berbew | e1a9226cb7d2aafc5de3bedc750de7febbb76b11b7f8c0f6218d162096fa9398

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_68d3773c3a1176926d6f8dd34e02199f_elex_wannacry.exe
Size 320KB
Sample260727-ryznhsvxbt
SHA256 e1a9226cb7d2aafc5de3bedc750de7febbb76b11b7f8c0f6218d162096fa9398
MD5 68d3773c3a1176926d6f8dd34e02199f
SHA1 2b21fcc0fccbffceecf05762efbd8409e18fe406
SHA512 d3f94bf10975e0851fd0fe42d16c522155d2205e4a74a3dd8fa671fbd0f57a2910e7545f727ef5fd81111487cb0b7e23b141424667c80dc8f906ee99798a74d2
SSDEEP 3072:fJFVvRKUu70wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:BFlI0V/Ah1G/AcQ///NR5fn
TLSH
T108642F1926340DFACEED5BB9AC1249D89149E9F428F1E13E2123DFDCC8E4DA2D854F91
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dlpgiebo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hcpcehko.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olfolp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iehfno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eojcao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eefhcimp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmabnnhg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpeibdfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdjapphl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojefjd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Doeifpkk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ilpaei32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcplle32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmdqai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pnjeqbkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgefogop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ghjfaa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chpangnk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhidcffq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hcpcehko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ieeihomg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Opongobp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ikmepj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldgkdbia.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdpnpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hmabnnhg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmgfmg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nllleapo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lfckjnjh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nebdighb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Olfolp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Onhhkb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	2026-07-27_68d3773c3a1176926d6f8dd34e02199f_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fkalmn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Giqlbqcc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ikmepj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iempingp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jlnnfghd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlpklg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojjoedfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pnlafaio.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cahffmel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jcplle32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngkjbkem.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnlhod32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olaeqp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eocegn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ieeihomg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpncbemh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lfhdem32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chpangnk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dlijodjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdcbic32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bblcda32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehgqed32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ghgjlaln.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifplgc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlnnfghd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpcedbjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Elpppcdl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iciflfcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdllhdco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kimnlj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdcbic32.exe

Executes dropped EXE 64 IoCs

pid	Process
3944	Bblcda32.exe
2868	Cbqlpabf.exe
2168	Chpangnk.exe
4496	Cahffmel.exe
4552	Dlpgiebo.exe
4260	Dbjofp32.exe
8	Daolgl32.exe
4684	Dhidcffq.exe
248	Doeifpkk.exe
776	Deoabj32.exe
3592	Dlijodjd.exe
5100	Dccbln32.exe
5944	Ehpjdepi.exe
5820	Eojcao32.exe
3644	Edgkif32.exe
4920	Ekqcfpmj.exe
4792	Eefhcimp.exe
3672	Elpppcdl.exe
2500	Eamhhjbd.exe
2032	Ehgqed32.exe
5412	Ecmebm32.exe
1108	Ehimkd32.exe
4080	Eocegn32.exe
3748	Fdpnpe32.exe
1972	Foebmn32.exe
5408	Fdbked32.exe
3236	Fohobmke.exe
1920	Ffbgog32.exe
1188	Fkopgn32.exe
2676	Ffdddg32.exe
2976	Fkalmn32.exe
4476	Fbkdjh32.exe
4752	Flqigq32.exe
972	Gbmaog32.exe
5068	Ghgjlaln.exe
5612	Gcmnijkd.exe
5204	Ghjfaa32.exe
1704	Gcojoj32.exe
4912	Ghlcga32.exe
3744	Gcagdj32.exe
4128	Gmjlmo32.exe
2068	Gcddjiel.exe
3576	Giqlbqcc.exe
5604	Hcfqoici.exe
4832	Hdgmga32.exe
5696	Hkaedk32.exe
1572	Hbknqeha.exe
3216	Hmabnnhg.exe
4060	Hckjjh32.exe
2820	Helfbqeb.exe
3408	Hkfookmo.exe
5388	Hflclcle.exe
5912	Hcpcehko.exe
3028	Ifplgc32.exe
1556	Ikmepj32.exe
4788	Ieeihomg.exe
5012	Ilpaei32.exe
3320	Iehfno32.exe
4088	Iciflfcd.exe
3256	Iejcco32.exe
124	Iempingp.exe
1736	Jcnpgf32.exe
3404	Jcplle32.exe
5020	Jmhaek32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Eamhhjbd.exe	Elpppcdl.exe
File created	C:\Windows\SysWOW64\Qeekhd32.dll	Giqlbqcc.exe
File created	C:\Windows\SysWOW64\Cijdnf32.dll	Helfbqeb.exe
File created	C:\Windows\SysWOW64\Leppfinp.dll	Keoeel32.exe
File created	C:\Windows\SysWOW64\Qakkgnpi.dll	Bblcda32.exe
File created	C:\Windows\SysWOW64\Ecmebm32.exe	Ehgqed32.exe
File created	C:\Windows\SysWOW64\Hmabnnhg.exe	Hbknqeha.exe
File created	C:\Windows\SysWOW64\Helfbqeb.exe	Hckjjh32.exe
File created	C:\Windows\SysWOW64\Lgpmhk32.dll	Dlpgiebo.exe
File opened for modification	C:\Windows\SysWOW64\Ieeihomg.exe	Ikmepj32.exe
File created	C:\Windows\SysWOW64\Dfgidngk.dll	Jmhaek32.exe
File created	C:\Windows\SysWOW64\Keoeel32.exe	Kmdqai32.exe
File created	C:\Windows\SysWOW64\Kpeibdfp.exe	Keoeel32.exe
File created	C:\Windows\SysWOW64\Kljgjdib.dll	Mdjapphl.exe
File opened for modification	C:\Windows\SysWOW64\Ojefjd32.exe	Olaeqp32.exe
File created	C:\Windows\SysWOW64\Keioln32.dll	Dhidcffq.exe
File created	C:\Windows\SysWOW64\Hjnijb32.dll	Deoabj32.exe
File created	C:\Windows\SysWOW64\Naaeedej.dll	Ojjoedfn.exe
File created	C:\Windows\SysWOW64\Pnlafaio.exe	Pcgmiiii.exe
File opened for modification	C:\Windows\SysWOW64\Dccbln32.exe	Dlijodjd.exe
File created	C:\Windows\SysWOW64\Ffmkieab.dll	Elpppcdl.exe
File opened for modification	C:\Windows\SysWOW64\Ghlcga32.exe	Gcojoj32.exe
File opened for modification	C:\Windows\SysWOW64\Jlnnfghd.exe	Jcbibeki.exe
File opened for modification	C:\Windows\SysWOW64\Lpnlicne.exe	Ldgkdbia.exe
File created	C:\Windows\SysWOW64\Olaeqp32.exe	Nciahk32.exe
File opened for modification	C:\Windows\SysWOW64\Fdbked32.exe	Foebmn32.exe
File created	C:\Windows\SysWOW64\Hkfookmo.exe	Helfbqeb.exe
File created	C:\Windows\SysWOW64\Kimnlj32.exe	Kpeibdfp.exe
File created	C:\Windows\SysWOW64\Ppoadkeg.dll	Kdcbic32.exe
File created	C:\Windows\SysWOW64\Mplhjabe.exe	Mmlphfed.exe
File opened for modification	C:\Windows\SysWOW64\Onhhkb32.exe	Oqdgan32.exe
File opened for modification	C:\Windows\SysWOW64\Cahffmel.exe	Chpangnk.exe
File opened for modification	C:\Windows\SysWOW64\Ghjfaa32.exe	Gcmnijkd.exe
File opened for modification	C:\Windows\SysWOW64\Pcgmiiii.exe	Pnjeqbkb.exe
File created	C:\Windows\SysWOW64\Facdom32.dll	Pgefogop.exe
File created	C:\Windows\SysWOW64\Pmfhbm32.exe	Pnakaa32.exe
File created	C:\Windows\SysWOW64\Bghagagc.dll	2026-07-27_68d3773c3a1176926d6f8dd34e02199f_elex_wannacry.exe
File created	C:\Windows\SysWOW64\Gcmnijkd.exe	Ghgjlaln.exe
File created	C:\Windows\SysWOW64\Cnlpjn32.dll	Lfckjnjh.exe
File opened for modification	C:\Windows\SysWOW64\Mmgfmg32.exe	Lpcedbjp.exe
File created	C:\Windows\SysWOW64\Dpammgnc.dll	Doeifpkk.exe
File created	C:\Windows\SysWOW64\Lmkfah32.exe	Kdcbic32.exe
File created	C:\Windows\SysWOW64\Dbjofp32.exe	Dlpgiebo.exe
File opened for modification	C:\Windows\SysWOW64\Flqigq32.exe	Fbkdjh32.exe
File created	C:\Windows\SysWOW64\Bidpblhd.dll	Hflclcle.exe
File opened for modification	C:\Windows\SysWOW64\Jcnpgf32.exe	Iempingp.exe
File opened for modification	C:\Windows\SysWOW64\Nnlhod32.exe	Ngbpbjoe.exe
File created	C:\Windows\SysWOW64\Fdpnpe32.exe	Eocegn32.exe
File opened for modification	C:\Windows\SysWOW64\Foebmn32.exe	Fdpnpe32.exe
File created	C:\Windows\SysWOW64\Fohobmke.exe	Fdbked32.exe
File created	C:\Windows\SysWOW64\Mgfjla32.dll	Iempingp.exe
File created	C:\Windows\SysWOW64\Ngmggj32.exe	Nneboemj.exe
File created	C:\Windows\SysWOW64\Ngbpbjoe.exe	Nllleapo.exe
File created	C:\Windows\SysWOW64\Hhigoqni.dll	Pnjeqbkb.exe
File created	C:\Windows\SysWOW64\Qkpdbm32.dll	Eamhhjbd.exe
File created	C:\Windows\SysWOW64\Hbknqeha.exe	Hkaedk32.exe
File created	C:\Windows\SysWOW64\Hcpcehko.exe	Hflclcle.exe
File created	C:\Windows\SysWOW64\Fcdamkaj.dll	Ojefjd32.exe
File opened for modification	C:\Windows\SysWOW64\Pnjeqbkb.exe	Pgpmdh32.exe
File created	C:\Windows\SysWOW64\Jcplle32.exe	Jcnpgf32.exe
File created	C:\Windows\SysWOW64\Eamhhjbd.exe	Elpppcdl.exe
File opened for modification	C:\Windows\SysWOW64\Chpangnk.exe	Cbqlpabf.exe
File opened for modification	C:\Windows\SysWOW64\Daolgl32.exe	Dbjofp32.exe
File created	C:\Windows\SysWOW64\Ehpjdepi.exe	Dccbln32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6060	1956	WerFault.exe	202

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbqlpabf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ffbgog32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hcpcehko.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcbibeki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ehpjdepi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ehgqed32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ehimkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkfookmo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kmbdkj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldleoa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chpangnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbjofp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Elpppcdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gmjlmo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdllhdco.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgpmdh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_68d3773c3a1176926d6f8dd34e02199f_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ekqcfpmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbkdjh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iciflfcd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onhhkb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dccbln32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkopgn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gcagdj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hbknqeha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcplle32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gcojoj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mccofn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnlafaio.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lfhdem32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nciahk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ecmebm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gcmnijkd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ieeihomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iejcco32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpncbemh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nllleapo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fdbked32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ffdddg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ilpaei32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Liimgh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olfolp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnjeqbkb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dlpgiebo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fdpnpe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hflclcle.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpcedbjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngmggj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cahffmel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kmdqai32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nebdighb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Doeifpkk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Edgkif32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ghjfaa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jmhaek32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqdgan32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhidcffq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ghlcga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngbpbjoe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojjoedfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eocegn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmgfmg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mnpice32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdjapphl.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
124	Iempingp.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffmkieab.dll"	Elpppcdl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ecmebm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ghgjlaln.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kdllhdco.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pnjeqbkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dkhokeah.dll"	Dlijodjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fkopgn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ieeihomg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aiojijfj.dll"	Lfhdem32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ldleoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abbffl32.dll"	Oqdgan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hkfookmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naqhjb32.dll"	Mccofn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Heimmh32.dll"	Eocegn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fdpnpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hbknqeha.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hckjjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjaendej.dll"	Jcnpgf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kdcbic32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Elpppcdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fohobmke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ffbgog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kljgjdib.dll"	Mdjapphl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dbjofp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eamhhjbd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ghjfaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gcddjiel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hkaedk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnmjmmpa.dll"	Iciflfcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ecieja32.dll"	Kimnlj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kallmekb.dll"	Lpnlicne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fkalmn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dlpgiebo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ghlcga32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Helfbqeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljeqcm32.dll"	Ifplgc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Keoeel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kpeibdfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gnhmbo32.dll"	Lmkfah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qakkgnpi.dll"	Bblcda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Helfbqeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kmdqai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lpnlicne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Olfolp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ojjoedfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nocebkkf.dll"	Pmfhbm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pmfhbm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Elpppcdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ecmebm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dcfchp32.dll"	Gmjlmo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mmgfmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omeqfhai.dll"	Pcgmiiii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Foebmn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gmjlmo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hcpcehko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbjdnm32.dll"	Mmlphfed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pnlafaio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkoikcjk.dll"	Eojcao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epofikbn.dll"	Ghgjlaln.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ngbpbjoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pgefogop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Llelkhhc.dll"	Hcpcehko.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fohobmke.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jlpklg32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 3944	2652	2026-07-27_68d3773c3a1176926d6f8dd34e02199f_elex_wannacry.exe	89
PID 3944 wrote to memory of 2868	3944	Bblcda32.exe	90
PID 2868 wrote to memory of 2168	2868	Cbqlpabf.exe	91
PID 2168 wrote to memory of 4496	2168	Chpangnk.exe	92
PID 4496 wrote to memory of 4552	4496	Cahffmel.exe	93
PID 4552 wrote to memory of 4260	4552	Dlpgiebo.exe	94
PID 4260 wrote to memory of 8	4260	Dbjofp32.exe	95
PID 8 wrote to memory of 4684	8	Daolgl32.exe	96
PID 4684 wrote to memory of 248	4684	Dhidcffq.exe	97
PID 248 wrote to memory of 776	248	Doeifpkk.exe	98
PID 776 wrote to memory of 3592	776	Deoabj32.exe	99
PID 3592 wrote to memory of 5100	3592	Dlijodjd.exe	100
PID 5100 wrote to memory of 5944	5100	Dccbln32.exe	101
PID 5944 wrote to memory of 5820	5944	Ehpjdepi.exe	102
PID 5820 wrote to memory of 3644	5820	Eojcao32.exe	103
PID 3644 wrote to memory of 4920	3644	Edgkif32.exe	104
PID 4920 wrote to memory of 4792	4920	Ekqcfpmj.exe	105
PID 4792 wrote to memory of 3672	4792	Eefhcimp.exe	106
PID 3672 wrote to memory of 2500	3672	Elpppcdl.exe	107
PID 2500 wrote to memory of 2032	2500	Eamhhjbd.exe	108
PID 2032 wrote to memory of 5412	2032	Ehgqed32.exe	109
PID 5412 wrote to memory of 1108	5412	Ecmebm32.exe	110
PID 1108 wrote to memory of 4080	1108	Ehimkd32.exe	111
PID 4080 wrote to memory of 3748	4080	Eocegn32.exe	112
PID 3748 wrote to memory of 1972	3748	Fdpnpe32.exe	113
PID 1972 wrote to memory of 5408	1972	Foebmn32.exe	114
PID 5408 wrote to memory of 3236	5408	Fdbked32.exe	115
PID 3236 wrote to memory of 1920	3236	Fohobmke.exe	116
PID 1920 wrote to memory of 1188	1920	Ffbgog32.exe	117
PID 1188 wrote to memory of 2676	1188	Fkopgn32.exe	118
PID 2676 wrote to memory of 2976	2676	Ffdddg32.exe	119
PID 2976 wrote to memory of 4476	2976	Fkalmn32.exe	120
PID 4476 wrote to memory of 4752	4476	Fbkdjh32.exe	121
PID 4752 wrote to memory of 972	4752	Flqigq32.exe	122
PID 972 wrote to memory of 5068	972	Gbmaog32.exe	123
PID 5068 wrote to memory of 5612	5068	Ghgjlaln.exe	124
PID 5612 wrote to memory of 5204	5612	Gcmnijkd.exe	125
PID 5204 wrote to memory of 1704	5204	Ghjfaa32.exe	126
PID 1704 wrote to memory of 4912	1704	Gcojoj32.exe	127
PID 4912 wrote to memory of 3744	4912	Ghlcga32.exe	128
PID 3744 wrote to memory of 4128	3744	Gcagdj32.exe	129
PID 4128 wrote to memory of 2068	4128	Gmjlmo32.exe	130
PID 2068 wrote to memory of 3576	2068	Gcddjiel.exe	131
PID 3576 wrote to memory of 5604	3576	Giqlbqcc.exe	132
PID 5604 wrote to memory of 4832	5604	Hcfqoici.exe	133
PID 4832 wrote to memory of 5696	4832	Hdgmga32.exe	134
PID 5696 wrote to memory of 1572	5696	Hkaedk32.exe	135
PID 1572 wrote to memory of 3216	1572	Hbknqeha.exe	136
PID 3216 wrote to memory of 4060	3216	Hmabnnhg.exe	137
PID 4060 wrote to memory of 2820	4060	Hckjjh32.exe	138
PID 2820 wrote to memory of 3408	2820	Helfbqeb.exe	139
PID 3408 wrote to memory of 5388	3408	Hkfookmo.exe	140
PID 5388 wrote to memory of 5912	5388	Hflclcle.exe	141
PID 5912 wrote to memory of 3028	5912	Hcpcehko.exe	142
PID 3028 wrote to memory of 1556	3028	Ifplgc32.exe	143
PID 1556 wrote to memory of 4788	1556	Ikmepj32.exe	144
PID 4788 wrote to memory of 5012	4788	Ieeihomg.exe	145
PID 5012 wrote to memory of 3320	5012	Ilpaei32.exe	146
PID 3320 wrote to memory of 4088	3320	Iehfno32.exe	147
PID 4088 wrote to memory of 3256	4088	Iciflfcd.exe	148
PID 3256 wrote to memory of 124	3256	Iejcco32.exe	149
PID 124 wrote to memory of 1736	124	Iempingp.exe	150
PID 1736 wrote to memory of 3404	1736	Jcnpgf32.exe	151
PID 3404 wrote to memory of 5020	3404	Jcplle32.exe	152

C:\Users\Admin\AppData\Local\Temp\2026-07-27_68d3773c3a1176926d6f8dd34e02199f_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_68d3773c3a1176926d6f8dd34e02199f_elex_wannacry.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\SysWOW64\Bblcda32.exe
  C:\Windows\system32\Bblcda32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3944
- - C:\Windows\SysWOW64\Cbqlpabf.exe
    C:\Windows\system32\Cbqlpabf.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\Windows\SysWOW64\Chpangnk.exe
      C:\Windows\system32\Chpangnk.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2168
    - - C:\Windows\SysWOW64\Cahffmel.exe
        
        C:\Windows\system32\Cahffmel.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4496
      - C:\Windows\SysWOW64\Dlpgiebo.exe
        
        C:\Windows\system32\Dlpgiebo.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4552
        
        C:\Windows\SysWOW64\Dbjofp32.exe
        
        C:\Windows\system32\Dbjofp32.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4260
        
        C:\Windows\SysWOW64\Daolgl32.exe
        
        C:\Windows\system32\Daolgl32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:8
        
        C:\Windows\SysWOW64\Dhidcffq.exe
        
        C:\Windows\system32\Dhidcffq.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4684
        
        C:\Windows\SysWOW64\Doeifpkk.exe
        
        C:\Windows\system32\Doeifpkk.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:248
        
        C:\Windows\SysWOW64\Deoabj32.exe
        
        C:\Windows\system32\Deoabj32.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:776
        
        C:\Windows\SysWOW64\Dlijodjd.exe
        
        C:\Windows\system32\Dlijodjd.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3592
        
        C:\Windows\SysWOW64\Dccbln32.exe
        
        C:\Windows\system32\Dccbln32.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5100
        
        C:\Windows\SysWOW64\Ehpjdepi.exe
        
        C:\Windows\system32\Ehpjdepi.exe
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5944
        
        C:\Windows\SysWOW64\Eojcao32.exe
        
        C:\Windows\system32\Eojcao32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5820
        
        C:\Windows\SysWOW64\Edgkif32.exe
        
        C:\Windows\system32\Edgkif32.exe
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3644
        
        C:\Windows\SysWOW64\Ekqcfpmj.exe
        
        C:\Windows\system32\Ekqcfpmj.exe
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4920
        
        C:\Windows\SysWOW64\Eefhcimp.exe
        
        C:\Windows\system32\Eefhcimp.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4792
        
        C:\Windows\SysWOW64\Elpppcdl.exe
        
        C:\Windows\system32\Elpppcdl.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3672
        
        C:\Windows\SysWOW64\Eamhhjbd.exe
        
        C:\Windows\system32\Eamhhjbd.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2500
        
        C:\Windows\SysWOW64\Ehgqed32.exe
        
        C:\Windows\system32\Ehgqed32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2032
        
        C:\Windows\SysWOW64\Ecmebm32.exe
        
        C:\Windows\system32\Ecmebm32.exe
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5412
        
        C:\Windows\SysWOW64\Ehimkd32.exe
        
        C:\Windows\system32\Ehimkd32.exe
        23⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1108
        
        C:\Windows\SysWOW64\Eocegn32.exe
        
        C:\Windows\system32\Eocegn32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4080
        
        C:\Windows\SysWOW64\Fdpnpe32.exe
        
        C:\Windows\system32\Fdpnpe32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3748
        
        C:\Windows\SysWOW64\Foebmn32.exe
        
        C:\Windows\system32\Foebmn32.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1972
        
        C:\Windows\SysWOW64\Fdbked32.exe
        
        C:\Windows\system32\Fdbked32.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5408
        
        C:\Windows\SysWOW64\Fohobmke.exe
        
        C:\Windows\system32\Fohobmke.exe
        28⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3236
        
        C:\Windows\SysWOW64\Ffbgog32.exe
        
        C:\Windows\system32\Ffbgog32.exe
        29⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1920
        
        C:\Windows\SysWOW64\Fkopgn32.exe
        
        C:\Windows\system32\Fkopgn32.exe
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1188
        
        C:\Windows\SysWOW64\Ffdddg32.exe
        
        C:\Windows\system32\Ffdddg32.exe
        31⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2676
        
        C:\Windows\SysWOW64\Fkalmn32.exe
        
        C:\Windows\system32\Fkalmn32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2976
        
        C:\Windows\SysWOW64\Fbkdjh32.exe
        
        C:\Windows\system32\Fbkdjh32.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4476
        
        C:\Windows\SysWOW64\Flqigq32.exe
        
        C:\Windows\system32\Flqigq32.exe
        34⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4752
        
        C:\Windows\SysWOW64\Gbmaog32.exe
        
        C:\Windows\system32\Gbmaog32.exe
        35⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:972
        
        C:\Windows\SysWOW64\Ghgjlaln.exe
        
        C:\Windows\system32\Ghgjlaln.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5068
        
        C:\Windows\SysWOW64\Gcmnijkd.exe
        
        C:\Windows\system32\Gcmnijkd.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5612
        
        C:\Windows\SysWOW64\Ghjfaa32.exe
        
        C:\Windows\system32\Ghjfaa32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5204
        
        C:\Windows\SysWOW64\Gcojoj32.exe
        
        C:\Windows\system32\Gcojoj32.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1704
        
        C:\Windows\SysWOW64\Ghlcga32.exe
        
        C:\Windows\system32\Ghlcga32.exe
        40⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4912
        
        C:\Windows\SysWOW64\Gcagdj32.exe
        
        C:\Windows\system32\Gcagdj32.exe
        41⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3744
        
        C:\Windows\SysWOW64\Gmjlmo32.exe
        
        C:\Windows\system32\Gmjlmo32.exe
        42⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4128
        
        C:\Windows\SysWOW64\Gcddjiel.exe
        
        C:\Windows\system32\Gcddjiel.exe
        43⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2068
        
        C:\Windows\SysWOW64\Giqlbqcc.exe
        
        C:\Windows\system32\Giqlbqcc.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3576
        
        C:\Windows\SysWOW64\Hcfqoici.exe
        
        C:\Windows\system32\Hcfqoici.exe
        45⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5604
        
        C:\Windows\SysWOW64\Hdgmga32.exe
        
        C:\Windows\system32\Hdgmga32.exe
        46⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4832
        
        C:\Windows\SysWOW64\Hkaedk32.exe
        
        C:\Windows\system32\Hkaedk32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5696
        
        C:\Windows\SysWOW64\Hbknqeha.exe
        
        C:\Windows\system32\Hbknqeha.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1572
        
        C:\Windows\SysWOW64\Hmabnnhg.exe
        
        C:\Windows\system32\Hmabnnhg.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3216
        
        C:\Windows\SysWOW64\Hckjjh32.exe
        
        C:\Windows\system32\Hckjjh32.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4060
        
        C:\Windows\SysWOW64\Helfbqeb.exe
        
        C:\Windows\system32\Helfbqeb.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2820
        
        C:\Windows\SysWOW64\Hkfookmo.exe
        
        C:\Windows\system32\Hkfookmo.exe
        52⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3408
        
        C:\Windows\SysWOW64\Hflclcle.exe
        
        C:\Windows\system32\Hflclcle.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5388
        
        C:\Windows\SysWOW64\Hcpcehko.exe
        
        C:\Windows\system32\Hcpcehko.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5912
        
        C:\Windows\SysWOW64\Ifplgc32.exe
        
        C:\Windows\system32\Ifplgc32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3028
        
        C:\Windows\SysWOW64\Ikmepj32.exe
        
        C:\Windows\system32\Ikmepj32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1556
        
        C:\Windows\SysWOW64\Ieeihomg.exe
        
        C:\Windows\system32\Ieeihomg.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4788
        
        C:\Windows\SysWOW64\Ilpaei32.exe
        
        C:\Windows\system32\Ilpaei32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5012
        
        C:\Windows\SysWOW64\Iehfno32.exe
        
        C:\Windows\system32\Iehfno32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3320
        
        C:\Windows\SysWOW64\Iciflfcd.exe
        
        C:\Windows\system32\Iciflfcd.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4088
        
        C:\Windows\SysWOW64\Iejcco32.exe
        
        C:\Windows\system32\Iejcco32.exe
        61⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3256
        
        C:\Windows\SysWOW64\Iempingp.exe
        
        C:\Windows\system32\Iempingp.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:124
        
        C:\Windows\SysWOW64\Jcnpgf32.exe
        
        C:\Windows\system32\Jcnpgf32.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1736
        
        C:\Windows\SysWOW64\Jcplle32.exe
        
        C:\Windows\system32\Jcplle32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3404
        
        C:\Windows\SysWOW64\Jmhaek32.exe
        
        C:\Windows\system32\Jmhaek32.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5020
        
        C:\Windows\SysWOW64\Jcbibeki.exe
        
        C:\Windows\system32\Jcbibeki.exe
        66⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4820
        
        C:\Windows\SysWOW64\Jlnnfghd.exe
        
        C:\Windows\system32\Jlnnfghd.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:464
        
        C:\Windows\SysWOW64\Jlpklg32.exe
        
        C:\Windows\system32\Jlpklg32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3020
        
        C:\Windows\SysWOW64\Kpncbemh.exe
        
        C:\Windows\system32\Kpncbemh.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5136
        
        C:\Windows\SysWOW64\Kmbdkj32.exe
        
        C:\Windows\system32\Kmbdkj32.exe
        70⤵
        System Location Discovery: System Language Discovery
        
        PID:4204
        
        C:\Windows\SysWOW64\Kdllhdco.exe
        
        C:\Windows\system32\Kdllhdco.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5584
        
        C:\Windows\SysWOW64\Kmdqai32.exe
        
        C:\Windows\system32\Kmdqai32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4144
        
        C:\Windows\SysWOW64\Keoeel32.exe
        
        C:\Windows\system32\Keoeel32.exe
        73⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2308
        
        C:\Windows\SysWOW64\Kpeibdfp.exe
        
        C:\Windows\system32\Kpeibdfp.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5988
        
        C:\Windows\SysWOW64\Kimnlj32.exe
        
        C:\Windows\system32\Kimnlj32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1300
        
        C:\Windows\SysWOW64\Kdcbic32.exe
        
        C:\Windows\system32\Kdcbic32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:2884
        
        C:\Windows\SysWOW64\Lmkfah32.exe
        
        C:\Windows\system32\Lmkfah32.exe
        77⤵
        Modifies registry class
        
        PID:4448
        
        C:\Windows\SysWOW64\Lfckjnjh.exe
        
        C:\Windows\system32\Lfckjnjh.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4768
        
        C:\Windows\SysWOW64\Ldgkdbia.exe
        
        C:\Windows\system32\Ldgkdbia.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3908
        
        C:\Windows\SysWOW64\Lpnlicne.exe
        
        C:\Windows\system32\Lpnlicne.exe
        80⤵
        Modifies registry class
        
        PID:1144
        
        C:\Windows\SysWOW64\Lfhdem32.exe
        
        C:\Windows\system32\Lfhdem32.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1044
        
        C:\Windows\SysWOW64\Ldleoa32.exe
        
        C:\Windows\system32\Ldleoa32.exe
        82⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1700
        
        C:\Windows\SysWOW64\Liimgh32.exe
        
        C:\Windows\system32\Liimgh32.exe
        83⤵
        System Location Discovery: System Language Discovery
        
        PID:5096
        
        C:\Windows\SysWOW64\Lpcedbjp.exe
        
        C:\Windows\system32\Lpcedbjp.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4196
        
        C:\Windows\SysWOW64\Mmgfmg32.exe
        
        C:\Windows\system32\Mmgfmg32.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6008
        
        C:\Windows\SysWOW64\Mccofn32.exe
        
        C:\Windows\system32\Mccofn32.exe
        86⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1688
        
        C:\Windows\SysWOW64\Mmlphfed.exe
        
        C:\Windows\system32\Mmlphfed.exe
        87⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2384
        
        C:\Windows\SysWOW64\Mplhjabe.exe
        
        C:\Windows\system32\Mplhjabe.exe
        88⤵
        
        PID:3512
        
        C:\Windows\SysWOW64\Mnpice32.exe
        
        C:\Windows\system32\Mnpice32.exe
        89⤵
        System Location Discovery: System Language Discovery
        
        PID:2268
        
        C:\Windows\SysWOW64\Mdjapphl.exe
        
        C:\Windows\system32\Mdjapphl.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1992
        
        C:\Windows\SysWOW64\Nnbeie32.exe
        
        C:\Windows\system32\Nnbeie32.exe
        91⤵
        
        PID:3308
        
        C:\Windows\SysWOW64\Ngkjbkem.exe
        
        C:\Windows\system32\Ngkjbkem.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4480
        
        C:\Windows\SysWOW64\Nneboemj.exe
        
        C:\Windows\system32\Nneboemj.exe
        93⤵
        Drops file in System32 directory
        
        PID:1620
        
        C:\Windows\SysWOW64\Ngmggj32.exe
        
        C:\Windows\system32\Ngmggj32.exe
        94⤵
        System Location Discovery: System Language Discovery
        
        PID:1252
        
        C:\Windows\SysWOW64\Nljopa32.exe
        
        C:\Windows\system32\Nljopa32.exe
        95⤵
        
        PID:2920
        
        C:\Windows\SysWOW64\Nebdighb.exe
        
        C:\Windows\system32\Nebdighb.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1008
        
        C:\Windows\SysWOW64\Nllleapo.exe
        
        C:\Windows\system32\Nllleapo.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4576
        
        C:\Windows\SysWOW64\Ngbpbjoe.exe
        
        C:\Windows\system32\Ngbpbjoe.exe
        98⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1844
        
        C:\Windows\SysWOW64\Nnlhod32.exe
        
        C:\Windows\system32\Nnlhod32.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2096
        
        C:\Windows\SysWOW64\Nciahk32.exe
        
        C:\Windows\system32\Nciahk32.exe
        100⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4904
        
        C:\Windows\SysWOW64\Olaeqp32.exe
        
        C:\Windows\system32\Olaeqp32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4048
        
        C:\Windows\SysWOW64\Ojefjd32.exe
        
        C:\Windows\system32\Ojefjd32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3496
        
        C:\Windows\SysWOW64\Opongobp.exe
        
        C:\Windows\system32\Opongobp.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6000
        
        C:\Windows\SysWOW64\Olfolp32.exe
        
        C:\Windows\system32\Olfolp32.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5652
        
        C:\Windows\SysWOW64\Ojjoedfn.exe
        
        C:\Windows\system32\Ojjoedfn.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3684
        
        C:\Windows\SysWOW64\Oqdgan32.exe
        
        C:\Windows\system32\Oqdgan32.exe
        106⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6004
        
        C:\Windows\SysWOW64\Onhhkb32.exe
        
        C:\Windows\system32\Onhhkb32.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6020
        
        C:\Windows\SysWOW64\Pgpmdh32.exe
        
        C:\Windows\system32\Pgpmdh32.exe
        108⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2452
        
        C:\Windows\SysWOW64\Pnjeqbkb.exe
        
        C:\Windows\system32\Pnjeqbkb.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5976
        
        C:\Windows\SysWOW64\Pcgmiiii.exe
        
        C:\Windows\system32\Pcgmiiii.exe
        110⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2428
        
        C:\Windows\SysWOW64\Pnlafaio.exe
        
        C:\Windows\system32\Pnlafaio.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4084
        
        C:\Windows\SysWOW64\Pgefogop.exe
        
        C:\Windows\system32\Pgefogop.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:292
        
        C:\Windows\SysWOW64\Pnakaa32.exe
        
        C:\Windows\system32\Pnakaa32.exe
        113⤵
        Drops file in System32 directory
        
        PID:3120
        
        C:\Windows\SysWOW64\Pmfhbm32.exe
        
        C:\Windows\system32\Pmfhbm32.exe
        114⤵
        Modifies registry class
        
        PID:1156
        
        C:\Windows\SysWOW64\Qfolkcpb.exe
        
        C:\Windows\system32\Qfolkcpb.exe
        115⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 448
        116⤵
        Program crash
        
        PID:6060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1956 -ip 1956
1⤵
PID:4536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Bblcda32.exe

Path C:\Windows\SysWOW64\Bblcda32.exe
Size 320KB
SHA256 458bd171705a89f3476ded6ceeeb16416d771b8c8f137da663c86cd5480c078a
MD5 721bd13721688223cfbb9dc52472ec6b
SHA1 6861edfedb701eff4f625c5bdfc75e29f77dce54
SHA512 20f602f5bc55f566ea5809c7340dd0e8fd647f28673984357aaf1671b310cad5e56a5f3c375b281e80bc9cd8c8027b838471b45ed83a49ca1eeda463a0c3c6cd
SSDEEP 3072:p2uLxC6wOP5G89Vm4Jc0hxDwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:p24xCenJc0hxDV/Ah1G/AcQ///NR5fn
TLSH
T160643119263009EACEED1FB5AC5749D85981E8F014F1E13E5123DFEEE9E8D62C819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cahffmel.exe

Path C:\Windows\SysWOW64\Cahffmel.exe
Size 320KB
SHA256 ccb334968e8192f8d0a472e836afc1bbd7923500e0a34081a59636743098b036
MD5 e44ecf732214b6022f18004fe4dd1b82
SHA1 8cc87e7659b5df2d73bf3710cb79305f72a126cd
SHA512 07a754fd9cacf7ba7d18e0a17f4ed1b3e8a55e2b068658d431ba03af6e771aa1c83cf1bb5aca2ce32b80c55d100afeb099cc905a6857976eb1c7ffce98de4f86
SSDEEP 6144:pQWoSEAjnfWPfx4++kw/+siWYwGV/Ah1G/AcQ///NR5fn:pQWiAjnfWPfx4++k2YM/Nv
TLSH
T1326452292A3409EACDED1FB5AE1259D86191E9F014F1E13E6123DFDCE8E4DA2DD04F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cbqlpabf.exe

Path C:\Windows\SysWOW64\Cbqlpabf.exe
Size 320KB
SHA256 a7f9e16289b75fc9b0a93ee55c8eb3175778897c90b61908db820656115601cf
MD5 abc4337cbb5392e86add8b2b0f824103
SHA1 179b1319d8d64c985e35199f9dc25ea8e49045b9
SHA512 14273ac17f572be2d463640607c1d23c5cbe5e43aa345c32fa4c03df8c4b40b4a8f2a67d2147f322c6d843982c5d01c05313de536475eabf3347b02f42c45629
SSDEEP 3072:HcrXcgAqRP2WwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:HM7A/WV/Ah1G/AcQ///NR5fn
TLSH
T1FF6441192A7409EACDED2FB5AC0259D85181E8F018F1E57E2123DFDCD8E4DAACC19F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Chpangnk.exe

Path C:\Windows\SysWOW64\Chpangnk.exe
Size 320KB
SHA256 27f6bb73e4f78fd1e05b514e462d3d8007ef5e8c2354a82e90796822fde99be6
MD5 8f4acdad98703044e52fc4342e74f560
SHA1 97ebb158b286ba8ddecb8d0112e5bfa947f18421
SHA512 9925e461e450cd6fa0612480e01223bdfe2f8110e3911a615f0135749e627f7140184d55bb0543e2442de116c0faeaa13db7b2564c95862e59532ec404ae053a
SSDEEP 3072:/omkKhqqdOwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:GbqdOV/Ah1G/AcQ///NR5fn
TLSH
T17E643F1A263409EACEED1BB5AC228DD85141E9F014F1E13E6923DFDCD9E5DA2CC45F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Daolgl32.exe

Path C:\Windows\SysWOW64\Daolgl32.exe
Size 320KB
SHA256 89e68760d6b0e818b56188adb6246e126549526520c3a2f909440d696410afbf
MD5 bde4e3b34409a776255e7d9d4bb8419d
SHA1 87e37821e1580fe7a0a12fabedab54fb180c72a6
SHA512 6c56988be0de8a517d50a898612e0abd86d496c40de1385e234612cf983ee182915c0f103d8b2e19c48d27bf1969cad8d435a80a8fd3825c7717d72786911642
SSDEEP 3072:hhRyQcTYQfMdEjQkwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:hhRymQfMqQkV/Ah1G/AcQ///NR5fn
TLSH
T1B9642F1A2A3009EACEED1FB6AD1249D85181E9F015F1E13E6127DFDCD8E4DA3D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dbjofp32.exe

Path C:\Windows\SysWOW64\Dbjofp32.exe
Size 320KB
SHA256 20526760b7cf5a6af388f0d70bf973671bae51ec6ac4749ff7caeae962abcb19
MD5 8e5d661c27ca1b39fdba357810302346
SHA1 4415480feabdd0cbf04395b69e72654e1c31cdba
SHA512 26d4f6f39834edf9f9e35d8e67f02e52da0c77212839c71e90e923f5f9c1578902e927dab61e5a4d6484dff5086b78a12a903eea095149d89fa3e694e198aa73
SSDEEP 3072:SrkM8OkgeOF3WD8ZLvOrTwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:V4D30TV/Ah1G/AcQ///NR5fn
TLSH
T1B464DA592A3149EACEED1BB6AD025DD89141E8F014F1E13E6933EFDCC9E4DA2D814F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dccbln32.exe

Path C:\Windows\SysWOW64\Dccbln32.exe
Size 320KB
SHA256 14fd8b03052993ad81b0f61079bf59ecf448d802759cc71a20b7a04d4282f00b
MD5 18f1ca243bed8a263e78b3c71b25107b
SHA1 ca6feef101f12732ab2cf2f443d69e71e905023a
SHA512 0f6876f62bc8f1875a81efaeab7ab27c40780628824e8cf240532df819ba982048406004402d3d3b56ffbc1921d4769b835e80bb39dd2d14ec7e6ad8a13fc8b3
SSDEEP 3072:WQddkntFmNwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:WMkKNV/Ah1G/AcQ///NR5fn
TLSH
T1D0642E592A3009EACEED1FB5EC1259D89142E9F054F1E23E6123DFDCD8E4DA6C819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Deoabj32.exe

Path C:\Windows\SysWOW64\Deoabj32.exe
Size 320KB
SHA256 92de0b5d52474526facfd4e2ea2dcb3fbd5aadc61fff95cd5e73b5e91945e88b
MD5 631a5f23dd3d4ef62bdf3af4a6fea039
SHA1 8168b0444c46b2f4e33017a5096a72b8ccbe2ed2
SHA512 18b8b6a13c129418a4e9d1dd0a13d096ad0e4883ff06772c31c5939bc175738ce7e456bd93104fc4fee5338e325e5a43c7bd6157e49c356ac7e2d54d04f29133
SSDEEP 3072:GHBTmykkaDPGo49geeVx2wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:DtZeWx2V/Ah1G/AcQ///NR5fn
TLSH
T13B64C819267409EACEEE1BB5BC124DDA9141E8F014F5E23E6167DFDCD8E4DA2CC09B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dhidcffq.exe

Path C:\Windows\SysWOW64\Dhidcffq.exe
Size 320KB
SHA256 617e9195e56be2bb9462c2815cd8881271e44282771cdc4894ad6c5b6c1b686c
MD5 24f42c3aa292a2b250300e6d3968437e
SHA1 e98108fcb700f91fcb672029dd2963f65247ecd1
SHA512 d97c8ba8580c3ceebf467404d43eaf33260e1e47cf7903d8b3ffea994b56b17cbe69ec4c79e428cd44ad4350b3bb32cc6ef4f79c02ec49c9fd89a3905df63417
SSDEEP 3072:badqPSXc841qV0wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:2dqPSs84sV0V/Ah1G/AcQ///NR5fn
TLSH
T1646430192A3489EACEED5BB5AC2259D89141E9F214F1E13E6523DFDCC8E4DB2D804FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dlijodjd.exe

Path C:\Windows\SysWOW64\Dlijodjd.exe
Size 320KB
SHA256 d4bb66bd6700b2a7dbecd51b4b02d039d41a582cdb3e580be8712708d52c3f25
MD5 d5a7a3b88a711f156450abda5f0d745d
SHA1 fea0e247181bd4170ae83a83cbb51a917cb98ea0
SHA512 4895f3d518570e18ac90a3a11f068b3d27e219edb8611a570acc2a915afb9cbd6650c0f361d9d5ceb581a4f65be214bce62b318f5d548811b12180eb950abe87
SSDEEP 3072:qn7HQoOWedmdvHxwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:q7H0RMHxV/Ah1G/AcQ///NR5fn
TLSH
T11064421926350DEACDEE1FB5AC1289E85141E6F018F2E13E5163DFDCD8E4EA6D818F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dlpgiebo.exe

Path C:\Windows\SysWOW64\Dlpgiebo.exe
Size 320KB
SHA256 3aed24063ad771512d3f7a1ffe54c6e92a3dc90299982603f78c89588d02471e
MD5 056916f0474ce55298739788e2aaeb08
SHA1 61318ad8a6d1f13adaeef8d05e02ca2ab0691319
SHA512 2ad68de002dfef9f44ff863e99aefa44810de600d9b18e6cc93bc0b2668a783ab7e43d8a39a4aae1dd4146b4d24e6cbca13181d0cef9fa2fd390244d39cebf5a
SSDEEP 3072:qlsz7tEhDqiShzGOci2wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:kWiShT2V/Ah1G/AcQ///NR5fn
TLSH
T14D64EA1926340AEACEED1BB9AC125DD85282EDB014F1E13E6123DFDDD8E4DA2CC45F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Doeifpkk.exe

Path C:\Windows\SysWOW64\Doeifpkk.exe
Size 320KB
SHA256 808b01865b23d6adf9c62c0cbec76a513efc1096c92500e42271e18e32f7322f
MD5 94d3f6bbaccc732bf310fd394db98a35
SHA1 721eee8450677955529a87f71835fd2359120369
SHA512 b8c325d844bbdcba1e23f1f6f92ecd40d71a6a70489a3b5b767e6fb5680012c6e949e4d7e1ad3080818cea65bd84e963fef4af6ea9c97ad5ff4c717a82f1d9bc
SSDEEP 3072:6Nc4z4CfepywS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:oXOyV/Ah1G/AcQ///NR5fn
TLSH
T1D7643019263409EACEED1FB6AC0249D89181E9F114F1E13E6123DFDCD8E4DB6E825F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eamhhjbd.exe

Path C:\Windows\SysWOW64\Eamhhjbd.exe
Size 320KB
SHA256 678dad93bab05e37c37cfde3ad27d61782af5131f891e011f26eabf0f0ee191a
MD5 4dd26531a27316fb5637454640adb9d1
SHA1 32cf15a60685975aa45660651d2fde9927f037d1
SHA512 86bd4ab57830a74c12901d969ded43aa036e49631e3b79b7797e5ece864e0f53e858e48c7e04dd7cf117472b1e522649520649891b09b08e937d785207121100
SSDEEP 3072:znWdjtBPyDB4FZwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:zn0TyVkZV/Ah1G/AcQ///NR5fn
TLSH
T1CF6451191A3009EAEDED1BB5AC1359D88581E8F014F2E13E6923DFDCC8E5DA2CC56F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ecmebm32.exe

Path C:\Windows\SysWOW64\Ecmebm32.exe
Size 320KB
SHA256 04fa5ed68afb42bc385c0b667e296e51e102b4c3756821e5d53be672f317e33b
MD5 b865513f0e41c14d06bf1fafa2a4cb69
SHA1 18858c6d0c84b4df13637a85c8bbc3de2db3ea28
SHA512 8ff2cd1a49307aadafb3e1bc7c49f23f6bb62a716a121f4fa2b628630af45c1ef1f79e7a792f5da4ba2d5f1630cc423ad101f2916d3fb17b1db64df80060e9b9
SSDEEP 3072:nIHZadZj5ZKbAb0oSqwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:n8ZaHFxIoSqV/Ah1G/AcQ///NR5fn
TLSH
T147640D19263409EADEED1BB6AC124DD89181E9F014F1E13E6623DFDCD8E4DA6C819FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Edgkif32.exe

Path C:\Windows\SysWOW64\Edgkif32.exe
Size 320KB
SHA256 4da03fe85a3425dceec4e90b33dfc4ac4232e387cbb563c3051c0fceb0cad506
MD5 d82abf17a889f603869efa8ecd608b31
SHA1 48bda0769a711816b3627e58de0f37de2bf46114
SHA512 be20639013a6bbe333c8de921004b4bf12e48aa7aee3a10990bf938afa3024b5536367f767239bb5862d04410bd879cc285756328b65de7ef81df48a01bd10db
SSDEEP 6144:cxrvWvXFD2v3znzqV/Ah1G/AcQ///NR5fn:cxruvXFm3znz/Nv
TLSH
T11564321A17740AEADEEE1FB5AC0259D85181E5F014F1E63E6123DFDCD8E5DA2C809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eefhcimp.exe

Path C:\Windows\SysWOW64\Eefhcimp.exe
Size 320KB
SHA256 d16118fc8645533e526c775a918936b113731609ee13ea4dffea363d849333d3
MD5 0379d39d4f9f1a1a6df88901d8d87f9b
SHA1 5ffd7ac57e89f638ffdda7893bcb6cd3081caee0
SHA512 58c0bba8e03acd464d290faa22c1749e6e20606dba5f33d6fff93674bc2ab147c0a28dd9b56c8951f76946b09c0624c32a52af6a4f2ed86dfd6a70efdbfa7273
SSDEEP 3072:CBvu26ukx4GXVLAH2wmCBTwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:CBvs7x4GF+waTV/Ah1G/AcQ///NR5fn
TLSH
T15D642059263409EACEED1FB6AC1249DC9585E9F014F2E13E6123DFDCD8E4DA2D809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ehgqed32.exe

Path C:\Windows\SysWOW64\Ehgqed32.exe
Size 320KB
SHA256 6d328aac2241adf5bf5aab527dd3854379f88140ac9ff68cc70358270283a071
MD5 1944b6bd7e27cee65ec5ed34d266fa33
SHA1 7a4772e8ee76de337f61b7ab45ade44da9d53eeb
SHA512 0b0554bcf34c8dcd89afad0afd8acf835d1e0828bab7d772672333c8778ce504f6f473692be55fb6290cdcb30061323d5e1bbd4588e9cdeacd3a5e9058c0e138
SSDEEP 6144:4tBQGNALCbGdbNpNV/Ah1G/AcQ///NR5fn:oBQGNQNdbNO/Nv
TLSH
T1C964302926310DEACDED1BF5AC2289D89181E6F124F1E17E6127DFDCD8E4DA2D805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ehimkd32.exe

Path C:\Windows\SysWOW64\Ehimkd32.exe
Size 320KB
SHA256 6706a64b0d21afb7c254b057a242e640a29e672abd4b24b44f5913bea634df91
MD5 e5212392aac79161207268cd24b45083
SHA1 8d41fe9e4a4f936058c7c32d5d4ef744435813d6
SHA512 883092d0b486cbba060fda0d6375f706393d74583a3b706fc0faa83239374b6d53991f76a22bac29b87b121bfc8b2e4f4b4eece2e61eb8f23dd598fd1020fb0e
SSDEEP 3072:abPotOmnxUD04hIkwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:6ia52kV/Ah1G/AcQ///NR5fn
TLSH
T12B641D1926340AFADEFD1BB6AC9249D85181E9F014F1E13E6123DFDCD8E4DA6C825F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ehpjdepi.exe

Path C:\Windows\SysWOW64\Ehpjdepi.exe
Size 320KB
SHA256 4bae4f9dc38e114eceac3d3db317e5d3d02bb12cd7ca895edda06cc773603797
MD5 d637ef50aff5b9a9bf68f78f06cc0718
SHA1 18f498d173dd134c6df6bc68a2da7507f00e87b5
SHA512 fb9ce8132ae609e9c5d1f75502365836fb52e6fd8caa411411f5783cf98ef67f7c2600a3f01f0dbc031ba3c2621be2e16b2f444b265d4d96ad17735852321d5e
SSDEEP 3072:Ack4zaIeVNWf23mwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Acla/VQf23mV/Ah1G/AcQ///NR5fn
TLSH
T197642E5A263449EACEED1BB5AC0249D89181E9F015F5E13E6133DFDDD8E4DA3C809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ekqcfpmj.exe

Path C:\Windows\SysWOW64\Ekqcfpmj.exe
Size 320KB
SHA256 27ffb2e08924954e0789938370c48ca061e7140e5984c06af8f52e925a4f4f80
MD5 083a68af146eb87b401d540b066541fc
SHA1 d9e2e9af3ed03f5f98d4ba248ff8bef6ed359ed2
SHA512 1e2639b77c87e6511aee573c095880555ae45080110261134e1cd513bcbcf6f5b5b52e52c2719d20fc42959085f7ea55a1d3e90f07585e226df0522012e10d8d
SSDEEP 6144:BHALE+G1TYXtP3Jja7gstyV/Ah1G/AcQ///NR5fn:BH8GiXq/Nv
TLSH
T141641D192A3409EADDED5BB9AC0269DC5141F4F014F1E23EA123DFEDE8E4DA2C855F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Elpppcdl.exe

Path C:\Windows\SysWOW64\Elpppcdl.exe
Size 320KB
SHA256 108cbf88c032cd8033b10c1993a5ecff2d3f0cf828b042c8e7e75834f5610d7f
MD5 97f472a5097cbfc10efce7c1d792e33c
SHA1 1c8805a2e3c0ac2fae6d4e6e73fe0c0778b44ba5
SHA512 25374de7d873b3c6b72bb6a24365760191e82d5cb2ca2b398bef38e9bebef2fb6c0d9a1cea6ac5cf3a55344631d0c4d8e50624e355ff062da006958dd8b469ab
SSDEEP 3072:tmbedmgsmZ+ir3Sq95wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:PWJir3S85V/Ah1G/AcQ///NR5fn
TLSH
T188643115263009EADDFD2FB6AC0249D89641E9F015F2E17EA167DFDCC8E4DA2D814F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eocegn32.exe

Path C:\Windows\SysWOW64\Eocegn32.exe
Size 320KB
SHA256 9914bd6554deaf1747e462d0bc10ea8aea400bda6f6f73ab4974d92c6915dc4a
MD5 1ad30718b4efbca2f585cf67ea03cf00
SHA1 0f10cb29737b376958a58685c89488e6e1a99628
SHA512 1dda817119ec8d739bd28f607e974c94e27bb6f08cdae45fc30d62cf6eb6ef566e8b7aac2c39222eb4db766e1cd6bd83a5e959caa1369c0fd3c9a7256f527888
SSDEEP 3072:s11aZ8G2z4YokvbUpqB7GnNvHwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:vZLCspYGhHV/Ah1G/AcQ///NR5fn
TLSH
T196643F192A3419EBCEED1FB9AC1249D89141E9F014F2E23E6123DFDDD8E4DA2C915F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eojcao32.exe

Path C:\Windows\SysWOW64\Eojcao32.exe
Size 320KB
SHA256 0463736a1af9e0a2e40f13fa6738ee3305e1d739977a05cba181bdc34424bbed
MD5 08e31b392301450b18d98848d79fb96a
SHA1 428b1ff0291408859ef392cb8b1b2c39a59e5e72
SHA512 aa70eacc2aa79025c2005412c303ba720cce249b4e1726789c0878a7e04322dcfebdc9eed02bdcb0c143a5fb7a1b2e29ef7a91106f5c1d5288987cd4a99d1c73
SSDEEP 3072:SiCtdzLgZSYKqD3bYwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:kwZd3bYV/Ah1G/AcQ///NR5fn
TLSH
T17D6400192A340DEACDED1BB5AD1349E89185E9F018F1E23E6123DFDCD8E4DA2D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fbkdjh32.exe

Path C:\Windows\SysWOW64\Fbkdjh32.exe
Size 320KB
SHA256 9d0d2b8d86becbf4d724ecc3728af1178a279a74572342be23975f085d6a1793
MD5 09c2d61c1e17f1196f12afd27e2b32f5
SHA1 58a63ae68fa771b2597d7d83bc3ab87cb5082343
SHA512 f261e296a559251c5f4b847695e91f584049311faf1bccac68a62e773eab8626e95dd9b0edd8df2735b1ca11c50b7029e48f4d3d79a85ddc956d7053e8e4f490
SSDEEP 3072:XUtjCken1PnDud2xq0tSy7wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:XJ1LudN0cy7V/Ah1G/AcQ///NR5fn
TLSH
T125643119263019EACEED1BB5AC1349D89141E9F014F1E23E6633EFDCD8E4DA6D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fdbked32.exe

Path C:\Windows\SysWOW64\Fdbked32.exe
Size 320KB
SHA256 6c64bb883de1c7a9ce858869f426d30b8b6ad1c401021e6e43ce1fe95548e49d
MD5 6493ee4879ecb49f21daf99aeb2d38b1
SHA1 4a84890aecbf579f5a33ddcfbd847b33b24a07a6
SHA512 04464e1bb36650832716f21a74d514ab69ccfa222172ae14a930121a90f0f712241bd499f6e68bf356c66fb48a84253cf884b246d53319d2feecb2a4c8d919de
SSDEEP 3072:7okh3KQXwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:7RdvXV/Ah1G/AcQ///NR5fn
TLSH
T15664FE19263449EACDED1FB5AD134AD85142E9F124F1E13E6123DFDCD8E8DA2C81AF81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fdpnpe32.exe

Path C:\Windows\SysWOW64\Fdpnpe32.exe
Size 320KB
SHA256 29e0319df631e1bbb0909da4453fef5219568989e175f31b983d0874135e1a99
MD5 ccc28186c1dbaaa739e22c518d32ef44
SHA1 4dd96104f3c234443e2221f5633a6e1c3529374f
SHA512 7f8abb7896e823bc5b7510e6ab37c5790effa09ff782ccdae052a92d46a90cbd175174e6a5879ff0a0c5582aa1657bf8be342786386817011072c49a490746a6
SSDEEP 3072:7rqNx/OcwMhxZwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:7rlcp7ZV/Ah1G/AcQ///NR5fn
TLSH
T1C9641F2A2A340DEACEED5BB5AC1249D89141F8F414F1E13E6123DFDCD8E4DA6E815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ffbgog32.exe

Path C:\Windows\SysWOW64\Ffbgog32.exe
Size 320KB
SHA256 1dcc3c92ee66cd49ff277fa683a130cb012a4182b8e40b48c445797ae6cb4349
MD5 e27ee2f97a77d007c392c486c9fa5911
SHA1 fbfba9ea1a300500fe6a61047b0f4788339fcb9e
SHA512 698656b7a10d150a55503a04721d0ac0b6a836ba8e7a4ba964d758c95e166f2fdbccf9c91ee8b66afc12b401c66ee25e7eb610551466315f3d0d0c1d431b4e92
SSDEEP 3072:KJ2qSFD8FUykwaWwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:KQqSd8FUMHV/Ah1G/AcQ///NR5fn
TLSH
T16864411A263409EACDED2FB6EC125AD85185E8F014F1E53E6123DFDCC8E5DA2C825F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ffdddg32.exe

Path C:\Windows\SysWOW64\Ffdddg32.exe
Size 320KB
SHA256 d2a5f5fd387a12e76fe10ddb09515195209eb811c4f5afa5ad26211b1ea92b40
MD5 4c7c9886185471ff6ce586b565c356ff
SHA1 638be04dc1e1a96616ef003efb3f97e6e82be7b8
SHA512 ee3bf345c728309a28edfcbf82804b2d09f7de386fb3017abf522624db5e9c8a64dec192949e5de16e53828fcddea6e43d94665d8119deb3f2b42ed1550880eb
SSDEEP 3072:CaTFQilBfbXZdOwso46+twS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:hTFPPfbpdV4ZtV/Ah1G/AcQ///NR5fn
TLSH
T14464EB1A2A3409EACDED1BB9AC5649D89142EAB014F1E13E6137DFDCD9F4DA2CC05F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fkalmn32.exe

Path C:\Windows\SysWOW64\Fkalmn32.exe
Size 320KB
SHA256 bf6d651ca15c3cba508a9697b17fb23a38fe54aea26398f2ee59a433deabce14
MD5 b660bb2aebbbb1a7e0fa56d942396f7b
SHA1 eddd87e4ff4834ae996ac9ee4b4792dfa1c53371
SHA512 3e7eaf7b47118fd43c0a111cf11493446df9584ae7cb7481e240803c3f8bdd9f360bf49d21227914832f5f13a9cb763d02210c6b330caab07726db79960fda0f
SSDEEP 3072:4WBpb2Ykv/0MPO4wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:nVSMmO4V/Ah1G/AcQ///NR5fn
TLSH
T141642E196A3019EACEED1FB5AC224AD89181E9F014F1E13E6127DFDCD8E4DA3C815F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fkopgn32.exe

Path C:\Windows\SysWOW64\Fkopgn32.exe
Size 320KB
SHA256 c4bd5c55f4d28b5a5feca557e627041f15d8fb98b02cc53ed63ae5be5ce07b56
MD5 ae7b03de90772f822f096fd2b16bb6f6
SHA1 67dce2f8dab9a19918ebfcb75031a8e045257094
SHA512 c75e0b446ea3c30122f791adc4f54eac8084ca79d0f7832837d3099e105fc021975ed4e407696bc08e8846026a6b4f1b7035488c5bf19615a8733e1816d21c95
SSDEEP 3072:v4u9JybaLKBW2usUwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:QuHyGmQ2nUV/Ah1G/AcQ///NR5fn
TLSH
T16E64DB192A740AEACEED1BB6AC0249D891C6E5F014F1E13E6523EFDCD8E4D66D805FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Foebmn32.exe

Path C:\Windows\SysWOW64\Foebmn32.exe
Size 320KB
SHA256 829ca82568eb4220bf6def32f1b402bc4d98ff3148bd6155fdf6b6793eb1ea94
MD5 f1d9e6780cf0a2e207609aa25dd0c96c
SHA1 08d536113337f245ac7c13ee3afbc6cabd676f68
SHA512 534f1f8d067f535a5773a6d6c92ea14b10f17621b2d971883e3ef5f3495e37b0815b2fd491eb4e7c486829822389bfe94c9458e7e4caf12f35829823367e7356
SSDEEP 3072:jYXV6nQpTiJFdwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:jYXwyQFdV/Ah1G/AcQ///NR5fn
TLSH
T127643D1A2AB409EACEED1BB6EC1349D85181E8F015F1E13E6123DFDDD8E4DA2C815F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fohobmke.exe

Path C:\Windows\SysWOW64\Fohobmke.exe
Size 320KB
SHA256 0ab3e81218cbfabc4fe47fa247f22720e6039798bf204926db24dc47ddd694ae
MD5 e1e91b46e5a84f3fe84cbe36acd94f66
SHA1 2759d889809a78bc9cd4122fe92c59e9f348cac5
SHA512 0104aa54aca92c5e4c906301450269489e8880b0cc09b916c6a49f0de3c07c7fe9c0be7a450359b0bab8304abb304b9520d02a1c782adfe90c2935ec770a01ed
SSDEEP 3072:xU43IOx0Vv9kx1SwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:EGx1SV/Ah1G/AcQ///NR5fn
TLSH
T1C9643F191A3409EADEED5FB5AC1249D85141E8F018F1E13E6923DFDCD8E8DA6C824F89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/8-507-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/8-49-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/124-370-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/248-64-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/464-395-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/776-70-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/972-235-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1044-466-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1108-154-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1144-461-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1188-203-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1300-435-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1556-340-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1572-300-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1688-496-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1700-472-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1704-255-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1736-375-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1920-196-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1972-175-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2032-140-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2068-275-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2168-22-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2168-483-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2308-425-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2384-502-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2500-133-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2652-460-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2652-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2652-1-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/2676-210-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2820-315-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2868-477-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2868-14-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2884-440-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2976-217-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3020-400-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3028-335-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3216-305-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3236-189-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3256-365-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3320-355-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3404-380-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3408-320-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3576-280-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3592-77-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3644-105-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3672-126-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3744-265-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3748-168-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3908-455-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3944-471-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3944-7-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4060-310-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4080-161-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4088-360-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4128-270-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4144-420-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4196-486-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4204-410-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4260-501-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4260-42-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4448-445-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4476-224-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4496-29-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4496-489-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4552-495-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4552-35-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4684-56-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4752-230-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4768-450-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4788-345-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4792-119-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4820-390-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4832-290-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4912-260-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4920-112-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5012-350-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5020-385-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5068-240-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5096-478-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5100-84-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5136-405-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5204-250-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5388-325-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5408-182-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5412-147-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5584-415-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5604-285-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5612-245-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5696-295-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5820-98-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5912-330-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5944-91-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5988-430-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6008-490-0x0000000000400000-0x000000000046D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads