berbew | 96c6bc73f11ec40f3785240fbc40fc470762e044c1e647b6de55efc5e8282c07

Analysis

max time kernel
149s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_717ced8b88c3c062e5cb414a7b650991_elex_wannacry.exe
Size 320KB
Sample260720-rtl7mac15l
SHA256 96c6bc73f11ec40f3785240fbc40fc470762e044c1e647b6de55efc5e8282c07
MD5 717ced8b88c3c062e5cb414a7b650991
SHA1 9c1abe4ae4762e4679adf953f87a99fe368aa1a7
SHA512 326d0623514a49a3c2b2a41f57d6a3e5ea2a5c8e4630e03da43e22dc9f31a30ec19a44bd27a64d070a49876ee6466ec1c18d71db05dc8219baa33642cfc917ed
SSDEEP 3072:HsmzpUC8rbwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:hzp2bV/Ah1G/AcQ///NR5fn
TLSH
T121640D19263409EADDED2BB5AC0299DC9141E9F015F1E53E6123DFDCD8E4DA2CC29F82
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ckafkfkp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deqqek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dbbdip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aaofedkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bdlncn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bdphnmjk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnhlgc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cebdcmhh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbiabq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deejpjgc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pphckb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Abdoqd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bilcol32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cqghcn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckmmpg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cgcmeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Canocm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dilmeida.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qkqdnkge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajmgof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bglgdi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dbdano32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgaiffii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Diafqi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eejcki32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qkqdnkge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aaofedkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bgeadjai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bglgdi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cgaqphgl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cgejkh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnboma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dlobmd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cgaqphgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dijppjfd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dlkiaece.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bdnkhn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnkbcp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dicbfhni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ehhpge32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abdoqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dbgndoho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cqiehnml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dbphcpog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Djklgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bkjpkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnpbgajc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ckcbaf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dendok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnienqbi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbdano32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dehgejep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pnlcdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjkcqdje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cgejkh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Deqqek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Deejpjgc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdphnmjk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgodjiio.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbphcpog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dendok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dijppjfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adnbapjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bilcol32.exe

Executes dropped EXE 64 IoCs

pid	Process
3304	Pphckb32.exe
3336	Pnlcdg32.exe
1760	Qkqdnkge.exe
3980	Qajlje32.exe
4572	Aaofedkl.exe
4632	Adnbapjp.exe
640	Ajmgof32.exe
700	Abdoqd32.exe
4052	Anjpeelk.exe
4580	Aqilaplo.exe
404	Bgeadjai.exe
4876	Bjcmpepm.exe
4368	Bdlncn32.exe
3916	Bdnkhn32.exe
4116	Bglgdi32.exe
1048	Bjkcqdje.exe
2120	Bdphnmjk.exe
548	Bilcol32.exe
3688	Bgodjiio.exe
2444	Bkjpkg32.exe
3060	Cnhlgc32.exe
1936	Cbdhgaid.exe
3260	Cqghcn32.exe
3148	Cebdcmhh.exe
2696	Cgaqphgl.exe
2840	Ckmmpg32.exe
2192	Cjomldfp.exe
3936	Cbfema32.exe
3824	Cqiehnml.exe
1972	Ciqmjkno.exe
3604	Cgcmeh32.exe
4936	Cnmebblf.exe
2128	Cbiabq32.exe
2584	Cegnol32.exe
2752	Cgejkh32.exe
3720	Ckafkfkp.exe
1780	Cnpbgajc.exe
2296	Canocm32.exe
3392	Cejjdlap.exe
4820	Cghgpgqd.exe
3472	Ckcbaf32.exe
4220	Cnboma32.exe
2516	Cbnknpqj.exe
2564	Celgjlpn.exe
3312	Cigcjj32.exe
536	Ckfofe32.exe
4132	Djipbbne.exe
3560	Dbphcpog.exe
1592	Dendok32.exe
3328	Dijppjfd.exe
3028	Dlhlleeh.exe
4732	Djklgb32.exe
1948	Dbbdip32.exe
3456	Deqqek32.exe
2420	Dilmeida.exe
3416	Dlkiaece.exe
2204	Dnienqbi.exe
4012	Dbdano32.exe
408	Decmjjie.exe
4236	Dgaiffii.exe
5008	Dlmegd32.exe
4672	Dnkbcp32.exe
1248	Dbgndoho.exe
1976	Deejpjgc.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Miagbi32.dll	Cejjdlap.exe
File created	C:\Windows\SysWOW64\Llbndn32.dll	Cnboma32.exe
File opened for modification	C:\Windows\SysWOW64\Deqqek32.exe	Dbbdip32.exe
File created	C:\Windows\SysWOW64\Ehhpge32.exe	Eejcki32.exe
File created	C:\Windows\SysWOW64\Lnojqbjp.dll	Ckafkfkp.exe
File created	C:\Windows\SysWOW64\Dbgndoho.exe	Dnkbcp32.exe
File created	C:\Windows\SysWOW64\Deejpjgc.exe	Dbgndoho.exe
File created	C:\Windows\SysWOW64\Mlkngglh.dll	Dnnoip32.exe
File opened for modification	C:\Windows\SysWOW64\Ehhpge32.exe	Eejcki32.exe
File created	C:\Windows\SysWOW64\Bdlncn32.exe	Bjcmpepm.exe
File created	C:\Windows\SysWOW64\Bjkcqdje.exe	Bglgdi32.exe
File created	C:\Windows\SysWOW64\Cqiehnml.exe	Cbfema32.exe
File created	C:\Windows\SysWOW64\Cegnol32.exe	Cbiabq32.exe
File created	C:\Windows\SysWOW64\Abflab32.dll	Djipbbne.exe
File created	C:\Windows\SysWOW64\Hjpdjplo.dll	Dlmegd32.exe
File created	C:\Windows\SysWOW64\Nkgjbjed.dll	Diafqi32.exe
File created	C:\Windows\SysWOW64\Lbccec32.dll	Bdlncn32.exe
File created	C:\Windows\SysWOW64\Obbcmknk.dll	Bgodjiio.exe
File created	C:\Windows\SysWOW64\Cigcjj32.exe	Celgjlpn.exe
File created	C:\Windows\SysWOW64\Pjnbdofa.dll	Dendok32.exe
File created	C:\Windows\SysWOW64\Dgaiffii.exe	Decmjjie.exe
File created	C:\Windows\SysWOW64\Ajmgof32.exe	Adnbapjp.exe
File opened for modification	C:\Windows\SysWOW64\Cgaqphgl.exe	Cebdcmhh.exe
File opened for modification	C:\Windows\SysWOW64\Ckmmpg32.exe	Cgaqphgl.exe
File created	C:\Windows\SysWOW64\Hknhkonb.dll	Cnmebblf.exe
File created	C:\Windows\SysWOW64\Jhhgefed.dll	Dicbfhni.exe
File created	C:\Windows\SysWOW64\Polnbakm.dll	Adnbapjp.exe
File created	C:\Windows\SysWOW64\Mbfggf32.dll	Cegnol32.exe
File created	C:\Windows\SysWOW64\Cdbhncfq.dll	Dbbdip32.exe
File created	C:\Windows\SysWOW64\Dbdano32.exe	Dnienqbi.exe
File created	C:\Windows\SysWOW64\Mmdcde32.dll	Elaobdmm.exe
File opened for modification	C:\Windows\SysWOW64\Bdlncn32.exe	Bjcmpepm.exe
File opened for modification	C:\Windows\SysWOW64\Canocm32.exe	Cnpbgajc.exe
File opened for modification	C:\Windows\SysWOW64\Cejjdlap.exe	Canocm32.exe
File created	C:\Windows\SysWOW64\Nfmdccgi.dll	Dlobmd32.exe
File created	C:\Windows\SysWOW64\Eejcki32.exe	Eangjkkd.exe
File opened for modification	C:\Windows\SysWOW64\Qkqdnkge.exe	Pnlcdg32.exe
File created	C:\Windows\SysWOW64\Egheil32.dll	Bgeadjai.exe
File created	C:\Windows\SysWOW64\Qajlje32.exe	Qkqdnkge.exe
File created	C:\Windows\SysWOW64\Bdphnmjk.exe	Bjkcqdje.exe
File created	C:\Windows\SysWOW64\Idqogkic.dll	Cgcmeh32.exe
File opened for modification	C:\Windows\SysWOW64\Cnboma32.exe	Ckcbaf32.exe
File created	C:\Windows\SysWOW64\Oanicm32.dll	Cbnknpqj.exe
File opened for modification	C:\Windows\SysWOW64\Dilmeida.exe	Deqqek32.exe
File created	C:\Windows\SysWOW64\Kldphm32.dll	Ajmgof32.exe
File created	C:\Windows\SysWOW64\Cbnknpqj.exe	Cnboma32.exe
File created	C:\Windows\SysWOW64\Abdoqd32.exe	Ajmgof32.exe
File opened for modification	C:\Windows\SysWOW64\Bdnkhn32.exe	Bdlncn32.exe
File created	C:\Windows\SysWOW64\Ckcbaf32.exe	Cghgpgqd.exe
File opened for modification	C:\Windows\SysWOW64\Ajmgof32.exe	Adnbapjp.exe
File created	C:\Windows\SysWOW64\Cjomldfp.exe	Ckmmpg32.exe
File created	C:\Windows\SysWOW64\Dlhlleeh.exe	Dijppjfd.exe
File created	C:\Windows\SysWOW64\Gbkkfg32.dll	Dehgejep.exe
File created	C:\Windows\SysWOW64\Eaoimpil.dll	Cnpbgajc.exe
File created	C:\Windows\SysWOW64\Qkqdnkge.exe	Pnlcdg32.exe
File created	C:\Windows\SysWOW64\Hinklh32.dll	Bilcol32.exe
File opened for modification	C:\Windows\SysWOW64\Bkjpkg32.exe	Bgodjiio.exe
File created	C:\Windows\SysWOW64\Cbdhgaid.exe	Cnhlgc32.exe
File opened for modification	C:\Windows\SysWOW64\Cnhlgc32.exe	Bkjpkg32.exe
File opened for modification	C:\Windows\SysWOW64\Dijppjfd.exe	Dendok32.exe
File opened for modification	C:\Windows\SysWOW64\Dbgndoho.exe	Dnkbcp32.exe
File created	C:\Windows\SysWOW64\Foadqnoo.dll	Bdphnmjk.exe
File created	C:\Windows\SysWOW64\Fkgeam32.dll	2026-07-20_717ced8b88c3c062e5cb414a7b650991_elex_wannacry.exe
File created	C:\Windows\SysWOW64\Cnglpdin.dll	Qajlje32.exe

Program crash 1 IoCs

pid	pid_target	Process
4232	1700	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deqqek32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbijinfl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjkcqdje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjomldfp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dendok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cqghcn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cebdcmhh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cegnol32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Celgjlpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbgndoho.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dehgejep.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dicbfhni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Enpknplq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbbdip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnhlgc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbiabq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbnknpqj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dijppjfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cqiehnml.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckcbaf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjcmpepm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cejjdlap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cigcjj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbphcpog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dlobmd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Elaobdmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adnbapjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abdoqd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdphnmjk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbdhgaid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qajlje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdnkhn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgodjiio.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ciqmjkno.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckfofe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgaiffii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ehhpge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eldlhckj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anjpeelk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djklgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dlkiaece.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbdano32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deejpjgc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbfema32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djipbbne.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dilmeida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqilaplo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgejkh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckafkfkp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cghgpgqd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dnienqbi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dnkbcp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_717ced8b88c3c062e5cb414a7b650991_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aaofedkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdlncn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bglgdi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgcmeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dnnoip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eangjkkd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eejcki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pphckb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qkqdnkge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajmgof32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgeadjai.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Anjpeelk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ckafkfkp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ckfofe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dlobmd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	2026-07-20_717ced8b88c3c062e5cb414a7b650991_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjkcqdje.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnpbgajc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dilmeida.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkgeam32.dll"	2026-07-20_717ced8b88c3c062e5cb414a7b650991_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Alnifp32.dll"	Qkqdnkge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cbfema32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cgejkh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbkkfg32.dll"	Dehgejep.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bglgdi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ckafkfkp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Llbndn32.dll"	Cnboma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjlmcilb.dll"	Dlhlleeh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Djklgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dbgndoho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Anjpeelk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dnnoip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Polnbakm.dll"	Adnbapjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bilcol32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Diafqi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dijppjfd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dlkiaece.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbccec32.dll"	Bdlncn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Obbcmknk.dll"	Bgodjiio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Djipbbne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnojon32.dll"	Dnienqbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dnnoip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dbbdip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dlmegd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Apjppniq.dll"	Dbijinfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dendok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dehgejep.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eangjkkd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Deejpjgc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjnlnaiq.dll"	Eejcki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fijbhpbc.dll"	Anjpeelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnojqbjp.dll"	Ckafkfkp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cnpbgajc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Canocm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dnienqbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Edcijq32.dll"	Dgaiffii.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qajlje32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bdnkhn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cbiabq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlqmgaad.dll"	Cgejkh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cejjdlap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oanicm32.dll"	Cbnknpqj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Beaeca32.dll"	Cigcjj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dbdano32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gglnncqg.dll"	Cbfema32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eggkfmfh.dll"	Deejpjgc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Foaeccgp.dll"	Enpknplq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pbfepjng.dll"	Pphckb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kldphm32.dll"	Ajmgof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjkcqdje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjomldfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idqogkic.dll"	Cgcmeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Donloloo.dll"	Ckfofe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dbijinfl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bdphnmjk.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 568 wrote to memory of 3304	568	2026-07-20_717ced8b88c3c062e5cb414a7b650991_elex_wannacry.exe	85
PID 3304 wrote to memory of 3336	3304	Pphckb32.exe	86
PID 3336 wrote to memory of 1760	3336	Pnlcdg32.exe	87
PID 1760 wrote to memory of 3980	1760	Qkqdnkge.exe	88
PID 3980 wrote to memory of 4572	3980	Qajlje32.exe	89
PID 4572 wrote to memory of 4632	4572	Aaofedkl.exe	90
PID 4632 wrote to memory of 640	4632	Adnbapjp.exe	91
PID 640 wrote to memory of 700	640	Ajmgof32.exe	92
PID 700 wrote to memory of 4052	700	Abdoqd32.exe	93
PID 4052 wrote to memory of 4580	4052	Anjpeelk.exe	94
PID 4580 wrote to memory of 404	4580	Aqilaplo.exe	95
PID 404 wrote to memory of 4876	404	Bgeadjai.exe	96
PID 4876 wrote to memory of 4368	4876	Bjcmpepm.exe	97
PID 4368 wrote to memory of 3916	4368	Bdlncn32.exe	98
PID 3916 wrote to memory of 4116	3916	Bdnkhn32.exe	99
PID 4116 wrote to memory of 1048	4116	Bglgdi32.exe	100
PID 1048 wrote to memory of 2120	1048	Bjkcqdje.exe	101
PID 2120 wrote to memory of 548	2120	Bdphnmjk.exe	102
PID 548 wrote to memory of 3688	548	Bilcol32.exe	103
PID 3688 wrote to memory of 2444	3688	Bgodjiio.exe	104
PID 2444 wrote to memory of 3060	2444	Bkjpkg32.exe	105
PID 3060 wrote to memory of 1936	3060	Cnhlgc32.exe	106
PID 1936 wrote to memory of 3260	1936	Cbdhgaid.exe	107
PID 3260 wrote to memory of 3148	3260	Cqghcn32.exe	108
PID 3148 wrote to memory of 2696	3148	Cebdcmhh.exe	109
PID 2696 wrote to memory of 2840	2696	Cgaqphgl.exe	110
PID 2840 wrote to memory of 2192	2840	Ckmmpg32.exe	111
PID 2192 wrote to memory of 3936	2192	Cjomldfp.exe	112
PID 3936 wrote to memory of 3824	3936	Cbfema32.exe	113
PID 3824 wrote to memory of 1972	3824	Cqiehnml.exe	114
PID 1972 wrote to memory of 3604	1972	Ciqmjkno.exe	115
PID 3604 wrote to memory of 4936	3604	Cgcmeh32.exe	116
PID 4936 wrote to memory of 2128	4936	Cnmebblf.exe	117
PID 2128 wrote to memory of 2584	2128	Cbiabq32.exe	118
PID 2584 wrote to memory of 2752	2584	Cegnol32.exe	119
PID 2752 wrote to memory of 3720	2752	Cgejkh32.exe	120
PID 3720 wrote to memory of 1780	3720	Ckafkfkp.exe	121
PID 1780 wrote to memory of 2296	1780	Cnpbgajc.exe	122
PID 2296 wrote to memory of 3392	2296	Canocm32.exe	123
PID 3392 wrote to memory of 4820	3392	Cejjdlap.exe	124
PID 4820 wrote to memory of 3472	4820	Cghgpgqd.exe	125
PID 3472 wrote to memory of 4220	3472	Ckcbaf32.exe	126
PID 4220 wrote to memory of 2516	4220	Cnboma32.exe	127
PID 2516 wrote to memory of 2564	2516	Cbnknpqj.exe	128
PID 2564 wrote to memory of 3312	2564	Celgjlpn.exe	129
PID 3312 wrote to memory of 536	3312	Cigcjj32.exe	130
PID 536 wrote to memory of 4132	536	Ckfofe32.exe	131
PID 4132 wrote to memory of 3560	4132	Djipbbne.exe	132
PID 3560 wrote to memory of 1592	3560	Dbphcpog.exe	133
PID 1592 wrote to memory of 3328	1592	Dendok32.exe	134
PID 3328 wrote to memory of 3028	3328	Dijppjfd.exe	135
PID 3028 wrote to memory of 4732	3028	Dlhlleeh.exe	136
PID 4732 wrote to memory of 1948	4732	Djklgb32.exe	137
PID 1948 wrote to memory of 3456	1948	Dbbdip32.exe	138
PID 3456 wrote to memory of 2420	3456	Deqqek32.exe	139
PID 2420 wrote to memory of 3416	2420	Dilmeida.exe	140
PID 3416 wrote to memory of 2204	3416	Dlkiaece.exe	141
PID 2204 wrote to memory of 4012	2204	Dnienqbi.exe	142
PID 4012 wrote to memory of 408	4012	Dbdano32.exe	143
PID 408 wrote to memory of 4236	408	Decmjjie.exe	144
PID 4236 wrote to memory of 5008	4236	Dgaiffii.exe	145
PID 5008 wrote to memory of 4672	5008	Dlmegd32.exe	146
PID 4672 wrote to memory of 1248	4672	Dnkbcp32.exe	147
PID 1248 wrote to memory of 1976	1248	Dbgndoho.exe	148

C:\Users\Admin\AppData\Local\Temp\2026-07-20_717ced8b88c3c062e5cb414a7b650991_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_717ced8b88c3c062e5cb414a7b650991_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:568
- C:\Windows\SysWOW64\Pphckb32.exe
  C:\Windows\system32\Pphckb32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\Windows\SysWOW64\Pnlcdg32.exe
    C:\Windows\system32\Pnlcdg32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:3336
  - - C:\Windows\SysWOW64\Qkqdnkge.exe
      C:\Windows\system32\Qkqdnkge.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1760
    - - C:\Windows\SysWOW64\Qajlje32.exe
        
        C:\Windows\system32\Qajlje32.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3980
      - C:\Windows\SysWOW64\Aaofedkl.exe
        
        C:\Windows\system32\Aaofedkl.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4572
        
        C:\Windows\SysWOW64\Adnbapjp.exe
        
        C:\Windows\system32\Adnbapjp.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4632
        
        C:\Windows\SysWOW64\Ajmgof32.exe
        
        C:\Windows\system32\Ajmgof32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:640
        
        C:\Windows\SysWOW64\Abdoqd32.exe
        
        C:\Windows\system32\Abdoqd32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:700
        
        C:\Windows\SysWOW64\Anjpeelk.exe
        
        C:\Windows\system32\Anjpeelk.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4052
        
        C:\Windows\SysWOW64\Aqilaplo.exe
        
        C:\Windows\system32\Aqilaplo.exe
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4580
        
        C:\Windows\SysWOW64\Bgeadjai.exe
        
        C:\Windows\system32\Bgeadjai.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:404
        
        C:\Windows\SysWOW64\Bjcmpepm.exe
        
        C:\Windows\system32\Bjcmpepm.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4876
        
        C:\Windows\SysWOW64\Bdlncn32.exe
        
        C:\Windows\system32\Bdlncn32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4368
        
        C:\Windows\SysWOW64\Bdnkhn32.exe
        
        C:\Windows\system32\Bdnkhn32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3916
        
        C:\Windows\SysWOW64\Bglgdi32.exe
        
        C:\Windows\system32\Bglgdi32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4116
        
        C:\Windows\SysWOW64\Bjkcqdje.exe
        
        C:\Windows\system32\Bjkcqdje.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1048
        
        C:\Windows\SysWOW64\Bdphnmjk.exe
        
        C:\Windows\system32\Bdphnmjk.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2120
        
        C:\Windows\SysWOW64\Bilcol32.exe
        
        C:\Windows\system32\Bilcol32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:548
        
        C:\Windows\SysWOW64\Bgodjiio.exe
        
        C:\Windows\system32\Bgodjiio.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3688
        
        C:\Windows\SysWOW64\Bkjpkg32.exe
        
        C:\Windows\system32\Bkjpkg32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2444
        
        C:\Windows\SysWOW64\Cnhlgc32.exe
        
        C:\Windows\system32\Cnhlgc32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3060
        
        C:\Windows\SysWOW64\Cbdhgaid.exe
        
        C:\Windows\system32\Cbdhgaid.exe
        23⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1936
        
        C:\Windows\SysWOW64\Cqghcn32.exe
        
        C:\Windows\system32\Cqghcn32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3260
        
        C:\Windows\SysWOW64\Cebdcmhh.exe
        
        C:\Windows\system32\Cebdcmhh.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3148
        
        C:\Windows\SysWOW64\Cgaqphgl.exe
        
        C:\Windows\system32\Cgaqphgl.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2696
        
        C:\Windows\SysWOW64\Ckmmpg32.exe
        
        C:\Windows\system32\Ckmmpg32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2840
        
        C:\Windows\SysWOW64\Cjomldfp.exe
        
        C:\Windows\system32\Cjomldfp.exe
        28⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2192
        
        C:\Windows\SysWOW64\Cbfema32.exe
        
        C:\Windows\system32\Cbfema32.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3936
        
        C:\Windows\SysWOW64\Cqiehnml.exe
        
        C:\Windows\system32\Cqiehnml.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3824
        
        C:\Windows\SysWOW64\Ciqmjkno.exe
        
        C:\Windows\system32\Ciqmjkno.exe
        31⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1972
        
        C:\Windows\SysWOW64\Cgcmeh32.exe
        
        C:\Windows\system32\Cgcmeh32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3604
        
        C:\Windows\SysWOW64\Cnmebblf.exe
        
        C:\Windows\system32\Cnmebblf.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4936
        
        C:\Windows\SysWOW64\Cbiabq32.exe
        
        C:\Windows\system32\Cbiabq32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2128
        
        C:\Windows\SysWOW64\Cegnol32.exe
        
        C:\Windows\system32\Cegnol32.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2584
        
        C:\Windows\SysWOW64\Cgejkh32.exe
        
        C:\Windows\system32\Cgejkh32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2752
        
        C:\Windows\SysWOW64\Ckafkfkp.exe
        
        C:\Windows\system32\Ckafkfkp.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3720
        
        C:\Windows\SysWOW64\Cnpbgajc.exe
        
        C:\Windows\system32\Cnpbgajc.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1780
        
        C:\Windows\SysWOW64\Canocm32.exe
        
        C:\Windows\system32\Canocm32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2296
        
        C:\Windows\SysWOW64\Cejjdlap.exe
        
        C:\Windows\system32\Cejjdlap.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3392
        
        C:\Windows\SysWOW64\Cghgpgqd.exe
        
        C:\Windows\system32\Cghgpgqd.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4820
        
        C:\Windows\SysWOW64\Ckcbaf32.exe
        
        C:\Windows\system32\Ckcbaf32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3472
        
        C:\Windows\SysWOW64\Cnboma32.exe
        
        C:\Windows\system32\Cnboma32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4220
        
        C:\Windows\SysWOW64\Cbnknpqj.exe
        
        C:\Windows\system32\Cbnknpqj.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2516
        
        C:\Windows\SysWOW64\Celgjlpn.exe
        
        C:\Windows\system32\Celgjlpn.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2564
        
        C:\Windows\SysWOW64\Cigcjj32.exe
        
        C:\Windows\system32\Cigcjj32.exe
        46⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3312
        
        C:\Windows\SysWOW64\Ckfofe32.exe
        
        C:\Windows\system32\Ckfofe32.exe
        47⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:536
        
        C:\Windows\SysWOW64\Djipbbne.exe
        
        C:\Windows\system32\Djipbbne.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4132
        
        C:\Windows\SysWOW64\Dbphcpog.exe
        
        C:\Windows\system32\Dbphcpog.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3560
        
        C:\Windows\SysWOW64\Dendok32.exe
        
        C:\Windows\system32\Dendok32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1592
        
        C:\Windows\SysWOW64\Dijppjfd.exe
        
        C:\Windows\system32\Dijppjfd.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3328
        
        C:\Windows\SysWOW64\Dlhlleeh.exe
        
        C:\Windows\system32\Dlhlleeh.exe
        52⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3028
        
        C:\Windows\SysWOW64\Djklgb32.exe
        
        C:\Windows\system32\Djklgb32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4732
        
        C:\Windows\SysWOW64\Dbbdip32.exe
        
        C:\Windows\system32\Dbbdip32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1948
        
        C:\Windows\SysWOW64\Deqqek32.exe
        
        C:\Windows\system32\Deqqek32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3456
        
        C:\Windows\SysWOW64\Dilmeida.exe
        
        C:\Windows\system32\Dilmeida.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2420
        
        C:\Windows\SysWOW64\Dlkiaece.exe
        
        C:\Windows\system32\Dlkiaece.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3416
        
        C:\Windows\SysWOW64\Dnienqbi.exe
        
        C:\Windows\system32\Dnienqbi.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2204
        
        C:\Windows\SysWOW64\Dbdano32.exe
        
        C:\Windows\system32\Dbdano32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4012
        
        C:\Windows\SysWOW64\Decmjjie.exe
        
        C:\Windows\system32\Decmjjie.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:408
        
        C:\Windows\SysWOW64\Dgaiffii.exe
        
        C:\Windows\system32\Dgaiffii.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4236
        
        C:\Windows\SysWOW64\Dlmegd32.exe
        
        C:\Windows\system32\Dlmegd32.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5008
        
        C:\Windows\SysWOW64\Dnkbcp32.exe
        
        C:\Windows\system32\Dnkbcp32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4672
        
        C:\Windows\SysWOW64\Dbgndoho.exe
        
        C:\Windows\system32\Dbgndoho.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1248
        
        C:\Windows\SysWOW64\Deejpjgc.exe
        
        C:\Windows\system32\Deejpjgc.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1976
        
        C:\Windows\SysWOW64\Diafqi32.exe
        
        C:\Windows\system32\Diafqi32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:2968
        
        C:\Windows\SysWOW64\Dlobmd32.exe
        
        C:\Windows\system32\Dlobmd32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5040
        
        C:\Windows\SysWOW64\Dnnoip32.exe
        
        C:\Windows\system32\Dnnoip32.exe
        68⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4948
        
        C:\Windows\SysWOW64\Dbijinfl.exe
        
        C:\Windows\system32\Dbijinfl.exe
        69⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:64
        
        C:\Windows\SysWOW64\Dehgejep.exe
        
        C:\Windows\system32\Dehgejep.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1356
        
        C:\Windows\SysWOW64\Dicbfhni.exe
        
        C:\Windows\system32\Dicbfhni.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4480
        
        C:\Windows\SysWOW64\Elaobdmm.exe
        
        C:\Windows\system32\Elaobdmm.exe
        72⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2340
        
        C:\Windows\SysWOW64\Enpknplq.exe
        
        C:\Windows\system32\Enpknplq.exe
        73⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2480
        
        C:\Windows\SysWOW64\Eangjkkd.exe
        
        C:\Windows\system32\Eangjkkd.exe
        74⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:984
        
        C:\Windows\SysWOW64\Eejcki32.exe
        
        C:\Windows\system32\Eejcki32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1520
        
        C:\Windows\SysWOW64\Ehhpge32.exe
        
        C:\Windows\system32\Ehhpge32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4664
        
        C:\Windows\SysWOW64\Eldlhckj.exe
        
        C:\Windows\system32\Eldlhckj.exe
        77⤵
        System Location Discovery: System Language Discovery
        
        PID:1700
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 400
        78⤵
        Program crash
        
        PID:4232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1700 -ip 1700
1⤵
PID:3572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Aaofedkl.exe

Path C:\Windows\SysWOW64\Aaofedkl.exe
Size 320KB
SHA256 b621db44639249e85cb34ddec4cc4f64f9c1806b0896e0d7e82556cb3829ee08
MD5 58d3882e60c904357a9fd708510148b0
SHA1 1a8edcceea00db04e3c0bcc6648c5420644992cc
SHA512 1313e4d97ce45a0bff51fcccc310f5e89a87c938545ebd86563dfb069fec4e90ac0198da376e478e0104e4561f5484c0e080e40bbee062ec7876ce9b7dd86aed
SSDEEP 3072:1NCIF+TO8wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:ee+68V/Ah1G/AcQ///NR5fn
TLSH
T10C642E1A667409EACEED1FF5AC125AD85141E9F014F1E23E6123DFDCD8E4DAAD808F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Abdoqd32.exe

Path C:\Windows\SysWOW64\Abdoqd32.exe
Size 320KB
SHA256 288d71e821320eb9cc1c3875e2bd8a6ca53402bf97574ed49e8a5b469b204f67
MD5 4c736a639db6f39e514f60e99ce7ffc7
SHA1 1c1867a227e2a8f220b05afb6719aea6c919b79f
SHA512 ddedba019cb620a554ae6de0d1ed7987c7e8bfa2954bb50e562551fdbb176ec4fa57b337aa11360cd84ffef40a3c5799e67edcbaae4ba004f923c926633c19cc
SSDEEP 3072:2kvguxUeYcrwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:1nxTrV/Ah1G/AcQ///NR5fn
TLSH
T1B4644219263019EACDED5FB5AC024DD85581E9F114F5E13E6223DFDCD8E8DAAE808F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Adnbapjp.exe

Path C:\Windows\SysWOW64\Adnbapjp.exe
Size 320KB
SHA256 72655d2c9b9aa230265f4aaea5d61ee0627d0f3646d9717e0d93b1ee1f398a9f
MD5 56c1a7232b8772f9feebab7fb515a16f
SHA1 28bae8ba3f2eb975b84273e17ded87228076d871
SHA512 89dee400bace89efac9838976d22039c3fe3cd5da4806bd18e33bb53326d598fad74aa3ddbcce4d38584ec1996bf1b6da7ee8b5877cebe58560864a6a9d233c2
SSDEEP 3072:g5yHQswF/exZwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:rHQswF/exZV/Ah1G/AcQ///NR5fn
TLSH
T1B8640F192A341BEACDED1BB5AC1289D85285E5F014F1E13EA523DFDCD8E8DA2C815FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ajmgof32.exe

Path C:\Windows\SysWOW64\Ajmgof32.exe
Size 320KB
SHA256 1ef7bcc4161389b197246eca976859a0cde3f1f5e071e252baa403b2982f8f91
MD5 cf68e10c264156cf09cf612ee5ff422d
SHA1 09806ab7cffd580958f5b1270d59f39c4cdefc4e
SHA512 6086d30d94be622012acbb24e707e4ef2e33dd6b778196efb0d9207d797733896341158ec038c2e08e54c203388d4a053138c4b5aee97ae5fd9983e8596c504b
SSDEEP 3072:MpPNzTTDBk5gRkwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:MBIYkV/Ah1G/AcQ///NR5fn
TLSH
T1BA64B6192A3409EACEED1FB5AC0249D89541E9F064F1E13E61239FDCDCE4DAADC58F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Anjpeelk.exe

Path C:\Windows\SysWOW64\Anjpeelk.exe
Size 320KB
SHA256 2547979af0680b4e4dba2d5bb00a13f90171929027481cbef35b1ea8cdef508b
MD5 d1455789a15be71c130d56147a9b19ff
SHA1 a14a79ea2c3d25c80d68389a6168ace22052eee1
SHA512 7a981214d3b2967710cf2835adf5072512c9a1cdebfb03c5744d2574549e8f19dad03012351d04a79386ab682452f6fb74585efd988c48e98a3095347f8c5b04
SSDEEP 3072:VGP5JU6DlJ3Lb5nC6wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:cnDlJ3LbxC6V/Ah1G/AcQ///NR5fn
TLSH
T1B1642E192A7509EACEED1FB5AC0249D8A541E9F018F1E13E6523DFDCC8E4DA2C849FD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Aqilaplo.exe

Path C:\Windows\SysWOW64\Aqilaplo.exe
Size 320KB
SHA256 655f5b8d1e4ccd6ae0c1135812f144bbc0b00f1a4c8f0b3687c2938398d0fac5
MD5 ec92b94653a6699a404d5dec61815659
SHA1 606e2d31a244365c4f60c57bdce08fc067aa5610
SHA512 c01953a9bf5aa846472022237a342b33487e670f02a48809cfb9e7616fe502fda09f2151840576594b7bc8b31a82bd5a6b8de19517aabefcc335f628ebd04c82
SSDEEP 3072:v5pVSxrinLwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:v5L3nLV/Ah1G/AcQ///NR5fn
TLSH
T1B8642E19263409EADEED1BB5AC124DD89181EAF115F5E13E6133EFDCC8E4DA2D809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bdlncn32.exe

Path C:\Windows\SysWOW64\Bdlncn32.exe
Size 320KB
SHA256 258098511e25b326b1b05646a960eec8487f7439e0e9caf7a383421d17934f9a
MD5 5b5865e4bed46c33a5e4c0ca058f9b8c
SHA1 169c1a601e37b9c431e61195c0f5da9853761cb6
SHA512 7694a7ff49769bc3237f965949b562670fbe8001a5a53da00118f92ad63f96e6b9a8bc463e6b0d515c529abd398007ab7554587ce7b3f28916697295b956dc8b
SSDEEP 3072:7FrgGe4s3C3Lf090wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:7FrA4syg90V/Ah1G/AcQ///NR5fn
TLSH
T1FE642F5A2A3009EACDED1FB5AC124ED89241E9F018F1E13E6123DFDDD8E4DA6D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bdnkhn32.exe

Path C:\Windows\SysWOW64\Bdnkhn32.exe
Size 320KB
SHA256 083b36596c4219bae2e6fbb804a627e29214fcc1ab14b95575c6434fba1e084c
MD5 3b06aff31373c5530fdc5fe9e24d9702
SHA1 991c345546ec1fe7a7ab67c30f2e0e8c8398faf4
SHA512 06e9ab63d30b90604c23f8eddc2b3c1e94fac86a2850166e5d2646430f67093c227fd128bddc9a54327f4a13209e6384a9d96e4f60cccdbca707853b0ef04a5d
SSDEEP 3072:X3znVZVe50wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:HjVrU0V/Ah1G/AcQ///NR5fn
TLSH
T1F264C919263809EACDED9BB6EC024DDC9141E6B054F1E13E6523DFECD8E4DA2D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bdphnmjk.exe

Path C:\Windows\SysWOW64\Bdphnmjk.exe
Size 320KB
SHA256 fe58138d091026116659cc8024751dfccbbd97bbacf721c6e84c1412bf05d404
MD5 ca2f474697b738d646ed19a322dd3853
SHA1 744b172c0cab1180c81a3011240add4db8d61307
SHA512 76c55dcf02e32d16e7f7cd824fc3dfd1dc6f9120c5757426932463e0aedadf4d59aed2668784167029e36df58eebfad2fa1659085d1b51974c34a8b03318da74
SSDEEP 3072:AJgpDQS/KkzhwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:vSShV/Ah1G/AcQ///NR5fn
TLSH
T147643019263409EACDED1FB6AD1289E89181E9F114F1E13E6123DFDCE8E4DA2DC15F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bgeadjai.exe

Path C:\Windows\SysWOW64\Bgeadjai.exe
Size 320KB
SHA256 8a164c3ef8456a76f794efea4faef05da87a496ed76af666c2dacdd5be81e6dd
MD5 3db87701de3539452c1e888d4a723ac7
SHA1 e48ee5ab486e650f0c6920a7e19e62167b9f23af
SHA512 082aeae3b43d0c92fc11e2cb5698e0201caf591e75ed476e4c3487eebfcceffb75ba82dc683689c3577f25c361c3f93ada7468188443a14d7adfc242b474e843
SSDEEP 3072:I4nCtIujBXrwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:lnILjRrV/Ah1G/AcQ///NR5fn
TLSH
T174641E192A3009EACDED1BB5AC1249D89581E4F664F1E53E2123DFDCC8E8DE2DD16F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bglgdi32.exe

Path C:\Windows\SysWOW64\Bglgdi32.exe
Size 320KB
SHA256 b196ee3cdb708b7b1afb3dfc65d18d495d53fdd49daf5d860d0164a5011ec584
MD5 b5f10795126dbf4cbf98a7ebbe048ea6
SHA1 c7d86f841e9a8d776aee1caa05c49c2c31a6aa9c
SHA512 52e92cd3f9e9eb78a6944ae5e17ec485cece481438956b57289bc653305a7bad132a4530bb2e8c2e30f5fc6111b27b330152e4f1c93bf3ed20109296e08e6dd6
SSDEEP 3072:E9ocnozYpVdwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:E9ocDpVdV/Ah1G/AcQ///NR5fn
TLSH
T191641F196A3409EACEED1BB5ED1249D8A181E9F014F1E13E6123DFECDCE4DA2D905F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bgodjiio.exe

Path C:\Windows\SysWOW64\Bgodjiio.exe
Size 320KB
SHA256 96a00e8026dbf879c33de5f05e78c92e84db7f3f39d578517bddccf8c1d10be3
MD5 e79acf1cf820b43d0e10954481c56b6b
SHA1 3c9b294d186865b6202c305163f0647c91fd71f8
SHA512 de75c168ae4bcfb85c91f699986d00a119434be2fadee3862a79816ed4c26eaf08bd3dc930ae183d660b3f65188d7e9478097c2b9f121e090a30a7fdfb2a368f
SSDEEP 3072:8JQKwq7AdGOYvpWl+1keywS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:8JNHAUTAE1keyV/Ah1G/AcQ///NR5fn
TLSH
T141643F1A2A3009EADDED5BB5EC1249DC9242E9F114F1E13E6123DFDCD8E4DA6D809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bilcol32.exe

Path C:\Windows\SysWOW64\Bilcol32.exe
Size 320KB
SHA256 0b30ff98b6ee3d53329992c7f5482de2c11a7b45d729b19de222274f6fa4cd02
MD5 a873c9a8b57d2b356d372788a671b8ad
SHA1 4b5dd8a944c8031328808d84981446f3018c73ec
SHA512 f665744ff463d607f4d6feeb4df948a7f6838f473df7c3d79321086bdbf76ffb68957109c0fb7b9810819e4de8d3f36da7e9c623321a0d6d76e4a904802583fc
SSDEEP 3072:msXqvXi+Ol7wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:7/+Ol7V/Ah1G/AcQ///NR5fn
TLSH
T1A1642F19273409EACEED1FB5AC1249D85181E9F514F2E13EA923DFDCD8E4DA2C849F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bjcmpepm.exe

Path C:\Windows\SysWOW64\Bjcmpepm.exe
Size 320KB
SHA256 c0bf7ee2008d8749f5d9b69d4c9b317bc65b9cfefb905e85cd2864bda3c2f6a8
MD5 8784ef6c71faac49f99ee4e8d3784d88
SHA1 aadfcea83a2ae2022b4054ec46ad45bcb6005f1f
SHA512 8fa10d40c8196563713ebec62414d13b4b62455b259053a70f77627b90e6aa91b97524a7b9733865d0ea35b6685ab1335564711dc88cf2eb62baeac9b6d1ce56
SSDEEP 3072:Q1aTT6F5ErwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:QUv6/ErV/Ah1G/AcQ///NR5fn
TLSH
T12A643019263419EACEED1FB5AC0249D85581F8F016F1E13E6123DFDED8E8DA2C819F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bjkcqdje.exe

Path C:\Windows\SysWOW64\Bjkcqdje.exe
Size 320KB
SHA256 d230fde86724389be9a0f5c60e7bb6f49c6095bb86931a1dd47e3d137598162e
MD5 9ff9c03441f4229e44358548dc0a7675
SHA1 754b22cfce5f83ef9899b7694866e4db2c7eef77
SHA512 aa3a20e7c46b36a05a1d3f3ceb83beb3397dfb5eb7a13e512a70ca56232a16e46548b34cf55f1153610398d4bdcd8c1c6764106941df83280b6451df2e83a43f
SSDEEP 3072:NK/bA7CmpLVXMV5vmwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:g/kCNV5mV/Ah1G/AcQ///NR5fn
TLSH
T1A4641D1A163009EACEED1BB5EC0259D89145E9F018F1E13E2123DFECD8E4DA6CC65F96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bkjpkg32.exe

Path C:\Windows\SysWOW64\Bkjpkg32.exe
Size 320KB
SHA256 8a5bfadeba1cccf34c971428dd521a2c60b4ef3d01a60efc4d4fff15b2a2332c
MD5 cad79daad1e67d729e8281da844b7b84
SHA1 d45c77444d6986df8080df31c00d4c77fd4ba6b8
SHA512 d46b73dabc4e371e47f753d02d8c70e8feea0ed8e20a5b08e6d4ca7ca9ca06fb4272913d9afec7b6d22957ab8b9b6f40f2ea8a456241743db2b8e4bf3592f4ba
SSDEEP 3072:CEus2LUmIksakwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:SwmIVakV/Ah1G/AcQ///NR5fn
TLSH
T10E64531A263009EACDED1FB5ACA269D85145E4F018F1E17E6123DFDCD8E4EA6EC14F90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cbdhgaid.exe

Path C:\Windows\SysWOW64\Cbdhgaid.exe
Size 320KB
SHA256 70150c6029c1f1033415ab76bc2190f47c511ba04887537d3a88877ce8a297e9
MD5 9fe6c04e7db13402ade31c76d64ce330
SHA1 5a39d1fed6c832c2dec6ddcb5c7e94d05f71629f
SHA512 ab2736019ead4dbc7d05a62b8b96921559ba24f5ae3c6132fa6f5e08e07dcddcc9cdbee347d9b0259798ac8688eedff532e84ed7c5474e7a5563b880af678ce4
SSDEEP 3072:VhfuykQTTkj2YBNeaQVwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:VZuyT3kj2Ym9VV/Ah1G/AcQ///NR5fn
TLSH
T17464211A26344AEACDED3FB6AC0249E89141E4F054F1E53E6123DFDCD8E4D66D806F92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cbfema32.exe

Path C:\Windows\SysWOW64\Cbfema32.exe
Size 320KB
SHA256 52f0beebe86bd0ff5f7c5ccfedb964c01f03bb9c70599240d6f3917c8dbd2e3b
MD5 abe482826ca766a0957bcee6d6ddb6c3
SHA1 41374fb6f7588547b06c04beaaca8c905a4a7fbc
SHA512 505b07cf503cb66c16cad11336f73277baf74f5d419beba5c6112158f7c9427edb9ab712373a841959b91a458eae4cfe5985c051e0f5497855237fecc0b97195
SSDEEP 3072:JGAi548kTIwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:IIIV/Ah1G/AcQ///NR5fn
TLSH
T1FE641E1A2A3909EACEED5BB6EC0249D89141E9F014F1E17E6123DFDCD8F4DA2D905F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cebdcmhh.exe

Path C:\Windows\SysWOW64\Cebdcmhh.exe
Size 320KB
SHA256 42b886594b5e19de789620ebb1bb8be195e281ba34ffcd210ac4e8041af9111a
MD5 efb7d254567f04941c5b602694a4deed
SHA1 379d91add0f3524f3464335976cd1403fa98efb2
SHA512 a2ae7fa51ab859b50a0e1179195d702ad641fa862b48240708d068bc1ba00fbce47f99086bf52f760869ecfaaf8a8ac47bcd631c199c137932ff6976aad78813
SSDEEP 3072:YuCtlfqIhKF1kDwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:iHqoDV/Ah1G/AcQ///NR5fn
TLSH
T1AF645F1A2A3009EADEED1FB5AC4349D89141E8F054F5E13E6123DFDDD8E4DA6C81AF81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cgaqphgl.exe

Path C:\Windows\SysWOW64\Cgaqphgl.exe
Size 320KB
SHA256 446db8259ac99e97c918214e6540bceb9e0cc7f963cc8a230c59c422bc51e0ed
MD5 d5f9dfce390b399fa51cffaa64c44502
SHA1 85c36dbeda1d2bce39354f5c6ee7ed282326713b
SHA512 c5c3375268161f77f55a0d6715ef1d8c41700ef94c0a459fbe91bc77423fb9304855b46c0327393b73a5f216511220587e98cb8f5cf589e3835e1178dc1c0465
SSDEEP 3072:gWA6RyFe0dsZFwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:g52T0dcFV/Ah1G/AcQ///NR5fn
TLSH
T1DC643E192A3109EACEED9BB5FC2249D85141E6F015F5E53E6123EFDED8E4DA2C804F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cgcmeh32.exe

Path C:\Windows\SysWOW64\Cgcmeh32.exe
Size 320KB
SHA256 322a27fc499411f6e05d9a082c9725c82ea6f8fb2185e7571e6118bbcc502254
MD5 23cb2fbbc60628f5bc50c6254ebd80c7
SHA1 1c629fa47a126bc6ca9d855b962ceee0e1a5ea8e
SHA512 5dc4c14c90fdeec38b17513e2cb5afbc3c5b4f9b37a9e65726ce6cae212d1222a2409d70e762e4cb6ff5e9a818dfb3c60e9ad2c94103280504dad0af60ff00c1
SSDEEP 3072:3hlk+Cr5knWlgF/xwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:/k+CrRuxV/Ah1G/AcQ///NR5fn
TLSH
T1F26430192A3049EACEEE1FB5AC0249D96541F9F115F1E13E6123DFDCD8E4DA2D80AF81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ciqmjkno.exe

Path C:\Windows\SysWOW64\Ciqmjkno.exe
Size 320KB
SHA256 4c15ae887c004c37ca12e1db3011e07acde656d6aa5ef529054e20fee8fabd8a
MD5 35f4f24c289400d681b5c05f72a908a4
SHA1 c3082b0c2bc8cb02711ca0d3d2c6ba59aca3e9ca
SHA512 d2062d6d20574e19e51a2645aea18b1c7ffb1518f15b562bc34b108664742ff80d2f83758e384b96fceae5c02fb6cadefe7b06754ee02fdde9e84a0b9c0e6bb1
SSDEEP 3072:3tENQKzVkzq4fRe8wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:J9z68V/Ah1G/AcQ///NR5fn
TLSH
T1BD640D19263149EACEED5BB5AC024AD89182E8F014F1E13EA523DFDCD8F4DA6DC05F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cjomldfp.exe

Path C:\Windows\SysWOW64\Cjomldfp.exe
Size 320KB
SHA256 986642d5249a35c3d926f0b570419cc9876ad9e693eda097197ebca37af87091
MD5 f356c09e25c95095f21fc6d4496c6161
SHA1 6a75d6d0168f50641ce7c6c0eedd3336e7ad8b85
SHA512 e247f7dbea809b67a1c2d9aa9b19f6d4322c36e7b39f3409002facb2d9cfa5ba1413e0fdee5c03971d69d38b63b407934c777fe1b4ba11e55619daa8293d3dd5
SSDEEP 3072:zpZiagx9dxg8GJQLjDgFwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:vgxlgzJUcFV/Ah1G/AcQ///NR5fn
TLSH
T161643F192A3809EACEED1FB5AD0249D89141E9F014F1E53F6163DFDEE8E4DA2C815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ckmmpg32.exe

Path C:\Windows\SysWOW64\Ckmmpg32.exe
Size 320KB
SHA256 a04716b0ea96ca1855d36250d5c8ddab5137edd04e5c0aae840e29092570576a
MD5 e936a92e9b0c652082cd904d1e0ca91e
SHA1 3f2718c8703da3ed84f7acf72f83fde6f061684f
SHA512 fc1e9037c9cc1530437f2789052dbb59c11d95fe65ca0d1fdfa743525040835a79c36aa45b6b07e5f95999c0ca0055b1ec6e9f7489da1f022520a74006c0d7d3
SSDEEP 3072:HwWy1PpWp1G42Jz8BwwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:HwWy1PX4BwV/Ah1G/AcQ///NR5fn
TLSH
T18D64311916340AEACEED1FB6AC129AD85141E9F014F5E13EE523DFDCC8E4DA6D809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cnhlgc32.exe

Path C:\Windows\SysWOW64\Cnhlgc32.exe
Size 320KB
SHA256 d5562c532b6bab68ef0baefe87dacad786477c02071bbd6ea69ccfa6c1a01a34
MD5 e90dd41d7f024258f9ab76dd377270d7
SHA1 c88c5b24da1a218e8f336779cf41dfdbc47bd16b
SHA512 db1edc0a472b2ae293a7b0a3efdbe80b1ecaa820e94fb56167a784e0fe4eb423e57c65e267555cb01b22fc66ac4b669df271cdde7278213c1c9f9f98c4de5ad2
SSDEEP 3072:hVeIc/7qSbQ9FFRwSO8wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:hVe7DVbQ9FFax8V/Ah1G/AcQ///NR5fn
TLSH
T18B64FE1A2A3409EACEED5FB5AC1249D85141E9F014F1F13E6123EFDDD8E4DA6E809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cnmebblf.exe

Path C:\Windows\SysWOW64\Cnmebblf.exe
Size 320KB
SHA256 6f62494ebb0751fd7ddb64bd6e15d08afb8503862ca43a8b6f8ddba866cca0b5
MD5 20082bea33db56a9556257f6450527b0
SHA1 bdd6a5a13104d91c9b612a6f487aa30e723484ed
SHA512 387ff625feacb210b0e9125aadc8fd9ab2048d520d5763402b406c34a348406f5ad45b79c08ca33a5c41f632dace61a3f16b6b789edb8ffcc244ea3481781a5a
SSDEEP 3072:dNmZHX3WtRb+gwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:dNmZHX3WtRagV/Ah1G/AcQ///NR5fn
TLSH
T19C6420192A3849FACDED1FB6AC0259D85141E5F114F1E23EA123DFDCD8E8DA2C925F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cqghcn32.exe

Path C:\Windows\SysWOW64\Cqghcn32.exe
Size 320KB
SHA256 033656423ec9dabfff8f083c3dcb2b15a06dae96cea80a136875a7a9983df9ca
MD5 4afbe845d33c6682d1af50e38da08770
SHA1 121a8a5f2dc2dba276859c585fa1e5ddb5e59bee
SHA512 b540026c4b218df1f109adf0e069e9f716e52787180a6474e21b2c09409520185bb0676a715c9085648e2935cd227f01b5399036bcc6007dcc47f159e7993578
SSDEEP 3072:CEyMi/4AhnaYWWGlwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:kMg5GlV/Ah1G/AcQ///NR5fn
TLSH
T13E642F6A263409EACEFD1BB5AC0249D99141E8F014F1F13E6223DFDDD8E8DA2D815F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cqiehnml.exe

Path C:\Windows\SysWOW64\Cqiehnml.exe
Size 320KB
SHA256 7e1e1b521b4374b2db973a8c92dfda960418643addfcf6d23b67c7f0e24b0be2
MD5 4664c944f2064627f65e95c752ff122e
SHA1 0c2f222b0340832f59072b366b34282e10342228
SHA512 a4b83b220956f13a843e871b0cf724d0f8887e99146c0168d3ab8fcdd2c4d03c1d6dd932959ba036c116ce7023f39fcf20cc21a60c30800e7f7c4a011cb760c2
SSDEEP 3072:QA/+8q8aUWFT1wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:R+8YFT1V/Ah1G/AcQ///NR5fn
TLSH
T11164212A163409EACEED1FB5AC5289D8A541E9F014F1E13EA123DFDCD8E4DA2CD15F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pnlcdg32.exe

Path C:\Windows\SysWOW64\Pnlcdg32.exe
Size 320KB
SHA256 71da283f241d0fcb24334f78a31080f06998b55d22d45ce81852f01bff96615a
MD5 3c8d5d49d84b1f15ca83cf280bfcb9b1
SHA1 2b6383c610110692f679010e30ab6774c2401cd9
SHA512 966a5e5626b1aab2c6f0731b044e0e29a7a6a3bd16886aeacb3f417e0241c795841c7284435d113adb54dfe22bc97b0e7537ff724d0d95632d92b6858a83af75
SSDEEP 3072:/VZ0myPdZ/gpmveywS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:/VZtyVZ/gMveyV/Ah1G/AcQ///NR5fn
TLSH
T18B64CA1A2A341DEACEFD1BB5AC1249D89141F9F014F1E13E61239FDCD8E4EA6E815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pphckb32.exe

Path C:\Windows\SysWOW64\Pphckb32.exe
Size 320KB
SHA256 25fd1722c0bb06b1c18aa120d9b9a3d4b01e131bb844bb18afb2b18ef7fc538d
MD5 3c5d1fc78f71d1eee352ebbf756f4eb8
SHA1 9f8d446c42e214194e90a707f194f04bbba4f223
SHA512 a4391f5936635f6ad153d755e6aefd615906fe6c923e3271a2aefe4cceb5c7ab4353aeb81d2c8c25a2d0bb24ef31f521fa260789102ae1f272c92c043ac9a7d6
SSDEEP 3072:AWc69isZ5lc13i/JCSXk9yFwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Td9isZYqJHFV/Ah1G/AcQ///NR5fn
TLSH
T1356430192A3409EADDED1FB6AC1259D85181F9F024F1E13E6123DFDCD8E4DA2E909F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qajlje32.exe

Path C:\Windows\SysWOW64\Qajlje32.exe
Size 320KB
SHA256 d345a09b1398c065737abf12d278415c4baccf6d64f350c7abef435f616be20a
MD5 2bc6b20bce436b8de344bc26f3fe058b
SHA1 e37a40d8b0e6eed3c614fb353630a0dd8bbdc5be
SHA512 eb218dcb020363db7bfd50d5bf9a541c823d06f064add9622ffee21bdcfd37594361071ccef594c9ab571a1523fa3e25f025bf1909a8fb8fcdad5ae50db88ad4
SSDEEP 6144:aCFpYc09juEjjTjUXNV/Ah1G/AcQ///NR5fn:PFpYP9juEjjTwQ/Nv
TLSH
T1BA642E1A263409EACEED1BB5AC1249D99241F9F014F1E13E6523EFDCC8E5DB2D809F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qkqdnkge.exe

Path C:\Windows\SysWOW64\Qkqdnkge.exe
Size 320KB
SHA256 e01e23858f6aef7cbcec8deb1f2bb4563c6dd3b60c325ad51cc74a6d34850db4
MD5 aea6cdc23cbd649e21bf98915a25be52
SHA1 db82ca245ca271e83974573035ba24ed725b1d10
SHA512 cc381c10da2df69db137215a1fc826d6765165bc10b12dcf3f015a1745daf2ad40b5643243ac053964140cb2272149fab6f2181d46a17a5a33b5ff95d2aa0e7b
SSDEEP 3072:kQHrKq7IHwC3Jds0IjwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:R1cHT7ojV/Ah1G/AcQ///NR5fn
TLSH
T1F46420192A3109EACDEDAFB6AC124AD89241E9F054F1E13E5123DFDCD8E4DA3D805F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/64-534-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/64-473-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/404-88-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/408-418-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/408-552-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/536-342-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/548-149-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/568-3-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/568-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/640-61-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/700-65-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/984-502-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/984-524-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1048-133-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1248-544-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1248-442-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1356-532-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1356-478-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1520-508-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1520-522-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1592-359-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1700-518-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1700-516-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1760-30-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1936-181-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1948-383-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1972-243-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1976-448-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1976-542-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2120-141-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2128-266-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2204-556-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2204-406-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2296-294-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2340-490-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2340-528-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2420-560-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2420-395-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2444-165-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2480-496-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2480-526-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2516-324-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2564-330-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2584-271-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2696-204-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2752-277-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2840-212-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2968-454-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2968-540-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3028-371-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3060-173-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3260-189-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3304-8-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3328-365-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3336-16-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3392-300-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3416-558-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3456-389-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3456-562-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3472-312-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3560-353-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3604-251-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3688-157-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3720-283-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3824-235-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3916-113-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3936-227-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3980-33-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4012-412-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4012-554-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4052-77-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4116-125-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4132-347-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4220-318-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4236-424-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4236-550-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4368-109-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4480-530-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4480-484-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4572-46-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4580-81-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4632-48-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4664-520-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4664-514-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4672-546-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4672-436-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4732-377-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4820-306-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4876-96-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4936-259-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4948-466-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4948-536-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5008-548-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5008-430-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5040-460-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5040-538-0x0000000000400000-0x000000000046D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads