berbew | e44e57affebdea199815186208e3d8abe2b9511a15397eb6591b27d695236963

Analysis

max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/10/2026, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-25_a58a79aa1646445c3c5ee8e5e30bd33a_elex_wannacry.exe
Size 429KB
Sample261026-vt1a2aft6x
SHA256 e44e57affebdea199815186208e3d8abe2b9511a15397eb6591b27d695236963
MD5 a58a79aa1646445c3c5ee8e5e30bd33a
SHA1 78c61b0dc2e025622d2b8f4b4c0909527728d561
SHA512 ee10bd7c9037faf8d1252311acbf6f5c0556d5ceced0e4b217b64198a62eea8ae64ddb72a51e758f5f9d7937baabe191db9eb47750683b08e319c0c36af3c3d9
SSDEEP 6144:FvvbV4sqyITfKqFtLHyrpFIl7R8V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:VbV4sqyITfKqFtLHU8l7b/NcZ7/N
TLSH
T1E1948225663019E6DDEE6BB5AC2249D89181E9B205F1F53E6633DFECC8E4DA1CC04F81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqfbkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ikgicmpe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpfggang.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldpoinjq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfedfk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Habndbpf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Idmafc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgeiokao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jpojml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmnjan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqnofkkj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dlegokbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eplckh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibhdgjap.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipqnknld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cccppgcp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aaldngqg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eflhiolf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gqhknd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ognginic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aoqegk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aejmdegn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jagqfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ogjmnomi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Obanqgkl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nofmndkd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Okcccdkp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qnlkllcf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dofpqfof.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Epjfehbd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojopki32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfacai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jjmhie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iaqapggb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Knjhae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncihbaie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ifipmo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngaabfio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ogjdheqd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Alioloje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmnjan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iaqapggb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldpoinjq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncpelbap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gpjfng32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdgejmdi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahfmka32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ejpnin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eplckh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mallojmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odnngclb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdgejmdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mhgkfkhl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oijqbh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Behiec32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ccacjgfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcdepd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjalpida.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dcdifdem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kkioojpp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nqgiel32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aacjofkp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gqdbbelf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kiikkada.exe

Executes dropped EXE 64 IoCs

pid	Process
4216	Gmfpgmil.exe
5960	Gfodpbpl.exe
4064	Gpgihh32.exe
2044	Gpjfng32.exe
2588	Gplbcgbg.exe
3796	Hjdcfp32.exe
2140	Hanlcjgh.exe
3136	Hhhdpd32.exe
5084	Haphiiee.exe
3368	Hfmqapcl.exe
5928	Hmginjki.exe
4108	Hdaajd32.exe
5552	Hnfehm32.exe
804	Hdcnpd32.exe
1196	Hjmfmnhp.exe
260	Ipjoee32.exe
3792	Ifdgaond.exe
4268	Imnoni32.exe
2840	Idhgkcln.exe
1940	Ikbphn32.exe
1644	Ipohpdbb.exe
1008	Ifipmo32.exe
4176	Imbhiial.exe
2756	Idmafc32.exe
3360	Ikgicmpe.exe
1496	Iaqapggb.exe
1332	Ihkila32.exe
1664	Imgbdh32.exe
1284	Jdajabdc.exe
4260	Jkkbnl32.exe
4124	Jphkfc32.exe
1832	Jgbccm32.exe
5244	Jmlkpgia.exe
1852	Jdfcla32.exe
4776	Jolhjj32.exe
2316	Jpmdabfb.exe
1756	Jggmnmmo.exe
3896	Jmqekg32.exe
4312	Jdkmgali.exe
2868	Jopaejlo.exe
2208	Kpanmb32.exe
5976	Kgkfil32.exe
2020	Knenffqf.exe
5992	Kdpfbp32.exe
1568	Kkioojpp.exe
4700	Kpfggang.exe
6076	Knjhae32.exe
2476	Kddpnpdn.exe
5816	Kknhjj32.exe
3012	Kahpgcch.exe
4272	Kgeiokao.exe
3464	Lnoalehl.exe
1340	Lhdeinhb.exe
5284	Lonnfg32.exe
5648	Lhgbomfo.exe
2312	Loqjlg32.exe
4588	Lhiodm32.exe
2064	Locgagli.exe
3204	Ldpoinjq.exe
5900	Lkjhfh32.exe
2520	Lqfpoope.exe
2692	Lgqhki32.exe
3164	Mnjqhcno.exe
5572	Mhpeelnd.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ccacjgfb.exe	Cpbgnlfo.exe
File created	C:\Windows\SysWOW64\Dlegokbe.exe	Dapcab32.exe
File created	C:\Windows\SysWOW64\Jobomo32.dll	Dapcab32.exe
File created	C:\Windows\SysWOW64\Anfbja32.dll	Eoapldei.exe
File created	C:\Windows\SysWOW64\Hihimfag.exe	Hclaeocp.exe
File created	C:\Windows\SysWOW64\Jagqfp32.exe	Jjmhie32.exe
File created	C:\Windows\SysWOW64\Majoikof.exe	Mgdklb32.exe
File created	C:\Windows\SysWOW64\Olgjef32.dll	Hjdcfp32.exe
File opened for modification	C:\Windows\SysWOW64\Aaldngqg.exe	Apkhfo32.exe
File opened for modification	C:\Windows\SysWOW64\Eflhiolf.exe	Eoapldei.exe
File opened for modification	C:\Windows\SysWOW64\Naaejj32.exe	Ncpelbap.exe
File created	C:\Windows\SysWOW64\Knappoek.dll	Pbfglg32.exe
File opened for modification	C:\Windows\SysWOW64\Hfmqapcl.exe	Haphiiee.exe
File created	C:\Windows\SysWOW64\Hpkmajcn.dll	Imgbdh32.exe
File created	C:\Windows\SysWOW64\Mdgejmdi.exe	Mojmbf32.exe
File created	C:\Windows\SysWOW64\Nojfic32.exe	Niqnli32.exe
File created	C:\Windows\SysWOW64\Pehghhgc.exe	Ppkopail.exe
File created	C:\Windows\SysWOW64\Nglkbd32.dll	Hfacai32.exe
File created	C:\Windows\SysWOW64\Lhdeinhb.exe	Lnoalehl.exe
File opened for modification	C:\Windows\SysWOW64\Mhgkfkhl.exe	Mnaghb32.exe
File created	C:\Windows\SysWOW64\Giilml32.dll	Ppkopail.exe
File created	C:\Windows\SysWOW64\Aacjofkp.exe	Apbngn32.exe
File opened for modification	C:\Windows\SysWOW64\Bpnncl32.exe	Behiec32.exe
File created	C:\Windows\SysWOW64\Ngnill32.dll	Dlegokbe.exe
File opened for modification	C:\Windows\SysWOW64\Ejbknnid.exe	Epjfehbd.exe
File created	C:\Windows\SysWOW64\Odnngclb.exe	Ogjmnomi.exe
File created	C:\Windows\SysWOW64\Nancfp32.dll	Hhhdpd32.exe
File created	C:\Windows\SysWOW64\Hfmqapcl.exe	Haphiiee.exe
File created	C:\Windows\SysWOW64\Kmlmlo32.exe	Kcfiof32.exe
File created	C:\Windows\SysWOW64\Ldjodh32.exe	Lmqggncn.exe
File created	C:\Windows\SysWOW64\Dhkggplm.dll	Ncpelbap.exe
File opened for modification	C:\Windows\SysWOW64\Ngaabfio.exe	Nqgiel32.exe
File created	C:\Windows\SysWOW64\Ogajid32.exe	Oagbljcp.exe
File created	C:\Windows\SysWOW64\Qimfoe32.exe	Pehghhgc.exe
File created	C:\Windows\SysWOW64\Angfompn.dll	Cediab32.exe
File created	C:\Windows\SysWOW64\Jfofee32.dll	Hcnnjoam.exe
File created	C:\Windows\SysWOW64\Qnoeacho.dll	Kdpfbp32.exe
File created	C:\Windows\SysWOW64\Odmapl32.dll	Ogjdheqd.exe
File opened for modification	C:\Windows\SysWOW64\Emhmkh32.exe	Efnennjc.exe
File created	C:\Windows\SysWOW64\Jabgkpad.exe	Ibagmiie.exe
File created	C:\Windows\SysWOW64\Cojqdhid.exe	Chphhn32.exe
File opened for modification	C:\Windows\SysWOW64\Dapcab32.exe	Dlckik32.exe
File created	C:\Windows\SysWOW64\Pofebf32.dll	Hdaajd32.exe
File created	C:\Windows\SysWOW64\Ibchnb32.dll	Kahpgcch.exe
File opened for modification	C:\Windows\SysWOW64\Apbngn32.exe	Aemjjeek.exe
File opened for modification	C:\Windows\SysWOW64\Fjccel32.exe	Fomohc32.exe
File created	C:\Windows\SysWOW64\Gpioca32.exe	Giofggia.exe
File opened for modification	C:\Windows\SysWOW64\Ldjodh32.exe	Lmqggncn.exe
File created	C:\Windows\SysWOW64\Pkilik32.dll	Majoikof.exe
File created	C:\Windows\SysWOW64\Ognginic.exe	Obanqgkl.exe
File created	C:\Windows\SysWOW64\Hjfgdeic.dll	Eqalfgll.exe
File created	C:\Windows\SysWOW64\Cfdbblqn.dll	Fiajfi32.exe
File created	C:\Windows\SysWOW64\Cqbnpknn.dll	Gqhknd32.exe
File opened for modification	C:\Windows\SysWOW64\Ipqnknld.exe	Ijcecgnl.exe
File created	C:\Windows\SysWOW64\Lfdjkn32.dll	Chnlbndj.exe
File created	C:\Windows\SysWOW64\Dpoohgim.dll	Damflb32.exe
File created	C:\Windows\SysWOW64\Ejegdngb.exe	Eplckh32.exe
File opened for modification	C:\Windows\SysWOW64\Fmjjqhpn.exe	Fbeeco32.exe
File created	C:\Windows\SysWOW64\Mgembdei.dll	Fomohc32.exe
File created	C:\Windows\SysWOW64\Bhbbnlco.dll	Hakhcd32.exe
File opened for modification	C:\Windows\SysWOW64\Lpapiipo.exe	Ligglo32.exe
File created	C:\Windows\SysWOW64\Kaehmgbl.dll	Ipjoee32.exe
File created	C:\Windows\SysWOW64\Gepmno32.dll	Gpgihh32.exe
File created	C:\Windows\SysWOW64\Jdajabdc.exe	Imgbdh32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7532	8108	WerFault.exe	350

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oijqbh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chphhn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lacihleo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Majoikof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipohpdbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpanmb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdgejmdi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fjqgpl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jbkjcgaj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Okgfdm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jmlkpgia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gpgihh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hhhdpd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jmqekg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Giofggia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mahbck32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Imbhiial.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocegnoog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qimfoe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpjmok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jkkbnl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpfggang.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qnlkllcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Naaejj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jdfcla32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogjmnomi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cccppgcp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hclaeocp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ognginic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Idmafc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Idhgkcln.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aacjofkp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cakjfcfe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Behiec32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eflhiolf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ffjdjmpf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gmclgghc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jdcplkoe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mkbcbp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hfmqapcl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhdilold.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Damflb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgdklb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Obmeeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hdaajd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onkbenbi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hakhcd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mallojmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kkioojpp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jdajabdc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nqgiel32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kmlmlo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqkdmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ikgicmpe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kknhjj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kahpgcch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mkangg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngaabfio.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cojqdhid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hcnnjoam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pbfglg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipjoee32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ikbphn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bppjhl32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hmginjki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hdaajd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Imgbdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpkmajcn.dll"	Imgbdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Onkbenbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ahfmka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cialka32.dll"	Bppjhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdhhfnom.dll"	Hdcnpd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ngaabfio.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ondleo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgakgc32.dll"	Bpidhmoi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cccppgcp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cakjfcfe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ecgeemgk.dll"	Fjqgpl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fjccel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hdcnpd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Imbhiial.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmlngkld.dll"	Mkangg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bppjhl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ibagmiie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kanffogf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpfmhf32.dll"	Kiikkada.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kdophj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmboib32.dll"	Qimfoe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oamlkk32.dll"	Gcpaiq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hclaeocp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hfacai32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ogjmnomi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akljinhl.dll"	Pjalpida.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Moacbe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ciioaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifhhflhc.dll"	Epjfehbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eflhiolf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kmiqfoie.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Obanqgkl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kgkfil32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Niqnli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cojqdhid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Djnaco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjmnib32.dll"	Kanffogf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eekcho32.dll"	Jgbccm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Okkidceh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chphhn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ipqnknld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naohpdqd.dll"	Oqmhlego.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fecibala.dll"	Lqfpoope.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgdeikmo.dll"	Mhpeelnd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mallojmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncpelbap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckpfqdce.dll"	Gpjfng32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Booaii32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gqdbbelf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lcifde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nancfp32.dll"	Hhhdpd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lhdeinhb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ibjqlj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mphfjhjf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kpanmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kahpgcch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Apbngn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oepdpcqg.dll"	Behiec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cfdbblqn.dll"	Fiajfi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aohcbiop.dll"	Knenffqf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nbfeoohe.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 4216	4452	2026-10-25_a58a79aa1646445c3c5ee8e5e30bd33a_elex_wannacry.exe	89
PID 4216 wrote to memory of 5960	4216	Gmfpgmil.exe	90
PID 5960 wrote to memory of 4064	5960	Gfodpbpl.exe	91
PID 4064 wrote to memory of 2044	4064	Gpgihh32.exe	92
PID 2044 wrote to memory of 2588	2044	Gpjfng32.exe	93
PID 2588 wrote to memory of 3796	2588	Gplbcgbg.exe	94
PID 3796 wrote to memory of 2140	3796	Hjdcfp32.exe	95
PID 2140 wrote to memory of 3136	2140	Hanlcjgh.exe	96
PID 3136 wrote to memory of 5084	3136	Hhhdpd32.exe	97
PID 5084 wrote to memory of 3368	5084	Haphiiee.exe	98
PID 3368 wrote to memory of 5928	3368	Hfmqapcl.exe	99
PID 5928 wrote to memory of 4108	5928	Hmginjki.exe	100
PID 4108 wrote to memory of 5552	4108	Hdaajd32.exe	101
PID 5552 wrote to memory of 804	5552	Hnfehm32.exe	102
PID 804 wrote to memory of 1196	804	Hdcnpd32.exe	103
PID 1196 wrote to memory of 260	1196	Hjmfmnhp.exe	104
PID 260 wrote to memory of 3792	260	Ipjoee32.exe	105
PID 3792 wrote to memory of 4268	3792	Ifdgaond.exe	106
PID 4268 wrote to memory of 2840	4268	Imnoni32.exe	107
PID 2840 wrote to memory of 1940	2840	Idhgkcln.exe	108
PID 1940 wrote to memory of 1644	1940	Ikbphn32.exe	109
PID 1644 wrote to memory of 1008	1644	Ipohpdbb.exe	110
PID 1008 wrote to memory of 4176	1008	Ifipmo32.exe	111
PID 4176 wrote to memory of 2756	4176	Imbhiial.exe	112
PID 2756 wrote to memory of 3360	2756	Idmafc32.exe	113
PID 3360 wrote to memory of 1496	3360	Ikgicmpe.exe	114
PID 1496 wrote to memory of 1332	1496	Iaqapggb.exe	115
PID 1332 wrote to memory of 1664	1332	Ihkila32.exe	116
PID 1664 wrote to memory of 1284	1664	Imgbdh32.exe	117
PID 1284 wrote to memory of 4260	1284	Jdajabdc.exe	118
PID 4260 wrote to memory of 4124	4260	Jkkbnl32.exe	119
PID 4124 wrote to memory of 1832	4124	Jphkfc32.exe	120
PID 1832 wrote to memory of 5244	1832	Jgbccm32.exe	121
PID 5244 wrote to memory of 1852	5244	Jmlkpgia.exe	122
PID 1852 wrote to memory of 4776	1852	Jdfcla32.exe	123
PID 4776 wrote to memory of 2316	4776	Jolhjj32.exe	124
PID 2316 wrote to memory of 1756	2316	Jpmdabfb.exe	125
PID 1756 wrote to memory of 3896	1756	Jggmnmmo.exe	126
PID 3896 wrote to memory of 4312	3896	Jmqekg32.exe	127
PID 4312 wrote to memory of 2868	4312	Jdkmgali.exe	128
PID 2868 wrote to memory of 2208	2868	Jopaejlo.exe	129
PID 2208 wrote to memory of 5976	2208	Kpanmb32.exe	130
PID 5976 wrote to memory of 2020	5976	Kgkfil32.exe	131
PID 2020 wrote to memory of 5992	2020	Knenffqf.exe	132
PID 5992 wrote to memory of 1568	5992	Kdpfbp32.exe	133
PID 1568 wrote to memory of 4700	1568	Kkioojpp.exe	134
PID 4700 wrote to memory of 6076	4700	Kpfggang.exe	135
PID 6076 wrote to memory of 2476	6076	Knjhae32.exe	136
PID 2476 wrote to memory of 5816	2476	Kddpnpdn.exe	137
PID 5816 wrote to memory of 3012	5816	Kknhjj32.exe	138
PID 3012 wrote to memory of 4272	3012	Kahpgcch.exe	139
PID 4272 wrote to memory of 3464	4272	Kgeiokao.exe	140
PID 3464 wrote to memory of 1340	3464	Lnoalehl.exe	141
PID 1340 wrote to memory of 5284	1340	Lhdeinhb.exe	142
PID 5284 wrote to memory of 5648	5284	Lonnfg32.exe	143
PID 5648 wrote to memory of 2312	5648	Lhgbomfo.exe	144
PID 2312 wrote to memory of 4588	2312	Loqjlg32.exe	145
PID 4588 wrote to memory of 2064	4588	Lhiodm32.exe	146
PID 2064 wrote to memory of 3204	2064	Locgagli.exe	147
PID 3204 wrote to memory of 5900	3204	Ldpoinjq.exe	148
PID 5900 wrote to memory of 2520	5900	Lkjhfh32.exe	149
PID 2520 wrote to memory of 2692	2520	Lqfpoope.exe	150
PID 2692 wrote to memory of 3164	2692	Lgqhki32.exe	151
PID 3164 wrote to memory of 5572	3164	Mnjqhcno.exe	152

C:\Users\Admin\AppData\Local\Temp\2026-10-25_a58a79aa1646445c3c5ee8e5e30bd33a_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-25_a58a79aa1646445c3c5ee8e5e30bd33a_elex_wannacry.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Windows\SysWOW64\Gmfpgmil.exe
  C:\Windows\system32\Gmfpgmil.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Windows\SysWOW64\Gfodpbpl.exe
    C:\Windows\system32\Gfodpbpl.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5960
  - - C:\Windows\SysWOW64\Gpgihh32.exe
      C:\Windows\system32\Gpgihh32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4064
    - - C:\Windows\SysWOW64\Gpjfng32.exe
        
        C:\Windows\system32\Gpjfng32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2044
      - C:\Windows\SysWOW64\Gplbcgbg.exe
        
        C:\Windows\system32\Gplbcgbg.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2588
        
        C:\Windows\SysWOW64\Hjdcfp32.exe
        
        C:\Windows\system32\Hjdcfp32.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3796
        
        C:\Windows\SysWOW64\Hanlcjgh.exe
        
        C:\Windows\system32\Hanlcjgh.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2140
        
        C:\Windows\SysWOW64\Hhhdpd32.exe
        
        C:\Windows\system32\Hhhdpd32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3136
        
        C:\Windows\SysWOW64\Haphiiee.exe
        
        C:\Windows\system32\Haphiiee.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5084
        
        C:\Windows\SysWOW64\Hfmqapcl.exe
        
        C:\Windows\system32\Hfmqapcl.exe
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3368
        
        C:\Windows\SysWOW64\Hmginjki.exe
        
        C:\Windows\system32\Hmginjki.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5928
        
        C:\Windows\SysWOW64\Hdaajd32.exe
        
        C:\Windows\system32\Hdaajd32.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4108
        
        C:\Windows\SysWOW64\Hnfehm32.exe
        
        C:\Windows\system32\Hnfehm32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5552
        
        C:\Windows\SysWOW64\Hdcnpd32.exe
        
        C:\Windows\system32\Hdcnpd32.exe
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:804
        
        C:\Windows\SysWOW64\Hjmfmnhp.exe
        
        C:\Windows\system32\Hjmfmnhp.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1196
        
        C:\Windows\SysWOW64\Ipjoee32.exe
        
        C:\Windows\system32\Ipjoee32.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:260
        
        C:\Windows\SysWOW64\Ifdgaond.exe
        
        C:\Windows\system32\Ifdgaond.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3792
        
        C:\Windows\SysWOW64\Imnoni32.exe
        
        C:\Windows\system32\Imnoni32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4268
        
        C:\Windows\SysWOW64\Idhgkcln.exe
        
        C:\Windows\system32\Idhgkcln.exe
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2840
        
        C:\Windows\SysWOW64\Ikbphn32.exe
        
        C:\Windows\system32\Ikbphn32.exe
        21⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1940
        
        C:\Windows\SysWOW64\Ipohpdbb.exe
        
        C:\Windows\system32\Ipohpdbb.exe
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1644
        
        C:\Windows\SysWOW64\Ifipmo32.exe
        
        C:\Windows\system32\Ifipmo32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1008
        
        C:\Windows\SysWOW64\Imbhiial.exe
        
        C:\Windows\system32\Imbhiial.exe
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4176
        
        C:\Windows\SysWOW64\Idmafc32.exe
        
        C:\Windows\system32\Idmafc32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2756
        
        C:\Windows\SysWOW64\Ikgicmpe.exe
        
        C:\Windows\system32\Ikgicmpe.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3360
        
        C:\Windows\SysWOW64\Iaqapggb.exe
        
        C:\Windows\system32\Iaqapggb.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1496
        
        C:\Windows\SysWOW64\Ihkila32.exe
        
        C:\Windows\system32\Ihkila32.exe
        28⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1332
        
        C:\Windows\SysWOW64\Imgbdh32.exe
        
        C:\Windows\system32\Imgbdh32.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1664
        
        C:\Windows\SysWOW64\Jdajabdc.exe
        
        C:\Windows\system32\Jdajabdc.exe
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1284
        
        C:\Windows\SysWOW64\Jkkbnl32.exe
        
        C:\Windows\system32\Jkkbnl32.exe
        31⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4260
        
        C:\Windows\SysWOW64\Jphkfc32.exe
        
        C:\Windows\system32\Jphkfc32.exe
        32⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4124
        
        C:\Windows\SysWOW64\Jgbccm32.exe
        
        C:\Windows\system32\Jgbccm32.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1832
        
        C:\Windows\SysWOW64\Jmlkpgia.exe
        
        C:\Windows\system32\Jmlkpgia.exe
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5244
        
        C:\Windows\SysWOW64\Jdfcla32.exe
        
        C:\Windows\system32\Jdfcla32.exe
        35⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1852
        
        C:\Windows\SysWOW64\Jolhjj32.exe
        
        C:\Windows\system32\Jolhjj32.exe
        36⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4776
        
        C:\Windows\SysWOW64\Jpmdabfb.exe
        
        C:\Windows\system32\Jpmdabfb.exe
        37⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2316
        
        C:\Windows\SysWOW64\Jggmnmmo.exe
        
        C:\Windows\system32\Jggmnmmo.exe
        38⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1756
        
        C:\Windows\SysWOW64\Jmqekg32.exe
        
        C:\Windows\system32\Jmqekg32.exe
        39⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3896
        
        C:\Windows\SysWOW64\Jdkmgali.exe
        
        C:\Windows\system32\Jdkmgali.exe
        40⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4312
        
        C:\Windows\SysWOW64\Jopaejlo.exe
        
        C:\Windows\system32\Jopaejlo.exe
        41⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2868
        
        C:\Windows\SysWOW64\Kpanmb32.exe
        
        C:\Windows\system32\Kpanmb32.exe
        42⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2208
        
        C:\Windows\SysWOW64\Kgkfil32.exe
        
        C:\Windows\system32\Kgkfil32.exe
        43⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5976
        
        C:\Windows\SysWOW64\Knenffqf.exe
        
        C:\Windows\system32\Knenffqf.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2020
        
        C:\Windows\SysWOW64\Kdpfbp32.exe
        
        C:\Windows\system32\Kdpfbp32.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5992
        
        C:\Windows\SysWOW64\Kkioojpp.exe
        
        C:\Windows\system32\Kkioojpp.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1568
        
        C:\Windows\SysWOW64\Kpfggang.exe
        
        C:\Windows\system32\Kpfggang.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4700
        
        C:\Windows\SysWOW64\Knjhae32.exe
        
        C:\Windows\system32\Knjhae32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6076
        
        C:\Windows\SysWOW64\Kddpnpdn.exe
        
        C:\Windows\system32\Kddpnpdn.exe
        49⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2476
        
        C:\Windows\SysWOW64\Kknhjj32.exe
        
        C:\Windows\system32\Kknhjj32.exe
        50⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5816
        
        C:\Windows\SysWOW64\Kahpgcch.exe
        
        C:\Windows\system32\Kahpgcch.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3012
        
        C:\Windows\SysWOW64\Kgeiokao.exe
        
        C:\Windows\system32\Kgeiokao.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4272
        
        C:\Windows\SysWOW64\Lnoalehl.exe
        
        C:\Windows\system32\Lnoalehl.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3464
        
        C:\Windows\SysWOW64\Lhdeinhb.exe
        
        C:\Windows\system32\Lhdeinhb.exe
        54⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1340
        
        C:\Windows\SysWOW64\Lonnfg32.exe
        
        C:\Windows\system32\Lonnfg32.exe
        55⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5284
        
        C:\Windows\SysWOW64\Lhgbomfo.exe
        
        C:\Windows\system32\Lhgbomfo.exe
        56⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5648
        
        C:\Windows\SysWOW64\Loqjlg32.exe
        
        C:\Windows\system32\Loqjlg32.exe
        57⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2312
        
        C:\Windows\SysWOW64\Lhiodm32.exe
        
        C:\Windows\system32\Lhiodm32.exe
        58⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4588
        
        C:\Windows\SysWOW64\Locgagli.exe
        
        C:\Windows\system32\Locgagli.exe
        59⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2064
        
        C:\Windows\SysWOW64\Ldpoinjq.exe
        
        C:\Windows\system32\Ldpoinjq.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3204
        
        C:\Windows\SysWOW64\Lkjhfh32.exe
        
        C:\Windows\system32\Lkjhfh32.exe
        61⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5900
        
        C:\Windows\SysWOW64\Lqfpoope.exe
        
        C:\Windows\system32\Lqfpoope.exe
        62⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2520
        
        C:\Windows\SysWOW64\Lgqhki32.exe
        
        C:\Windows\system32\Lgqhki32.exe
        63⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2692
        
        C:\Windows\SysWOW64\Mnjqhcno.exe
        
        C:\Windows\system32\Mnjqhcno.exe
        64⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3164
        
        C:\Windows\SysWOW64\Mhpeelnd.exe
        
        C:\Windows\system32\Mhpeelnd.exe
        65⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5572
        
        C:\Windows\SysWOW64\Mojmbf32.exe
        
        C:\Windows\system32\Mojmbf32.exe
        66⤵
        Drops file in System32 directory
        
        PID:3640
        
        C:\Windows\SysWOW64\Mdgejmdi.exe
        
        C:\Windows\system32\Mdgejmdi.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2644
        
        C:\Windows\SysWOW64\Mkangg32.exe
        
        C:\Windows\system32\Mkangg32.exe
        68⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2808
        
        C:\Windows\SysWOW64\Mbkfcabb.exe
        
        C:\Windows\system32\Mbkfcabb.exe
        69⤵
        
        PID:2628
        
        C:\Windows\SysWOW64\Mggolhaj.exe
        
        C:\Windows\system32\Mggolhaj.exe
        70⤵
        
        PID:3352
        
        C:\Windows\SysWOW64\Mnaghb32.exe
        
        C:\Windows\system32\Mnaghb32.exe
        71⤵
        Drops file in System32 directory
        
        PID:1176
        
        C:\Windows\SysWOW64\Mhgkfkhl.exe
        
        C:\Windows\system32\Mhgkfkhl.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:688
        
        C:\Windows\SysWOW64\Moacbe32.exe
        
        C:\Windows\system32\Moacbe32.exe
        73⤵
        Modifies registry class
        
        PID:4512
        
        C:\Windows\SysWOW64\Mdnlkl32.exe
        
        C:\Windows\system32\Mdnlkl32.exe
        74⤵
        
        PID:4180
        
        C:\Windows\SysWOW64\Nocphd32.exe
        
        C:\Windows\system32\Nocphd32.exe
        75⤵
        
        PID:4448
        
        C:\Windows\SysWOW64\Ndphpk32.exe
        
        C:\Windows\system32\Ndphpk32.exe
        76⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Nofmndkd.exe
        
        C:\Windows\system32\Nofmndkd.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5736
        
        C:\Windows\SysWOW64\Nqgiel32.exe
        
        C:\Windows\system32\Nqgiel32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4900
        
        C:\Windows\SysWOW64\Ngaabfio.exe
        
        C:\Windows\system32\Ngaabfio.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2780
        
        C:\Windows\SysWOW64\Nbfeoohe.exe
        
        C:\Windows\system32\Nbfeoohe.exe
        80⤵
        Modifies registry class
        
        PID:2936
        
        C:\Windows\SysWOW64\Niqnli32.exe
        
        C:\Windows\system32\Niqnli32.exe
        81⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2192
        
        C:\Windows\SysWOW64\Nojfic32.exe
        
        C:\Windows\system32\Nojfic32.exe
        82⤵
        
        PID:3288
        
        C:\Windows\SysWOW64\Negoaj32.exe
        
        C:\Windows\system32\Negoaj32.exe
        83⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Nombnc32.exe
        
        C:\Windows\system32\Nombnc32.exe
        84⤵
        
        PID:1612
        
        C:\Windows\SysWOW64\Nqnofkkj.exe
        
        C:\Windows\system32\Nqnofkkj.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5152
        
        C:\Windows\SysWOW64\Okcccdkp.exe
        
        C:\Windows\system32\Okcccdkp.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2440
        
        C:\Windows\SysWOW64\Obnlpnbm.exe
        
        C:\Windows\system32\Obnlpnbm.exe
        87⤵
        
        PID:1084
        
        C:\Windows\SysWOW64\Ogjdheqd.exe
        
        C:\Windows\system32\Ogjdheqd.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2076
        
        C:\Windows\SysWOW64\Ondleo32.exe
        
        C:\Windows\system32\Ondleo32.exe
        89⤵
        Modifies registry class
        
        PID:4100
        
        C:\Windows\SysWOW64\Oijqbh32.exe
        
        C:\Windows\system32\Oijqbh32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4084
        
        C:\Windows\SysWOW64\Opdiobod.exe
        
        C:\Windows\system32\Opdiobod.exe
        91⤵
        
        PID:4416
        
        C:\Windows\SysWOW64\Oeqagi32.exe
        
        C:\Windows\system32\Oeqagi32.exe
        92⤵
        
        PID:2980
        
        C:\Windows\SysWOW64\Okkidceh.exe
        
        C:\Windows\system32\Okkidceh.exe
        93⤵
        Modifies registry class
        
        PID:2524
        
        C:\Windows\SysWOW64\Oagbljcp.exe
        
        C:\Windows\system32\Oagbljcp.exe
        94⤵
        Drops file in System32 directory
        
        PID:52
        
        C:\Windows\SysWOW64\Ogajid32.exe
        
        C:\Windows\system32\Ogajid32.exe
        95⤵
        
        PID:4284
        
        C:\Windows\SysWOW64\Onkbenbi.exe
        
        C:\Windows\system32\Onkbenbi.exe
        96⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4192
        
        C:\Windows\SysWOW64\Oiagcg32.exe
        
        C:\Windows\system32\Oiagcg32.exe
        97⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\Ppkopail.exe
        
        C:\Windows\system32\Ppkopail.exe
        98⤵
        Drops file in System32 directory
        
        PID:3600
        
        C:\Windows\SysWOW64\Pehghhgc.exe
        
        C:\Windows\system32\Pehghhgc.exe
        99⤵
        Drops file in System32 directory
        
        PID:3372
        
        C:\Windows\SysWOW64\Qimfoe32.exe
        
        C:\Windows\system32\Qimfoe32.exe
        100⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3940
        
        C:\Windows\SysWOW64\Qbekgknb.exe
        
        C:\Windows\system32\Qbekgknb.exe
        101⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Qhbcpb32.exe
        
        C:\Windows\system32\Qhbcpb32.exe
        102⤵
        
        PID:4756
        
        C:\Windows\SysWOW64\Qnlkllcf.exe
        
        C:\Windows\system32\Qnlkllcf.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5932
        
        C:\Windows\SysWOW64\Aefcif32.exe
        
        C:\Windows\system32\Aefcif32.exe
        104⤵
        
        PID:4516
        
        C:\Windows\SysWOW64\Apkhfo32.exe
        
        C:\Windows\system32\Apkhfo32.exe
        105⤵
        Drops file in System32 directory
        
        PID:4048
        
        C:\Windows\SysWOW64\Aaldngqg.exe
        
        C:\Windows\system32\Aaldngqg.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5020
        
        C:\Windows\SysWOW64\Ahfmka32.exe
        
        C:\Windows\system32\Ahfmka32.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2472
        
        C:\Windows\SysWOW64\Aoqegk32.exe
        
        C:\Windows\system32\Aoqegk32.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5600
        
        C:\Windows\SysWOW64\Aejmdegn.exe
        
        C:\Windows\system32\Aejmdegn.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:428
        
        C:\Windows\SysWOW64\Aldeap32.exe
        
        C:\Windows\system32\Aldeap32.exe
        110⤵
        
        PID:4640
        
        C:\Windows\SysWOW64\Aemjjeek.exe
        
        C:\Windows\system32\Aemjjeek.exe
        111⤵
        Drops file in System32 directory
        
        PID:1924
        
        C:\Windows\SysWOW64\Apbngn32.exe
        
        C:\Windows\system32\Apbngn32.exe
        112⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5372
        
        C:\Windows\SysWOW64\Aacjofkp.exe
        
        C:\Windows\system32\Aacjofkp.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3340
        
        C:\Windows\SysWOW64\Alioloje.exe
        
        C:\Windows\system32\Alioloje.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2120
        
        C:\Windows\SysWOW64\Abcgii32.exe
        
        C:\Windows\system32\Abcgii32.exe
        115⤵
        
        PID:3024
        
        C:\Windows\SysWOW64\Bhppap32.exe
        
        C:\Windows\system32\Bhppap32.exe
        116⤵
        
        PID:4944
        
        C:\Windows\SysWOW64\Bbecnipp.exe
        
        C:\Windows\system32\Bbecnipp.exe
        117⤵
        
        PID:4608
        
        C:\Windows\SysWOW64\Bpidhmoi.exe
        
        C:\Windows\system32\Bpidhmoi.exe
        118⤵
        Modifies registry class
        
        PID:5956
        
        C:\Windows\SysWOW64\Bajqpe32.exe
        
        C:\Windows\system32\Bajqpe32.exe
        119⤵
        
        PID:3828
        
        C:\Windows\SysWOW64\Bhdilold.exe
        
        C:\Windows\system32\Bhdilold.exe
        120⤵
        System Location Discovery: System Language Discovery
        
        PID:5580
        
        C:\Windows\SysWOW64\Booaii32.exe
        
        C:\Windows\system32\Booaii32.exe
        121⤵
        Modifies registry class
        
        PID:4244
        
        C:\Windows\SysWOW64\Behiec32.exe
        
        C:\Windows\system32\Behiec32.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5480
        
        C:\Windows\SysWOW64\Bpnncl32.exe
        
        C:\Windows\system32\Bpnncl32.exe
        123⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\Bekfkc32.exe
        
        C:\Windows\system32\Bekfkc32.exe
        124⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Bppjhl32.exe
        
        C:\Windows\system32\Bppjhl32.exe
        125⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6052
        
        C:\Windows\SysWOW64\Ciioaa32.exe
        
        C:\Windows\system32\Ciioaa32.exe
        126⤵
        Modifies registry class
        
        PID:3472
        
        C:\Windows\SysWOW64\Cpbgnlfo.exe
        
        C:\Windows\system32\Cpbgnlfo.exe
        127⤵
        Drops file in System32 directory
        
        PID:2300
        
        C:\Windows\SysWOW64\Ccacjgfb.exe
        
        C:\Windows\system32\Ccacjgfb.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3844
        
        C:\Windows\SysWOW64\Chnlbndj.exe
        
        C:\Windows\system32\Chnlbndj.exe
        129⤵
        Drops file in System32 directory
        
        PID:3516
        
        C:\Windows\SysWOW64\Cccppgcp.exe
        
        C:\Windows\system32\Cccppgcp.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4140
        
        C:\Windows\SysWOW64\Chphhn32.exe
        
        C:\Windows\system32\Chphhn32.exe
        131⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2236
        
        C:\Windows\SysWOW64\Cojqdhid.exe
        
        C:\Windows\system32\Cojqdhid.exe
        132⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1180
        
        C:\Windows\SysWOW64\Cediab32.exe
        
        C:\Windows\system32\Cediab32.exe
        133⤵
        Drops file in System32 directory
        
        PID:4684
        
        C:\Windows\SysWOW64\Cpjmok32.exe
        
        C:\Windows\system32\Cpjmok32.exe
        134⤵
        System Location Discovery: System Language Discovery
        
        PID:3264
        
        C:\Windows\SysWOW64\Cakjfcfe.exe
        
        C:\Windows\system32\Cakjfcfe.exe
        135⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2680
        
        C:\Windows\SysWOW64\Clqncl32.exe
        
        C:\Windows\system32\Clqncl32.exe
        136⤵
        
        PID:2572
        
        C:\Windows\SysWOW64\Damflb32.exe
        
        C:\Windows\system32\Damflb32.exe
        137⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5916
        
        C:\Windows\SysWOW64\Dlckik32.exe
        
        C:\Windows\system32\Dlckik32.exe
        138⤵
        Drops file in System32 directory
        
        PID:1744
        
        C:\Windows\SysWOW64\Dapcab32.exe
        
        C:\Windows\system32\Dapcab32.exe
        139⤵
        Drops file in System32 directory
        
        PID:940
        
        C:\Windows\SysWOW64\Dlegokbe.exe
        
        C:\Windows\system32\Dlegokbe.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4800
        
        C:\Windows\SysWOW64\Dhlhcl32.exe
        
        C:\Windows\system32\Dhlhcl32.exe
        141⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\Dofpqfof.exe
        
        C:\Windows\system32\Dofpqfof.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5632
        
        C:\Windows\SysWOW64\Dhndil32.exe
        
        C:\Windows\system32\Dhndil32.exe
        143⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Dcdifdem.exe
        
        C:\Windows\system32\Dcdifdem.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6212
        
        C:\Windows\SysWOW64\Djnaco32.exe
        
        C:\Windows\system32\Djnaco32.exe
        145⤵
        Modifies registry class
        
        PID:6252
        
        C:\Windows\SysWOW64\Eokjke32.exe
        
        C:\Windows\system32\Eokjke32.exe
        146⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Ejpnin32.exe
        
        C:\Windows\system32\Ejpnin32.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6332
        
        C:\Windows\SysWOW64\Epjfehbd.exe
        
        C:\Windows\system32\Epjfehbd.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6372
        
        C:\Windows\SysWOW64\Ejbknnid.exe
        
        C:\Windows\system32\Ejbknnid.exe
        149⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Eplckh32.exe
        
        C:\Windows\system32\Eplckh32.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6452
        
        C:\Windows\SysWOW64\Ejegdngb.exe
        
        C:\Windows\system32\Ejegdngb.exe
        151⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Eoapldei.exe
        
        C:\Windows\system32\Eoapldei.exe
        152⤵
        Drops file in System32 directory
        
        PID:6536
        
        C:\Windows\SysWOW64\Eflhiolf.exe
        
        C:\Windows\system32\Eflhiolf.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6576
        
        C:\Windows\SysWOW64\Eqalfgll.exe
        
        C:\Windows\system32\Eqalfgll.exe
        154⤵
        Drops file in System32 directory
        
        PID:6620
        
        C:\Windows\SysWOW64\Efnennjc.exe
        
        C:\Windows\system32\Efnennjc.exe
        155⤵
        Drops file in System32 directory
        
        PID:6660
        
        C:\Windows\SysWOW64\Emhmkh32.exe
        
        C:\Windows\system32\Emhmkh32.exe
        156⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Fbeeco32.exe
        
        C:\Windows\system32\Fbeeco32.exe
        157⤵
        Drops file in System32 directory
        
        PID:6744
        
        C:\Windows\SysWOW64\Fmjjqhpn.exe
        
        C:\Windows\system32\Fmjjqhpn.exe
        158⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Fbgbione.exe
        
        C:\Windows\system32\Fbgbione.exe
        159⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Fiajfi32.exe
        
        C:\Windows\system32\Fiajfi32.exe
        160⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6868
        
        C:\Windows\SysWOW64\Fokbbcmo.exe
        
        C:\Windows\system32\Fokbbcmo.exe
        161⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Fjqgpl32.exe
        
        C:\Windows\system32\Fjqgpl32.exe
        162⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6952
        
        C:\Windows\SysWOW64\Fomohc32.exe
        
        C:\Windows\system32\Fomohc32.exe
        163⤵
        Drops file in System32 directory
        
        PID:6992
        
        C:\Windows\SysWOW64\Fjccel32.exe
        
        C:\Windows\system32\Fjccel32.exe
        164⤵
        Modifies registry class
        
        PID:7028
        
        C:\Windows\SysWOW64\Foplnb32.exe
        
        C:\Windows\system32\Foplnb32.exe
        165⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Ffjdjmpf.exe
        
        C:\Windows\system32\Ffjdjmpf.exe
        166⤵
        System Location Discovery: System Language Discovery
        
        PID:7112
        
        C:\Windows\SysWOW64\Gmclgghc.exe
        
        C:\Windows\system32\Gmclgghc.exe
        167⤵
        System Location Discovery: System Language Discovery
        
        PID:7160
        
        C:\Windows\SysWOW64\Gbqeonfj.exe
        
        C:\Windows\system32\Gbqeonfj.exe
        168⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Gijmlh32.exe
        
        C:\Windows\system32\Gijmlh32.exe
        169⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Gcpaiq32.exe
        
        C:\Windows\system32\Gcpaiq32.exe
        170⤵
        Modifies registry class
        
        PID:6308
        
        C:\Windows\SysWOW64\Gjjjfkdj.exe
        
        C:\Windows\system32\Gjjjfkdj.exe
        171⤵
        
        PID:1728
        
        C:\Windows\SysWOW64\Gqdbbelf.exe
        
        C:\Windows\system32\Gqdbbelf.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3260
        
        C:\Windows\SysWOW64\Gbenjm32.exe
        
        C:\Windows\system32\Gbenjm32.exe
        173⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Giofggia.exe
        
        C:\Windows\system32\Giofggia.exe
        174⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6556
        
        C:\Windows\SysWOW64\Gpioca32.exe
        
        C:\Windows\system32\Gpioca32.exe
        175⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Gjocaj32.exe
        
        C:\Windows\system32\Gjocaj32.exe
        176⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Gqhknd32.exe
        
        C:\Windows\system32\Gqhknd32.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6756
        
        C:\Windows\SysWOW64\Gfedfk32.exe
        
        C:\Windows\system32\Gfedfk32.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6836
        
        C:\Windows\SysWOW64\Hakhcd32.exe
        
        C:\Windows\system32\Hakhcd32.exe
        179⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6892
        
        C:\Windows\SysWOW64\Hjcllilo.exe
        
        C:\Windows\system32\Hjcllilo.exe
        180⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Hclaeocp.exe
        
        C:\Windows\system32\Hclaeocp.exe
        181⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7056
        
        C:\Windows\SysWOW64\Hihimfag.exe
        
        C:\Windows\system32\Hihimfag.exe
        182⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Hcnnjoam.exe
        
        C:\Windows\system32\Hcnnjoam.exe
        183⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6224
        
        C:\Windows\SysWOW64\Hjhfgi32.exe
        
        C:\Windows\system32\Hjhfgi32.exe
        184⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Habndbpf.exe
        
        C:\Windows\system32\Habndbpf.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6460
        
        C:\Windows\SysWOW64\Hjjbmhfg.exe
        
        C:\Windows\system32\Hjjbmhfg.exe
        186⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Hadkib32.exe
        
        C:\Windows\system32\Hadkib32.exe
        187⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Hfacai32.exe
        
        C:\Windows\system32\Hfacai32.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6816
        
        C:\Windows\SysWOW64\Imklncch.exe
        
        C:\Windows\system32\Imklncch.exe
        189⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Ibhdgjap.exe
        
        C:\Windows\system32\Ibhdgjap.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7052
        
        C:\Windows\SysWOW64\Immhdc32.exe
        
        C:\Windows\system32\Immhdc32.exe
        191⤵
        
        PID:3720
        
        C:\Windows\SysWOW64\Ibjqlj32.exe
        
        C:\Windows\system32\Ibjqlj32.exe
        192⤵
        Modifies registry class
        
        PID:6328
        
        C:\Windows\SysWOW64\Iakajagl.exe
        
        C:\Windows\system32\Iakajagl.exe
        193⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Ijcecgnl.exe
        
        C:\Windows\system32\Ijcecgnl.exe
        194⤵
        Drops file in System32 directory
        
        PID:6780
        
        C:\Windows\SysWOW64\Ipqnknld.exe
        
        C:\Windows\system32\Ipqnknld.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6964
        
        C:\Windows\SysWOW64\Imdndbkn.exe
        
        C:\Windows\system32\Imdndbkn.exe
        196⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Ibagmiie.exe
        
        C:\Windows\system32\Ibagmiie.exe
        197⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:748
        
        C:\Windows\SysWOW64\Jabgkpad.exe
        
        C:\Windows\system32\Jabgkpad.exe
        198⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Jbccbi32.exe
        
        C:\Windows\system32\Jbccbi32.exe
        199⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Jinloboo.exe
        
        C:\Windows\system32\Jinloboo.exe
        200⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Jdcplkoe.exe
        
        C:\Windows\system32\Jdcplkoe.exe
        201⤵
        System Location Discovery: System Language Discovery
        
        PID:6968
        
        C:\Windows\SysWOW64\Jjmhie32.exe
        
        C:\Windows\system32\Jjmhie32.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6512
        
        C:\Windows\SysWOW64\Jagqfp32.exe
        
        C:\Windows\system32\Jagqfp32.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1116
        
        C:\Windows\SysWOW64\Jfdinf32.exe
        
        C:\Windows\system32\Jfdinf32.exe
        204⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Jaimko32.exe
        
        C:\Windows\system32\Jaimko32.exe
        205⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Jbkjcgaj.exe
        
        C:\Windows\system32\Jbkjcgaj.exe
        206⤵
        System Location Discovery: System Language Discovery
        
        PID:7232
        
        C:\Windows\SysWOW64\Jidbpa32.exe
        
        C:\Windows\system32\Jidbpa32.exe
        207⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Jpojml32.exe
        
        C:\Windows\system32\Jpojml32.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7304
        
        C:\Windows\SysWOW64\Kkdnjd32.exe
        
        C:\Windows\system32\Kkdnjd32.exe
        209⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Kanffogf.exe
        
        C:\Windows\system32\Kanffogf.exe
        210⤵
        Modifies registry class
        
        PID:7376
        
        C:\Windows\SysWOW64\Kiikkada.exe
        
        C:\Windows\system32\Kiikkada.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7412
        
        C:\Windows\SysWOW64\Kdophj32.exe
        
        C:\Windows\system32\Kdophj32.exe
        212⤵
        Modifies registry class
        
        PID:7448
        
        C:\Windows\SysWOW64\Kilhqq32.exe
        
        C:\Windows\system32\Kilhqq32.exe
        213⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Kcdmifip.exe
        
        C:\Windows\system32\Kcdmifip.exe
        214⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Kmiqfoie.exe
        
        C:\Windows\system32\Kmiqfoie.exe
        215⤵
        Modifies registry class
        
        PID:7564
        
        C:\Windows\SysWOW64\Kcfiof32.exe
        
        C:\Windows\system32\Kcfiof32.exe
        216⤵
        Drops file in System32 directory
        
        PID:7600
        
        C:\Windows\SysWOW64\Kmlmlo32.exe
        
        C:\Windows\system32\Kmlmlo32.exe
        217⤵
        System Location Discovery: System Language Discovery
        
        PID:7640
        
        C:\Windows\SysWOW64\Lcifde32.exe
        
        C:\Windows\system32\Lcifde32.exe
        218⤵
        Modifies registry class
        
        PID:7676
        
        C:\Windows\SysWOW64\Lmnjan32.exe
        
        C:\Windows\system32\Lmnjan32.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7712
        
        C:\Windows\SysWOW64\Lckbje32.exe
        
        C:\Windows\system32\Lckbje32.exe
        220⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Lmqggncn.exe
        
        C:\Windows\system32\Lmqggncn.exe
        221⤵
        Drops file in System32 directory
        
        PID:7780
        
        C:\Windows\SysWOW64\Ldjodh32.exe
        
        C:\Windows\system32\Ldjodh32.exe
        222⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Ligglo32.exe
        
        C:\Windows\system32\Ligglo32.exe
        223⤵
        Drops file in System32 directory
        
        PID:7852
        
        C:\Windows\SysWOW64\Lpapiipo.exe
        
        C:\Windows\system32\Lpapiipo.exe
        224⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Lkgdfb32.exe
        
        C:\Windows\system32\Lkgdfb32.exe
        225⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Lpcmoi32.exe
        
        C:\Windows\system32\Lpcmoi32.exe
        226⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Lgnekcei.exe
        
        C:\Windows\system32\Lgnekcei.exe
        227⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Lacihleo.exe
        
        C:\Windows\system32\Lacihleo.exe
        228⤵
        System Location Discovery: System Language Discovery
        
        PID:8040
        
        C:\Windows\SysWOW64\Mcdepd32.exe
        
        C:\Windows\system32\Mcdepd32.exe
        229⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8076
        
        C:\Windows\SysWOW64\Mphfjhjf.exe
        
        C:\Windows\system32\Mphfjhjf.exe
        230⤵
        Modifies registry class
        
        PID:8116
        
        C:\Windows\SysWOW64\Mknjgajl.exe
        
        C:\Windows\system32\Mknjgajl.exe
        231⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Mahbck32.exe
        
        C:\Windows\system32\Mahbck32.exe
        232⤵
        System Location Discovery: System Language Discovery
        
        PID:8188
        
        C:\Windows\SysWOW64\Mgdklb32.exe
        
        C:\Windows\system32\Mgdklb32.exe
        233⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7220
        
        C:\Windows\SysWOW64\Majoikof.exe
        
        C:\Windows\system32\Majoikof.exe
        234⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7292
        
        C:\Windows\SysWOW64\Mkbcbp32.exe
        
        C:\Windows\system32\Mkbcbp32.exe
        235⤵
        System Location Discovery: System Language Discovery
        
        PID:7352
        
        C:\Windows\SysWOW64\Mallojmd.exe
        
        C:\Windows\system32\Mallojmd.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7420
        
        C:\Windows\SysWOW64\Mkepgp32.exe
        
        C:\Windows\system32\Mkepgp32.exe
        237⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Maohdj32.exe
        
        C:\Windows\system32\Maohdj32.exe
        238⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Ncpelbap.exe
        
        C:\Windows\system32\Ncpelbap.exe
        239⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7616
        
        C:\Windows\SysWOW64\Naaejj32.exe
        
        C:\Windows\system32\Naaejj32.exe
        240⤵
        System Location Discovery: System Language Discovery
        
        PID:7668
        
        C:\Windows\SysWOW64\Nkijbooo.exe
        
        C:\Windows\system32\Nkijbooo.exe
        241⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\Nqfbkf32.exe
        
        C:\Windows\system32\Nqfbkf32.exe
        242⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7772
        
        C:\Windows\SysWOW64\Nklfho32.exe
        
        C:\Windows\system32\Nklfho32.exe
        243⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Nbfoeiei.exe
        
        C:\Windows\system32\Nbfoeiei.exe
        244⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Nkncno32.exe
        
        C:\Windows\system32\Nkncno32.exe
        245⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Nbhkjicf.exe
        
        C:\Windows\system32\Nbhkjicf.exe
        246⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Ncihbaie.exe
        
        C:\Windows\system32\Ncihbaie.exe
        247⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8068
        
        C:\Windows\SysWOW64\Njcpok32.exe
        
        C:\Windows\system32\Njcpok32.exe
        248⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Oqmhlego.exe
        
        C:\Windows\system32\Oqmhlego.exe
        249⤵
        Modifies registry class
        
        PID:8180
        
        C:\Windows\SysWOW64\Oggqho32.exe
        
        C:\Windows\system32\Oggqho32.exe
        250⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Obmeeh32.exe
        
        C:\Windows\system32\Obmeeh32.exe
        251⤵
        System Location Discovery: System Language Discovery
        
        PID:7348
        
        C:\Windows\SysWOW64\Ogjmnomi.exe
        
        C:\Windows\system32\Ogjmnomi.exe
        252⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7460
        
        C:\Windows\SysWOW64\Odnngclb.exe
        
        C:\Windows\system32\Odnngclb.exe
        253⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7560
        
        C:\Windows\SysWOW64\Okgfdm32.exe
        
        C:\Windows\system32\Okgfdm32.exe
        254⤵
        System Location Discovery: System Language Discovery
        
        PID:7672
        
        C:\Windows\SysWOW64\Obanqgkl.exe
        
        C:\Windows\system32\Obanqgkl.exe
        255⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7796
        
        C:\Windows\SysWOW64\Ognginic.exe
        
        C:\Windows\system32\Ognginic.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7904
        
        C:\Windows\SysWOW64\Obdkfg32.exe
        
        C:\Windows\system32\Obdkfg32.exe
        257⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Ocegnoog.exe
        
        C:\Windows\system32\Ocegnoog.exe
        258⤵
        System Location Discovery: System Language Discovery
        
        PID:8112
        
        C:\Windows\SysWOW64\Ojopki32.exe
        
        C:\Windows\system32\Ojopki32.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7240
        
        C:\Windows\SysWOW64\Pbfglg32.exe
        
        C:\Windows\system32\Pbfglg32.exe
        260⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7444
        
        C:\Windows\SysWOW64\Pcgdcome.exe
        
        C:\Windows\system32\Pcgdcome.exe
        261⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Pjalpida.exe
        
        C:\Windows\system32\Pjalpida.exe
        262⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7884
        
        C:\Windows\SysWOW64\Pqkdmc32.exe
        
        C:\Windows\system32\Pqkdmc32.exe
        263⤵
        System Location Discovery: System Language Discovery
        
        PID:8108
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8108 -s 448
        264⤵
        Program crash
        
        PID:7532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 8108 -ip 8108
1⤵
PID:7824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Gfodpbpl.exe

Path C:\Windows\SysWOW64\Gfodpbpl.exe
Size 429KB
SHA256 36b964a88465d11a05352ab5d76663a0b55065d6653e410ed145ef47fc5c3857
MD5 6ca56ce01b4e9a8bba17c065843839c3
SHA1 4de91bd839bd21493f99fdd3a4849a15588cd715
SHA512 e1cf38aafccad75bcd18828b562d1e590fdfdbfb8b60a829089603b9f807eeb71ef911ea2fd2f83455aa923c2e0d24a50044ef498ecb6e35f7b1ea8d9840b2e2
SSDEEP 6144:gpbEfeJFV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:N//NcZ7/N
TLSH
T1819460256A3119E6DDEE6BF5AC1249D88181E9B118F1F13EA633DFDCC8E4DA1CC14B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gmfpgmil.exe

Path C:\Windows\SysWOW64\Gmfpgmil.exe
Size 429KB
SHA256 6522ee902e1b83247edbc56917102ccb182f97c3059b1f54b5e166831498bc3b
MD5 b1a59388ef94ecb4ec45fdd63f7086c0
SHA1 91b1b125826ba09eb25b110fe60dbd5f347d377b
SHA512 474dcd1f81015ed0ea2403ddc474217dc387c0198037b4d61f98fed776c2c154e486f1dbfe82784d4d859a00445a023870bdaf40d3b912286e10aebf355a6092
SSDEEP 6144:fiOOyyjV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:fiO9j/NcZ7/N
TLSH
T1509482252A3019E5DDEE6FB5AC9259D88181E8B124F2F13E6633DFDDC8E4D65CC04B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gpgihh32.exe

Path C:\Windows\SysWOW64\Gpgihh32.exe
Size 429KB
SHA256 66472312609560a8579c07efab5feb138aec459009c5f15ed0108328c23c9398
MD5 183618f6cafab81fe107f339f982d324
SHA1 6a4ea280de31061e988dd912a466252e3db509f5
SHA512 7ffe5fc52587d021a0a40102fc2ca9593abb591113a84ddce6d1335ceb81a68e9d5e75c0f8dbac18801706c7f2bfaaabc3ad6740368a29621d5b6083dea96c09
SSDEEP 6144:w/vFTwAhJ/7Xzvrfb3TPLQMoYkNV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:w/vCAhJ/7Xzvrfb3TPLQMoW/NcZ7/N
TLSH
T1099460652B3019E6DDEE6BB5AC1249D88281F9B114F1F13E6623DFDCD8E6DA1CC04B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gpjfng32.exe

Path C:\Windows\SysWOW64\Gpjfng32.exe
Size 429KB
SHA256 02b06e27677edc54b3721b1829f2ff894a8994a5145a3587324e90cc8c7cd496
MD5 8c991c781db74257dca81aabe46546d8
SHA1 656053f7e8df8c482e85bb2b099f5cbf3335cc49
SHA512 6cefe82b571951b8bf6be32a9ebe20b8e97322a964833cc80de912d52c326e2a33f67cbfbdf1f86e1eca69b50b9cd0947a9a5c8a85d23f6ab8df6d95debed9b5
SSDEEP 6144:F5y8Ry2V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:Xy8Y/NcZ7/N
TLSH
T1F09472666A301DE6DDEE6BB5AC1249D88182E9B114F1F13E6633EFDCC8E4D61CC44B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gplbcgbg.exe

Path C:\Windows\SysWOW64\Gplbcgbg.exe
Size 429KB
SHA256 719d53aaaa3f6e2b028bd973b3d67c2094bf990c9386a16c10e46662e216c45e
MD5 215e599a0daefeca337f033ec9093682
SHA1 af2bfa41ed79af1f381ef7d62fa06b31db4e65b2
SHA512 f0870926beb761ba7ab44f2ea94b537c2ecca2db23816c30c1ba8ae30808a8c5b28b15cd7b8356d061dd9061ed193d5e99c133407ce9797b1e90bb393caecc00
SSDEEP 6144:UvxvRV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:Uvx8/NcZ7/N
TLSH
T1349481292A3019E6DDFE6BB5AC1249E88181E4B115F1F13E6633DFECC8E5D66CC44B90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hanlcjgh.exe

Path C:\Windows\SysWOW64\Hanlcjgh.exe
Size 429KB
SHA256 c88996c69d097c39fe06e90a2ef5f69eee1153caf68cef8de7bf7b2525152ba3
MD5 7bad399c8c3c420757f7b34372da841e
SHA1 6e444d1f4d54073de383c54dea2649e88dc55a0f
SHA512 6135a9c8c57715c359be94a949dfedb2f93783618538e7e9ed457c2e4950a0bc0235fad7ac8ec892facec7b40ae467d826d8b95634423e3a3958574587b752b8
SSDEEP 6144:YYf38V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:YWV/NcZ7/N
TLSH
T1F29460656A3019EADDEE6BB5BC1249D88181E4B114F1F13E6633DFDCC8E4EA6CC04B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Haphiiee.exe

Path C:\Windows\SysWOW64\Haphiiee.exe
Size 429KB
SHA256 256744fe046f01bf15f5f014f9690817552d23cf808b5f08a531e0a327019a9d
MD5 2160603de507b08452558d271f9c4144
SHA1 413dfe1d63577f789d71ba2e9dd6e1bccb73b8e8
SHA512 3286599db7d546574c84612ffcfcab41e5622f9eff67be3e4abcb530ec7f3b99f7e9538d94bac8c9db6f586b94440328cccd9a34feb380dc23b100de57f270ee
SSDEEP 6144:LbXYuetWxUV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:PoNt2/NcZ7/N
TLSH
T193947366663019E6DEEE6BB5AC1249D88181E4B114F1F13E9673DFDCC8E4EA1CC85F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hdaajd32.exe

Path C:\Windows\SysWOW64\Hdaajd32.exe
Size 429KB
SHA256 f0b9d15ac553e083584d724a6009f3880af94cb603df15f2e25e54d9d05303ec
MD5 82fe34adc9508bd55e03fe21a2b5287c
SHA1 e92857dad0da294f42b1402d943cdef94da31ced
SHA512 fdbcecfee15c8dc72a6fae3258e7dcd5ba5b7718d3cc5b65e95e4a7ea4e0a04f5ff96ea7fca7230cb75d83434ca82d0c03409bf7529646dcb04e4306533f5dd9
SSDEEP 6144:CVX2LDV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:w2O/NcZ7/N
TLSH
T1089470A67A3019EADDEE6BB5AC5249E88181E5B104F1F13E6633DFDCC8E4D61CC05B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hdcnpd32.exe

Path C:\Windows\SysWOW64\Hdcnpd32.exe
Size 429KB
SHA256 6ec15d2107d27b7523b6e476fabec44503b3791f91e9ce12b04d6add0d9d10ed
MD5 17ba1b5af5b47e6368c9897bf5449ecc
SHA1 c3cc7a855b6d50863acb3b3ad5b79df9c2247e0d
SHA512 09fa5b4616e704a754e0e54f287307d9402bd982babcded121b4e7c874eb17b2ff3464032a97ed27682541c793f9ceb9804d5e1aca0c2f1656e5eae8dd522514
SSDEEP 6144:0Z6ExxgV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:4Bl/NcZ7/N
TLSH
T1DF948366663019E6DDEE6BB5AC124AE88081E4B918F1F13E6633DFDCD8E4D61CC05F84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hfmqapcl.exe

Path C:\Windows\SysWOW64\Hfmqapcl.exe
Size 429KB
SHA256 feaf8730c9b3c6155d2d7336976677600d3f30cecfc19875d3008ada1f79439c
MD5 3846e55d8dbe974ea5daf9a48d44ef22
SHA1 9eb3213ff59409437653d3b18782bfca13515a63
SHA512 684a4efb753c9f4f999ede9db27106d82ba63df08516e7b00db47b277d077ef9cdfcc4cbcccb6fc2b489ed22b6c110bde2a4980f9c29fb52837e08a37ce1663a
SSDEEP 6144:m8hV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:6/NcZ7/N
TLSH
T1E29470652A3019E7DDEE6BB5AC1249D88181E5B114F1F13E6A33DFDEC8E4DA2CC05B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hhhdpd32.exe

Path C:\Windows\SysWOW64\Hhhdpd32.exe
Size 429KB
SHA256 d28e8b0eb68dd665973eceabdad169b0a48c123b8f9875a1c47bba0a6cfd5f97
MD5 7c87335a93dfefae78870b4f053dd82b
SHA1 f037aea3a144c6a244845788d478a2e3d4050253
SHA512 881eac429879163a54f2746126ebed4f5b0822a98c997d92b3c58ef691b1abda484823867ff7ec98c8e940eec699773cc56839cb2dd6698d48c452eab1240914
SSDEEP 6144:IC98lFWYV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:d9KFY/NcZ7/N
TLSH
T1C9948459663019E5DDEE6BB5AC1249E881C1E9B148F1F13E6633DFECC9E4E62CC14B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hjdcfp32.exe

Path C:\Windows\SysWOW64\Hjdcfp32.exe
Size 429KB
SHA256 673e4bc150e8ad96687c8aaa7df81d2d064350c44f9044ff761236e1ad0845e9
MD5 3083710cf89b74ab2432f371b28489eb
SHA1 3731de9913b58adba3a89a7a427d04be7669a513
SHA512 a05e9927987316105976aaa9f177a5288f3bfd056b2be6d52a656aef63b7573ed1c7e24c017794f2a8488cfbebb664b19a7bb5541b45aa6d41692cd7fb7b48e7
SSDEEP 6144:rfm6FV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:rfa/NcZ7/N
TLSH
T1819481252A3819E6DDEE6BB5BC1249D99085E8B144F1F13E6637DFDCC8E4D62CC04B82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hjmfmnhp.exe

Path C:\Windows\SysWOW64\Hjmfmnhp.exe
Size 429KB
SHA256 cf6c61a9eab6085f3135eb5546942958d507968744807a9617712b117a47953b
MD5 0c7bfe0c35ae856f59217dabf679ed1b
SHA1 f50d30287795e24524fc0f34a4ebc843dccae2af
SHA512 4e10d265018d42032f9da9ec1425f066b6931dcbe09a30d1a99b236ffa1ff6a57e7288644dd7b1a2d1a51cbc5b4e1c6b165d1e02a49a29810a71bc73dd135071
SSDEEP 6144:LfmUgcsR+V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:LfmUc/NcZ7/N
TLSH
T1329472652A3019E6EDEEABB5AC1259E88181E5B104F1F13E6A33DFDDC8F5D61CC04B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hmginjki.exe

Path C:\Windows\SysWOW64\Hmginjki.exe
Size 429KB
SHA256 4f19eb77510ce62a865adb57054e67395a0fa75035e993fd692225f0f2e59974
MD5 52c2f6849909a57327292e21e2f542f0
SHA1 c18c77a8d1bf86abad51a13a40c4608649221b4b
SHA512 e4e46593c67f9418e7f0edcf532b324ec5dde68e124657d518e9f6af746046b91ffcf5030cea6bbc6056b96314b363e22069091531ce84371b744ccb2e76c59c
SSDEEP 6144:XM03SV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:cO/NcZ7/N
TLSH
T12D945065263019E6DDEE6BB5AC1249E88181E9F114F1F13EA633DFECD8E5D61CC09B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hnfehm32.exe

Path C:\Windows\SysWOW64\Hnfehm32.exe
Size 429KB
SHA256 bcb3383f560a84678fa89993d22a4749bcc570f947bbfd4680f8f6a762e272b1
MD5 c492349f66c6023b930f8f8f8c652c17
SHA1 51dd3c7ad3a78bccd14a52b88d7934c6656b58a9
SHA512 f1d2b238042ebe803bf5c5aceb1f2a781a03bba91ba8387b6c5f2bfc526fe7280664c01d2b9012c5712d8e8b7ec1ca937d3bb72c210ab4ae0cfab630be101545
SSDEEP 6144:7xKktOV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:7x/NcZ7/N
TLSH
T180946166663019E6DDEE6BB5AC1249E89182E9B114F1F13F6633DFDCC8E4DA1CC04B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Iaqapggb.exe

Path C:\Windows\SysWOW64\Iaqapggb.exe
Size 429KB
SHA256 c2c899135dacb0fb200356c39f6a495c16370a4ad1a63fef87f02779ca4770c1
MD5 9e89d86cf92762e87c6fb022a68b5173
SHA1 1507645d5d867f6609d784d20e9cfc57b2215438
SHA512 36488b1ed8c363d3a92e867b5c093ce3ecd43c5b85190244d05758ebc0850c4dddf98bf50eb0669dacc55d73ca8115b5917dfa2f83eea249fa06bdc2210dd41d
SSDEEP 6144:q+LX9hy5V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:rj9h1/NcZ7/N
TLSH
T1229481266A7019E9DEEE6BB5AD1249D88181E4B504F1F17E6633DFDCC8F4DA1CC08B84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Idhgkcln.exe

Path C:\Windows\SysWOW64\Idhgkcln.exe
Size 429KB
SHA256 340121b5307496ae1f8eca20534ec52c946fde7073a2af7bf47f2f0cb6ca00d8
MD5 33abea1c25a0daa12e8734ee7dcdfce7
SHA1 17d19ba32531b6e2257af91e05b7a857ef731c92
SHA512 e30cb7762fc74a972127abefd27da328badddc81bc41507f7a8b2805b63fcc54287050f813437ee742d1d5dad8c99ac4e1d582571110ec1effc2137ee7b5c564
SSDEEP 6144:5Lz4ys+V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:90/NcZ7/N
TLSH
T142945F656A301AE6DDEE6BB5AC1249E88181E5F114F1F13F66339FDCD8E4D61CC0AB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Idmafc32.exe

Path C:\Windows\SysWOW64\Idmafc32.exe
Size 429KB
SHA256 e15b86a0e63e04ce20bc1d7f8bbb9c347486fc248622acdf7d5b15c1980b7c87
MD5 3a724ec57d5b4f191920b51b3443d7bd
SHA1 23ba312031ff5e6270f940b24146bfa5949b440f
SHA512 2ae040dd3276fb84ad8990e691b0870c74c0f54873a74846b70f974f1d8c75943508ff623e97f43c7ad87af5af257dbdb83cc42f0846525cd4f53b066f36668d
SSDEEP 6144:NxFJWz5IHV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:PFMP/NcZ7/N
TLSH
T187946F696A3019E6EDEE6BF5AC1249D88181E5B114F1F23E6633DFDCC8E5DA1CC44B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ifdgaond.exe

Path C:\Windows\SysWOW64\Ifdgaond.exe
Size 429KB
SHA256 04200a4569d9956af2c2c7cf5ec2c9493773cf50b417dc5b07925411b75e9b2c
MD5 0bbba3b7c52f25773c589d706451a8e6
SHA1 e0578c37af4947a4e5f28d05914c66b804673e30
SHA512 aceda1d5ca26ea2e05bf9f61f3744a2972775633c5922fcacfaf053dac5274a0f44da74850590cdd622b5f943b59488f07f6e5a6bfbec796f4db0f7d3e871cbe
SSDEEP 6144:CjrPbYV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:iP9/NcZ7/N
TLSH
T1DB9472262A3019E6DEEE6BB5AC5249E88181E5B114F1F13E6A33DFDCD8E4D61DC44F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ifipmo32.exe

Path C:\Windows\SysWOW64\Ifipmo32.exe
Size 429KB
SHA256 0e75fb7ef443b8b2a06a10ee12ba2349e764a5ee5f08a858d9281590d897785e
MD5 66760a5c372517929ef553554b2c3531
SHA1 2e910e45f98af35eb12a78721ef8e8be81109cb9
SHA512 d1053429e533e9e334c14f1c651223f365f1d4a03212c409108bea84b278f208c3489d6f74b4e837562867e85c884f1af97153f44f41abd63236dcbc7a6646b8
SSDEEP 6144:Gy+NVCpdV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:GyQN/NcZ7/N
TLSH
T1C7948265AA3019E6DDEE6BB9BC1249E88185E5B114F1F13E6633DFDCC8E4DA1CC04B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ihkila32.exe

Path C:\Windows\SysWOW64\Ihkila32.exe
Size 429KB
SHA256 22389d13dc11bfc6571cfd0af5228460209a231815954105718ce3f3be59835e
MD5 58ba078f5c8496943ba785faef11ff66
SHA1 576b30c7cddaddc579e845aa767e7d3d4549e805
SHA512 31206971fa70f14e7f102e9196069bae57498dc3619f816cc3b787f16d69d817084423077fa8ec52f43230aa063d7e795220788c883fbcfa15d1d3be71f9da4c
SSDEEP 6144:oPTrV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:oG/NcZ7/N
TLSH
T1189461652A3029E6DEEE6BB5AC1249D88181E5F114F2F13E6633DFDDC8E4D61CC09B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ikbphn32.exe

Path C:\Windows\SysWOW64\Ikbphn32.exe
Size 429KB
SHA256 2c61321738c1fb58250034cad6d3ad8b6005e307b98ec0df159fe0e8eb8b1d0a
MD5 0db4e6fc31b4be5a82ccddfba9881be7
SHA1 448e53da4efb81de28bfc721eacaf4481f482cf4
SHA512 44f5b59f64a3859c0e0bc1c3e0a3d9aa1b75294b41ac2035c7572ffee50d4ca5b7a8bf0c9044188e45acd929ad46f801862afd972dcf7ac082143975ea158284
SSDEEP 6144:yNd895V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:yz8S/NcZ7/N
TLSH
T1DE9481652A3419E6DDEE6FB5AD1249D88281E6B804F1F13E66B3DFDCC8E4D61CC44B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ikgicmpe.exe

Path C:\Windows\SysWOW64\Ikgicmpe.exe
Size 429KB
SHA256 db4355ad5d542960c69cd428dbc687a508d917c269941596913799897e577dff
MD5 d9c7246f828d89156128018130c30459
SHA1 15ce833c24ef397af3e67ac5d2ff73a39a129fe3
SHA512 cfd35f42cea605469c299c37f4deae1554cd11630906012a32b44bf90d0b3b952ccf7580fcb49958f0079388cbd53512ef18f2252e3917ba3552d402ac09d8f1
SSDEEP 6144:RDc3qT1cmAV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:RDc6T1cY/NcZ7/N
TLSH
T1D89461692A301AE5DDEEABB5AC5249D88181E4B104F1F17F6673DFECC8E4D62CC14B84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Imbhiial.exe

Path C:\Windows\SysWOW64\Imbhiial.exe
Size 429KB
SHA256 5fe2d355b03fb2a94dd2e48268fb5e283996454412228f5f2933927ef2363ffe
MD5 2241247ec97380d15a033190457b73bc
SHA1 590f561e6b497cd3d0fd1444c0d0ddf0a78de472
SHA512 0ddaa428ae10fcb3338e2dc6e722edcaf974b7556dea6489291ae84ffc1c42cb89e2e834df039e7d3c0d7705be7d8fae83c30fe0c9625d61f44d11dae43a84d6
SSDEEP 6144:MpfuV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:g/NcZ7/N
TLSH
T1FA946165263029E5DDEE6BB5AC1249D881C1E5B118F6F13E6633DFDCC8E4EA1CC84B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Imgbdh32.exe

Path C:\Windows\SysWOW64\Imgbdh32.exe
Size 429KB
SHA256 556c647755a61578f831a79d4415288639779ba5bac7bb673daeb63d1f277fd6
MD5 3386ce4d155054355b8c4b962e6e826c
SHA1 8010fbff2fa8516ff39a3c0693598f1e02c2b700
SHA512 fc4126d2def1e1e5360409da75665d7c78231ea82e7e6cd1dded3b06920283c1d624d182bd1b3596172cc2a9617d545aa6f5ad3049b83b34e0c324ef8c5d3497
SSDEEP 6144:PRwJSrV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:5wJD/NcZ7/N
TLSH
T1759482652A3419E6DEEE6BB5AC1289D88181E9F104F1F17E6633DFDCC9E4D62CC44B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Imnoni32.exe

Path C:\Windows\SysWOW64\Imnoni32.exe
Size 429KB
SHA256 0bd2935c45ad401add6a382abb45aff77f63a030c8c4c01bc1f2669003bbc2ef
MD5 9dc3a545ba710449498dd3c43dbdf289
SHA1 0a3f50ca556822a5c0aa569fd2401cf134f630f0
SHA512 f30f495b546500f1cba79b3e2e143ca4764c05010aacb6de17b88322f1efe14fba7fa2905b7782f369edf0b19280311b7b0bd62ddb0db659b19119a3260b1a6f
SSDEEP 6144:jChyP6ympmXp3Y4mEAZ4/mV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:jCIP6ympmXp3Y4mED/NcZ7/N
TLSH
T1589482656A3019E6DDEEABB5EC1249E88181E4B514F1F13E6637DFECC8E4D61CC18B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ipjoee32.exe

Path C:\Windows\SysWOW64\Ipjoee32.exe
Size 429KB
SHA256 f8fcf538376ce57cff5798e8d73f2a560e37e861271f3df84124100ceff0a115
MD5 73f963f3ad04ff432b883ff9789882ef
SHA1 825357aafa3bf60a03bb4b13fb0ef4936fcb472a
SHA512 f75231f51ab69d4dd337af65d5d3c8dabbb4ef1b31b58618acd8d4c0fd2f5467a04b7cebdbaa53012e35edb1c47707d76e4b9a3188a1ec8b5e915dc292e4d139
SSDEEP 6144:2gB355pWO0kyV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:N355pb/NcZ7/N
TLSH
T1E49492252A705AE6DDEE6BB5AC1249E88581E8B114F1F13E6633DFDDD8E4DA1CC04F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ipohpdbb.exe

Path C:\Windows\SysWOW64\Ipohpdbb.exe
Size 429KB
SHA256 cf3b1d6b8d1f8ac1353b57ce2c7281e0a90bebd8ab379da8f012501521a559d4
MD5 3c64eda991999b4806e8950f31f16f39
SHA1 928cc0a0b6e817562b53b6eb0fb0122f62303b19
SHA512 f8c977c0eff3d93c3945d5e61424356e8fbfd2dd5a3d69db00a84bf375c7a40303f7cc6a49823c404c3f2afdd0147835bdbcd77985b06f97ea71cef97711e805
SSDEEP 6144:egc3z4V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:S/NcZ7/N
TLSH
T1069471256A3019E5DDEE6FB5AC1259E88182E5B508F1F13E6A33DFDCC8E4D61CC05B82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jdajabdc.exe

Path C:\Windows\SysWOW64\Jdajabdc.exe
Size 429KB
SHA256 c2384ac5427d999378cf9558ce7f8238b8f44aec88abf3b08c79e6ed853742fc
MD5 c6184c5b4711316a24065cb295c9faef
SHA1 b797b83ed6ec6e1bfd813f4928c919c16edc3ddc
SHA512 038ba78598cf34f3b825bff5f7f50b72298232292f1efce1639e0a898760fbed6723d16cd88877f937bc5512816c416fd2f16e0a65cb53774b93968bbbfc78b5
SSDEEP 6144:m1nYl2V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:mVYJ/NcZ7/N
TLSH
T129946F252A301AF5DDEE6BB5AD1249D88181E4B114F2F13E6633DFECC8E5DA6D804F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jgbccm32.exe

Path C:\Windows\SysWOW64\Jgbccm32.exe
Size 429KB
SHA256 0e8f7cf27d3b90a09ec183ca7e360e2d0b66612e8962667ee3ca626f4dcf2d4e
MD5 f8fda09108764ce8df2a8af49c2b4472
SHA1 d49f73f2992906c489a6b880f13e3753735d94b3
SHA512 a1a67022d9bb782007ae4049a169b7e3fbffcb46482a89a573a95d5fb597a09a49992c5180b596d7f57f27abec561b050008e71b6d6913718060b42e6dc532a6
SSDEEP 6144:vkHAWHeV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:cHAg/NcZ7/N
TLSH
T17994606527301AE6DDEE6BB9AC2289D88181E4F105F2F17E9633DFDCC9E5D61C804B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jkkbnl32.exe

Path C:\Windows\SysWOW64\Jkkbnl32.exe
Size 429KB
SHA256 30e1a5ca1fc61eca5a55e1c9a7a75b52ef59a0e520ae6ba9afca1ed0d2ca84ed
MD5 33ffff9df2addf44f11e60286d441b43
SHA1 4a6396c1749ccb0a626e0f384f752f5397e7f41d
SHA512 8e436dd95969079124b40dcbbdd6e165fbce33ed3f91aef4834903106ff8bac9519cc345217d00a3cd37f030183bf889f2f9ea0cd3f088ecfceb310b37503988
SSDEEP 6144:+sFKkfz25zV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:+sFKq28/NcZ7/N
TLSH
T18F9460266A301DE5DDEE6BB5AC1249E88181E5B148F1F13E6623DFDDC8E4D62CC06F90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jphkfc32.exe

Path C:\Windows\SysWOW64\Jphkfc32.exe
Size 429KB
SHA256 05ebaf4ad211aae57c1b72798cd58a820d1e27e374a47e861f5edbc36e9fb9d0
MD5 1bae1fc0cd9a095222be2d170c6ad08f
SHA1 c885813671500eca6c2df33ab4ad3c67d7fa1c7d
SHA512 845067eef9f03f3be25d4c3e11b10b4e461b93248db3e6da02afbb7bc8939f6492707a8dbf632319dfedddf0071676c7f5672cfcfff31502b4c2313a86b7935a
SSDEEP 6144:5NXADE+8lV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:5NQAe/NcZ7/N
TLSH
T1289471652A3029EADDEE6BB1BD1249E88581E4B114F1F13E6633DFDCC8E4DA1DC05B84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/260-112-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/688-420-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/804-98-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1008-154-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1084-502-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1176-415-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1196-105-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1284-203-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1332-189-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1340-330-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1496-182-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1568-290-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1612-484-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1644-147-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1664-196-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1756-250-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1832-224-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1852-235-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1940-140-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2020-280-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2044-489-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2044-28-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2064-355-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2140-49-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2140-507-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2192-466-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2208-270-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2312-345-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2316-245-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2440-496-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2476-305-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2520-370-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2588-35-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2588-495-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2628-405-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2644-395-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2692-375-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2756-168-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2780-455-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2808-400-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2840-133-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2868-265-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2936-461-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3012-315-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3136-56-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3164-380-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3204-360-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3288-472-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3352-410-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3360-175-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3368-70-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3464-325-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3640-390-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3792-119-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3796-501-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3796-42-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3896-255-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4064-21-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4064-483-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4108-84-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4124-217-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4176-161-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4180-430-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4216-7-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4216-471-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4260-210-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4268-126-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4272-320-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4312-260-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4448-435-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4452-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4452-1-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/4452-460-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4512-425-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4588-350-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4700-295-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4776-240-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4900-450-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5084-63-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5152-490-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5244-230-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5284-335-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5388-440-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5552-91-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5572-385-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5648-340-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5736-445-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5816-310-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5900-365-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5928-77-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5960-14-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5960-477-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5976-275-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5992-285-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6076-300-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6088-478-0x0000000000400000-0x000000000046D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads