berbew | 506d35ae442a939659b58f4f14f2835043d9e91f3adcc92122a794d15fea0b5b

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 14:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_37a439ebdd879e63249ed6d1a426f85f_elex_wannacry.exe
Size 320KB
Sample260720-r166dafv5t
SHA256 506d35ae442a939659b58f4f14f2835043d9e91f3adcc92122a794d15fea0b5b
MD5 37a439ebdd879e63249ed6d1a426f85f
SHA1 4efdc9e5cbeb45245714b4c99de8c2d849b226f1
SHA512 e95a43e2ec28c7773cd501deaa59d07a79e58c1e6e480db351a6813f41b20e4faa2e97a65eda231ea6686621c111ffe97ce4745b19f78c5c0987b061245d5675
SSDEEP 3072:KlHm+sjL8szt3wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:3FjLzzdV/Ah1G/AcQ///NR5fn
TLSH
T177643059263209EACEED1FB5AC1259D85141F8F014F1E23E6127DFECE8E4DA2C919F81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mmfaafej.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nipokfil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nmpdgdmp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Glpdjpbj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilqmam32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iadljc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Npighq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndjldo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljjicl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpinac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjaodkmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mboqnm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmpdgdmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hepoddcc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hedhoc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ieknpb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jcfejfag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jcmkjeko.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jkhpogij.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkflpe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlbllc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Glpdjpbj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hepoddcc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mbamcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mbamcm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mbcjimda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mminfech.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbefolao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njokei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jhqqlmba.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmobii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpkkgbmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mlbllc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndjldo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Glkkop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Glkkop32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ieknpb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iadljc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmaooihb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjaodkmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mfhpilbc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmahff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gedohfmp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljglnmdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ljglnmdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ljjicl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mboqnm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mmdekf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mbcjimda.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npighq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Haafnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jcknee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mminfech.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nipokfil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jhejgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jkhpogij.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jhejgl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcmkjeko.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbefolao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	2026-07-20_37a439ebdd879e63249ed6d1a426f85f_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gedohfmp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kiomnk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hakidd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ilqmam32.exe

Executes dropped EXE 42 IoCs

pid	Process
4740	Glkkop32.exe
4148	Gedohfmp.exe
5744	Glpdjpbj.exe
3104	Haafnf32.exe
5208	Hepoddcc.exe
3276	Hedhoc32.exe
5844	Hakidd32.exe
5956	Ilqmam32.exe
1816	Ieknpb32.exe
4560	Iadljc32.exe
3444	Jhqqlmba.exe
972	Jcfejfag.exe
4592	Jhejgl32.exe
4532	Jcknee32.exe
4056	Jcmkjeko.exe
2984	Jkhpogij.exe
124	Kiomnk32.exe
3296	Kbgafqla.exe
3548	Kmobii32.exe
2864	Kmaooihb.exe
4212	Lkflpe32.exe
2576	Ljglnmdi.exe
5452	Ljjicl32.exe
5652	Lpinac32.exe
4944	Mpkkgbmi.exe
3496	Mjaodkmo.exe
5068	Mlbllc32.exe
2624	Mfhpilbc.exe
1996	Mmahff32.exe
2188	Mboqnm32.exe
2384	Mmdekf32.exe
2692	Mbamcm32.exe
4356	Mmfaafej.exe
5996	Mbcjimda.exe
3392	Mminfech.exe
5416	Nbefolao.exe
724	Nipokfil.exe
2676	Npighq32.exe
1088	Njokei32.exe
2564	Nmpdgdmp.exe
5508	Ndjldo32.exe
3540	Nleaha32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ilqmam32.exe	Hakidd32.exe
File created	C:\Windows\SysWOW64\Jkhpogij.exe	Jcmkjeko.exe
File created	C:\Windows\SysWOW64\Ljjicl32.exe	Ljglnmdi.exe
File opened for modification	C:\Windows\SysWOW64\Mmahff32.exe	Mfhpilbc.exe
File created	C:\Windows\SysWOW64\Nbefolao.exe	Mminfech.exe
File created	C:\Windows\SysWOW64\Nleaha32.exe	Ndjldo32.exe
File created	C:\Windows\SysWOW64\Jcfejfag.exe	Jhqqlmba.exe
File created	C:\Windows\SysWOW64\Blgmmd32.dll	Kmaooihb.exe
File opened for modification	C:\Windows\SysWOW64\Mminfech.exe	Mbcjimda.exe
File created	C:\Windows\SysWOW64\Ofgbflng.dll	Mbcjimda.exe
File created	C:\Windows\SysWOW64\Njokei32.exe	Npighq32.exe
File created	C:\Windows\SysWOW64\Mipoje32.dll	Npighq32.exe
File created	C:\Windows\SysWOW64\Fkklfgll.dll	Iadljc32.exe
File created	C:\Windows\SysWOW64\Pofbggpf.dll	Jhejgl32.exe
File created	C:\Windows\SysWOW64\Mlbllc32.exe	Mjaodkmo.exe
File created	C:\Windows\SysWOW64\Jieiif32.dll	Nipokfil.exe
File created	C:\Windows\SysWOW64\Ncdkgi32.dll	Njokei32.exe
File created	C:\Windows\SysWOW64\Jhejgl32.exe	Jcfejfag.exe
File created	C:\Windows\SysWOW64\Jhkane32.dll	Jcknee32.exe
File opened for modification	C:\Windows\SysWOW64\Nipokfil.exe	Nbefolao.exe
File opened for modification	C:\Windows\SysWOW64\Nleaha32.exe	Ndjldo32.exe
File opened for modification	C:\Windows\SysWOW64\Ilqmam32.exe	Hakidd32.exe
File created	C:\Windows\SysWOW64\Iadljc32.exe	Ieknpb32.exe
File created	C:\Windows\SysWOW64\Kbgafqla.exe	Kiomnk32.exe
File opened for modification	C:\Windows\SysWOW64\Kmobii32.exe	Kbgafqla.exe
File opened for modification	C:\Windows\SysWOW64\Mpkkgbmi.exe	Lpinac32.exe
File created	C:\Windows\SysWOW64\Hbacoioc.dll	Mlbllc32.exe
File opened for modification	C:\Windows\SysWOW64\Mmdekf32.exe	Mboqnm32.exe
File created	C:\Windows\SysWOW64\Mbamcm32.exe	Mmdekf32.exe
File created	C:\Windows\SysWOW64\Jhqqlmba.exe	Iadljc32.exe
File created	C:\Windows\SysWOW64\Dajqphlf.dll	Kbgafqla.exe
File created	C:\Windows\SysWOW64\Pjfffd32.dll	Ljglnmdi.exe
File created	C:\Windows\SysWOW64\Lpinac32.exe	Ljjicl32.exe
File opened for modification	C:\Windows\SysWOW64\Ljjicl32.exe	Ljglnmdi.exe
File created	C:\Windows\SysWOW64\Phioej32.dll	Mbamcm32.exe
File created	C:\Windows\SysWOW64\Hedhoc32.exe	Hepoddcc.exe
File created	C:\Windows\SysWOW64\Oflcnqal.dll	Gedohfmp.exe
File created	C:\Windows\SysWOW64\Ejjakmcg.dll	Kiomnk32.exe
File created	C:\Windows\SysWOW64\Kmobii32.exe	Kbgafqla.exe
File created	C:\Windows\SysWOW64\Nmpdgdmp.exe	Njokei32.exe
File created	C:\Windows\SysWOW64\Jcknee32.exe	Jhejgl32.exe
File created	C:\Windows\SysWOW64\Amqfdcji.dll	Nmpdgdmp.exe
File created	C:\Windows\SysWOW64\Gedkkm32.dll	Hepoddcc.exe
File created	C:\Windows\SysWOW64\Pdooddpo.dll	Hakidd32.exe
File opened for modification	C:\Windows\SysWOW64\Npighq32.exe	Nipokfil.exe
File created	C:\Windows\SysWOW64\Glkkop32.exe	2026-07-20_37a439ebdd879e63249ed6d1a426f85f_elex_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\Glpdjpbj.exe	Gedohfmp.exe
File opened for modification	C:\Windows\SysWOW64\Jhejgl32.exe	Jcfejfag.exe
File created	C:\Windows\SysWOW64\Fnchgmkg.dll	Jkhpogij.exe
File created	C:\Windows\SysWOW64\Mfhpilbc.exe	Mlbllc32.exe
File opened for modification	C:\Windows\SysWOW64\Haafnf32.exe	Glpdjpbj.exe
File created	C:\Windows\SysWOW64\Mmdekf32.exe	Mboqnm32.exe
File opened for modification	C:\Windows\SysWOW64\Mmfaafej.exe	Mbamcm32.exe
File opened for modification	C:\Windows\SysWOW64\Gedohfmp.exe	Glkkop32.exe
File created	C:\Windows\SysWOW64\Fclddi32.dll	Ieknpb32.exe
File opened for modification	C:\Windows\SysWOW64\Kbgafqla.exe	Kiomnk32.exe
File created	C:\Windows\SysWOW64\Mmahff32.exe	Mfhpilbc.exe
File opened for modification	C:\Windows\SysWOW64\Glkkop32.exe	2026-07-20_37a439ebdd879e63249ed6d1a426f85f_elex_wannacry.exe
File created	C:\Windows\SysWOW64\Bdgfpe32.dll	Glkkop32.exe
File opened for modification	C:\Windows\SysWOW64\Hakidd32.exe	Hedhoc32.exe
File created	C:\Windows\SysWOW64\Ieknpb32.exe	Ilqmam32.exe
File created	C:\Windows\SysWOW64\Bllhabgk.dll	Mpkkgbmi.exe
File created	C:\Windows\SysWOW64\Mboqnm32.exe	Mmahff32.exe
File opened for modification	C:\Windows\SysWOW64\Hedhoc32.exe	Hepoddcc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
764	3540	WerFault.exe	130

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nbefolao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ieknpb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mboqnm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mbamcm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mminfech.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npighq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Haafnf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hakidd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljjicl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mpkkgbmi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjaodkmo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmfaafej.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mbcjimda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njokei32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Glkkop32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iadljc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jhqqlmba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jhejgl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcknee32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jkhpogij.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kiomnk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mfhpilbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcfejfag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nipokfil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmpdgdmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_37a439ebdd879e63249ed6d1a426f85f_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hepoddcc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lkflpe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljglnmdi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmahff32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ilqmam32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kmobii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpinac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ndjldo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nleaha32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gedohfmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Glpdjpbj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcmkjeko.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbgafqla.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kmaooihb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlbllc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hedhoc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmdekf32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mmdekf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njokei32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lpinac32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nipokfil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jcfejfag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kmobii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ndjldo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ieknpb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pofbggpf.dll"	Jhejgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	2026-07-20_37a439ebdd879e63249ed6d1a426f85f_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ieknpb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dajqphlf.dll"	Kbgafqla.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ndjldo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hepoddcc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iadljc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jhejgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nbefolao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Npighq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mminfech.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blgmmd32.dll"	Kmaooihb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lkflpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lkflpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjfffd32.dll"	Ljglnmdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eghdmn32.dll"	Ljjicl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mmdekf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kbgafqla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kmaooihb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jkhpogij.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ljjicl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mlbllc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnchgmkg.dll"	Jkhpogij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kbgafqla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggfcbi32.dll"	Lkflpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ljglnmdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdgfpe32.dll"	Glkkop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hqhdnc32.dll"	Mfhpilbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amqfdcji.dll"	Nmpdgdmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njokei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qfpmdman.dll"	Jcmkjeko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jkhpogij.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Glpdjpbj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hakidd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jhejgl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kmaooihb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nipokfil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cibdlc32.dll"	Glpdjpbj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mmahff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mmahff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jcmkjeko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnghjd32.dll"	Mmfaafej.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hedhoc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jhqqlmba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nogoacbd.dll"	Mjaodkmo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nmpdgdmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nmpdgdmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Haafnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mfhpilbc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mbamcm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mbcjimda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mipoje32.dll"	Npighq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	2026-07-20_37a439ebdd879e63249ed6d1a426f85f_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	2026-07-20_37a439ebdd879e63249ed6d1a426f85f_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gedohfmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Glpdjpbj.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 4740	4072	2026-07-20_37a439ebdd879e63249ed6d1a426f85f_elex_wannacry.exe	88
PID 4740 wrote to memory of 4148	4740	Glkkop32.exe	90
PID 4148 wrote to memory of 5744	4148	Gedohfmp.exe	91
PID 5744 wrote to memory of 3104	5744	Glpdjpbj.exe	92
PID 3104 wrote to memory of 5208	3104	Haafnf32.exe	93
PID 5208 wrote to memory of 3276	5208	Hepoddcc.exe	94
PID 3276 wrote to memory of 5844	3276	Hedhoc32.exe	95
PID 5844 wrote to memory of 5956	5844	Hakidd32.exe	96
PID 5956 wrote to memory of 1816	5956	Ilqmam32.exe	97
PID 1816 wrote to memory of 4560	1816	Ieknpb32.exe	98
PID 4560 wrote to memory of 3444	4560	Iadljc32.exe	99
PID 3444 wrote to memory of 972	3444	Jhqqlmba.exe	100
PID 972 wrote to memory of 4592	972	Jcfejfag.exe	101
PID 4592 wrote to memory of 4532	4592	Jhejgl32.exe	102
PID 4532 wrote to memory of 4056	4532	Jcknee32.exe	103
PID 4056 wrote to memory of 2984	4056	Jcmkjeko.exe	104
PID 2984 wrote to memory of 124	2984	Jkhpogij.exe	105
PID 124 wrote to memory of 3296	124	Kiomnk32.exe	106
PID 3296 wrote to memory of 3548	3296	Kbgafqla.exe	107
PID 3548 wrote to memory of 2864	3548	Kmobii32.exe	108
PID 2864 wrote to memory of 4212	2864	Kmaooihb.exe	109
PID 4212 wrote to memory of 2576	4212	Lkflpe32.exe	110
PID 2576 wrote to memory of 5452	2576	Ljglnmdi.exe	111
PID 5452 wrote to memory of 5652	5452	Ljjicl32.exe	112
PID 5652 wrote to memory of 4944	5652	Lpinac32.exe	113
PID 4944 wrote to memory of 3496	4944	Mpkkgbmi.exe	114
PID 3496 wrote to memory of 5068	3496	Mjaodkmo.exe	115
PID 5068 wrote to memory of 2624	5068	Mlbllc32.exe	116
PID 2624 wrote to memory of 1996	2624	Mfhpilbc.exe	117
PID 1996 wrote to memory of 2188	1996	Mmahff32.exe	118
PID 2188 wrote to memory of 2384	2188	Mboqnm32.exe	119
PID 2384 wrote to memory of 2692	2384	Mmdekf32.exe	120
PID 2692 wrote to memory of 4356	2692	Mbamcm32.exe	121
PID 4356 wrote to memory of 5996	4356	Mmfaafej.exe	122
PID 5996 wrote to memory of 3392	5996	Mbcjimda.exe	123
PID 3392 wrote to memory of 5416	3392	Mminfech.exe	124
PID 5416 wrote to memory of 724	5416	Nbefolao.exe	125
PID 724 wrote to memory of 2676	724	Nipokfil.exe	126
PID 2676 wrote to memory of 1088	2676	Npighq32.exe	127
PID 1088 wrote to memory of 2564	1088	Njokei32.exe	128
PID 2564 wrote to memory of 5508	2564	Nmpdgdmp.exe	129
PID 5508 wrote to memory of 3540	5508	Ndjldo32.exe	130

C:\Users\Admin\AppData\Local\Temp\2026-07-20_37a439ebdd879e63249ed6d1a426f85f_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_37a439ebdd879e63249ed6d1a426f85f_elex_wannacry.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Windows\SysWOW64\Glkkop32.exe
  C:\Windows\system32\Glkkop32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Windows\SysWOW64\Gedohfmp.exe
    C:\Windows\system32\Gedohfmp.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4148
  - - C:\Windows\SysWOW64\Glpdjpbj.exe
      C:\Windows\system32\Glpdjpbj.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:5744
    - - C:\Windows\SysWOW64\Haafnf32.exe
        
        C:\Windows\system32\Haafnf32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3104
      - C:\Windows\SysWOW64\Hepoddcc.exe
        
        C:\Windows\system32\Hepoddcc.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5208
        
        C:\Windows\SysWOW64\Hedhoc32.exe
        
        C:\Windows\system32\Hedhoc32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3276
        
        C:\Windows\SysWOW64\Hakidd32.exe
        
        C:\Windows\system32\Hakidd32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5844
        
        C:\Windows\SysWOW64\Ilqmam32.exe
        
        C:\Windows\system32\Ilqmam32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5956
        
        C:\Windows\SysWOW64\Ieknpb32.exe
        
        C:\Windows\system32\Ieknpb32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1816
        
        C:\Windows\SysWOW64\Iadljc32.exe
        
        C:\Windows\system32\Iadljc32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4560
        
        C:\Windows\SysWOW64\Jhqqlmba.exe
        
        C:\Windows\system32\Jhqqlmba.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3444
        
        C:\Windows\SysWOW64\Jcfejfag.exe
        
        C:\Windows\system32\Jcfejfag.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:972
        
        C:\Windows\SysWOW64\Jhejgl32.exe
        
        C:\Windows\system32\Jhejgl32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4592
        
        C:\Windows\SysWOW64\Jcknee32.exe
        
        C:\Windows\system32\Jcknee32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4532
        
        C:\Windows\SysWOW64\Jcmkjeko.exe
        
        C:\Windows\system32\Jcmkjeko.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4056
        
        C:\Windows\SysWOW64\Jkhpogij.exe
        
        C:\Windows\system32\Jkhpogij.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2984
        
        C:\Windows\SysWOW64\Kiomnk32.exe
        
        C:\Windows\system32\Kiomnk32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:124
        
        C:\Windows\SysWOW64\Kbgafqla.exe
        
        C:\Windows\system32\Kbgafqla.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3296
        
        C:\Windows\SysWOW64\Kmobii32.exe
        
        C:\Windows\system32\Kmobii32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3548
        
        C:\Windows\SysWOW64\Kmaooihb.exe
        
        C:\Windows\system32\Kmaooihb.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2864
        
        C:\Windows\SysWOW64\Lkflpe32.exe
        
        C:\Windows\system32\Lkflpe32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4212
        
        C:\Windows\SysWOW64\Ljglnmdi.exe
        
        C:\Windows\system32\Ljglnmdi.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2576
        
        C:\Windows\SysWOW64\Ljjicl32.exe
        
        C:\Windows\system32\Ljjicl32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5452
        
        C:\Windows\SysWOW64\Lpinac32.exe
        
        C:\Windows\system32\Lpinac32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5652
        
        C:\Windows\SysWOW64\Mpkkgbmi.exe
        
        C:\Windows\system32\Mpkkgbmi.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4944
        
        C:\Windows\SysWOW64\Mjaodkmo.exe
        
        C:\Windows\system32\Mjaodkmo.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3496
        
        C:\Windows\SysWOW64\Mlbllc32.exe
        
        C:\Windows\system32\Mlbllc32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5068
        
        C:\Windows\SysWOW64\Mfhpilbc.exe
        
        C:\Windows\system32\Mfhpilbc.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2624
        
        C:\Windows\SysWOW64\Mmahff32.exe
        
        C:\Windows\system32\Mmahff32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1996
        
        C:\Windows\SysWOW64\Mboqnm32.exe
        
        C:\Windows\system32\Mboqnm32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2188
        
        C:\Windows\SysWOW64\Mmdekf32.exe
        
        C:\Windows\system32\Mmdekf32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2384
        
        C:\Windows\SysWOW64\Mbamcm32.exe
        
        C:\Windows\system32\Mbamcm32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2692
        
        C:\Windows\SysWOW64\Mmfaafej.exe
        
        C:\Windows\system32\Mmfaafej.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4356
        
        C:\Windows\SysWOW64\Mbcjimda.exe
        
        C:\Windows\system32\Mbcjimda.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5996
        
        C:\Windows\SysWOW64\Mminfech.exe
        
        C:\Windows\system32\Mminfech.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3392
        
        C:\Windows\SysWOW64\Nbefolao.exe
        
        C:\Windows\system32\Nbefolao.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5416
        
        C:\Windows\SysWOW64\Nipokfil.exe
        
        C:\Windows\system32\Nipokfil.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:724
        
        C:\Windows\SysWOW64\Npighq32.exe
        
        C:\Windows\system32\Npighq32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2676
        
        C:\Windows\SysWOW64\Njokei32.exe
        
        C:\Windows\system32\Njokei32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1088
        
        C:\Windows\SysWOW64\Nmpdgdmp.exe
        
        C:\Windows\system32\Nmpdgdmp.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2564
        
        C:\Windows\SysWOW64\Ndjldo32.exe
        
        C:\Windows\system32\Ndjldo32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5508
        
        C:\Windows\SysWOW64\Nleaha32.exe
        
        C:\Windows\system32\Nleaha32.exe
        43⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3540
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3540 -s 448
        44⤵
        Program crash
        
        PID:764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3540 -ip 3540
1⤵
PID:1400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Gedohfmp.exe

Path C:\Windows\SysWOW64\Gedohfmp.exe
Size 320KB
SHA256 46c3bc7f94a7ad2fc92ebed0ff0e696920b078687f20097edc7b44b003438401
MD5 70d3688e9867fa019c237e687cce31db
SHA1 e0c054470858f7406e353cf2f148a0764a082be3
SHA512 3d084a4e7d47edfa4e34c93394eec27e90f3496aec34cdca0fb4d73fb1f3292e5e3656cacf73a50e43f01a1cfc58ace947510ec8859790c89015dec63e7d219b
SSDEEP 3072:rnbJVB47RQqDbcSq/uMwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:rnbJQFDgAMV/Ah1G/AcQ///NR5fn
TLSH
T101641D192A3009EADEED1BF6AC1249D85141E8F218F1E13E6123DFDCC8E5DAACC55F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Glkkop32.exe

Path C:\Windows\SysWOW64\Glkkop32.exe
Size 320KB
SHA256 d7827f8108665442fb99503df2359feb231f6cc5299340ab5e943ba358fa070b
MD5 98d57bd284e80648f935c1375b515d92
SHA1 c68f07445ae5cea8ce4e849f65a5932f2dad3635
SHA512 afe9903ac69f8c2d5dca17dc6e0fae975dfee3b8569c3203ace1f98700938b863c4b663282aac17a8f2a4bc28058705303e5e99ab13b8999afce1cc339f3d528
SSDEEP 3072:fpMH8D/RFQi+vdbUEkwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:hgKfEUEkV/Ah1G/AcQ///NR5fn
TLSH
T162643059263409EACEED6FB6AC1249D99241E9F014F1E17E6123DFDCC8E4DA2C816FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Glpdjpbj.exe

Path C:\Windows\SysWOW64\Glpdjpbj.exe
Size 320KB
SHA256 7b04893200e7e80ef4b33b33d8d017b1fe2d7644c6140742e9154dc32cb4cf0d
MD5 ca15bf3ba5b1c6d5663695777b6fabd1
SHA1 73d7c80696a5194729df5302f502bec3d926bbe1
SHA512 173873dad5fee4dc512c63136249198c847e3a781ce7de7b46a82f76b96d2621148c6649a9e196863e9ace59993c55d22c4253d8937ec3772233ce3ed125c95c
SSDEEP 3072:Jrz1vyzPWU7MwzH2v31tkQ6wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Vz1KDtzH2P1KQ6V/Ah1G/AcQ///NR5fn
TLSH
T19764E95A263009EACDED5BF6BD124DD89142E9B014F1E53E2123DFDCD8E8DA2E815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Haafnf32.exe

Path C:\Windows\SysWOW64\Haafnf32.exe
Size 320KB
SHA256 e644eb0ea063846680da735f7e7bd5e8ea1c52868fff82b61292c2c77d94fde1
MD5 7d0cbb51f5add632c88832e7cf86f11d
SHA1 a845e11b4eb9ce62f41f9b702021baf2d4fd8a40
SHA512 585fe157923550d49cc0099b6a5566f029be2a352fb0d42d5c76e24743380d47a04e1eb7dbd8d9ea5fc3f88d27f1fc0a75f82bb31768cf5a50583999f70114ce
SSDEEP 3072:7/dnz/Mze0RPCMwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:7Fn7Qe0RPCMV/Ah1G/AcQ///NR5fn
TLSH
T14C645425263409EADEED1FB5AC1299D89191E4F014F1E13F6123DFECD8E8DA2D825F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hakidd32.exe

Path C:\Windows\SysWOW64\Hakidd32.exe
Size 320KB
SHA256 592f60f1552341182d81aec8418236cc391d5e75b1b3ecdbff21519947a58acd
MD5 8efe264032ba79abddc6d9c05a568f6d
SHA1 3fee7756c605df6d2923dd9541a9ed80b583b629
SHA512 a4b8482c748b6bfb0d7c16a2b1c8e25133f2d323209091d4d7ae1173f9b0f01f71c39893ba61409e94ea755986c8f778bd6b2f8910f4be146512b82cb5291d03
SSDEEP 3072:xaP2XzdtWQG1wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:g2+1V/Ah1G/AcQ///NR5fn
TLSH
T103640C1A2A3409EACDED1BB5BD5349D89981E8F014F1E17E6123DFDCC8E4DA6C819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hedhoc32.exe

Path C:\Windows\SysWOW64\Hedhoc32.exe
Size 320KB
SHA256 d74d701e355c465d2c5b2e7dd3e2ae4a2742fe175c7db279c7f882b0368dfc7f
MD5 398cf05585ea630bcf3d11d509092e2e
SHA1 be3d040a3407950dc9ec72fba713d428fe20aeca
SHA512 f4f06fb95e356b4d3ef8121ed879b0efae887c07f3a937ca3f96ef627293c0d520f211fd5ab919b42facd42a1c53471e812b3d71ab684a9a61cfb80b914d144c
SSDEEP 3072:aMqrqu1APCifZwhznpWU1wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:aMqr/1iLCznpD1V/Ah1G/AcQ///NR5fn
TLSH
T119641F191A300DEACEED1BB5AC1249D89141EAF114F2E13E7523DFEDD8E4DA6C809F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hepoddcc.exe

Path C:\Windows\SysWOW64\Hepoddcc.exe
Size 320KB
SHA256 1d11ed311d24ff997d5692b2b45f4ca5e12b67946fc8a94ecdf196613d8957c1
MD5 923cca0588d86cbd18445923efec76a7
SHA1 4724fed22ffc04bfc71f92f6d44661920d6e1f0e
SHA512 9cbdc3d3032e62ffd63ebcba54faf950a00191605476c22bc6315045e935f341b4c46c5d5ec1a83aa7217fc3cbaee5a067ff13ee5ead322cdc6f0475b1925f6f
SSDEEP 3072:am140p7H5ztP1+rwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:g0pjRtsrV/Ah1G/AcQ///NR5fn
TLSH
T115643E192A3409EACDED1FB6AC0249D89141E9F015F1E13E6967DFDCC8E9DA2D809FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Iadljc32.exe

Path C:\Windows\SysWOW64\Iadljc32.exe
Size 320KB
SHA256 09f1fafcd3fc3e42946422b420755bb8f4fbb241630ef9b77cd358b427213d89
MD5 b8e970aa44de46c8fd1ceae3912ec5d0
SHA1 6ee56963319eb3e56034e8cfb8a6a4eeda5d2f66
SHA512 1bb21a9661d5f1b56cf206477e7c93fe103436986d58faba4ad755262a2f33a84487f4f0e615009379452af06b8991d526195a169806dbc114bb6931079c5242
SSDEEP 3072:JTxkRFGbEtA76p+IwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:JuabEeIV/Ah1G/AcQ///NR5fn
TLSH
T13F64FB1A6A300AEACDED1BB5AC124DEC5141EAF015F1E13E6563DFDCD9E4DA2C809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ieknpb32.exe

Path C:\Windows\SysWOW64\Ieknpb32.exe
Size 320KB
SHA256 89942acf7e11edceb29d806bd9168e7f87c26c70b17e7e91a9f959636a06ef04
MD5 5dad9ce7e8b909163c1c20a372023d04
SHA1 866834b53925d58e45895a911366fbab882cb09d
SHA512 153a225abeeb20a16c941c6809b9e8291d6018f6726dd14f8fd45e7626183708ade16081cd77da2a115675ecedf415c37f7134f5d9b49e4255ccdf640cf9e26c
SSDEEP 3072:vaNIqwfmYKwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:QwfmYKV/Ah1G/AcQ///NR5fn
TLSH
T13F642F1BA67409EADEED1BF5AC2249D95141E8F018F1E13E6123DFDCD8E4DA6C909F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ilqmam32.exe

Path C:\Windows\SysWOW64\Ilqmam32.exe
Size 320KB
SHA256 7dbb9db513e7b99c2be54276c1df92fa74268dbc12af98997a340214a2583c32
MD5 4be7bf418594c8c6537c92d7c8a6903b
SHA1 612b65bcdb7128566a5fee4721073c0a8f815d8d
SHA512 0ca03b33a266e669e295166a64ef0fab27a82f8d849f9a7590ffe9bf33b5a1d7753d1bfa3a62b78064fa855a89a2d2b0f7e459a0b7fcfda985f4891b4dc29f1d
SSDEEP 3072:0/I3CpG8wRpwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:0g3CgFRpV/Ah1G/AcQ///NR5fn
TLSH
T19F64321916340AEACEEE2FB5AD024AD89142F8F114F5E13E9123DFDCD8E4D62D919F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jcfejfag.exe

Path C:\Windows\SysWOW64\Jcfejfag.exe
Size 320KB
SHA256 dc9d25a922ad887af12ed9e60843c4129700c773c2e9dd77558f46164e2bff63
MD5 e92f8131967acfe78fbb614fec101e1b
SHA1 ace6d9b3bc16bfda8ec589c77861f2d6540aea47
SHA512 c8d888fe6e89320590c8ed59c451a3d510f08422305d76fc1296975a7540c6b5f4988ae7e80da2d7826ba1c3b509c9ac59c80a9b6c97a5193a654d6d43d6faa5
SSDEEP 3072:mkgiBNJDB1uxRQoC2Me7c4NVwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:mkgIexRlMe7cYVV/Ah1G/AcQ///NR5fn
TLSH
T12564301A263009EADDED1BB5EC1249DC9191E5F118F1E13EA127DFECD8E4DA2C849F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jcknee32.exe

Path C:\Windows\SysWOW64\Jcknee32.exe
Size 320KB
SHA256 377a91cb60862e5640705dd3ab2a0f9e5e90176bb4fb49daf79b9525ea027e84
MD5 cee5d90284d46ece67fb9d12675ce932
SHA1 862773da6207025922a19f846761f06ab553c19e
SHA512 34ea1d89863dfff600056cbf2debe26391425e34355bf2859d3c0bda0f05545b06bb0500ab054a0871d6635717c2f0bb50d64d41b2862261c44ade1f77977319
SSDEEP 3072:ILbgzooD9tIJ1hxewS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:IvgcJleV/Ah1G/AcQ///NR5fn
TLSH
T1136430192AB409EACEED1FB5AC0249D89145E9F414F1F13E6163DFDCD8E4EA6C809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jcmkjeko.exe

Path C:\Windows\SysWOW64\Jcmkjeko.exe
Size 320KB
SHA256 c9d2d90d46ca92b5c9f7fbff29fb77bd6f82096af1ad92593a5360289c3b20f7
MD5 395a2abd7f92ce4c7ae89e159f65c074
SHA1 9719cf88b42b2bbeb99f19dd2933e7a99051837a
SHA512 35a1c0ad86a1d3e1965b2507f571ee181aea9e05632bf066b2954127644190cf53453bc839e042a2780e0dd3cd7cb4ec6a1b6a15909faedffb89e210cc38e209
SSDEEP 3072:O2/jliUs4ErwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:dieErV/Ah1G/AcQ///NR5fn
TLSH
T1C8642F1A263449EADEED1BB5AC0269D85141F9F014F1E23E6123DFDCD8E5DA3D818F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jhejgl32.exe

Path C:\Windows\SysWOW64\Jhejgl32.exe
Size 320KB
SHA256 e88bda0863d25754ec45fbfeb5227b5ac0d502efa71e5209b7a94975159df872
MD5 e4e890fb6ffdaa63dbfaf42a31e7271f
SHA1 1491c40bc3d28b9983c0b3a9f06d9bda11d8d334
SHA512 4bb1426739cee19d257ed99482e043d0444c280f223a6d7ca750d96ee4e4f5cb1957d5efd9e45f66a79593d17266cede30fe3daab9904472c0555c0592eb980e
SSDEEP 3072:eQ5WoLM8nQ7gFktvAOGwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:bWoLM8QuDRV/Ah1G/AcQ///NR5fn
TLSH
T1D264301A1A7209EACEED1FB5AD1249D85141E9F055F1E13FA523DFECC8E4DA2C909F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jhqqlmba.exe

Path C:\Windows\SysWOW64\Jhqqlmba.exe
Size 320KB
SHA256 05b76c42aaf57ef5a51a82b114071399c031087452305182b5c1429f06148c46
MD5 5eab9b63d35c89763f117e9a8c4d10c7
SHA1 45d1c776dd58d5dc153586baca59d429d64ab527
SHA512 dafc70069b3d801a8c3268e300f732c37cacbe00ead5eb4641d5bdac5f55fefa587ed69c8754b8eea637bee16ded70efcdda0ae32a2577fc1b6b00d980dbcf4e
SSDEEP 3072:lYsMBpnwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:lYsspnV/Ah1G/AcQ///NR5fn
TLSH
T10964FE191A380AEACEED1BB5AC1249DC5141E8F014F1E13F6923DFDCD8E4EA6E815F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jkhpogij.exe

Path C:\Windows\SysWOW64\Jkhpogij.exe
Size 320KB
SHA256 2c239cbf775ffad4ce05390c8411400e6111558f2e8a16368b9cc150b611c6ba
MD5 28c887f34edbf70abe35e61a9cc98ce5
SHA1 1f6492374d9b4ed83cc0061f0faca8e872ef1f00
SHA512 da1805c031697226fbf664ba5cebaf50f5efef5946591699301b4baac1260ea63ed756f6eb33a9c02ca76714a31409dba8da43dd860587328ce962964c5feb0f
SSDEEP 6144:xLnU8y3volrLJlZ07V/Ah1G/AcQ///NR5fn:hnU8y3volrLJlz/Nv
TLSH
T1DB64D9196A3809FACDED1BB5AD524DD89181E9F014F1E13E61339FDCD8E4EA2C819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kbgafqla.exe

Path C:\Windows\SysWOW64\Kbgafqla.exe
Size 320KB
SHA256 a1b9d5a39d9afdc8f19f155c465d78ec11512cbf583f2526565b8a46ceea58a1
MD5 027009eab3a8d26b6d6cfdd659bf79fd
SHA1 37a5db1a6391ac66bf483fcfd05e3b6e5957c2a3
SHA512 7a579c5e8ebb584f34a13ea5e6a41f21884a83044e61fcc11f7392aaf832a297579a9468be63230397278534c9dac5032df9f7ba8c52ad74025e81c86ad4a7d4
SSDEEP 3072:+arV0gMeTmENtSMESwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:+ar99NtdESV/Ah1G/AcQ///NR5fn
TLSH
T151641F5A263809EACEED1BB6AC1249D99141FAF014F1E13E6123DFDCD8F4DA2D805F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kiomnk32.exe

Path C:\Windows\SysWOW64\Kiomnk32.exe
Size 320KB
SHA256 85ab571a4d766881936498ebc049de02a410fd86f32641d1a78caeaee2047bcd
MD5 5a8a2101a75c68f041053ec245bb12fb
SHA1 a852d13e8d169ad1a4833286c8f4ca1212b0fcca
SHA512 3908af8cc56a253229ba0689d7d1275cca3dcf6940d4ea2045f2a3f0c2e56d83f823a06e1c410ed82f77691cce036f8a6b15e300d76a1a51c09e4257d58da4b4
SSDEEP 3072:yXRMJtytTN+5GrHwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:yXNC5GrHV/Ah1G/AcQ///NR5fn
TLSH
T10464515A26304AEACDED1FB5AC1249D85141E9F164F1E23F6A23DFDDC8E4DA2C805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kmaooihb.exe

Path C:\Windows\SysWOW64\Kmaooihb.exe
Size 320KB
SHA256 b3499a41cd4c0835238022df52ff2c3f14345d0029e6f56af250650a27d6ce77
MD5 9e175a302331ec03a9c306a5527809e0
SHA1 80d65a54cef823f5a364e958fde87f3084c41915
SHA512 1875226aa6f66963ce92a6eeaeeeb797a3a1a51bc31be7cdc21349752cec3200e5dbdc1f3f00dd0846b1008dd34b133da6c227f8e7d31b74f19e00b23e115ba1
SSDEEP 3072:FsYtcaa/Ym1wxKwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:F3caaT1wxKV/Ah1G/AcQ///NR5fn
TLSH
T1A66441196A3409EACEED1FB5AD0349DA5181E9F054F2E13E6223DFDCC8E4DA2C855F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kmobii32.exe

Path C:\Windows\SysWOW64\Kmobii32.exe
Size 320KB
SHA256 bf450ecec9e82cd2f87037b9f4442396a25a68a0d906ed9768b2bd7fd02bd36b
MD5 f9e8dd7b776a0b8bdabd6dfe6989104c
SHA1 336f1a295f4b228cfd9ef5e3fbc5b023bbff971d
SHA512 6851ceeed21137feb73f2a701324e16154f4c1d2edbbf690f9b78d032b5294fa647e0baf2b856426883b6ece003d673ad8962800682b98efbc91c8c08cd2e596
SSDEEP 3072:IXeqb9E2IX9FutmawS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:h2xtmaV/Ah1G/AcQ///NR5fn
TLSH
T16364311A2A3409EACDED1FB5AC1289D89141E9F014F1E13E6127DFDCDCE4DA6C899F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ljglnmdi.exe

Path C:\Windows\SysWOW64\Ljglnmdi.exe
Size 320KB
SHA256 3a80c2c4d57a091ad78a0b1b93c87200d17c1e4b91126908fb8b69266e51e990
MD5 3a534bbe22a7b534745197fde92dff4b
SHA1 0262332dfe3ea89fcd7cb3785ec38bff993f0bb5
SHA512 62cc13d31ee95dd9f7a87ba003b7841ba60761c96c04839774eb4b888f59dbfec37685a52021d923de74883c55a760a47c47afec79364150719c4f9b3164d5bd
SSDEEP 3072:xuItsH1YYTQwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:xuIU1YYTQV/Ah1G/AcQ///NR5fn
TLSH
T14C64E91A2A3009EAEDED5BB5BC5249D89181F8F014F1E13E65339FDDC8E4DA6C825F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ljjicl32.exe

Path C:\Windows\SysWOW64\Ljjicl32.exe
Size 320KB
SHA256 a52f90ebf739c0ca8ccb1a981154f7e612a2a5f5d82bd8b1163ca46834f6666f
MD5 aec2859a736460b7b0e757f0062b2706
SHA1 0e45d69c3db16277a68d3e179e5e37b2ebe26811
SHA512 b513fb4068b6c06d7fd2ba5eabacbde99393830be22dbc19630ea234a033406173c505f8e6b4e14d44b108c91c226c8d7161a9e6a08d5ba349ee75742dc02aba
SSDEEP 3072:rLVVXya1vDwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:rhEa1vDV/Ah1G/AcQ///NR5fn
TLSH
T1DB641D192A3009EACEED1BB5AD1389D8A151E9F014F1E53E6523DFDCD8E4DA2CC19F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lkflpe32.exe

Path C:\Windows\SysWOW64\Lkflpe32.exe
Size 320KB
SHA256 7770b385a4e948b609d5e2874fc921078739aa7f0c827829f15931bf998bccb1
MD5 a350cb04bd146f215f6a773a1454f5a1
SHA1 6be27ada5c6c1653c66eaf060fda707968f1148c
SHA512 fc62314f5d2a089e34caa483d3c3be284749ef1e01c723d691b0d7060908f27ff6e426942ea6e91366c6bd86529edb87d3e566f1993861e73398a4c7a3271a99
SSDEEP 3072:1CvSPNZjvwVwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:6SPNZjIVV/Ah1G/AcQ///NR5fn
TLSH
T10C6420191A3009EACEED1FB5AD1249D99182E9F124F1E13E6523DFDEC8E4DB6C814F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lpinac32.exe

Path C:\Windows\SysWOW64\Lpinac32.exe
Size 320KB
SHA256 3710da2e604c53a5bd3c5b80db93cab1144dc0df7282067f0fd998c5d9ab74e3
MD5 a0fbde37363a525f0d73a81f153af714
SHA1 a61d8de2ed6b8b442549959514ed7f1c7b488eb7
SHA512 e22b032d8fe9af3792407eab071763573cf95ff149325b9b453eac2e83415c10c677fa281298c3b2417a91b868cb9affcc4d54213a838bed1fb356091a035446
SSDEEP 3072:4OsWWOwN+S/IwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:wJ+uIV/Ah1G/AcQ///NR5fn
TLSH
T1E4642D19663449EACEED1BF5AC1249D89189E9F014F1E13EA123DFDCD8F8DA2D805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mbamcm32.exe

Path C:\Windows\SysWOW64\Mbamcm32.exe
Size 320KB
SHA256 22a019b8bd01f59b98b036f9e156390d87d34ce6874add3591aabe0be98d0e5e
MD5 220944d16e214973992c22f4fa51d39a
SHA1 540a58363dfbec4c9be157675fe978804f3641b2
SHA512 c0a71b42e61a2be1cbe23e13dfb77d7efc90d839522297a04cbec3b288e1a26162254f1c788ed7ae902ef38a6fda5fdcbed7e226f3f1f131ac5779537f3033a6
SSDEEP 3072:e+FudLGU5k3blwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:DFudLA3blV/Ah1G/AcQ///NR5fn
TLSH
T189642E196A7009EADEED5FB9ED0249D89141E8F014F1E23E6923DFDCD8E4DA6D805F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mboqnm32.exe

Path C:\Windows\SysWOW64\Mboqnm32.exe
Size 320KB
SHA256 160c19a67f479a7925da2dd810219d1d01a29121b0cc7a25a762e190bdb9b945
MD5 3b204a7d4ee3850698c65b9093769a90
SHA1 01f19922589b313cfa28000fcc1f20b00aef2088
SHA512 530c3f32253a558348230967b9906fff7399f24af58d049cd364dba28c53fbd4c0fc205b9a9e61844196fa477abf477bcece3c98ad222124666def5c15738d0c
SSDEEP 3072:vl1Gz1QlDLALYQWwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:vl1u1QlDELpWV/Ah1G/AcQ///NR5fn
TLSH
T109640C192A3489EACDED1BB5EC0249D85141E9F018F1F13EA123DFDCD8E5DA6D825F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mfhpilbc.exe

Path C:\Windows\SysWOW64\Mfhpilbc.exe
Size 320KB
SHA256 3cf3597acbf74aede3c32c056b4eca94c6354c98b2edb4ffdf2443ed343f50d6
MD5 14912866d49429d28bbeec579d8bc243
SHA1 0ac0201333c5bbaa9f66a8dce1a9128916cd40b7
SHA512 a8991ed7c42a006668aa27a360f6f8818997ddfe10c7ef1cd797d79514028973feb2784f63320512476194126ab46860965dbf204097750803e919ec49d438e4
SSDEEP 3072:GVZoCj+LUiutz6eLTRvqxwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:GVZoCj+CEET8xV/Ah1G/AcQ///NR5fn
TLSH
T183640E19263409FACDED6BB6BC1249D8A151E8F015F5E13E6123DFDCD8E6DA6C808F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mjaodkmo.exe

Path C:\Windows\SysWOW64\Mjaodkmo.exe
Size 320KB
SHA256 64bdfe01e113dceda90a2b19720fc265012f9679e1e200b7169235cef4913875
MD5 798dafad699d733b6b09a44bbdcbe76d
SHA1 4e95355642265f6fca146a8f6b3d34ae23bff534
SHA512 887786a76663b143b721f7c0f4e01864894f391c889bc53edf3d649daa0944ef36e92bb8942043036cb7b1f611f5af486c66f606a1c63ea53af7fb707f4a145c
SSDEEP 3072:IAWl2AHohOVMB76wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:IAWUAIkVG6V/Ah1G/AcQ///NR5fn
TLSH
T11C641D1A663409FACEEE1BB5AC0A49E85141E9F055F5E13E6133DFDCC8E8DA2D805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mlbllc32.exe

Path C:\Windows\SysWOW64\Mlbllc32.exe
Size 320KB
SHA256 fda5956921d5f171664b0c9a64adc4eccda3fe6dbabd3405dd74e22307da08db
MD5 e07bd5772be75ea21c5ed1874bbda2ea
SHA1 80457e28a3fd0c7621eef7bf11710e60053b83d6
SHA512 b1233db35746ac201cdb2e5e9598f050081a3bbff9a58337a1942dda1337d40a04f50b6bec4e13ddcdf5c599609b08e6077867c16733d6f84ec683cbebed2515
SSDEEP 3072:4f8j/VRry0qYYfTBWnRBwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:4f8/VRQNfTUBV/Ah1G/AcQ///NR5fn
TLSH
T17A641D2A267409EACEED2FB5AC124DD89141EAF014F5E13E6523DFDCD8E4DA2C805F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mmahff32.exe

Path C:\Windows\SysWOW64\Mmahff32.exe
Size 320KB
SHA256 b7cffb7896fd321f828245b83a5e58fef7d5d05fd1ff3566e52c379d87bad7d3
MD5 2cda79640f00adc5d870ac5642130394
SHA1 46d79cf92141b303fed90b14ba6fc10e5fb6232d
SHA512 20d5407c7bf01ff26eeabaff89884ca2f2ca8b54b6cb588c3e91bc34e7b53496f9757b7249b67713c926ad16fb16d5581558230056631252f0f6b1e6f9b8c8c9
SSDEEP 3072:O0vKe4/EpSThxLkDoZnxtwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:hie4/EonLgIxtV/Ah1G/AcQ///NR5fn
TLSH
T18E642F2A26300DEAEEED1FB5AC1249D89541EAF014F1E13E6123DFDCD8E5DA2D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mmdekf32.exe

Path C:\Windows\SysWOW64\Mmdekf32.exe
Size 320KB
SHA256 917639ed1af235faa59d6ccb2905fc6b3cf0347a6fc8d6b964dc5742c3cca91f
MD5 aabf081af2497992c95f0e19f5db1384
SHA1 1d423c404325f615397ac64149585be919a0f2b3
SHA512 7221af1b562e1f1db6b45fb80368ccb47b0c31e80d88bcc48b8161285ccc7cef977e48322e28a43210a15bf1d92decbb229e1f0f7479c1ad5a2c1d51381b840f
SSDEEP 3072:Lah9qs3ZwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:LaGuZV/Ah1G/AcQ///NR5fn
TLSH
T14664EB1926340DEACEED1FB5AC2249D89185E9F114F2E17E6223DFDCD8E4DA6C805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mpkkgbmi.exe

Path C:\Windows\SysWOW64\Mpkkgbmi.exe
Size 320KB
SHA256 0bd8e4c3e1c0a1d92207284da2900a236e2f87a0e811008b77869de469717ad8
MD5 34666d16c126db7e10fa0b1abf6125ff
SHA1 373e6d4396e800f68f1084b7099ab155d4dbaec2
SHA512 2aca3a14d32d198b8221ed836b1b0838df80dea55d3508771add1297f41d89a910807f023432a4b22169b162ce1cb89e9ed1e305d1e122e5fe93619a5ddc7669
SSDEEP 3072:KTnNE91rqGyU/srPwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:onN+prkrPV/Ah1G/AcQ///NR5fn
TLSH
T1F4640E1A2A3009EACEED1FF5AC125AD89141E9F014F5E13EA123DFDCD8E4DA6D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/124-326-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/124-119-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/724-288-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/724-250-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/972-336-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/972-84-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1088-260-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1088-283-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1816-342-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1816-64-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1996-203-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1996-302-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2188-210-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2188-300-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2384-361-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2384-217-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2564-281-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2564-265-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2576-156-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2576-316-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2624-196-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2624-304-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2676-285-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2676-255-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2692-224-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2692-297-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2864-320-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2864-140-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2984-328-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2984-112-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3104-352-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3104-28-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3276-42-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3276-348-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3296-325-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3296-126-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3392-293-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3392-240-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3444-339-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3444-77-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3496-308-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3496-182-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3540-275-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3540-279-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3548-322-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3548-133-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4056-330-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4056-105-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4072-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4072-1-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/4072-360-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4148-356-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4148-14-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4212-318-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4212-147-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4356-295-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4356-230-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4532-332-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4532-98-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4560-340-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4560-70-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4592-91-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4592-334-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4740-7-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4740-359-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4944-310-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4944-175-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5068-189-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5068-306-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5208-35-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5208-350-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5416-245-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5416-289-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5452-314-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5452-161-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5508-270-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5508-278-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5652-168-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5652-312-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5744-354-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5744-21-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5844-50-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5844-346-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5956-56-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5956-344-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5996-291-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5996-235-0x0000000000400000-0x000000000046D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads