berbew | 1ffeee4fa123b8e22b96b8551f92ce55d69120ab024309c8a76e39a460f33e57

Analysis

max time kernel
148s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/07/2026, 16:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_f9ea04a385ee822cd71ca34c4de3a7dd_elex_wannacry.exe
Size 320KB
Sample260717-tthkjsft2m
SHA256 1ffeee4fa123b8e22b96b8551f92ce55d69120ab024309c8a76e39a460f33e57
MD5 f9ea04a385ee822cd71ca34c4de3a7dd
SHA1 20ccb0c5a5bdc84636dcbc31f6a652dc7c255d9c
SHA512 e9ec99182877d7714cb12cf23b51642fbd4be2ba425fe1b46eb94e830f143455fbe7719d70a7b8c0b8e0da8d6b6033d26491e362e16823ee2062ca4a3fdfab81
SSDEEP 3072:uABL0Iu1Ox2CFfwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:dBLgOHfV/Ah1G/AcQ///NR5fn
TLSH
T15D64FC1A2A3009EACDED1FB5AD0249D8A241EAB014F1F17E6123DFDCD8F5DA2D945F81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amlogfel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amnlme32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Boldhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dojqjdbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dgeenfog.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmnbfhal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aaoaic32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhmbqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dgcihgaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dahmfpap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Onocomdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhkfkmmg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgelgi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aogbfi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cgifbhid.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmiikh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afpjel32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnhgjaml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cogddd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oplfkeob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Omgmeigd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adhdjpjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aggpfkjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Onmfimga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocaebc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qhjmdp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qjiipk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahaceo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cocjiehd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cpfcfmlp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Phcgcqab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qpcecb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qdaniq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aogbfi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aaoaic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cpmapodj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Opnbae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qhhpop32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qhjmdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Akpoaj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onkidm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pccahbmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjpfjl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adhdjpjf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdfpkm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdkifmjq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cogddd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdpcal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddgibkpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aaenbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bdmmeo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bajqda32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhphmj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aaenbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cggimh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afbgkl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmjkic32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdmfllhn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cklhcfle.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oaplqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adcjop32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmeandma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Conanfli.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofkgcobj.exe

Executes dropped EXE 64 IoCs

pid	Process
3272	Ngjkfd32.exe
2864	Nmkmjjaa.exe
2740	Npiiffqe.exe
4100	Ngqagcag.exe
1244	Ojomcopk.exe
3300	Onkidm32.exe
1416	Omnjojpo.exe
3680	Oplfkeob.exe
4944	Ocgbld32.exe
2956	Offnhpfo.exe
3388	Onmfimga.exe
1956	Ompfej32.exe
1072	Opnbae32.exe
4628	Ocjoadei.exe
432	Ogekbb32.exe
2152	Ojdgnn32.exe
552	Onocomdo.exe
4936	Oanokhdb.exe
2704	Opqofe32.exe
4584	Oghghb32.exe
1132	Ofkgcobj.exe
2408	Onapdl32.exe
3516	Oaplqh32.exe
4136	Ocohmc32.exe
4768	Ogjdmbil.exe
920	Ojhpimhp.exe
1668	Omgmeigd.exe
4420	Oabhfg32.exe
2368	Ocaebc32.exe
3140	Ohlqcagj.exe
4164	Pjkmomfn.exe
3800	Pmiikh32.exe
5028	Paeelgnj.exe
440	Pccahbmn.exe
3276	Pfandnla.exe
464	Pjmjdm32.exe
2360	Pmlfqh32.exe
548	Pagbaglh.exe
2332	Pdenmbkk.exe
3008	Pjpfjl32.exe
3236	Pmnbfhal.exe
4124	Paiogf32.exe
1284	Pdhkcb32.exe
1840	Phcgcqab.exe
2080	Pjbcplpe.exe
1824	Pnmopk32.exe
2512	Palklf32.exe
2032	Pdjgha32.exe
536	Phfcipoo.exe
1776	Pjdpelnc.exe
212	Pmblagmf.exe
4736	Ppahmb32.exe
4500	Qhhpop32.exe
3924	Qfkqjmdg.exe
2444	Qobhkjdi.exe
4472	Qaqegecm.exe
1084	Qpcecb32.exe
1768	Qhjmdp32.exe
4468	Qjiipk32.exe
4080	Qmgelf32.exe
4248	Qacameaj.exe
5132	Qdaniq32.exe
5168	Afpjel32.exe
5208	Aogbfi32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ejphhm32.dll	Amlogfel.exe
File created	C:\Windows\SysWOW64\Cpmapodj.exe	Bajqda32.exe
File created	C:\Windows\SysWOW64\Jlobem32.dll	Cpmapodj.exe
File opened for modification	C:\Windows\SysWOW64\Cglbhhga.exe	Cdmfllhn.exe
File created	C:\Windows\SysWOW64\Mcdibc32.dll	Cocjiehd.exe
File opened for modification	C:\Windows\SysWOW64\Bklomh32.exe	Bhmbqm32.exe
File created	C:\Windows\SysWOW64\Dhphmj32.exe	Dafppp32.exe
File created	C:\Windows\SysWOW64\Ipjijkpg.dll	Dojqjdbl.exe
File opened for modification	C:\Windows\SysWOW64\Omnjojpo.exe	Onkidm32.exe
File opened for modification	C:\Windows\SysWOW64\Palklf32.exe	Pnmopk32.exe
File opened for modification	C:\Windows\SysWOW64\Qobhkjdi.exe	Qfkqjmdg.exe
File created	C:\Windows\SysWOW64\Nhhlki32.dll	Qhjmdp32.exe
File created	C:\Windows\SysWOW64\Agimkk32.exe	Adkqoohc.exe
File created	C:\Windows\SysWOW64\Ckjknfnh.exe	Chkobkod.exe
File created	C:\Windows\SysWOW64\Ekppjn32.dll	Dafppp32.exe
File created	C:\Windows\SysWOW64\Nchkcb32.dll	Dahmfpap.exe
File created	C:\Windows\SysWOW64\Blqhpg32.dll	Omnjojpo.exe
File created	C:\Windows\SysWOW64\Ojenek32.dll	Opqofe32.exe
File opened for modification	C:\Windows\SysWOW64\Dafppp32.exe	Cogddd32.exe
File created	C:\Windows\SysWOW64\Dgeenfog.exe	Ddgibkpc.exe
File opened for modification	C:\Windows\SysWOW64\Dgeenfog.exe	Ddgibkpc.exe
File opened for modification	C:\Windows\SysWOW64\Onapdl32.exe	Ofkgcobj.exe
File created	C:\Windows\SysWOW64\Ojhpimhp.exe	Ogjdmbil.exe
File created	C:\Windows\SysWOW64\Omgmeigd.exe	Ojhpimhp.exe
File opened for modification	C:\Windows\SysWOW64\Pjpfjl32.exe	Pfdjinjo.exe
File created	C:\Windows\SysWOW64\Pnmopk32.exe	Pjbcplpe.exe
File created	C:\Windows\SysWOW64\Hhblffgn.dll	Qhhpop32.exe
File opened for modification	C:\Windows\SysWOW64\Bhpofl32.exe	Bphgeo32.exe
File created	C:\Windows\SysWOW64\Gbhhlfgd.dll	Bnlhncgi.exe
File created	C:\Windows\SysWOW64\Nmkmjjaa.exe	Ngjkfd32.exe
File created	C:\Windows\SysWOW64\Npiiffqe.exe	Nmkmjjaa.exe
File created	C:\Windows\SysWOW64\Ocgbld32.exe	Oplfkeob.exe
File opened for modification	C:\Windows\SysWOW64\Ocohmc32.exe	Oaplqh32.exe
File opened for modification	C:\Windows\SysWOW64\Pdenmbkk.exe	Pagbaglh.exe
File created	C:\Windows\SysWOW64\Apjkcadp.exe	Amlogfel.exe
File opened for modification	C:\Windows\SysWOW64\Cpmapodj.exe	Bajqda32.exe
File created	C:\Windows\SysWOW64\Eehnaq32.dll	Bajqda32.exe
File created	C:\Windows\SysWOW64\Lhdbgapf.dll	Paeelgnj.exe
File created	C:\Windows\SysWOW64\Qfkqjmdg.exe	Qhhpop32.exe
File created	C:\Windows\SysWOW64\Lcccepbd.dll	Afbgkl32.exe
File created	C:\Windows\SysWOW64\Mioaanec.dll	Bdmmeo32.exe
File created	C:\Windows\SysWOW64\Caageq32.exe	Cocjiehd.exe
File created	C:\Windows\SysWOW64\Pipeabep.dll	Caageq32.exe
File created	C:\Windows\SysWOW64\Dempqa32.dll	Npiiffqe.exe
File created	C:\Windows\SysWOW64\Gbfnjgdn.dll	Pfandnla.exe
File created	C:\Windows\SysWOW64\Lfdqcn32.dll	Pjmjdm32.exe
File created	C:\Windows\SysWOW64\Apgnjp32.dll	Pmnbfhal.exe
File opened for modification	C:\Windows\SysWOW64\Phfcipoo.exe	Pdjgha32.exe
File created	C:\Windows\SysWOW64\Ppahmb32.exe	Pmblagmf.exe
File created	C:\Windows\SysWOW64\Afbgkl32.exe	Adcjop32.exe
File created	C:\Windows\SysWOW64\Ifaohg32.dll	Aaoaic32.exe
File created	C:\Windows\SysWOW64\Oplfkeob.exe	Omnjojpo.exe
File opened for modification	C:\Windows\SysWOW64\Ogekbb32.exe	Ocjoadei.exe
File opened for modification	C:\Windows\SysWOW64\Paeelgnj.exe	Pmiikh32.exe
File created	C:\Windows\SysWOW64\Qgaeof32.dll	Aknbkjfh.exe
File created	C:\Windows\SysWOW64\Ofkhal32.dll	Bhkfkmmg.exe
File created	C:\Windows\SysWOW64\Ampillfk.dll	Bmhocd32.exe
File created	C:\Windows\SysWOW64\Cammjakm.exe	Conanfli.exe
File created	C:\Windows\SysWOW64\Ojdgnn32.exe	Ogekbb32.exe
File created	C:\Windows\SysWOW64\Ocohmc32.exe	Oaplqh32.exe
File created	C:\Windows\SysWOW64\Qobhkjdi.exe	Qfkqjmdg.exe
File created	C:\Windows\SysWOW64\Bpdnjple.exe	Bmeandma.exe
File created	C:\Windows\SysWOW64\Cocjiehd.exe	Cglbhhga.exe
File opened for modification	C:\Windows\SysWOW64\Chkobkod.exe	Cdpcal32.exe

Program crash 1 IoCs

pid	pid_target	Process
7000	6904	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oplfkeob.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfandnla.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phcgcqab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aonhghjl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cglbhhga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npiiffqe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aopemh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aggpfkjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bajqda32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chkobkod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmkmjjaa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bklomh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Coqncejg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngjkfd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ohlqcagj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pagbaglh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjdpelnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhkfkmmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cogddd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkqaoe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oabhfg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qobhkjdi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dojqjdbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onkidm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oghghb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocaebc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Paiogf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgelgi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjmjdm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qaqegecm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caojpaij.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofkgcobj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojhpimhp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppahmb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmgelf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aaenbd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cklhcfle.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdmfllhn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogekbb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opqofe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pccahbmn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdenmbkk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apjkcadp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgeenfog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocohmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdhkcb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aknbkjfh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bknlbhhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdfpkm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cammjakm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdkifmjq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_f9ea04a385ee822cd71ca34c4de3a7dd_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opnbae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bpdnjple.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjpfjl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahaceo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agimkk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmeandma.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cggimh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgcihgaj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Offnhpfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ompfej32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocjoadei.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qfkqjmdg.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Omnjojpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Onocomdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Phcgcqab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qhhpop32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cpfcfmlp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dojqjdbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ngjkfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhpicj32.dll"	Onkidm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Adcjop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Opcefi32.dll"	Ogekbb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmnbjama.dll"	Palklf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pdjgha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcgplk32.dll"	Ahaceo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bdfpkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lelgfl32.dll"	Cammjakm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdmfllhn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	2026-07-17_f9ea04a385ee822cd71ca34c4de3a7dd_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Opqofe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Apjkcadp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifaohg32.dll"	Aaoaic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnlhncgi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Caageq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnhgjaml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Onkidm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjdpelnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aggpfkjj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Agimkk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bgkiaj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bkibgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehojko32.dll"	Bknlbhhe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bgelgi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnffoibg.dll"	Omgmeigd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pfandnla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcgmgn32.dll"	Paiogf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbkkam32.dll"	Cdpcal32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cogddd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgfpihkg.dll"	Ocohmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aogbfi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aknbkjfh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdebopdl.dll"	Akpoaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aonhghjl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bmjkic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eehnaq32.dll"	Bajqda32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ddgibkpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hodbhp32.dll"	Ojomcopk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lihcbd32.dll"	Ocgbld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Onapdl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ocohmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qnbidcgp.dll"	Bgkiaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okhbek32.dll"	Cdkifmjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcknij32.dll"	Ddgibkpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogakfe32.dll"	Pjbcplpe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Palklf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qdaniq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojenek32.dll"	Opqofe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oaplqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oabhfg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ocaebc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ocaebc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jnfpnk32.dll"	Pdenmbkk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ahaceo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aonhghjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jchdqkfl.dll"	Nmkmjjaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Onkidm32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 3272	1288	2026-07-17_f9ea04a385ee822cd71ca34c4de3a7dd_elex_wannacry.exe	85
PID 3272 wrote to memory of 2864	3272	Ngjkfd32.exe	86
PID 2864 wrote to memory of 2740	2864	Nmkmjjaa.exe	87
PID 2740 wrote to memory of 4100	2740	Npiiffqe.exe	88
PID 4100 wrote to memory of 1244	4100	Ngqagcag.exe	89
PID 1244 wrote to memory of 3300	1244	Ojomcopk.exe	90
PID 3300 wrote to memory of 1416	3300	Onkidm32.exe	91
PID 1416 wrote to memory of 3680	1416	Omnjojpo.exe	92
PID 3680 wrote to memory of 4944	3680	Oplfkeob.exe	93
PID 4944 wrote to memory of 2956	4944	Ocgbld32.exe	94
PID 2956 wrote to memory of 3388	2956	Offnhpfo.exe	95
PID 3388 wrote to memory of 1956	3388	Onmfimga.exe	96
PID 1956 wrote to memory of 1072	1956	Ompfej32.exe	97
PID 1072 wrote to memory of 4628	1072	Opnbae32.exe	98
PID 4628 wrote to memory of 432	4628	Ocjoadei.exe	99
PID 432 wrote to memory of 2152	432	Ogekbb32.exe	100
PID 2152 wrote to memory of 552	2152	Ojdgnn32.exe	101
PID 552 wrote to memory of 4936	552	Onocomdo.exe	102
PID 4936 wrote to memory of 2704	4936	Oanokhdb.exe	103
PID 2704 wrote to memory of 4584	2704	Opqofe32.exe	104
PID 4584 wrote to memory of 1132	4584	Oghghb32.exe	105
PID 1132 wrote to memory of 2408	1132	Ofkgcobj.exe	106
PID 2408 wrote to memory of 3516	2408	Onapdl32.exe	107
PID 3516 wrote to memory of 4136	3516	Oaplqh32.exe	108
PID 4136 wrote to memory of 4768	4136	Ocohmc32.exe	109
PID 4768 wrote to memory of 920	4768	Ogjdmbil.exe	110
PID 920 wrote to memory of 1668	920	Ojhpimhp.exe	111
PID 1668 wrote to memory of 4420	1668	Omgmeigd.exe	112
PID 4420 wrote to memory of 2368	4420	Oabhfg32.exe	113
PID 2368 wrote to memory of 3140	2368	Ocaebc32.exe	114
PID 3140 wrote to memory of 4164	3140	Ohlqcagj.exe	115
PID 4164 wrote to memory of 3800	4164	Pjkmomfn.exe	116
PID 3800 wrote to memory of 5028	3800	Pmiikh32.exe	117
PID 5028 wrote to memory of 440	5028	Paeelgnj.exe	118
PID 440 wrote to memory of 3276	440	Pccahbmn.exe	119
PID 3276 wrote to memory of 464	3276	Pfandnla.exe	120
PID 464 wrote to memory of 2360	464	Pjmjdm32.exe	121
PID 2360 wrote to memory of 548	2360	Pmlfqh32.exe	122
PID 548 wrote to memory of 2332	548	Pagbaglh.exe	123
PID 2176 wrote to memory of 3008	2176	Pfdjinjo.exe	125
PID 3008 wrote to memory of 3236	3008	Pjpfjl32.exe	126
PID 3236 wrote to memory of 4124	3236	Pmnbfhal.exe	127
PID 4124 wrote to memory of 1284	4124	Paiogf32.exe	128
PID 1284 wrote to memory of 1840	1284	Pdhkcb32.exe	129
PID 1840 wrote to memory of 2080	1840	Phcgcqab.exe	130
PID 2080 wrote to memory of 1824	2080	Pjbcplpe.exe	131
PID 1824 wrote to memory of 2512	1824	Pnmopk32.exe	132
PID 2512 wrote to memory of 2032	2512	Palklf32.exe	133
PID 2032 wrote to memory of 536	2032	Pdjgha32.exe	134
PID 536 wrote to memory of 1776	536	Phfcipoo.exe	135
PID 1776 wrote to memory of 212	1776	Pjdpelnc.exe	136
PID 212 wrote to memory of 4736	212	Pmblagmf.exe	137
PID 4736 wrote to memory of 4500	4736	Ppahmb32.exe	138
PID 4500 wrote to memory of 3924	4500	Qhhpop32.exe	139
PID 3924 wrote to memory of 2444	3924	Qfkqjmdg.exe	140
PID 2444 wrote to memory of 4472	2444	Qobhkjdi.exe	141
PID 4472 wrote to memory of 1084	4472	Qaqegecm.exe	142
PID 1084 wrote to memory of 1768	1084	Qpcecb32.exe	143
PID 1768 wrote to memory of 4468	1768	Qhjmdp32.exe	144
PID 4468 wrote to memory of 4080	4468	Qjiipk32.exe	145
PID 4080 wrote to memory of 4248	4080	Qmgelf32.exe	146
PID 4248 wrote to memory of 5132	4248	Qacameaj.exe	147
PID 5132 wrote to memory of 5168	5132	Qdaniq32.exe	148
PID 5168 wrote to memory of 5208	5168	Afpjel32.exe	149

C:\Users\Admin\AppData\Local\Temp\2026-07-17_f9ea04a385ee822cd71ca34c4de3a7dd_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_f9ea04a385ee822cd71ca34c4de3a7dd_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\SysWOW64\Ngjkfd32.exe
  C:\Windows\system32\Ngjkfd32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3272
- - C:\Windows\SysWOW64\Nmkmjjaa.exe
    C:\Windows\system32\Nmkmjjaa.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2864
  - - C:\Windows\SysWOW64\Npiiffqe.exe
      C:\Windows\system32\Npiiffqe.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2740
    - - C:\Windows\SysWOW64\Ngqagcag.exe
        
        C:\Windows\system32\Ngqagcag.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4100
      - C:\Windows\SysWOW64\Ojomcopk.exe
        
        C:\Windows\system32\Ojomcopk.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1244
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3300
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1416
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3680
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4944
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2956
        
        C:\Windows\SysWOW64\Onmfimga.exe
        
        C:\Windows\system32\Onmfimga.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3388
        
        C:\Windows\SysWOW64\Ompfej32.exe
        
        C:\Windows\system32\Ompfej32.exe
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1956
        
        C:\Windows\SysWOW64\Opnbae32.exe
        
        C:\Windows\system32\Opnbae32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1072
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4628
        
        C:\Windows\SysWOW64\Ogekbb32.exe
        
        C:\Windows\system32\Ogekbb32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:432
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2152
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:552
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4936
        
        C:\Windows\SysWOW64\Opqofe32.exe
        
        C:\Windows\system32\Opqofe32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2704
        
        C:\Windows\SysWOW64\Oghghb32.exe
        
        C:\Windows\system32\Oghghb32.exe
        21⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4584
        
        C:\Windows\SysWOW64\Ofkgcobj.exe
        
        C:\Windows\system32\Ofkgcobj.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1132
        
        C:\Windows\SysWOW64\Onapdl32.exe
        
        C:\Windows\system32\Onapdl32.exe
        23⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2408
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3516
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        25⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4136
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4768
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:920
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1668
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        29⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4420
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2368
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        31⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3140
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        32⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4164
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3800
        
        C:\Windows\SysWOW64\Paeelgnj.exe
        
        C:\Windows\system32\Paeelgnj.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5028
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:440
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3276
        
        C:\Windows\SysWOW64\Pjmjdm32.exe
        
        C:\Windows\system32\Pjmjdm32.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:464
        
        C:\Windows\SysWOW64\Pmlfqh32.exe
        
        C:\Windows\system32\Pmlfqh32.exe
        38⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2360
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:548
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        40⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2332
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        41⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2176
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3008
        
        C:\Windows\SysWOW64\Pmnbfhal.exe
        
        C:\Windows\system32\Pmnbfhal.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3236
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        44⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4124
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        45⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1284
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1840
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2080
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1824
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        49⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2512
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2032
        
        C:\Windows\SysWOW64\Phfcipoo.exe
        
        C:\Windows\system32\Phfcipoo.exe
        51⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:536
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        52⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1776
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:212
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        54⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4736
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4500
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3924
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        57⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2444
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        58⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4472
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1084
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1768
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4468
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        62⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4080
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        63⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4248
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5132
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5168
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:5208
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5248
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5288
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5328
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        70⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5368
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5408
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        72⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5448
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5488
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5528
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5568
        
        C:\Windows\SysWOW64\Aajhndkb.exe
        
        C:\Windows\system32\Aajhndkb.exe
        76⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5648
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5688
        
        C:\Windows\SysWOW64\Aonhghjl.exe
        
        C:\Windows\system32\Aonhghjl.exe
        79⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5728
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        80⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        81⤵
        Drops file in System32 directory
        
        PID:5808
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        82⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5852
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        83⤵
        System Location Discovery: System Language Discovery
        
        PID:5892
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5936
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5972
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        86⤵
        Modifies registry class
        
        PID:6012
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6056
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        88⤵
        System Location Discovery: System Language Discovery
        
        PID:6100
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3504
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        90⤵
        Modifies registry class
        
        PID:4152
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        91⤵
        Drops file in System32 directory
        
        PID:3036
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        92⤵
        
        PID:2468
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2104
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        94⤵
        System Location Discovery: System Language Discovery
        
        PID:1828
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3852
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        96⤵
        Drops file in System32 directory
        
        PID:4976
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        97⤵
        
        PID:3972
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        98⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3492
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        99⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2136
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1764
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5164
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5244
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5324
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5376
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5480
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5552
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        107⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5632
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2052
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5760
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        110⤵
        System Location Discovery: System Language Discovery
        
        PID:5844
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        111⤵
        System Location Discovery: System Language Discovery
        
        PID:5932
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6000
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        113⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6176
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6216
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        115⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6256
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6296
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        117⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6336
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        118⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6416
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6460
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        121⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6540
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6580
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        124⤵
        Drops file in System32 directory
        
        PID:6624
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6664
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6704
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6744
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6784
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6824
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6864
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        131⤵
        System Location Discovery: System Language Discovery
        
        PID:6904
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6904 -s 400
        132⤵
        Program crash
        
        PID:7000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6904 -ip 6904
1⤵
PID:6976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Ngjkfd32.exe

Path C:\Windows\SysWOW64\Ngjkfd32.exe
Size 320KB
SHA256 3a1223eb65c521f268a06ed78600ed3b5471365e3d86af0c4604655c46491fc3
MD5 09b43e55c2c98b5f8446d3635fe99385
SHA1 f2a872725c6b0e3734ce27d073a7d0e9764586dc
SHA512 7b93401474eff911ac0be48f52329785295469901cdea2c378b70e58b5362af169d30a28c3319139b997d84351f86ad2511312d5479f8741e8c043c848265a14
SSDEEP 3072:NLBowUJuLFSTrecjwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:NawaLTrTjV/Ah1G/AcQ///NR5fn
TLSH
T151643F192A300DEACDED1FB5AD0249D89142E9F614F1E23E6123DFDCD8E4DA6D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ngqagcag.exe

Path C:\Windows\SysWOW64\Ngqagcag.exe
Size 320KB
SHA256 a486118202f6e51ffb6b19eb409ea69d5fd1ca59e8b6582a4be8922a093c9212
MD5 46cfd2fcaf4457743b880f9944158188
SHA1 3ea44bc931314a3789321d53afd456680dfacc13
SHA512 2a5b52a7348b25a37799537fdcb3ea7c133113da19f1cdc30ef0ee26636eede7408b121c25464a6e722b56f987fa47b30119ac7931d160c588cc73eaf8063a3b
SSDEEP 3072:meJdJvR8YnLn1fctc2awS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:meAKn1fcW2aV/Ah1G/AcQ///NR5fn
TLSH
T1B964DA592A3409EACEFD1BB6BC125DD89142E8B014F1E13E6523DFDCDAE4DA6C805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nmkmjjaa.exe

Path C:\Windows\SysWOW64\Nmkmjjaa.exe
Size 320KB
SHA256 e6113222bf39c4f54450558a3fa54ade030921aa175d8242bd732996152bd418
MD5 d83e4f7f0603aef655660f18f7c7754c
SHA1 83bc808df42546c0bd669ce3be475cb05549705e
SHA512 52c456f5b76115ca600090042b6cbb976c76455da33db9fd3211faab407e9c124353091a28cbb616b902887b7c444a34c060deffdb018a516eb912b2267cdef6
SSDEEP 3072:KdnRgWM+YZKUcwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:KdnqKYZ1cV/Ah1G/AcQ///NR5fn
TLSH
T1346420192A3009EACEED5FB6AC024DD89145E8F014F6E13E6123DFDCD8E4DA2D956F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Npiiffqe.exe

Path C:\Windows\SysWOW64\Npiiffqe.exe
Size 320KB
SHA256 b2568f72e15e2f4005201ac0ef71b43e32034071bbac606229d869aeef79f0a5
MD5 e8efd9d6da69be261c199269aedd5118
SHA1 46607948e2b9e173d6960ea721b8926936f0e4eb
SHA512 bec7df0558b69c59bc46889927c6b3dc00f92f723aad1848c2a4e97c1c8d9ae859a76e2f14f6b7600dcfdfdb6c70c0ef1dd6414d095e2e5135210e2a43d37791
SSDEEP 3072:/Bjwbglu2wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:/eEs2V/Ah1G/AcQ///NR5fn
TLSH
T131641E1A263409EACEED1BF6AC0649DC9581E8F014F1E53E6527DFDCD8E4DA2CA05F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Oabhfg32.exe

Path C:\Windows\SysWOW64\Oabhfg32.exe
Size 320KB
SHA256 e68324b8277d029161d23a260796681fd1b7ad39e1a38fb3475fb6006a38590c
MD5 e1e2a74c15d12318ec277a42899c249f
SHA1 c661db0efe495a494bf36291f817d6b04471509d
SHA512 b433b03f32f00cc7f2f349fdcf1a3dbc6463afe4e7d135c7b8e85dc43e7661bdbcca35a7bc946deeba3315c08d690d83ba10b7669c307ca948e2b44f0283b6d6
SSDEEP 3072:y6DYgdgAG1T+6e5SpAwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:weglT+qpAV/Ah1G/AcQ///NR5fn
TLSH
T118640E19163409EACEED5BB9ED1249D89141E9F018F1E13E6123DFECD8F8DA6C819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Oanokhdb.exe

Path C:\Windows\SysWOW64\Oanokhdb.exe
Size 320KB
SHA256 9a82745b53dfb73e1807e8bb9864db35eb48cb5d214788f0b8f3094bf95e986f
MD5 d4c684a60f12fe746b0309949ac89ad7
SHA1 da6011dc3c658bcb5356225e75eae7cfcbeac315
SHA512 0188d78ae09b882fa0c65f16a752b4f7a4b9097129cc36fb756038251e393b8ce1fea3aeeb366e316be5ae7aba38f68e4721d5f324879494234fb1aaa01f3471
SSDEEP 3072:UuqH/5D+u+KvawS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:o/5daV/Ah1G/AcQ///NR5fn
TLSH
T15A64421A1A3409EACDED2BB5AC1249E85181E8F005F1E13E5523DFECD8E5DA6CD1DF81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Oaplqh32.exe

Path C:\Windows\SysWOW64\Oaplqh32.exe
Size 320KB
SHA256 70a6e08855d8ba5c28c433d2c822522144290fb7e570e7fcd1d97b41cb5fdf95
MD5 e4b13ec1ab2ea680161ab310d3e261d7
SHA1 a30e8ac4ecc1e2f047f3e3d6f12bbec3a66fdf98
SHA512 4209cc3f398027f7d8a9f35cf9b425711c85feca68e3055499253f8c5f62315233292ba1b290b0c7a6ff6aa537766f53a12f3f65b143c369a433e226f14b8cbf
SSDEEP 3072:aEkl6fgDYDd3ifG1mwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:aEkEYDYUfumV/Ah1G/AcQ///NR5fn
TLSH
T10364FB19263009EACEFD2BB5AD124AD85141EAF124F1E53E6123DFDCD8E4DAACC15F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ocaebc32.exe

Path C:\Windows\SysWOW64\Ocaebc32.exe
Size 320KB
SHA256 bb48959a3b117695103ba53252cc13d6d89a01ce9a05fc7688ff1f5e566c9040
MD5 5fbe088e9a085673d538353743521949
SHA1 5115987a5ab683a8071779ed02f1b2e1922fdb7f
SHA512 5461c4de58b784002617d5ec2bab941e5bf84d895ce7d1c6a4b3437fd2ae63808fe94f3ea4d9d3eaef54c6edb05bd9781886f9c1a3adce09eee4ba6a295cedf1
SSDEEP 3072:EvchS97CHHwKwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:IchQCnwKV/Ah1G/AcQ///NR5fn
TLSH
T1A7642E1A2A3009EACDED1BB5AC5249E85141F9F214F1E13E6163DFDCDCE8DA2D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ocgbld32.exe

Path C:\Windows\SysWOW64\Ocgbld32.exe
Size 320KB
SHA256 ea575c10d6b49220212e9fdcbed7d3804332959f4d72bf2f7c00fb0e22eae214
MD5 e776b35b59d2b85d6865d61a05f3f206
SHA1 296a0ae9f8d648debf365cfaab7e1f60a1b212b3
SHA512 6bd5a75a9765d1ed43d30089b2bbcffb0b242ec87f2a6c16c90df6f9bac3fd64ad936af4d7cc7ef804aa61967a4a57f8764b6658d178cb7c26e4b746d9bbfe96
SSDEEP 3072:slZY+0NB96wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:N+0N36V/Ah1G/AcQ///NR5fn
TLSH
T1FD641D1926340DFADEED1BB6AC1249D85191E8F014F5E13E6123DFECC8E4DAAD819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ocjoadei.exe

Path C:\Windows\SysWOW64\Ocjoadei.exe
Size 320KB
SHA256 060bde0ae25eb8540cb76776ddc9282b484e4d9e4764a5e0b24725372a8f485f
MD5 3aa801c674c4daf4d30e054b122e501a
SHA1 daa0c1878a9ef72e1b2e4ff6c69d93f4c5ce49f4
SHA512 bf8a7fa616bfd1cae2d037c3a2bdd34cee9dd38aa204c8015a01b9d9825bf9fc5d55754f1829537920eb3266f7880184afa8b6e58ae26f27c4ce7e0b8c1ec39d
SSDEEP 3072:xqWVlAEKoBd6uwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:cKlAtoBouV/Ah1G/AcQ///NR5fn
TLSH
T12264FB192A3049EACEED1BB5EC0249D89559E8F014F1E13E6223DFDCD9E5DA2EC14F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ocohmc32.exe

Path C:\Windows\SysWOW64\Ocohmc32.exe
Size 320KB
SHA256 d476a7d14e05fe8c99fffa850db700e4ad0c0355d82463569c09a6ff5fd70074
MD5 890f8d9adf9e14455335b31932b5e8d8
SHA1 afc4822080c005329abb15d71155f39f2a78c28c
SHA512 715a3f4c49c9aff16e0c6462ebe724b0ecbae461433c80ad101b0f748dfc16061a0c3d905e94c0ed210d6166fe8ab44edb840e4bb12cf0c7fe718a7bea5a3662
SSDEEP 3072:XkAiMeZBOZIFDpF1dWwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:XwDZBOZmdWV/Ah1G/AcQ///NR5fn
TLSH
T15E64411926340DEACDED1FB5AC0289E89151E9F014F5E23E6527EFDCD8E4DA2C816F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Offnhpfo.exe

Path C:\Windows\SysWOW64\Offnhpfo.exe
Size 320KB
SHA256 2c6f7021d789d51caae3a75da5f698135e8a1aab0dd02dc21800e0a8c276beca
MD5 829739526d7cea63898f1ed29c1c696c
SHA1 c1129ae7177ccd8902247711b0f4948fb74dd5a6
SHA512 2f3956108be77ecf8443bb520cbd564314744c1a822b2586de4814b06a21c7be8ff12a6799d644f4e841e53af34cb90ed4263d0ddc38df943659fb43e9676ed3
SSDEEP 3072:XjzF2x13LYDF6JSc2/SwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Xjzgx1MDF6JSSV/Ah1G/AcQ///NR5fn
TLSH
T11C642F1A2A3509EECDED1BB6AC1259D89141E9F114F1E13E1123DFDCD8E4EA3C919F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ofkgcobj.exe

Path C:\Windows\SysWOW64\Ofkgcobj.exe
Size 320KB
SHA256 c3571675e57691510d0654d97e1ca76eae63ebed1833a211c61c6b339c93c33e
MD5 2e0145b1289099387eb6bd0b29f54125
SHA1 4f0a9a0c642e4166b3c23f074cd92172e750a63a
SHA512 70ca7094ad82997f43b205d5cf1d216c1299d781c73c354bc77145713d2a42264198f81655394348a1edb07950428c325bcaa6c783e502d13a16b84e76a4a5b9
SSDEEP 3072:r1tzhwmpcLKZsUwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:r1ttwuc2ZsUV/Ah1G/AcQ///NR5fn
TLSH
T1F5641F19263409EACDFD2BB9AC0249D85141E9F024F1E17E6923DFDCD8E4DA6C859FC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ogekbb32.exe

Path C:\Windows\SysWOW64\Ogekbb32.exe
Size 320KB
SHA256 b93eeb8b7d5ecff89add96b5766ff5e39fba1fd01b1483bc6b57d2467eda98b3
MD5 432dd032f4245737191f49532ff3bfd7
SHA1 f1e0d28a724167adb64d0b25538a5b3f08d63c66
SHA512 89aa41aa0ced719d41edff791085070e9f7c9cc0951604252801a89130bc18586c6d0c682e88308e37b032914e4cf5151f847945e0706f337f36642d12ccf8fc
SSDEEP 3072:iO0BYTkXANY2rpvxzwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:iO06kA+2tpzV/Ah1G/AcQ///NR5fn
TLSH
T14E6441192A3019EACEEE1FB6AC4249D86141E8F455F2E13E6123DFDCD8E4DA2CC45F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Oghghb32.exe

Path C:\Windows\SysWOW64\Oghghb32.exe
Size 320KB
SHA256 0077e0b5a48e666776c72513e273c07ed7d00a93f0203d1ba9f8c9b1c5c08ec2
MD5 fa36c2ba599883cbcd3f32ddf50d8352
SHA1 2898dddb1af8b1a9fea37f32d8c33a98b9bcbf71
SHA512 5d2c747c075de941b8c097921750c7216bed740e4cb68e1c0f878e401f0df2619a7d6cf10ecbeb0140cb4aac9003f419fe6abc83ec58414491f7bd5f5d47608f
SSDEEP 3072:8qIDqohsV1ccubc/I/yEtPwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:xIOoiV1CeEtPV/Ah1G/AcQ///NR5fn
TLSH
T18D6431555A3419EACEED1BB6AC1349E85141F8F018F1E23E6123DFDCD8E4DA6D818F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ogjdmbil.exe

Path C:\Windows\SysWOW64\Ogjdmbil.exe
Size 320KB
SHA256 f4ba34c30dced7b8b53d9c16cdd8f5c3dfba18cde640d5b14e6af4d4d60fedfb
MD5 1a0460a9b816d0e7078f365117521c44
SHA1 181008aa41106672d9747478f4ec481dba8c2a22
SHA512 d770cfae7388d6b51ba39dd6edc1a2f85aab5f64dda9f05bd19a76c119ccdb667b10cc87d5d4bf0480135f3776e1d466b8143ec0553cd8c8436d69211aafd87b
SSDEEP 3072:h+CBI7dyORO6XkxwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:h+H7dyYUxV/Ah1G/AcQ///NR5fn
TLSH
T17F6452192A3209EACDEE1FB5AC1259EC9541E8F025F1E13E6123DFDCC8E4DA2D905F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ohlqcagj.exe

Path C:\Windows\SysWOW64\Ohlqcagj.exe
Size 320KB
SHA256 927125952174c06a5b34b188ff9d86da04537b99f9fde191675e97338b43d087
MD5 41f43c74c6e2c357873506f63d605499
SHA1 27e0d5d3141c800cb0b603a0bf8f20e4e8bf6f72
SHA512 7a53242ec423cba5d74db77596c68ef694dec3fc512a996ce165dee84769bebd0c26cd8fc2f074dc144fa255cdde713dd23fb1aa7ad813bd44291a7275a8bae8
SSDEEP 3072:qaem28V3xHGYwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:qXT8V3pGYV/Ah1G/AcQ///NR5fn
TLSH
T13A640D1926340EEACEFD1BB5AC0269D8A141E9F114F1E23E6523DFDCD8E4DA2D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ojdgnn32.exe

Path C:\Windows\SysWOW64\Ojdgnn32.exe
Size 320KB
SHA256 134e86be74aaa57e0fa6934e2cdcb27eb779a798b805cddbc620f21b4ff5e36b
MD5 6fc076c6986f6a803557c9276331f43e
SHA1 bc1ddc06754a2d99160ca6e37a0074d6f1b25bd6
SHA512 e972b01c7427a68b9fb01eb5f640a3f6e8ec9480e8266d59439b30f72f99137e7cd093f16884143ec6b310eabc22128b420fa79b130bd83942b74c3ba3841cca
SSDEEP 3072:N38AUGPs2Y5au6OOMjGQxwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:iA7sGaGQxV/Ah1G/AcQ///NR5fn
TLSH
T1246421192A3009EACDFD1BB6AC1259D89181E5F014F1E13EA523DFECD8E4DA2D84DF91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ojhpimhp.exe

Path C:\Windows\SysWOW64\Ojhpimhp.exe
Size 320KB
SHA256 7aeba554583fbc36ce9808708a9dd3bca7e6e18232900821ccdf8d18af118adb
MD5 8448bedc60e171b9aa26328f56ec1661
SHA1 6531108452bbf913986383de2c721fa8f428cccd
SHA512 de2cae5395290f03a77e243de9ced9cfb7b3a61a6632541f35d59ec74ff2786664c0dba3356eb72ae472f08788fe4238eb91afc03ba97aa716ae0105c2889bd3
SSDEEP 6144:tzknAsWZGeWj8d6rKV/Ah1G/AcQ///NR5fn:tzk2ZGejd6r/Nv
TLSH
T16364FD1A263409EACDED1BB6AC024DD89192E9F014F1E13E6923DFDCD8F4DA6D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ojomcopk.exe

Path C:\Windows\SysWOW64\Ojomcopk.exe
Size 320KB
SHA256 5dd21ac0c1e50bcf57cdb17da6a859e36b87a251cbef2c845d145e03d3f13a56
MD5 a247099a4ddfb7adec28e52ec433b749
SHA1 a961462180863983767139f837a71c92d5705a2f
SHA512 408054b155a9f615de028366f2fb550bc4b265c3c1b3b57662057945ec11a488d3e49409054c25e5fe076bf89273be60c24deedcc7bac36e29f99dab20c062ae
SSDEEP 3072:38HEGbrmX7RrzvGF4wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:MHkXs4V/Ah1G/AcQ///NR5fn
TLSH
T1716421192A340AFACDED1FB5AD125AD86141E9F014F2E13E6123DFDDD8E4EA2C815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Omgmeigd.exe

Path C:\Windows\SysWOW64\Omgmeigd.exe
Size 320KB
SHA256 d37f2afe9746fd7410e43b5d76bc13f7d3718bae03d79db3f64b988273316ee6
MD5 2b6c5745f1e22c60b4b6adfb4efab366
SHA1 117e342fe24da6c4d8518f2f55b3e7bd348bcdc9
SHA512 bee43ee73f61ea5dc69cb9c3b956f9d3542e8df17bd149f888c56183e23d6535713f180521b06cc23fb42f1b2ef1facef75892ddeb56296330205dc3c14c7af1
SSDEEP 3072:E1nKTt3QLX7WO0Ot5ewS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:SnKZ3QLX7mqeV/Ah1G/AcQ///NR5fn
TLSH
T1CA6420196A3009EACEED5BB6ED0249D85141F9F098F1E13E5123DFDDC8E4DAAD818F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Omnjojpo.exe

Path C:\Windows\SysWOW64\Omnjojpo.exe
Size 320KB
SHA256 1d61c9b04f2310b647dd79e06975332720a196d04236758e491c726cefec0fde
MD5 f8bece730623e35cae96d3f502ff29ad
SHA1 677119911aecf1a22cc96067f931a69725c79698
SHA512 3c761e0dfa0028ab54ab3e32e3651ed1758e359dc04cf2c92f59ee2337cb881ff9d585f51c429fdffabdee7c981ca62046dc8842650add8ca23c38a6a9b060fb
SSDEEP 3072:U8BAG1zPG5K6wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:U8N1rD6V/Ah1G/AcQ///NR5fn
TLSH
T135642E192A740DEADEED1BB5AC1249DC9141E9F024F1E13E6123DFDCD8E9DA2D818F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ompfej32.exe

Path C:\Windows\SysWOW64\Ompfej32.exe
Size 320KB
SHA256 dacf5d862a5b2be347e844a08955a97298e2edc5c025b912fa1139390291ebd5
MD5 ed81f3c1cf9cbc7e0a3673c376bc5bb9
SHA1 46fc8a7433d6a16b514cf2f7dda2b720eeae8628
SHA512 9d6393d62677c5483c5fd3730eeda66c1c05ac333fb6bc2f77304af5a5306c8023785fdbe16d00224fbf22dc112b2ed93433d039b3d7f8ab279958b5184f1bbc
SSDEEP 3072:SH9wzwYvH9mwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Y2zwY1mV/Ah1G/AcQ///NR5fn
TLSH
T106641D1A2A3489EACEED1BF5AC1259D89181E9F014F1E17E6133DFDCD8E4DA6C805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Onapdl32.exe

Path C:\Windows\SysWOW64\Onapdl32.exe
Size 320KB
SHA256 afc5fdf499c426b80118acd62e41316a6cedbd1e58720cebf6ab94b33ae77532
MD5 d3de22a9e6674a3bfe54868aaea67fc1
SHA1 23b4b2a4731df21f2e096f009a64eebdf96c05dd
SHA512 80f2f47697c9df47a1cd76ce31118fdaad45bac204db3a8df5f57ea14d6b69196ec8ec17ed55b5dcf545e8864992d12d191cc2fdd28d3ddf78059cd7adec67fa
SSDEEP 3072:UREGKXOpAsdwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:5G5AsdV/Ah1G/AcQ///NR5fn
TLSH
T1806440195A7019EACEFD1FB5AC024AD88182E9F014F1E13E6123DFDDD8E4DAAC945F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Onkidm32.exe

Path C:\Windows\SysWOW64\Onkidm32.exe
Size 320KB
SHA256 754d700b54885972a684332495857249de8a1b8c0d9d96644cf1f6e403d3bfdb
MD5 45e4325bcbb68bb5572e851e9afa5fdc
SHA1 d8d5fa0a855efa2ee0c97de60ae25ae6d6543994
SHA512 d02199f5d389e731eb2bb5b14c3c01fc889f961ac47d4a3d9aafdcc537c6e80f24c8447ec4bf997cec09090eab14644d649baff38c4fc0d0b7a4e50005c74477
SSDEEP 6144:e1uaaNzyH6Q8yCaxNcEKxOV9V/Ah1G/AcQ///NR5fn:e1uhNzyH6Q8yvNcEKxOa/Nv
TLSH
T149643E596A3009EACDFD1BB5AC1259E89145EAF014F2E13E6523DFDCD8E4DA2D804FC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Onmfimga.exe

Path C:\Windows\SysWOW64\Onmfimga.exe
Size 320KB
SHA256 a5391c7f4eddd44e297d9018fa897ae36b1125427adb44738ee7bb243c6e80ea
MD5 2ac7f2d281edd33e4af6f48dd3990007
SHA1 419fca6bf50d44d2c157efff85480d696b348661
SHA512 b99a3a2f5d57e045eb8084764c724de5e271db2343e26a353275f3fbb8debfe08d0526e84595169c4640c8b2869ac725f16dd7f5c74eecaac929b3c1ccf0deea
SSDEEP 3072:yHdhNgcHb5rznX9dlwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:gdhNt75HX9dlV/Ah1G/AcQ///NR5fn
TLSH
T145642019263419EBCEED2BB5AC0249D89141E6F114F1E13E6223DFDCD8F4DAAC915F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Onocomdo.exe

Path C:\Windows\SysWOW64\Onocomdo.exe
Size 320KB
SHA256 c21f974e95291e0b62c34473d7e0b1cb791629ce1295fd09b8d84df3f6c70ae0
MD5 6563ffd4518806cf85a7811b243078fd
SHA1 f0b74af4b0fd86257c5b47d7b347d694fc6cb666
SHA512 911588b8fa8bf5a27a14db9d0ae505f608196a82a3a08c4fc3dec42597a19b39445d7f1fbe71d1be0b088f4ac14696e27592aff5a2b3358131b66e4631eec442
SSDEEP 3072:1m4SapRysGFubTsPCwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:yapRyFubTaCV/Ah1G/AcQ///NR5fn
TLSH
T13964EA192A3809EACDED1BB6ED1249DC5181E9F018F1E23E6163DFDDC8E4DA2D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Oplfkeob.exe

Path C:\Windows\SysWOW64\Oplfkeob.exe
Size 320KB
SHA256 9b77b7a6b42b999695019cc4697c63966c1366131add06ca0df4740f8a0136bb
MD5 bf2e22c9906ceaec8420ff90f017be08
SHA1 71b1923f26a1a13cf8072c212f231aef1cf525ee
SHA512 b14ee0551c7728d307ea63222409c5eaba44db87156734ea389c4902c367eddfcb1d0d7bbe3303a978183477ea99eccd2469fe5cc6d548ee1c9877d555274935
SSDEEP 3072:VYxuzOuAh4SjEwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Dt8jEV/Ah1G/AcQ///NR5fn
TLSH
T12F64EA1A5A300DEACEED9BB6BC1249D85245E8F014F1E13E6133DFDCD8E4DA6D825B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Opnbae32.exe

Path C:\Windows\SysWOW64\Opnbae32.exe
Size 320KB
SHA256 283ec3da28c958a5697ec02927689f34330defb27206f6b05c7069e2a552ee97
MD5 f8236455966f5aa63a8d6f63f7bf572c
SHA1 b3c952f84c93917d183073c4925f6e9ca9fe2b50
SHA512 5035be2b8bb5ede8f28e2e4c83eaecc2c0a9a9e4b153f14ab98c2972fde9b3883bf62bf3d1a473ef0cb75fb23561ad019c46ac69c4ca5a44435ea720897f2753
SSDEEP 3072:n242gPBFkhIw2wwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:d2gPBFkhp2wV/Ah1G/AcQ///NR5fn
TLSH
T17F640F19263409EACEED1BF5AC0289DD5291E8F014F1E17E6523DFECD8E5DA6C809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Opqofe32.exe

Path C:\Windows\SysWOW64\Opqofe32.exe
Size 320KB
SHA256 76340b8d86a11458880d778c0483fe29bff9b1b8c7e22e9f92088485def4b929
MD5 84e65abefebe47570855bfe3c2d3deae
SHA1 b66a0760a3d4c1a02de52ae05e80e48774d7ebc1
SHA512 e98a236a2a4aba81b4a63ded5b5654a083e986a2f63bf412db3c6e0dc9d208bce5595450cc0f3721226b5d05ba04ca1fed83c36bf098afc74d3b38a4b213c5fd
SSDEEP 3072:ONr5BfC2WExPTwZlmwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:K5BfGlmV/Ah1G/AcQ///NR5fn
TLSH
T199641E1A263509EACDED1FB9AC1249D8A145E8F014F1E23E6523DFDCD8E4DA6CC09F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pjkmomfn.exe

Path C:\Windows\SysWOW64\Pjkmomfn.exe
Size 320KB
SHA256 f9e9ee1aa54588ad6b0264cd90425a1e61ff8e152a45d310446425985ef82d74
MD5 fb02f5b39b4414de698a3d6b9f3b3f65
SHA1 4b92012ba74faf589c71323280a766c9c666c595
SHA512 8ec7d209cb01debac1c6da3655020efac73cf3efc8eb842d7e229bced9d3a8eb2b848ceaf4e9b24c82fcc93494a74d4d40fffd4b70175a1bc74c925c5f9fdee3
SSDEEP 3072:skXbOvlsV4lRwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:JSlzRV/Ah1G/AcQ///NR5fn
TLSH
T1836430292A7009EACDFD1BB6AC9249D89141E9F114F1E13E6533DFDCC8E4DA6C819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pmiikh32.exe

Path C:\Windows\SysWOW64\Pmiikh32.exe
Size 320KB
SHA256 9c1d596c429621bea21d07979815e6abb6d4d49ef9808640d307d2284b9dc264
MD5 b43710b415fc89661da4655b42394454
SHA1 4db2deeb0cf81d878efbd8550303ed08527c3215
SHA512 0acb755922ac35be7079349672c0fcb04cea322d79270824cb33fdf2941a6549cf21234416ba9e8e4ca8b91cec36c4523f40885e19492f08b600900bb45609a2
SSDEEP 3072:vbfmNnO4v7M/TROvqwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:rmZWOvqV/Ah1G/AcQ///NR5fn
TLSH
T1BA645F59263849FACEED1FB5AC1249D99141E8F014F2E13E2163DFDCE9E4DAAC805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/212-373-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/432-126-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/432-634-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/440-272-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/536-361-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/548-295-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/552-142-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/920-213-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1072-110-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1072-622-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1084-409-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1244-571-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1244-45-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1284-326-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1288-533-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1288-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1288-1-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/1416-585-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1416-61-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1668-221-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1776-367-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1824-343-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1828-623-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1840-332-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1956-616-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1956-102-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2032-355-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2152-133-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2176-302-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2332-296-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2360-289-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2368-236-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2408-181-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2444-397-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2512-349-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2704-158-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2740-558-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2740-29-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2864-27-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2864-547-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2956-86-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2956-603-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3008-308-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3036-604-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3140-244-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3236-314-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3272-8-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3272-546-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3276-278-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3300-578-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3300-54-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3388-610-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3388-93-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3516-189-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3680-69-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3680-591-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3800-260-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3924-391-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4080-426-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4100-564-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4100-37-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4124-320-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4136-197-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4164-252-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4468-420-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4472-403-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4500-385-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4584-166-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4628-118-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4736-379-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4768-205-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4936-150-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4944-77-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4944-597-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5028-266-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5132-437-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5168-443-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5208-449-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5248-455-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5288-461-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5328-467-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5368-473-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5408-479-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5448-485-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5488-491-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5528-497-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5568-503-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5608-509-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5648-515-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5688-521-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5728-527-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5768-534-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5808-540-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5972-565-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6012-572-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6056-579-0x0000000000400000-0x000000000046D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads