berbew | 04c5980efd102de067943d3eb7b980175d2cc44f9b28e0f6add754fc3d2c9f4c

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 14:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_d4443f63cbd7afa4c8ef44810290f08e_elex_wannacry.exe
Size 320KB
Sample260720-rfkfwaew5s
SHA256 04c5980efd102de067943d3eb7b980175d2cc44f9b28e0f6add754fc3d2c9f4c
MD5 d4443f63cbd7afa4c8ef44810290f08e
SHA1 c38696dbbcbd5ea9769a0783f9853ef5530ba4a3
SHA512 37446fd8b1df2787ec87d96aa5944cec680852f23b6af7f5fc05db71fa6282ad9493bafb5769e693816ecad39f562127b195a5a00075d010fe07f7418d3e4b4e
SSDEEP 3072:90QKIehobOntoYFkBtrYwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:90Q1ehoGtoGAYV/Ah1G/AcQ///NR5fn
TLSH
T1A7640029263409EACEED1BB5AD0249D85241F9F028F2E17E6123DFDCD8E4DA6CC15F91
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbbldp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	2026-07-20_d4443f63cbd7afa4c8ef44810290f08e_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gplbcgbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hcjkje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iandjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgnbol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kafcadej.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lhkkjl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnpcjplf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laofhbmp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnojcb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmbpbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iplkje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifipmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jgbccm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdfmcobk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Niqnli32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ggoaje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kolaqh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lonnfg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ninafj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gceaofmc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hhojqcil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipohpdbb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipohpdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ggoaje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hcjkje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iffcgoka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgceqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mhgkfkhl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipjoee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jaekkfcm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lonnfg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Laofhbmp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnimia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnkioq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipjoee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hmginjki.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iandjg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgnbol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lhkkjl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgceqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbbldp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oapllk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ifipmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hmbpbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gplbcgbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hhojqcil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnojcb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnaghb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mhgkfkhl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nojfic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jhapmphg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdfmcobk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laacmbkm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnimia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ninafj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Niqnli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnpcjplf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oapllk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gceaofmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Igkmbn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nojfic32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmginjki.exe

Executes dropped EXE 38 IoCs

pid	Process
1364	Ggoaje32.exe
3344	Gceaofmc.exe
4108	Gplbcgbg.exe
4068	Hcjkje32.exe
2916	Hmbpbk32.exe
6060	Hmginjki.exe
2424	Hhojqcil.exe
5492	Ipjoee32.exe
2104	Iplkje32.exe
2340	Iffcgoka.exe
4416	Ipohpdbb.exe
5900	Ifipmo32.exe
2860	Iandjg32.exe
4144	Igkmbn32.exe
4808	Jaekkfcm.exe
240	Jgbccm32.exe
2732	Jhapmphg.exe
5856	Kgnbol32.exe
2516	Kafcadej.exe
4528	Kdfmcobk.exe
1224	Kolaqh32.exe
5432	Lonnfg32.exe
6112	Laofhbmp.exe
4848	Laacmbkm.exe
1408	Lhkkjl32.exe
1152	Mgceqh32.exe
4700	Mnojcb32.exe
1172	Mnaghb32.exe
472	Mhgkfkhl.exe
5332	Nbbldp32.exe
3532	Nnimia32.exe
5460	Ninafj32.exe
3460	Nnkioq32.exe
4732	Niqnli32.exe
5996	Nojfic32.exe
2500	Nnpcjplf.exe
1264	Oapllk32.exe
3444	Okfpid32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ggoaje32.exe	2026-07-20_d4443f63cbd7afa4c8ef44810290f08e_elex_wannacry.exe
File created	C:\Windows\SysWOW64\Hmbpbk32.exe	Hcjkje32.exe
File created	C:\Windows\SysWOW64\Jhapmphg.exe	Jgbccm32.exe
File created	C:\Windows\SysWOW64\Mgceqh32.exe	Lhkkjl32.exe
File created	C:\Windows\SysWOW64\Ginjpq32.dll	Nnpcjplf.exe
File opened for modification	C:\Windows\SysWOW64\Ipohpdbb.exe	Iffcgoka.exe
File created	C:\Windows\SysWOW64\Piifki32.dll	Ifipmo32.exe
File created	C:\Windows\SysWOW64\Kafcadej.exe	Kgnbol32.exe
File created	C:\Windows\SysWOW64\Qgpkkf32.dll	Laofhbmp.exe
File created	C:\Windows\SysWOW64\Bcflcnam.dll	2026-07-20_d4443f63cbd7afa4c8ef44810290f08e_elex_wannacry.exe
File created	C:\Windows\SysWOW64\Mcfqjihp.dll	Gplbcgbg.exe
File opened for modification	C:\Windows\SysWOW64\Ifipmo32.exe	Ipohpdbb.exe
File created	C:\Windows\SysWOW64\Igkmbn32.exe	Iandjg32.exe
File created	C:\Windows\SysWOW64\Kgnbol32.exe	Jhapmphg.exe
File created	C:\Windows\SysWOW64\Icpnjl32.dll	Nbbldp32.exe
File opened for modification	C:\Windows\SysWOW64\Gceaofmc.exe	Ggoaje32.exe
File created	C:\Windows\SysWOW64\Ddifbphg.dll	Iffcgoka.exe
File created	C:\Windows\SysWOW64\Caikpked.dll	Igkmbn32.exe
File created	C:\Windows\SysWOW64\Nnimia32.exe	Nbbldp32.exe
File opened for modification	C:\Windows\SysWOW64\Nnimia32.exe	Nbbldp32.exe
File opened for modification	C:\Windows\SysWOW64\Gplbcgbg.exe	Gceaofmc.exe
File created	C:\Windows\SysWOW64\Ipjoee32.exe	Hhojqcil.exe
File opened for modification	C:\Windows\SysWOW64\Laacmbkm.exe	Laofhbmp.exe
File created	C:\Windows\SysWOW64\Oapllk32.exe	Nnpcjplf.exe
File created	C:\Windows\SysWOW64\Nbbldp32.exe	Mhgkfkhl.exe
File created	C:\Windows\SysWOW64\Lfmbjg32.dll	Hhojqcil.exe
File opened for modification	C:\Windows\SysWOW64\Ipjoee32.exe	Hhojqcil.exe
File created	C:\Windows\SysWOW64\Ifipmo32.exe	Ipohpdbb.exe
File created	C:\Windows\SysWOW64\Cqhiiapq.dll	Hmginjki.exe
File created	C:\Windows\SysWOW64\Iplkje32.exe	Ipjoee32.exe
File created	C:\Windows\SysWOW64\Ndjcpigg.dll	Laacmbkm.exe
File created	C:\Windows\SysWOW64\Niqnli32.exe	Nnkioq32.exe
File created	C:\Windows\SysWOW64\Edfaonkb.dll	Niqnli32.exe
File opened for modification	C:\Windows\SysWOW64\Nojfic32.exe	Niqnli32.exe
File opened for modification	C:\Windows\SysWOW64\Oapllk32.exe	Nnpcjplf.exe
File opened for modification	C:\Windows\SysWOW64\Okfpid32.exe	Oapllk32.exe
File opened for modification	C:\Windows\SysWOW64\Ggoaje32.exe	2026-07-20_d4443f63cbd7afa4c8ef44810290f08e_elex_wannacry.exe
File created	C:\Windows\SysWOW64\Hhojqcil.exe	Hmginjki.exe
File created	C:\Windows\SysWOW64\Jgbccm32.exe	Jaekkfcm.exe
File created	C:\Windows\SysWOW64\Eoeeekec.dll	Kafcadej.exe
File created	C:\Windows\SysWOW64\Fkngbb32.dll	Ggoaje32.exe
File created	C:\Windows\SysWOW64\Jaekkfcm.exe	Igkmbn32.exe
File opened for modification	C:\Windows\SysWOW64\Mnojcb32.exe	Mgceqh32.exe
File created	C:\Windows\SysWOW64\Nnpcjplf.exe	Nojfic32.exe
File opened for modification	C:\Windows\SysWOW64\Nnpcjplf.exe	Nojfic32.exe
File opened for modification	C:\Windows\SysWOW64\Laofhbmp.exe	Lonnfg32.exe
File created	C:\Windows\SysWOW64\Laacmbkm.exe	Laofhbmp.exe
File created	C:\Windows\SysWOW64\Hdphjchg.dll	Lhkkjl32.exe
File opened for modification	C:\Windows\SysWOW64\Mhgkfkhl.exe	Mnaghb32.exe
File opened for modification	C:\Windows\SysWOW64\Ninafj32.exe	Nnimia32.exe
File opened for modification	C:\Windows\SysWOW64\Niqnli32.exe	Nnkioq32.exe
File created	C:\Windows\SysWOW64\Iandjg32.exe	Ifipmo32.exe
File created	C:\Windows\SysWOW64\Ddeoah32.dll	Jhapmphg.exe
File created	C:\Windows\SysWOW64\Kolaqh32.exe	Kdfmcobk.exe
File created	C:\Windows\SysWOW64\Laofhbmp.exe	Lonnfg32.exe
File opened for modification	C:\Windows\SysWOW64\Lhkkjl32.exe	Laacmbkm.exe
File created	C:\Windows\SysWOW64\Jdahgq32.dll	Mgceqh32.exe
File created	C:\Windows\SysWOW64\Mhgkfkhl.exe	Mnaghb32.exe
File created	C:\Windows\SysWOW64\Ojhmipdl.dll	Nnimia32.exe
File opened for modification	C:\Windows\SysWOW64\Jhapmphg.exe	Jgbccm32.exe
File created	C:\Windows\SysWOW64\Gplbcgbg.exe	Gceaofmc.exe
File created	C:\Windows\SysWOW64\Ipohpdbb.exe	Iffcgoka.exe
File created	C:\Windows\SysWOW64\Odighm32.dll	Ipohpdbb.exe
File opened for modification	C:\Windows\SysWOW64\Hhojqcil.exe	Hmginjki.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4380	3444	WerFault.exe	126

System Location Discovery: System Language Discovery 1 TTPs 39 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mnojcb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipjoee32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipohpdbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lonnfg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnimia32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ninafj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnkioq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gplbcgbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iffcgoka.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ifipmo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iandjg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Laacmbkm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mnaghb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nojfic32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Okfpid32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hhojqcil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jgbccm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Laofhbmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmbpbk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Igkmbn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdfmcobk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lhkkjl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgceqh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nbbldp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_d4443f63cbd7afa4c8ef44810290f08e_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hcjkje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iplkje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jaekkfcm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jhapmphg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kolaqh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ggoaje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmginjki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Niqnli32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnpcjplf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kgnbol32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kafcadej.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mhgkfkhl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oapllk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gceaofmc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oapllk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Laacmbkm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdahgq32.dll"	Mgceqh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mnaghb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojhmipdl.dll"	Nnimia32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ifipmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlhhjg32.dll"	Kdfmcobk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnimia32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ninafj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbcbcc32.dll"	Hcjkje32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hmbpbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddeoah32.dll"	Jhapmphg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eoeeekec.dll"	Kafcadej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kolaqh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jaekkfcm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ggoaje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hmginjki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iplkje32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ipohpdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kdfmcobk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hhojqcil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chbbfgah.dll"	Ipjoee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jhapmphg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lonnfg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgceqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mhgkfkhl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkngbb32.dll"	Ggoaje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Igkmbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odejmglm.dll"	Jgbccm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Niqnli32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lhkkjl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ipjoee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Caikpked.dll"	Igkmbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ninafj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cqhiiapq.dll"	Hmginjki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfmbjg32.dll"	Hhojqcil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cegjdgdl.dll"	Iplkje32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iffcgoka.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kolaqh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnpcjplf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dkcfca32.dll"	Mnojcb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdelid32.dll"	Nnkioq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Niqnli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hhojqcil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Piifki32.dll"	Ifipmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jaekkfcm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgceqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nbbldp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jahbefmn.dll"	Nojfic32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oapllk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lonnfg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldibcl32.dll"	Lonnfg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gplbcgbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	2026-07-20_d4443f63cbd7afa4c8ef44810290f08e_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iplkje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Edfaonkb.dll"	Niqnli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckpfqdce.dll"	Gceaofmc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mhgkfkhl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ginjpq32.dll"	Nnpcjplf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mnojcb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nbbldp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	2026-07-20_d4443f63cbd7afa4c8ef44810290f08e_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iffcgoka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ifipmo32.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 1364	1064	2026-07-20_d4443f63cbd7afa4c8ef44810290f08e_elex_wannacry.exe	89
PID 1364 wrote to memory of 3344	1364	Ggoaje32.exe	90
PID 3344 wrote to memory of 4108	3344	Gceaofmc.exe	91
PID 4108 wrote to memory of 4068	4108	Gplbcgbg.exe	92
PID 4068 wrote to memory of 2916	4068	Hcjkje32.exe	93
PID 2916 wrote to memory of 6060	2916	Hmbpbk32.exe	94
PID 6060 wrote to memory of 2424	6060	Hmginjki.exe	95
PID 2424 wrote to memory of 5492	2424	Hhojqcil.exe	96
PID 5492 wrote to memory of 2104	5492	Ipjoee32.exe	97
PID 2104 wrote to memory of 2340	2104	Iplkje32.exe	98
PID 2340 wrote to memory of 4416	2340	Iffcgoka.exe	99
PID 4416 wrote to memory of 5900	4416	Ipohpdbb.exe	100
PID 5900 wrote to memory of 2860	5900	Ifipmo32.exe	101
PID 2860 wrote to memory of 4144	2860	Iandjg32.exe	102
PID 4144 wrote to memory of 4808	4144	Igkmbn32.exe	103
PID 4808 wrote to memory of 240	4808	Jaekkfcm.exe	104
PID 240 wrote to memory of 2732	240	Jgbccm32.exe	105
PID 2732 wrote to memory of 5856	2732	Jhapmphg.exe	106
PID 5856 wrote to memory of 2516	5856	Kgnbol32.exe	107
PID 2516 wrote to memory of 4528	2516	Kafcadej.exe	108
PID 4528 wrote to memory of 1224	4528	Kdfmcobk.exe	109
PID 1224 wrote to memory of 5432	1224	Kolaqh32.exe	110
PID 5432 wrote to memory of 6112	5432	Lonnfg32.exe	111
PID 6112 wrote to memory of 4848	6112	Laofhbmp.exe	112
PID 4848 wrote to memory of 1408	4848	Laacmbkm.exe	113
PID 1408 wrote to memory of 1152	1408	Lhkkjl32.exe	114
PID 1152 wrote to memory of 4700	1152	Mgceqh32.exe	115
PID 4700 wrote to memory of 1172	4700	Mnojcb32.exe	116
PID 1172 wrote to memory of 472	1172	Mnaghb32.exe	117
PID 472 wrote to memory of 5332	472	Mhgkfkhl.exe	118
PID 5332 wrote to memory of 3532	5332	Nbbldp32.exe	119
PID 3532 wrote to memory of 5460	3532	Nnimia32.exe	120
PID 5460 wrote to memory of 3460	5460	Ninafj32.exe	121
PID 3460 wrote to memory of 4732	3460	Nnkioq32.exe	122
PID 4732 wrote to memory of 5996	4732	Niqnli32.exe	123
PID 5996 wrote to memory of 2500	5996	Nojfic32.exe	124
PID 2500 wrote to memory of 1264	2500	Nnpcjplf.exe	125
PID 1264 wrote to memory of 3444	1264	Oapllk32.exe	126

C:\Users\Admin\AppData\Local\Temp\2026-07-20_d4443f63cbd7afa4c8ef44810290f08e_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_d4443f63cbd7afa4c8ef44810290f08e_elex_wannacry.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\SysWOW64\Ggoaje32.exe
  C:\Windows\system32\Ggoaje32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Windows\SysWOW64\Gceaofmc.exe
    C:\Windows\system32\Gceaofmc.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3344
  - - C:\Windows\SysWOW64\Gplbcgbg.exe
      C:\Windows\system32\Gplbcgbg.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4108
    - - C:\Windows\SysWOW64\Hcjkje32.exe
        
        C:\Windows\system32\Hcjkje32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4068
      - C:\Windows\SysWOW64\Hmbpbk32.exe
        
        C:\Windows\system32\Hmbpbk32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2916
        
        C:\Windows\SysWOW64\Hmginjki.exe
        
        C:\Windows\system32\Hmginjki.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:6060
        
        C:\Windows\SysWOW64\Hhojqcil.exe
        
        C:\Windows\system32\Hhojqcil.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2424
        
        C:\Windows\SysWOW64\Ipjoee32.exe
        
        C:\Windows\system32\Ipjoee32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5492
        
        C:\Windows\SysWOW64\Iplkje32.exe
        
        C:\Windows\system32\Iplkje32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2104
        
        C:\Windows\SysWOW64\Iffcgoka.exe
        
        C:\Windows\system32\Iffcgoka.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2340
        
        C:\Windows\SysWOW64\Ipohpdbb.exe
        
        C:\Windows\system32\Ipohpdbb.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4416
        
        C:\Windows\SysWOW64\Ifipmo32.exe
        
        C:\Windows\system32\Ifipmo32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5900
        
        C:\Windows\SysWOW64\Iandjg32.exe
        
        C:\Windows\system32\Iandjg32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2860
        
        C:\Windows\SysWOW64\Igkmbn32.exe
        
        C:\Windows\system32\Igkmbn32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4144
        
        C:\Windows\SysWOW64\Jaekkfcm.exe
        
        C:\Windows\system32\Jaekkfcm.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4808
        
        C:\Windows\SysWOW64\Jgbccm32.exe
        
        C:\Windows\system32\Jgbccm32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:240
        
        C:\Windows\SysWOW64\Jhapmphg.exe
        
        C:\Windows\system32\Jhapmphg.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2732
        
        C:\Windows\SysWOW64\Kgnbol32.exe
        
        C:\Windows\system32\Kgnbol32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5856
        
        C:\Windows\SysWOW64\Kafcadej.exe
        
        C:\Windows\system32\Kafcadej.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2516
        
        C:\Windows\SysWOW64\Kdfmcobk.exe
        
        C:\Windows\system32\Kdfmcobk.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4528
        
        C:\Windows\SysWOW64\Kolaqh32.exe
        
        C:\Windows\system32\Kolaqh32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1224
        
        C:\Windows\SysWOW64\Lonnfg32.exe
        
        C:\Windows\system32\Lonnfg32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5432
        
        C:\Windows\SysWOW64\Laofhbmp.exe
        
        C:\Windows\system32\Laofhbmp.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6112
        
        C:\Windows\SysWOW64\Laacmbkm.exe
        
        C:\Windows\system32\Laacmbkm.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4848
        
        C:\Windows\SysWOW64\Lhkkjl32.exe
        
        C:\Windows\system32\Lhkkjl32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1408
        
        C:\Windows\SysWOW64\Mgceqh32.exe
        
        C:\Windows\system32\Mgceqh32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1152
        
        C:\Windows\SysWOW64\Mnojcb32.exe
        
        C:\Windows\system32\Mnojcb32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4700
        
        C:\Windows\SysWOW64\Mnaghb32.exe
        
        C:\Windows\system32\Mnaghb32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1172
        
        C:\Windows\SysWOW64\Mhgkfkhl.exe
        
        C:\Windows\system32\Mhgkfkhl.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:472
        
        C:\Windows\SysWOW64\Nbbldp32.exe
        
        C:\Windows\system32\Nbbldp32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5332
        
        C:\Windows\SysWOW64\Nnimia32.exe
        
        C:\Windows\system32\Nnimia32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3532
        
        C:\Windows\SysWOW64\Ninafj32.exe
        
        C:\Windows\system32\Ninafj32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5460
        
        C:\Windows\SysWOW64\Nnkioq32.exe
        
        C:\Windows\system32\Nnkioq32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3460
        
        C:\Windows\SysWOW64\Niqnli32.exe
        
        C:\Windows\system32\Niqnli32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4732
        
        C:\Windows\SysWOW64\Nojfic32.exe
        
        C:\Windows\system32\Nojfic32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5996
        
        C:\Windows\SysWOW64\Nnpcjplf.exe
        
        C:\Windows\system32\Nnpcjplf.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2500
        
        C:\Windows\SysWOW64\Oapllk32.exe
        
        C:\Windows\system32\Oapllk32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1264
        
        C:\Windows\SysWOW64\Okfpid32.exe
        
        C:\Windows\system32\Okfpid32.exe
        39⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3444
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3444 -s 448
        40⤵
        Program crash
        
        PID:4380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3444 -ip 3444
1⤵
PID:5048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Gceaofmc.exe

Path C:\Windows\SysWOW64\Gceaofmc.exe
Size 320KB
SHA256 4a51bbfa88e27f9ee0d1186dd2f8b1e462a2293dcaaccb71d02f6ea338979da6
MD5 42523282c76dee97ed7697ca1a57adb3
SHA1 dc4938eea76b3e535ff67416e3435b844e80cc4d
SHA512 fb47472576a63fa4ed1898e4c8ec1dbab61a27ad9174a44eaf87d49f6b35b2654d07653afe4efe563bdd27e8bf3d1be8cee935f0b1c1769b8c4f088f7842c182
SSDEEP 3072:uxJGknZPsdktwg6NtGI4XwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:uXFAjGI4XV/Ah1G/AcQ///NR5fn
TLSH
T1FF64DA1A2A340AEACDFE1BB5AC2259DC5181E9B014F1E13E6123DFDDD8F4DA2D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ggoaje32.exe

Path C:\Windows\SysWOW64\Ggoaje32.exe
Size 320KB
SHA256 1b90ab5de3052b6edf1cce3bb24a0ba46867e990f8a069da9eb38ff45fd1dc9d
MD5 71d12579b322d319900eaa48d682f1ee
SHA1 378864e53b89df6104add21f8fa1b7c71b33f364
SHA512 c0837f9c9ef2b27080db2696755eb5f3f2f7a7826aa8ae981b5fc6707d93ec625432e5e641f381268d81ddf6294204c65392a68aee61a9db8b60bc67035ebfb5
SSDEEP 3072:dpsMVi8cTW0swS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:zPViVsV/Ah1G/AcQ///NR5fn
TLSH
T1B264311A2A340DEADDED1FB5AD1249D89191E9F014F1E13EA127DFDCC8E4DA2D808F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gplbcgbg.exe

Path C:\Windows\SysWOW64\Gplbcgbg.exe
Size 320KB
SHA256 dd99ec35217252e2854d3b69bf349eeb2dd749255276c9b4500a15e09cfadfaf
MD5 1ff5339dfc61b55ee4c19962a7c74681
SHA1 774df13ce4df94f6dcb98f1a6387543e058560df
SHA512 9bc09d95d94892916113a4d3afd25522e7ab3bfc503fa6d5200ff6e385161abd4576fe864a414fd965ced59a14f745970fe684f942ab8e4344f883dd2d51468e
SSDEEP 3072:Vsr/IjyhRNvzwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:UvxvzV/Ah1G/AcQ///NR5fn
TLSH
T16F643F1926344AEACEFD1BB5AC1249DC9181E8F015F1E13E6123DFECC8E5DAAC854F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hcjkje32.exe

Path C:\Windows\SysWOW64\Hcjkje32.exe
Size 320KB
SHA256 dac05a0bea067f560dd9e2b337b24ce1650e38dbab1cbe592f151bca2fc6b3b5
MD5 041829a358bf722a3857b84a1d2bc1ec
SHA1 1a01fb868ab5dbafe8509c32f5012ce4b30fc77b
SHA512 e7d9596bfe162e7105f7b9b76530756e220781d5ae8b5b7127dda4afebd427af831ff00cdf2b966e4bb1b6d12ed3f63b8f0df548fbe4c24d7609bf5f02575d6c
SSDEEP 3072:0qLaXtxuSzXwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:0dxuSzXV/Ah1G/AcQ///NR5fn
TLSH
T18E641D192A3409EACEED1BB5ED0249D89141E4F018F1E13E6127DFDCD8F4EA6E859F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hhojqcil.exe

Path C:\Windows\SysWOW64\Hhojqcil.exe
Size 320KB
SHA256 b437b943c18be8690315732f1b8da5329b412fec631f85285f25ba1f266a1bdc
MD5 7163e980a0019f8e27eb5789520fd7ab
SHA1 b18efccb163d1867742139e5e26ae95142697aa5
SHA512 5254755d96ab3e1ceb2b8a579a686023d8eb8148a7078c6f420da40f3228629180b34e27dd8868f7ea5e1304adae6ce296e3dcfcedebbe301047bb7b52b0cebb
SSDEEP 3072:3bxopKpzQAoeLVyP1ywS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:3b1zzoeLYP1yV/Ah1G/AcQ///NR5fn
TLSH
T109641019167009EACEEE5BB5EC1259D85181E8F014F1E13E6523DFECD8F4DA6C826F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hmbpbk32.exe

Path C:\Windows\SysWOW64\Hmbpbk32.exe
Size 320KB
SHA256 cd413f87e284c3a12062ccd650e54bc98adf561e1b4c87ed1aa50117c962d189
MD5 53377a90de2097d3cdeb0828440907f2
SHA1 6ff14c0dfbaa28155d8dedd31f31f8a51bb4d758
SHA512 010fe4b5b605e20b6e0374ed2c1bf42c932cfc67d4704ac782c7185f1cd3f7bf729f3b4f15c021157b159577e5aa09471247ce4904c23069c58b498cf9652dd8
SSDEEP 3072:c9h63t+PsSES1MlJwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:cKt+H7MlJV/Ah1G/AcQ///NR5fn
TLSH
T1E4642119167409EACEEE1BB5EC5259E85252E9F014F1E13E6123EFDDC8E4DA2CC05F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hmginjki.exe

Path C:\Windows\SysWOW64\Hmginjki.exe
Size 320KB
SHA256 69acc140f2968bb46d0c866f84f8288d6f3668a0e0e1168eb059abc66c433119
MD5 4e6cde36f642cf36f17cada2cdfc1521
SHA1 d79f3d896340a26834db3bdb21cf6974c8cd71a0
SHA512 e6f7d6a037d812df95a496d5dc1bb842cc0f067eee7fa0c84d14b066e6abfa215fec353fd3cc87120cba3188f2543b65693742496d391f007dbb86ea7d224d7e
SSDEEP 3072:X0npYyMaGZlI6mwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:XM03mV/Ah1G/AcQ///NR5fn
TLSH
T17F641119263409EACDED1BB6ED1249E85541E9F024F1E13E6123DFECE8E4DA2DC19F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Iandjg32.exe

Path C:\Windows\SysWOW64\Iandjg32.exe
Size 320KB
SHA256 e2b8cd2ea6d2fd831d47fe320bf7a6eaca2b0ef0e52095ffca5f25cac8917c2c
MD5 6b34637986774f573e763adfbe6aadb7
SHA1 f9abfbfcc2bb281141b57d6803161a2b87e029d7
SHA512 c1f215105f189289726545c3d095f3d448a7b61776ea9ffdfc4c5bb439854cd6762c8f56f7bb3b9f3e0bf90ba58f3c5c9611d2cca8bf04c4f2f26fa1d526e07b
SSDEEP 3072:EGcRBkJ6Nt0ytcEwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:EzkJGt0yOEV/Ah1G/AcQ///NR5fn
TLSH
T17E643E192A3419EACEEE1BF5AC0249D85541E8F015F1E13E6127DFDCD8E8EA2CC09F95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Iffcgoka.exe

Path C:\Windows\SysWOW64\Iffcgoka.exe
Size 320KB
SHA256 4cd4d4f3c7e1c36e5c51c279b17a83222dfe5265fc80d729b835a4e93934323c
MD5 64460884e1bf08ee9e1fcecefb1ec4fb
SHA1 1a175d9e6ea4c96c6128393d5e6a9a4209980e10
SHA512 8c5d76fd54734008cca783b34f10e5b8642146808313b0384381edd6056fafb817d80ea888ee3d5919d9d473b0e55f0dcc0e63ffe09d669401894186f1968127
SSDEEP 6144:mdtIS51PcqFMHF/8XxV/Ah1G/AcQ///NR5fn:mdtV52Fd/Nv
TLSH
T101640E1996340DEACDEE1BB5AC0689D85282E5F015F1E13E2523DFECE8E4DA6DC14F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ifipmo32.exe

Path C:\Windows\SysWOW64\Ifipmo32.exe
Size 320KB
SHA256 9508dc1e7b32090c667c1e95ab1741239b0b5a3f44794f8f55b673d06e2c4320
MD5 a28443f3b98d5455fb209bd30e98f0e5
SHA1 2ae965b2e6752ca5ebce1605bc9c225880978b39
SHA512 4fe8e95b521d4994f9f163b31ceb873f5c88839516eb87aefd2860decbad3af2383ae5c544c73a3d7f4488a3bda086c5d60db7ea4b321d2f9b8f545e27482211
SSDEEP 3072:f+KV+NbRCpdwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Gy+NVCpdV/Ah1G/AcQ///NR5fn
TLSH
T1BA641F1A5A3409EACDED2BB9BC0349D89159E9F014F1E13E6123DFDCD8E4DA6D809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Igkmbn32.exe

Path C:\Windows\SysWOW64\Igkmbn32.exe
Size 320KB
SHA256 00134aa0bf778329ffd1286c7ef2eec883dea3a7f13b3a68f9db013ec5a9181f
MD5 b83bf293b1b14d41626b38b2032b7376
SHA1 28996fbd932919a2b7e45da7f6ab7bbeb1501164
SHA512 7bf4aea7de77ab39f482159bdc3db73be625e42afb24c858efa51c84aa556072089189f7ffcaa0605ecca36af44aff43b5cef1755632ee7cf6b50398d2eb1beb
SSDEEP 3072:E3V4aA3Tu91Oss3lwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:G2DurOdlV/Ah1G/AcQ///NR5fn
TLSH
T12264C9192A7409EACEED6BF5EC124DD85181EAF014F1E13E61239FDCD8E4DA6D806F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ipjoee32.exe

Path C:\Windows\SysWOW64\Ipjoee32.exe
Size 320KB
SHA256 f26e083d07ec969d49ebd3dd755a0b734bc722f4f364e4211129a33a93760f51
MD5 a5ffe2ae4ea0bf1eb12b40e25d3b0860
SHA1 17f066c1853945d7fa29c1034bf07112f3293657
SHA512 d5360c204e8b52c6e43997ad91cd3df2938f2b400f56575c85645913bfce62e0d3380e26ddf74307ed359c246a5a6cffea2821679ca1443965898a1b664671ae
SSDEEP 3072:2gngm355pWHu0kywS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:2gB355pWO0kyV/Ah1G/AcQ///NR5fn
TLSH
T1F36430192A7049EACEEE1FB5AC1249D89581E9F014F1E13E6533DFDDE8E4DA2C805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Iplkje32.exe

Path C:\Windows\SysWOW64\Iplkje32.exe
Size 320KB
SHA256 1a794615972d7594a53c23d5d8ffc0f4576dc62628b8ad754fba7c63a9ea0851
MD5 4e3595d0a6e2f6d013af44baa7ee6747
SHA1 96914c8311aad031eb3d200c9829b334653896bd
SHA512 f049ac0c4066a03b355d57ed2d4fd9c4bddf9360865d49a4c75966ddd9c8174037ec1bf2aeea2e2c661caf958650c65d49daf9738f85f101e9c7d13e1504b622
SSDEEP 3072:aqFBThzY+Bj2slDmwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:HNzjJnmV/Ah1G/AcQ///NR5fn
TLSH
T1EE6441191A3009EACEED5FB5AD0A4DD89141EAF014F1E53E5227DFDCD9E4DA2C80AF81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ipohpdbb.exe

Path C:\Windows\SysWOW64\Ipohpdbb.exe
Size 320KB
SHA256 76f3d1d85301016e8ffc94d3e36ba2dd0d130e5e3178430aef43aba20d776b67
MD5 31c0052d469f923e146e252229402919
SHA1 8dffb50d6271b124dd42bff154ffde16bfbe1a8c
SHA512 d6c3c5bffd883258ead1bf85faf13c639326160c59dd1cc9010f2c7a6779991b534a17568ab91af9038df1e0aa56e8f850b47509ce183009a417e516b919b15b
SSDEEP 3072:NUtYnxa29c6ez4wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:egc3z4V/Ah1G/AcQ///NR5fn
TLSH
T1226430192A3009EACDED1FB5AC1259D89192E5F458F1E13E6933DFDCD8E4DA2C805F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jaekkfcm.exe

Path C:\Windows\SysWOW64\Jaekkfcm.exe
Size 320KB
SHA256 4977f6e9ea36313633793cdacd7dad8b0401b6ba3268766eb566419adc06cd59
MD5 113c3ee39c3fc4408c0aa48afcf5f653
SHA1 3ca86057088bfe921f582332c0526169f84931cb
SHA512 7efb9d52c473c924e05fb7084005807f303173a57f1aa11d4d1742aceae621662f8d29a26e4395b14aaefb7d2eefaf3ea57cc06f4118d5bff711438cd308f59e
SSDEEP 3072:YgAsJOxzbbh/wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Y7GOVh/V/Ah1G/AcQ///NR5fn
TLSH
T16964411A26300DEACDED1FB6AD125AE84141E9F014F2E53E6923DFDCD8E4DA6C805F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jgbccm32.exe

Path C:\Windows\SysWOW64\Jgbccm32.exe
Size 320KB
SHA256 4e7bc24ca8a60d10776c9daa5989993253a975cb74c3e8bfd90107a7d62031d8
MD5 ea2a2a9adba7a951fe53f75e95a2b18b
SHA1 07d022e9b063645e32e47d13cabec082f9cf2097
SHA512 38058d901f5eda340468d33f4685bf4d2c4da1012b08be6c20085c0d77836a2761e43fd9c269e8db391045c883e30e50ec3232e17f3c345e7a6c980658c92566
SSDEEP 3072:vkHAk5HYwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:vkHAWHYV/Ah1G/AcQ///NR5fn
TLSH
T19D641F1926300AEACDED1BB9ED228DD89181E4F015F2E17E9123DFDCD9E4DA6C815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jhapmphg.exe

Path C:\Windows\SysWOW64\Jhapmphg.exe
Size 320KB
SHA256 a471ead8a235be3afacaa257769f9b1090fe29bef04415dfa27cb7046e040ca2
MD5 7b23602ce9c00c27af359c626aa03357
SHA1 e5de04f60ce06dfa9c7203ffcea1304fcb3d2927
SHA512 0210bf9840e082f656b7fb012292ef1a2633c81d773f7a7697e5c361baeed091040affe75716569ca4dc8a49c9163c78725db0eca77dce841ab342745b136b38
SSDEEP 6144:XQOdP6DPb4kcXDbV/Ah1G/AcQ///NR5fn:XQO4/Nv
TLSH
T17F64EB19263009EBDEED1BB5AC124ADC9581E9B168F1E13E6123DFDCD8E4DA2C815FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kafcadej.exe

Path C:\Windows\SysWOW64\Kafcadej.exe
Size 320KB
SHA256 0f8d4bab075f64a7d7467d9da0a6b52e7ee582edaf76958034ecf037d6c6cb42
MD5 107a56e015fe77abdd35bf38f3b75462
SHA1 45b7290ad284d7ec43eadf88f12516a76bf9e07f
SHA512 68017fe51b67388ddd0bf273d67c1c5aadc761e651214aef36a1b1cdddd0dfd156b348928519abc4ba5dcdb831bf44e5bb58ca16bd7a980538887cbd10065ab3
SSDEEP 3072:brP6AMxTnw5zYsuwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:vaK/uV/Ah1G/AcQ///NR5fn
TLSH
T16F64322A1A3409EACEED1FB5AC1259D89152E8F014F1E13E6123DFDCD8E4DA6C819FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kdfmcobk.exe

Path C:\Windows\SysWOW64\Kdfmcobk.exe
Size 320KB
SHA256 a2165c5e8c772ec8f7b073990b5ed653de7a04ec6a49d0907a2c502195147e7c
MD5 f4d1ffac4337ed88916e0fdf279cf29e
SHA1 0a5ded5105e24dcef81f91071cc46b0b4941ef1d
SHA512 fbe7eb3d2e470d2017091dcfb4cc29042bea199be040d52b96a4960caa9a9cd42ad0523cd6198f9c28281306d8e9b452c3ebe990a5008420c440fec5ca1dfa15
SSDEEP 3072:lL9fJGJ0hAVowS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:NBzhkoV/Ah1G/AcQ///NR5fn
TLSH
T1CB643F592A3409EACEED1BB9AC2259D85181F9F014F1F53E2563DFDCC8E4DAAC805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kgnbol32.exe

Path C:\Windows\SysWOW64\Kgnbol32.exe
Size 320KB
SHA256 315b45cd200ffd0e435e525a12374982a5ac11b49d23fd0f780083adbc908586
MD5 b0010bfb0b58813ac8dc76f52bf6a634
SHA1 301ffce89badd3a7b874fc312d4d15f290bb5e69
SHA512 d7fae5d86e2a255064c134dc509b3481b232793cbb4bef2c92a4a41167e7a55c957dc2e60696b3bbf5e68aafc6fa26fd3183067f1909984df32037bf8beebea5
SSDEEP 3072:ogvsRf+mURHCPlwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:1vIQRelV/Ah1G/AcQ///NR5fn
TLSH
T176644119263489EADDED2FB5ED1249D89141E9F024F2E13E6223DFDCD8E4DA2D814F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kolaqh32.exe

Path C:\Windows\SysWOW64\Kolaqh32.exe
Size 320KB
SHA256 421976db46fd362d4bfaf72a0fd7e1ef0b5c1437e06f7a6a25f5465c2105e4e5
MD5 d5fb0ceff95bd5e0201a47df290ce0ce
SHA1 88f39a8185433963beba05c18e42c25f5c88a97f
SHA512 98975fda7812e7673746fb4b42b6f7320a3c0533f96571f9417e0d6bd83ea18b3e62beecc07c7b9ecf1ad72053593cb3b5da7408f910772903ff69b47d5459bd
SSDEEP 3072:3JQNaFDewS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:ZQkNeV/Ah1G/AcQ///NR5fn
TLSH
T19964112A163809EACFED1FB5AC2249E89145E9F014F1E13E6123DFDCD8E4DA2D815F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Laacmbkm.exe

Path C:\Windows\SysWOW64\Laacmbkm.exe
Size 320KB
SHA256 1f71ad50c684c4136675310e93b97e4edb09df7defa223851cf41d811f51b403
MD5 256c0837fbf77bbfbb27a2876aa74f07
SHA1 d29ca36cafa3ba763edfc2c7400284cd44074ddc
SHA512 e9cd8304302374bba0cd5a39d50586767d637f2530ee6157e11cbf729e5e0229df96351ee4e3c47672c408c0cc4555b555bb1c02b1a3caa89e02b0bd30768de0
SSDEEP 3072:ePpQCcc0QZbePdbQwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:ercc0GbeRQV/Ah1G/AcQ///NR5fn
TLSH
T1B3640E192A340AEACDED5BBAAC1249D89185E9F114F1F13E6133DFDCD8E5DA2C805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Laofhbmp.exe

Path C:\Windows\SysWOW64\Laofhbmp.exe
Size 320KB
SHA256 dd44750671ecd3f3647e898bd55f46a4bc6ab6d22acbf7b92d2b1467e5070837
MD5 5981d19f4ac69db1e74c97abd62da2e0
SHA1 b176a2557e2fa2b1484faec6c44ec17fa181c72a
SHA512 28c4a3a72fe6c2d957c25dfefe5553aae4602710569f321b797abfd4ef812099dcad6764e6c737ccabc2f8cc6dada9995e37abcb83439ee776e9c3384ff6f067
SSDEEP 3072:RoaBJbVtO4UYwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:fJXKYV/Ah1G/AcQ///NR5fn
TLSH
T1DC64C8192A3409EACEED3BB5AC124DD89141E9B118F1E13E6123DFDDD8E4DA2DC19F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lhkkjl32.exe

Path C:\Windows\SysWOW64\Lhkkjl32.exe
Size 320KB
SHA256 60f6438d89ed6bea71ca6929ca61bb24e7412a363c8fafcb265145e98d0961de
MD5 62b25427acebcbc600aa0b248c7cc490
SHA1 8ed94c943dd5b2f8fa3e06d3196d60ba41aaeca9
SHA512 91a759d2b7ed03100f5f3a94e26f1681dc0b5fc0c9bc6445c106041f250d9d93ad48b8eaa5bf9834d919c8580ac1e93ccc67c84158326dc51c9a9fd471b06de5
SSDEEP 3072:PfmKYYfBiwJxQ+zwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:HJ5fYwJxJzV/Ah1G/AcQ///NR5fn
TLSH
T135644F59AA3019EACDED1FB5AC1209D85541E8F024F1E23E6123DFDCD8E4DA2DC29F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lonnfg32.exe

Path C:\Windows\SysWOW64\Lonnfg32.exe
Size 320KB
SHA256 8f1e545c4a2a51a93d0c521fab7ecbf87d14af4401a8a2d50884be387c4048d5
MD5 fb34b982a22e292b64e253b5391c210a
SHA1 fafa22a15a1f9c704f6b7f560a7e414b0f25394c
SHA512 4432955650b2afab7b55e7283064cfe15cb780076e4d9ff097319d5ef52bc58db0324a090bf4e47993a0511440ecd15c420818f0377b3341c8d676f6dc01e83d
SSDEEP 3072:jqeNOvYKkr9Ey2n9gTke2scjwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:xMvTmE8geojV/Ah1G/AcQ///NR5fn
TLSH
T1EC6420192B3409EACEED1FB5AC1249D89241E8F414F1E17E6523EFDCD8E4DA6C819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mgceqh32.exe

Path C:\Windows\SysWOW64\Mgceqh32.exe
Size 320KB
SHA256 decfacddbb61f2556ad27f6b0fd2c8b6cc4ddc8a7ced3933139ab35bae51b93d
MD5 d755ba9b6173ecfa1b855e1810be9736
SHA1 495bc230f243ffb90fc6f2265780c8f2176a4f84
SHA512 9d20adc0a9516a16e2f736d7922ae4f979e6c88249bdd0a7e938e4ae19be4d53dc8be881ddb7efc0b5e600cc002776591b01721f9acef491300cc7b930dc188a
SSDEEP 3072:W2WbsRqo2wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Qzo2V/Ah1G/AcQ///NR5fn
TLSH
T1C36431292A3409EACEED1FB5AC1249E89181F5F014F2E13E6163DFDCD8E4DA2D915F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mhgkfkhl.exe

Path C:\Windows\SysWOW64\Mhgkfkhl.exe
Size 320KB
SHA256 85d19bbb7a6d2fed6711e694ebb66950f554361ed15a3ff3e78c48920057c008
MD5 164d34a44bcaefd58102575864058a62
SHA1 9e93685da91bb992a2c738e46561054829edb4ea
SHA512 64be4a111efc66e7a42cd1d0e3ee00cca8c325ad7d265c2d5333d5dd586041dd01060a855805259a47b72364f01f6234919d44eef09a21a23a3f0415a7a776cd
SSDEEP 3072:qXsI8sFsiJTVwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:qw0sqTVV/Ah1G/AcQ///NR5fn
TLSH
T19A64411A263509EACEED2FB6AC5249DC9191E9F014F1E13E6523DFDCD8E4DA2C805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mnaghb32.exe

Path C:\Windows\SysWOW64\Mnaghb32.exe
Size 320KB
SHA256 e56819f5a2073ed3c95405637fc299d8e10f07fb756f42d2ae3d1b30b5a246ee
MD5 7f5421f4e528108465f2c8614929a3c5
SHA1 b0f893bf2da7606e00183e25974f210a675e6c63
SHA512 cdb6d6981a7c1104edaba2bb8af7710d3f7287884f15f41fb85d1ecfd4b270feb1d4110e641c2fb7e6cbdf99a58204329644fcb21a6ccdc8baeb68f0fb83ee5b
SSDEEP 3072:3XI1IQv1zocGJHr92iwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:3X0IQ9BGJHrkiV/Ah1G/AcQ///NR5fn
TLSH
T1A56409192A3419EACEED1BB7AD426DD88141E9F015F1E17E2127DFDCC8E4DA2D818F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mnojcb32.exe

Path C:\Windows\SysWOW64\Mnojcb32.exe
Size 320KB
SHA256 698aec82db278eeccc3b7aeffeb63237f90af3ddb64cd35d74bcd485296af182
MD5 6947a6d3fc8114eb0cb6e9d9ab66cf04
SHA1 c15dd06de81ecdc07616bd02e09a4042aeb6f026
SHA512 ec292ba672c7c370754c7a018b2353eb50b1bbeafe583ee4dbb1fda314e7e9cf7ebd83bb3a42d5742040077b474dd85c955c6011db19c848de007d99c26dc1ff
SSDEEP 3072:x1zgY4XMwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:xm5XMV/Ah1G/AcQ///NR5fn
TLSH
T1396431191A3809EACDED1FB9AC0249D89181E8F118F1E13E6127DFDDD8E5DA6CC16F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nbbldp32.exe

Path C:\Windows\SysWOW64\Nbbldp32.exe
Size 320KB
SHA256 2e472a3bfca94033912a9b0345e0daf206d0123ada120613d9271cce01197527
MD5 0fc208bbde8d100f662df83d41888baa
SHA1 ce6707ddde21b390c37773538300cf71c178c196
SHA512 a203596fcb00ed12383b8646a6f9ba8f39ffa59fc432df9d3e3772f9bc4e83f7cb6d59be0bb9b082a34a0413d334e31035e3c0422f0ac4da37b872636ee3df23
SSDEEP 3072:t5tgmL+6AgwMYhwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:tkbg1YhV/Ah1G/AcQ///NR5fn
TLSH
T190643119267449EAEEED1BB5AC0289D89181E8F814F1F53E6133DFDCD8E4DA2D805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ninafj32.exe

Path C:\Windows\SysWOW64\Ninafj32.exe
Size 320KB
SHA256 cbf16190a41e5f6f2ca2d567f617336557e3b6592e43c63fa77f25d0c4bd8447
MD5 f80d050c3a67f131206cbf46737efe05
SHA1 680686ec2100576837ef7ba41c247aace4bde962
SHA512 086bdbca66a2f22ba6cea23054b0ab171c9c688f2eb54fa4b6a3342d0096c5d2778208a6527f5e401a919df57a0ef4d173a48fbe1a5bebcccf50dc47817fee2b
SSDEEP 3072:Wo/lX03fG+Yp+wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Wo/F03f/Yp+V/Ah1G/AcQ///NR5fn
TLSH
T103641019263419EACEED6BB6AC024AE89541E5F014F1F17E6223FFDCD8E5D62C805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nnimia32.exe

Path C:\Windows\SysWOW64\Nnimia32.exe
Size 320KB
SHA256 006148cf386b9c1de11c2373997e64dbc6bf2dc331789b8e4378d52537f7b034
MD5 628432d64b613b2fbf35b5fd50561a89
SHA1 bf80fa6f8e6cd0e003264f07877cb481927c1a70
SHA512 c1398fad14ac8145e2e594cf4a5e4582c19766014a9b0eb07121d4de3a8db2a24f8f8177a76f29f076a19ccc63feeca0944b71f3e2450e18914a37772f8d0f27
SSDEEP 6144:xa7JeHL90XdA3/qV/Ah1G/AcQ///NR5fn:xa090tAX/Nv
TLSH
T10A642F1A6A3409EACEED1BB5AC0249D89545E4F014F1E13E6123DFDEDCE4DA6C81AFC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-112-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/240-301-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/472-275-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/472-203-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1064-333-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1064-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1064-4-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/1152-281-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1152-183-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1172-197-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1172-277-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1224-291-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1224-148-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1264-258-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1264-250-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1364-7-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1364-332-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1408-175-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1408-283-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2104-315-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2104-63-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2340-313-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2340-70-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2424-319-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2424-49-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2500-261-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2500-245-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2516-133-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2516-295-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2732-119-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2732-299-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2860-91-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2860-307-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2916-35-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2916-324-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3344-14-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3344-331-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3444-260-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3444-255-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3460-269-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3460-230-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3532-217-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3532-271-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4068-28-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4068-326-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4108-21-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4108-328-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4144-306-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4144-98-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4416-77-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4416-312-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4528-294-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4528-141-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4700-189-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4700-279-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4732-265-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4732-235-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4808-105-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4808-303-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4848-168-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4848-285-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5332-211-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5332-273-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5432-289-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5432-154-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5460-268-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5460-224-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5492-317-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5492-60-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5856-297-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5856-126-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5900-310-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5900-84-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5996-263-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5996-240-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6060-42-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6060-322-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6112-287-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6112-161-0x0000000000400000-0x000000000046D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads