
        443⤵
        
        PID:10960
        
        C:\Windows\SysWOW64\Ipdnna32.exe
        
        C:\Windows\system32\Ipdnna32.exe
        444⤵
        
        PID:10584
        
        C:\Windows\SysWOW64\Ieagfh32.exe
        
        C:\Windows\system32\Ieagfh32.exe
        445⤵
        
        PID:10812
        
        C:\Windows\SysWOW64\Ilkocb32.exe
        
        C:\Windows\system32\Ilkocb32.exe
        446⤵
        
        PID:11280
        
        C:\Windows\SysWOW64\Ibegpmah.exe
        
        C:\Windows\system32\Ibegpmah.exe
        447⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11312
        
        C:\Windows\SysWOW64\Ihbphcpo.exe
        
        C:\Windows\system32\Ihbphcpo.exe
        448⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:11344
        
        C:\Windows\SysWOW64\Ipihiaqa.exe
        
        C:\Windows\system32\Ipihiaqa.exe
        449⤵
        System Location Discovery: System Language Discovery
        
        PID:11376
        
        C:\Windows\SysWOW64\Jialbf32.exe
        
        C:\Windows\system32\Jialbf32.exe
        450⤵
        
        PID:11408
        
        C:\Windows\SysWOW64\Jpkdoq32.exe
        
        C:\Windows\system32\Jpkdoq32.exe
        451⤵
        
        PID:11440
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11440 -s 448
        452⤵
        Program crash
        
        PID:11520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 11440 -ip 11440
1⤵
PID:11496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Bbbkmebo.exe

Path C:\Windows\SysWOW64\Bbbkmebo.exe
Size 429KB
SHA256 e2996d0c641219a4cb0eee093235e5416c83eff276134ff17877edbb954390ba
MD5 a4279c68464df085e24f65120b0b86d4
SHA1 f31b22f1685ff385460469220393ad766c7a9d91
SHA512 049a18728fdeef5b324a41ff6f0eabf0d1bb96c87d8281d6b203d9070640ad33cc064d4729da3fe6fa2d13ecea5acb59d53b4718ec2082ce5c8747fbc867d6a3
SSDEEP 6144:4duYRBgV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:4tx/NcZ7/N
TLSH
T1459460692A3019E9DDEE6BB5AC524AD88181E5B214F1F13F6A77DFDCC8E4D61CC04B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bbgehd32.exe

Path C:\Windows\SysWOW64\Bbgehd32.exe
Size 429KB
SHA256 4e35fe253b3beab2d100f7daa650f20d17c1dad1cd5339551327c0b1ac94c286
MD5 57296e3a526e9dfd8a2611296bf91856
SHA1 9a8a6dca85a7a8073efd2500ac614801ed8de351
SHA512 9167a495dd76f85db61fa5ac68a9ba589d23aff280ff475019c0f89a7d4dd73bb2abbfd209b59693236ea77210bfc5226a714327a3ba3c0ff102a8c0d1088255
SSDEEP 6144:7S6nV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:7K/NcZ7/N
TLSH
T1FC944F65663059E9DDEE6BB5AC1289D881C1E5B114F2F13E6623DFDCC8E8EA1CC04BC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bcahgh32.exe

Path C:\Windows\SysWOW64\Bcahgh32.exe
Size 429KB
SHA256 2f60544934805eb86ce9bb49abfa947101a59b1ca7c380016293bef113c9841c
MD5 77fdb5441c3a3cf25f334693e2c6daa4
SHA1 9f6e76c064d920441f9497c02f195975c2f5fae0
SHA512 24ef3dd724510b3e772df074fa1bbabf1e81ddef623615baa0bf016de5d7e9794ef29a390e9d27517cce7cd2f098a65f701003d9d245103bc953c07e2829b1f1
SSDEEP 6144:7jIXryVTdmV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:7jIXryVT9/NcZ7/N
TLSH
T1E6946F252A3019E6DDEE6BB5ED1249DA8181E5B114F1F13E6633DFDCE8E4DA1CC08B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bcfabgel.exe

Path C:\Windows\SysWOW64\Bcfabgel.exe
Size 429KB
SHA256 0d9d069650c6df3f77b55ce5a5f545a9eecbc6c723beff91c2ba925e187e2502
MD5 5c6a6a526573749d5adafbc9f4e183ca
SHA1 f8d51dc22b339fdff7e17c5bb2e344f7ce66f54c
SHA512 38a4cb6b7ab4a30de19aa68c0323a99bea92c154e3a0d5fa01a4e8d539a88e0febe47eee757008acc6834668df4b61eb5c462351a8f8f24de9e489c62268c2a9
SSDEEP 6144:QqKU9XPl1g00x/aV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:/KCfg00R/NcZ7/N
TLSH
T1A6948465AA351AE5DDEE6BB5AC1249D88181E4B114F1F13E6A33DFECC8E4DA1CC04F84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bfenncdp.exe

Path C:\Windows\SysWOW64\Bfenncdp.exe
Size 429KB
SHA256 c674feedc8402cd0584bc30a367e52869e995c89724f46141645f62173fbfc15
MD5 22755c5830e6ec1833837ab66635cdd7
SHA1 3b5df2f43142b2436027ba83cf78b44ab41c6da2
SHA512 297f3c8cb33b442925ff8cfe765edcb894f047453cd03ca7970fe0899ea3cef45ca46c9ce23edfa9c1f70cf2cf527e4653b66ccace7c9aec4342160a64afee6a
SSDEEP 6144:StVZzqCV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:oVNW/NcZ7/N
TLSH
T10F9480692A7419E5DDEE6BB5AC2289E98181E4B104F1F13E6633DFDCD8E4D62CC04F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bhjgdplo.exe

Path C:\Windows\SysWOW64\Bhjgdplo.exe
Size 429KB
SHA256 ddc2b9c00409e670bc7aeba64ac33a515de832ed9f449bf0ec8d6f85bd642469
MD5 56f1bede6076754b1e45d30421ed48cd
SHA1 1de69e937823a3a3137fb8469b6dc90af795caf0
SHA512 e523b7ad4ee64a2e19dec6103144074b05a967860e68bd8d72aa1adeb45636daf13005a700789b7cb21e9edb8afed6509706f2fe6715d7729f30d580677d923f
SSDEEP 6144:mD7wT9JKuV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:o7wu/NcZ7/N
TLSH
T1EE9482252A301AE6DDEE6BB5AD1249E88181E4B114F1F13E6633DFDCC8E4DA1DC58F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bhldio32.exe

Path C:\Windows\SysWOW64\Bhldio32.exe
Size 429KB
SHA256 857a07e5c9f4e52357812a4ce6a6261642bce937b6ac1a3a9e1d64e5e1bc0f3c
MD5 02bc2d09f0500acb4723c9d24691e51d
SHA1 0e183165272ea587adf9b6f9bd2668d430a62ab3
SHA512 f414689081332edfcf2507f37b070dec0ad1ce4184d28b4534a5e00623fa700ffb8124b4153fabed78da72b4ddf0ad0cd86de041ed44f5592f4e4b1dacbefda2
SSDEEP 6144:NXMWU/ImBKV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:eIm5/NcZ7/N
TLSH
T193946F652A3019E6DDEE6BB6AC1249E88181E9F144F1F13E6633DFDCD8E4D66CC04B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bhqmdoef.exe

Path C:\Windows\SysWOW64\Bhqmdoef.exe
Size 429KB
SHA256 20ad2112e03049eeedf988c8251f8c43d96494b2b9a3c7b86a94cebe61c4cc40
MD5 64026bf9b33fb7cc0a3bca4e50995466
SHA1 036a1b3dfd0add8b928f6b4806549ea7d107c6f5
SHA512 929631ea81cfe128c6368b116fd58e592e399e3e1fc9ad6a9e5cb9445c8b9673346f2d9070a9396485cd5ed319e6327c5574590fae423219a2685e1f9629f600
SSDEEP 6144:VChvIiQaK7V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:4xQm/NcZ7/N
TLSH
T13E9481A96A3129E5DDEE6BB5AC1289D98181E8B014F1F13E5633DFDCC8F8D61DC04B84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bjlpcbqo.exe

Path C:\Windows\SysWOW64\Bjlpcbqo.exe
Size 429KB
SHA256 83735b50dd517b9c2124aaa286db8f707726fa60f3c1ddf9d1524533092bd974
MD5 fcd1ea1ba6913857ccce12adecd896f1
SHA1 c2912e133fb042ea636dec6c9ea906b905c910c8
SHA512 1666e25731ed869bc636a0ba2af38dc2709dee0723061c1e583b65f6a7df078ab3b12ed56abdcdfd9c4e318b1cfe534c8ea982291f3561b6169b0ee2be668629
SSDEEP 6144:Y3Ut/3SV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:2Ut/X/NcZ7/N
TLSH
T1A69470652A3119E6DDEE6BB5AC1249E88181E9B114F1F13E6633DFDCD8F4DA2CC04B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bkmmkj32.exe

Path C:\Windows\SysWOW64\Bkmmkj32.exe
Size 429KB
SHA256 2e0f85d883fccb2a0622bf76d9ec70953abd40427a75703a11b8b8889bf0456e
MD5 1af69d8b9e30d16fd8ad1864152fcd64
SHA1 6398ee3b43f5cff9e02a04e6ffed51f14dd7bfd4
SHA512 af4cf9a744f873853f55e5f1b237765db0ba7a62bda3a766f703e8558362aad7ce3458f0752c01845cf5418cd8d561b0717753648d24ee2a6b505404c4bcacc6
SSDEEP 6144:1c1OvLhoWV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:1SOvdo/NcZ7/N
TLSH
T1459470252A3019E6DDEE6BB5AC1249E98181E8B158F1F13E6633DFDCC8F4DA1DC05B84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Boabkj32.exe

Path C:\Windows\SysWOW64\Boabkj32.exe
Size 429KB
SHA256 734e6e9161748d2daaee0281dfa4668f8a0b11da8c4fa96ee9ae02a464cd3ef7
MD5 14d71ce8dd4b4bfddda735886b9dfc8c
SHA1 cc7a33de96ff7b6d59740f0b246d6a9386bd0c7b
SHA512 658be4e3695b31ddb769df54b50258354f9a36f956850766af0939ec7c9c92cc5a6f3fa90f989d842859233b5be80ea6c6dd7143577831068bb2bdfb18efd2c0
SSDEEP 6144:179olV4V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:J9olv/NcZ7/N
TLSH
T1B794A526663519EADDEE6BB5AC1249D88086E5B114F1F17EA633DFDCC8E4E61CC04F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cbeaib32.exe

Path C:\Windows\SysWOW64\Cbeaib32.exe
Size 429KB
SHA256 c33015039bfe70b2f0f11c77166881d43d33bea303c974321e2a2456fca35e22
MD5 43997bce859f1793d5386ae684df99ce
SHA1 f8a798fc167dec9d116b9492bfc56403679620b6
SHA512 c81087078fa9b2fb7815125b29142499260b76eca5d788d5c5b82bddeab2cf59442c60aa7cacf7d6ec5b77a75df062f6869053e66a323344d007ba03dc34bd35
SSDEEP 6144:7Nr9gsg/vV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:7Nr9i+/NcZ7/N
TLSH
T1A49491266A3019E5DDEEABB1AD1249E98181E4B504F1F53E6633DFDCC9E4DA2CC04F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cbphncfo.exe

Path C:\Windows\SysWOW64\Cbphncfo.exe
Size 429KB
SHA256 72d97d89089e525a1f4497bca5b792278537b1aedbb3c4bbadf28218f2c825a3
MD5 6fd3df2a04e3a6b3ca99d067205adbf7
SHA1 a73c48c1c849d11e6eefb5d1071ce589395a67f5
SHA512 65cb810e4669e09a622c0a1f22fe32f1a9fc6bbe2ca673a282441d0d8abdeb65186adf813ccaeef6cfb2375b6055597776d3cff67d905ace0c4e514c23b0050b
SSDEEP 6144:uYONwVZFRV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:uYONt/NcZ7/N
TLSH
T1EF94706AAA701DE6DDEE6BB5AC1249D88181E4B114F1F13E6633DFDCC9E4DA1DC04B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cckkmg32.exe

Path C:\Windows\SysWOW64\Cckkmg32.exe
Size 429KB
SHA256 e1d81c606fc77d9a8527191bf6ec890915560486c5cd8edd85910ab43137ab0a
MD5 231a838b1b6fdf2f24dcf35b7ba0b8a3
SHA1 f1c1d676804037aeac157eccfee129fe72865a05
SHA512 b1b12b45997220a0c0eab830c82900c946746b298b1daa233df3e8ae565e209da2243537a6715849123988a2ed2e102c995197803bb31b6347116a5b074778e5
SSDEEP 6144:qID0YV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:JDu/NcZ7/N
TLSH
T1BD944F656A3019EADDEE6BB5AC1249D88181E5B214F1F13F6633DFDCC8E9DA1CC05B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cfgjcb32.exe

Path C:\Windows\SysWOW64\Cfgjcb32.exe
Size 429KB
SHA256 a79d0ce97c26e7c400371bd4fccef3004e6173c03ffe5d20eee87fa61adc68e0
MD5 712fb65c50fa50d61374706278237cd6
SHA1 c9e473f6d22a02c954363d74817c2c1ceb062d6e
SHA512 da89511c776fc12ac6179fcd380dfb0c87a72f05a5541715063f741f94db27f9f5c8880678bb4f05b0c72719c539cf231f58f1cafea07aecf9d1202c2901ca41
SSDEEP 6144:JMJNs2K7V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:Et/NcZ7/N
TLSH
T1D89460256A301AE6DDEE6BB5AC1249D88191E9B104F1F13E6A33DFDCC8F5DA1DC04B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cfigib32.exe

Path C:\Windows\SysWOW64\Cfigib32.exe
Size 429KB
SHA256 3b19a0c8f741e25f5e830cbbb59f111f8f3e2765bcd76521e33b6a26bf5fd843
MD5 e99a08435a428437e958a18ad4c12e4e
SHA1 5704360a7dcf76360d66573b1f7ac14a7d699202
SHA512 a0718d610492bf2bd9cef727475545383b396d7bcdafe39bfc13ef51d689ccf815d147ef40e422a2ca7d72fb13c83884560a8ad35c712decfed62d2b6163e3e9
SSDEEP 6144:yAjg2QvBfSV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:Zj1Qv/NcZ7/N
TLSH
T1F0945F252F3059E6DDEE6BB5AC1249D88181E5B154F1F53E6623EFECC8E4DA1DC08B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cfnqdale.exe

Path C:\Windows\SysWOW64\Cfnqdale.exe
Size 429KB
SHA256 2febadb95bbd570829a0a06475479a0837712f4df810060adb06d14926642730
MD5 f10bf2178b85e220a729285096dee6e0
SHA1 6e8a5092361978c2be3a388501296919279c021a
SHA512 59d3dc838651cc68e5f7f9d33297f6c38db3a16805964e8c1fecd75e88be44d23cc44f08cf11acabf018076499e6b789df4c24ed6859e4d7520caf583af0d55c
SSDEEP 6144:hCzxB35V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:CfM/NcZ7/N
TLSH
T1589460652A311DE5DDEE6BB5AC124AD88282E4B214F5F13E6623DFECC8E4D61CC14F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cijpkmml.exe

Path C:\Windows\SysWOW64\Cijpkmml.exe
Size 429KB
SHA256 a79f78f9e380f3d46c55e191fcf292baa1a101bef821dd9d5de309262d88e6da
MD5 d4d4f7a4e1246dc1c7a2222050b683d1
SHA1 83566467cb8166e3f67c85c04064f04e802a8f52
SHA512 225a476df7db676521be282d2308af7d6ef7f59e8be756a6cd3c2441814862a6a45924934f0991324ee635bbd476d271617de4e0d4d8c0643bb028705696af50
SSDEEP 6144:XpfO/EGCsxoV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:Xpm/EGpT/NcZ7/N
TLSH
T11C9471256A3119E9DDEE6BB5AC2249D88181E8B154F2F17E6633DFDCC8E5D62CC04B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cioifm32.exe

Path C:\Windows\SysWOW64\Cioifm32.exe
Size 429KB
SHA256 ed5f6add45520c117fd812a7caa48cba22bd9872cadbce046f72ce89c26478de
MD5 0a434954e554f5dd0a6b1ffd0aef506e
SHA1 222f0369e2822bb07d2c07aad966ca5ddbe410e4
SHA512 747bca39d2d220a6c82d6567bc263e811dcd9d873ed86ed6d21f4f0b159971d03401bfc5b720bd7a11401a98c75a3a714cac5aebb21dba1925aa020930f1240c
SSDEEP 6144:9ArU+ypxV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:O4e/NcZ7/N
TLSH
T18C944D652B701AE6DDEEABB5AC1289D88181E5B104F5F13E6633DFDCC8E4DA1CC44B84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cmabpmjj.exe

Path C:\Windows\SysWOW64\Cmabpmjj.exe
Size 429KB
SHA256 716084772571c444b21db86dc7314dddc37fb773fec6a90b1ff1c33377be0f50
MD5 ec7e06f48ec1b14aa632b7581c32fd74
SHA1 fa67c582300d753b471debbc57c9b38fed5d24f2
SHA512 62309118c2068debd4915da48a43cd7c9e4c9a785b8292cb776830e801ce4ede74479b717be8fc85197982745b06020fd2caaf0a0e08d25510e2379433cdd802
SSDEEP 6144:NjLLPR1zcEPFV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:NzP/cl/NcZ7/N
TLSH
T1E69461256A3029E5DDEE6BB5AC124DD98185E8B114F1F13EAA33DFDCC8E5DA5CC04B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cmcoflhh.exe

Path C:\Windows\SysWOW64\Cmcoflhh.exe
Size 429KB
SHA256 334cd6a1a3fa311aece599746122880150364fb6235dd545b3fe98a8bdc42724
MD5 6f57e3f756256799737fe85d462e2237
SHA1 9d4881a10a1d482853b1201666ded04b62cd0a98
SHA512 78401acadb7c539ce7b2685c7d64b159d6e0d7e50d8af4525b322cc8292164423218ea9455d9c4126498495c4f156af35b2818289b0802f862bcb25ed516656c
SSDEEP 6144:/LzGaV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:TG/NcZ7/N
TLSH
T1739472252A3019E6DDEE6BB5AC1249D88181E9B215F1F13E6633EFDCD8E4D66CC04F84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cmhial32.exe

Path C:\Windows\SysWOW64\Cmhial32.exe
Size 429KB
SHA256 70843d007a9517d16cc4e31335ce119e7d8414e7b326cd15bbada7598d7bb0f5
MD5 735c3f748f35c71033c22337af8fa4ab
SHA1 84f36c02a3e184b0605578d8d6193d8da5720101
SHA512 429897f44054e1cdf4d7154707169ec6a29e05205216098c7e6cdd3865910bba13565dc2f513be94533c32d429a40f77be1f09b04b995663929aed5dc55db230
SSDEEP 6144:iqYgtEPjV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:iqRyy/NcZ7/N
TLSH
T16A9481296A301DE6DDEE6BB5AC5249E88181E4B504F1F13E6633DFDDC8E5DA2CC04B84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Codhgg32.exe

Path C:\Windows\SysWOW64\Codhgg32.exe
Size 429KB
SHA256 abd285e756092c11383f5ae282772f37aa47ed7c54305122f0667b3cefcc27b4
MD5 02796107fdb7a4932a11bc0a7ab8d825
SHA1 bbdfbb0d306e0939e90a7a893ee3a6a4270dac9c
SHA512 ff837e801dd9168d87ae14b0f99b6bd2010a0bde4a49c7910b35040c9158b267cb87c7132c3b60eb8253b5579c61f853aa86cc6edbd203e1df355f44b1c1dcfd
SSDEEP 6144:JwQR+qlV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:Jhm/NcZ7/N
TLSH
T1609484252A7019E5DEEE6BB5AC1259D89481E5F144F2F23EA633EFDCC8E4D65CC04B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Combgh32.exe

Path C:\Windows\SysWOW64\Combgh32.exe
Size 429KB
SHA256 dd98de8c3eb38f94883054a7d2c82d94aee2c9c115e0d9b8593e4c0fc3d735a0
MD5 8dcffe8b5f8f428df82277b1b28e0807
SHA1 fbfad99cb89557f7ae2de07ae9e8d77555c86d4d
SHA512 dd1cef1004b5075603fb9bb07e8e73973155d05ddb569323a9fe6744bfd8861d674006c8ee0017460c409eb6f14624e0ae205f14dcb0d283279ac77334f8dfa5
SSDEEP 6144:0ZIoMcJnNvfV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:fcJNu/NcZ7/N
TLSH
T12E9460656A3019E6DDEE6BB5AC1249E88181E9B104F1F13E6633DFDCC9E4DA6CC44F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dbgnobpg.exe

Path C:\Windows\SysWOW64\Dbgnobpg.exe
Size 429KB
SHA256 0f6f0d7df82501b1793018b23c6d4eed3cf389a37fed9950ce7753304c021971
MD5 505836b3e7b2c6b9c4f5001e5927ce49
SHA1 e1ee310add0912d88f3f7af9c6ad744e967d28ff
SHA512 06cdf07a8441da2cb178080d9b0db595ed0fa44ddc195dcd8d2a9ad5302292f10873547f60213e7c7f7c1560c019024cfdb67ae77c42ca07a856914acfef3600
SSDEEP 6144:Xbw4K+MDyV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:L5Kdj/NcZ7/N
TLSH
T16C9470296A3019E6DDEE6BB5AC1249E98581E8B104F1F13E6633DFDCC8F4DA1CC45B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dblgja32.exe

Path C:\Windows\SysWOW64\Dblgja32.exe
Size 429KB
SHA256 cd172699c081707b66f624dcf5a74581cf0fcdb8fba6b5c3e513d46cb385c39f
MD5 211e02c52a0f1e94a6df86792b688feb
SHA1 68274c49149d4d3f72252612682b7ea5d4508a50
SHA512 7e19c57c46f86be2b718c45fb16caaf44110d470b9b4c2c484f74a0acac31ec56e15f893b85ad8fcb97448bd441c622a5241686d370ae7649c9d3a648a518b29
SSDEEP 6144:iUFR/EnVuKMpV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:iUFR/QVb/NcZ7/N
TLSH
T12B9460656A3019E6EDEE6FB9AC1249D89181E8B514F1F13E6633DFDCC8E8D65C804F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dcgjie32.exe

Path C:\Windows\SysWOW64\Dcgjie32.exe
Size 429KB
SHA256 3b4db17346c34d0d4d8826140093f3bd17a60676c5dd6b1816b0efaec5f9658b
MD5 c122c7cd299be46ce228992cfd47058c
SHA1 155d82d698e797edcb3da040d376a7847002f846
SHA512 1cfb1e8ab747b961629f76eb72002cd800e716d41ef6e95412d97bd16778fae98b992245fa217d0d8ee573f5753d5f214ca44ce9cd35d803f7734645b7c28c23
SSDEEP 6144:bmmDReX59fq2V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:ts7u/NcZ7/N
TLSH
T1C99461652A7419E6DDEE6BB5AC1249D88281E6B114F1F13FA633DFDCC8E4DA1CC44B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Diafkl32.exe

Path C:\Windows\SysWOW64\Diafkl32.exe
Size 429KB
SHA256 7477183adc8d5e2e9021a9615049f76a2ee5ff7b36adab183ffb4816ca6146d3
MD5 a90f082cc9ddeaeece8cba93e36bdf22
SHA1 27f2f92acf2577772a760becd600a5f6ce3a7e02
SHA512 31d44bf1e667c1e105b1cda583d84cdc5dc915f725c1d5e5f4a594936a8e1fea2c9a943bac184013477c894d05a2b97cd2d284b301036e634729505bd65f89eb
SSDEEP 6144:ysnscJCoeWrV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:Yog/NcZ7/N
TLSH
T1DB9471666A3019E5EDEE6BB5AC1249D88181E8B114F1F13E6633DFDCC8E4DA6CC04F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Difpflco.exe

Path C:\Windows\SysWOW64\Difpflco.exe
Size 429KB
SHA256 f4a3c68972109f98326d0798e401148e19bf8ab47cf0f580444fad156342fcca
MD5 1c8bb317997143cc87b8e1405b918f2b
SHA1 eb379598c875516eb40482f68e479983eae4e439
SHA512 e024369bcf42291c8efdbb691f52e87d34f83c2ea2e2e8b1ac570275d20148fe6c527870a44eb753debf312f93c127ce0e0ac7427889b7dbb0829ad51a37f832
SSDEEP 6144:RCGubLV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:gFO/NcZ7/N
TLSH
T1E79481652A3219E6DDEEABB5AC1249D881C1E4B115F1F53E6633DFDCC8E4DA2CD04B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Djqbeonf.exe

Path C:\Windows\SysWOW64\Djqbeonf.exe
Size 429KB
SHA256 a38cbe96e8c962dddc8fe8a1126db1c0728033da1c079e5a0950885228f73422
MD5 ca31cadc676446f6d7a26a437a113f4f
SHA1 4ce90a37077b511d592ef0558314067d42492510
SHA512 9ea3411abafb838371c1494078b3f3204c43049e09eaf61e827c1c1fbbb3147f4b4235e94355b29f6fc6cd581dd083fd4ae04810ac2a306c146387e98e94385a
SSDEEP 6144:tsArdzBTIpA9V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:tsAr9BTIpP/NcZ7/N
TLSH
T1C1946F656A301DE6DDEE6BB5AC1259D88181E9B118F1F17E6633DFDCC8E4DA2CC04B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dkbomgde.exe

Path C:\Windows\SysWOW64\Dkbomgde.exe
Size 429KB
SHA256 6e049ae635f9cf701244f3811a51ef51543c9cdc46d2cd73fe2974a1997c79f1
MD5 d1b46f6ff3253068988f7b0aa5bb25d8
SHA1 ab376bd61837a5a2dd859a5fbb617a9d6d1520a9
SHA512 10f3ab73c91bfde4f555bdc630bcba2e9d8a89eb0da8ca82592bd2e2f7cac42f5ff2a35dd38860b9f46a7dcd9f9e960e26b50d5de4b39ec61f01144600bbe6f1
SSDEEP 6144:1O3eT79HhUMCTV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:1OuT7Pn/NcZ7/N
TLSH
T1E49483652A3019EADDEE6BB6AC1249D89185E4B114F1F63E6633DFDCC8E4D62CC04F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Doiabgqc.exe

Path C:\Windows\SysWOW64\Doiabgqc.exe
Size 429KB
SHA256 b8337590fead5ef9a0fa39a1d70d23e0e44d25ff377f013409519254631a3fed
MD5 3365c7d43728069025df597856557189
SHA1 a27a859de915fbb925e78e6495b50fe2c561bc74
SHA512 31f7c5916de5536b6be0f7412ff665d9db024b87a7fe06f84168561ef318c1c4bac8d03ad21740bec05bcd51e9dc9c232a24a62b2b97389148470a952e9a09ea
SSDEEP 6144:/SVdIqV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:/O2/NcZ7/N
TLSH
T16D9472652A301DE9DDEE6BB5AC1249E88185E4B104F1F17E6673DFECC8E4E62CC05B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/700-250-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/792-435-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/824-35-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/824-495-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/928-260-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1032-112-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1180-420-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1420-126-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1472-230-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1484-425-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1524-290-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1672-365-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1676-450-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1764-496-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1864-105-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2184-370-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2248-466-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2332-477-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2332-14-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2352-360-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2460-270-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2516-84-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2640-245-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2768-380-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2868-280-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2920-310-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2924-390-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2960-203-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3024-91-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3048-140-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3056-400-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3164-295-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3192-355-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3224-440-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3232-255-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3308-235-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3336-161-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3400-335-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3476-330-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3536-147-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3696-168-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3860-430-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3908-240-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4040-490-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4044-340-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4056-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4056-3-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/4056-460-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4064-42-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4064-501-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4068-133-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4072-70-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4216-49-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4216-507-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4224-471-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4224-7-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4260-98-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4296-63-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4308-502-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4532-275-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4556-375-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4632-345-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4648-175-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4660-472-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4668-217-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4684-182-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4736-265-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4780-285-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4800-410-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4820-305-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4836-154-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4904-189-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4956-325-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5016-300-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5028-224-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5092-119-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5196-320-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5284-395-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5288-77-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5388-56-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5492-445-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5504-405-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5512-484-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5532-315-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5624-461-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5648-350-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5672-478-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5704-483-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5704-21-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5736-489-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5736-28-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5756-415-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5944-385-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6000-210-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6012-455-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6020-196-0x0000000000400000-0x000000000046D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads