berbew | d437b2b7e6bcbc35c9e2776f220df2865ab5a95637b7d34f6cddd8530e126966

Analysis

max time kernel
148s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 16:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_c3b55c085a58d78582d82fe9ad9bc4e2_elex_wannacry.exe
Size 320KB
Sample260803-vg29vsfp31
SHA256 d437b2b7e6bcbc35c9e2776f220df2865ab5a95637b7d34f6cddd8530e126966
MD5 c3b55c085a58d78582d82fe9ad9bc4e2
SHA1 89089da6a648d73e07bdad2ba1e79812ca49404e
SHA512 d8b3adc116c5d75aceb619fe31edb7fea616beea3fe16960e530c2516b2e5fe6f86ec664abfe29b5a7e8d276b472526f412894544af03654a096de8a1e2363be
SSDEEP 6144:sLnBzJWwiMHr6SIV/Ah1G/AcQ///NR5fn:MnBl3pOQ/Nv
TLSH
T11D642F19263809EACEED1BB5AD124AD89181F9F114F1E23F6123DFDCD8E5DA2C815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hnpaec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jdopjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kocphojh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibpgqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Llkjmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibgmaqfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jejbhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Koimbpbc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilfodgeg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibpgqa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gcqjal32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hejjanpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jaemilci.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ledoegkm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilkhog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jhkljfok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hjfbjdnd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ilkhog32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibdplaho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jdjfohjg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jlkafdco.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lknjhokg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hkcbnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ijbbfc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jehfcl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Khabke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Khfkfedn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdpiqehp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Llimgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lbhool32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hannao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ijmhkchl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jnnnfalp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klmnkdal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Llngbabj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibnjkbog.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iccpniqp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hgcmbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kefbdjgm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbqinm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iabglnco.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hegmlnbp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkgdhp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llimgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lhpnlclc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llngbabj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hnpaec32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jacpcl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbhool32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iapjgo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klmnkdal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iajmmm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjgkab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdhbpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kkegbpca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gcqjal32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iapjgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jlidpe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ijkled32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iagqgn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kemhei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lknjhokg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hjaioe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbijgp32.exe

Executes dropped EXE 64 IoCs

pid	Process
2796	Gbpnjdkg.exe
4048	Gcqjal32.exe
3696	Gglfbkin.exe
4200	Hgcmbj32.exe
4264	Hjaioe32.exe
3852	Hbiapb32.exe
4528	Hegmlnbp.exe
2984	Hgeihiac.exe
1808	Hnpaec32.exe
2380	Hbknebqi.exe
2600	Hannao32.exe
3196	Hejjanpm.exe
3408	Hghfnioq.exe
2104	Hkcbnh32.exe
1824	Hjfbjdnd.exe
3608	Ibnjkbog.exe
1768	Iapjgo32.exe
4584	Ielfgmnj.exe
2088	Igjbci32.exe
4340	Ilfodgeg.exe
3520	Ijiopd32.exe
4708	Ibpgqa32.exe
2220	Iabglnco.exe
4784	Icachjbb.exe
4676	Igmoih32.exe
4064	Ijkled32.exe
552	Infhebbh.exe
4752	Ibbcfa32.exe
3276	Ieqpbm32.exe
2868	Iccpniqp.exe
5000	Ilkhog32.exe
368	Ijmhkchl.exe
3808	Inidkb32.exe
2836	Ibdplaho.exe
3812	Iagqgn32.exe
1484	Icfmci32.exe
4444	Ihaidhgf.exe
1760	Ilmedf32.exe
2528	Ijpepcfj.exe
2224	Ibgmaqfl.exe
3092	Iajmmm32.exe
2584	Idhiii32.exe
4488	Ihceigec.exe
3928	Ijbbfc32.exe
5052	Jnnnfalp.exe
4400	Jbijgp32.exe
2640	Jehfcl32.exe
3772	Jdjfohjg.exe
4092	Jhfbog32.exe
4812	Jjdokb32.exe
4028	Jnpjlajn.exe
4148	Janghmia.exe
4192	Jejbhk32.exe
4184	Jhhodg32.exe
4904	Jldkeeig.exe
3956	Jjgkab32.exe
3304	Jbncbpqd.exe
4748	Jaqcnl32.exe
4100	Jdopjh32.exe
1072	Jhkljfok.exe
636	Jlfhke32.exe
4948	Jnedgq32.exe
3716	Jbppgona.exe
2552	Jacpcl32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Hbknebqi.exe	Hnpaec32.exe
File created	C:\Windows\SysWOW64\Lqcnhf32.dll	Ilfodgeg.exe
File created	C:\Windows\SysWOW64\Ibbcfa32.exe	Infhebbh.exe
File created	C:\Windows\SysWOW64\Mjfkgg32.dll	Jbijgp32.exe
File created	C:\Windows\SysWOW64\Eepbdodb.dll	Jhfbog32.exe
File created	C:\Windows\SysWOW64\Ekheml32.dll	Koljgppp.exe
File created	C:\Windows\SysWOW64\Llimgb32.exe	Lhmafcnf.exe
File created	C:\Windows\SysWOW64\Epaaihpg.dll	Ihaidhgf.exe
File created	C:\Windows\SysWOW64\Jdjfohjg.exe	Jehfcl32.exe
File created	C:\Windows\SysWOW64\Khihld32.exe	Kdmlkfjb.exe
File opened for modification	C:\Windows\SysWOW64\Lkiamp32.exe	Klgqabib.exe
File opened for modification	C:\Windows\SysWOW64\Llimgb32.exe	Lhmafcnf.exe
File opened for modification	C:\Windows\SysWOW64\Lojfin32.exe	Lknjhokg.exe
File created	C:\Windows\SysWOW64\Gccebdmn.dll	Igjbci32.exe
File created	C:\Windows\SysWOW64\Iojnef32.dll	Igmoih32.exe
File created	C:\Windows\SysWOW64\Ofbmdj32.dll	Ibbcfa32.exe
File opened for modification	C:\Windows\SysWOW64\Jehfcl32.exe	Jbijgp32.exe
File created	C:\Windows\SysWOW64\Kefbdjgm.exe	Kbgfhnhi.exe
File created	C:\Windows\SysWOW64\Hbiapb32.exe	Hjaioe32.exe
File created	C:\Windows\SysWOW64\Iajmmm32.exe	Ibgmaqfl.exe
File opened for modification	C:\Windows\SysWOW64\Idhiii32.exe	Iajmmm32.exe
File created	C:\Windows\SysWOW64\Jjgkab32.exe	Jldkeeig.exe
File opened for modification	C:\Windows\SysWOW64\Jhkljfok.exe	Jdopjh32.exe
File opened for modification	C:\Windows\SysWOW64\Jlkafdco.exe	Jhoeef32.exe
File opened for modification	C:\Windows\SysWOW64\Khfkfedn.exe	Kdkoef32.exe
File created	C:\Windows\SysWOW64\Aomqdipk.dll	Kopcbo32.exe
File opened for modification	C:\Windows\SysWOW64\Hannao32.exe	Hbknebqi.exe
File opened for modification	C:\Windows\SysWOW64\Iapjgo32.exe	Ibnjkbog.exe
File created	C:\Windows\SysWOW64\Jlidpe32.exe	Jhmhpfmi.exe
File created	C:\Windows\SysWOW64\Jaemilci.exe	Jbbmmo32.exe
File opened for modification	C:\Windows\SysWOW64\Klgqabib.exe	Kdpiqehp.exe
File opened for modification	C:\Windows\SysWOW64\Ibpgqa32.exe	Ijiopd32.exe
File opened for modification	C:\Windows\SysWOW64\Ijmhkchl.exe	Ilkhog32.exe
File created	C:\Windows\SysWOW64\Jbijgp32.exe	Jnnnfalp.exe
File opened for modification	C:\Windows\SysWOW64\Kdhbpf32.exe	Kefbdjgm.exe
File opened for modification	C:\Windows\SysWOW64\Infhebbh.exe	Ijkled32.exe
File created	C:\Windows\SysWOW64\Loemnnhe.exe	Lkiamp32.exe
File opened for modification	C:\Windows\SysWOW64\Ldfoad32.exe	Ledoegkm.exe
File opened for modification	C:\Windows\SysWOW64\Ibdplaho.exe	Inidkb32.exe
File created	C:\Windows\SysWOW64\Jnedgq32.exe	Jlfhke32.exe
File created	C:\Windows\SysWOW64\Kongimkh.dll	Jbncbpqd.exe
File created	C:\Windows\SysWOW64\Jdopjh32.exe	Jaqcnl32.exe
File created	C:\Windows\SysWOW64\Jbppgona.exe	Jnedgq32.exe
File created	C:\Windows\SysWOW64\Elmoqj32.dll	Jbppgona.exe
File created	C:\Windows\SysWOW64\Kaaldjil.exe	Kocphojh.exe
File created	C:\Windows\SysWOW64\Ldikgdpe.exe	Lbhool32.exe
File opened for modification	C:\Windows\SysWOW64\Hegmlnbp.exe	Hbiapb32.exe
File created	C:\Windows\SysWOW64\Hjfbjdnd.exe	Hkcbnh32.exe
File created	C:\Windows\SysWOW64\Qbddhbhn.dll	Ihceigec.exe
File created	C:\Windows\SysWOW64\Gpejnp32.dll	Jogqlpde.exe
File opened for modification	C:\Windows\SysWOW64\Jaemilci.exe	Jbbmmo32.exe
File opened for modification	C:\Windows\SysWOW64\Jhoeef32.exe	Jeaiij32.exe
File opened for modification	C:\Windows\SysWOW64\Kejloi32.exe	Kaopoj32.exe
File opened for modification	C:\Windows\SysWOW64\Loemnnhe.exe	Lkiamp32.exe
File created	C:\Windows\SysWOW64\Flbldfbp.dll	2026-08-03_c3b55c085a58d78582d82fe9ad9bc4e2_elex_wannacry.exe
File created	C:\Windows\SysWOW64\Hghfnioq.exe	Hejjanpm.exe
File opened for modification	C:\Windows\SysWOW64\Ibnjkbog.exe	Hjfbjdnd.exe
File created	C:\Windows\SysWOW64\Balfdi32.dll	Jejbhk32.exe
File created	C:\Windows\SysWOW64\Ifkqol32.dll	Jlkafdco.exe
File created	C:\Windows\SysWOW64\Khabke32.exe	Kdffjgpj.exe
File created	C:\Windows\SysWOW64\Kongmo32.exe	Klpjad32.exe
File opened for modification	C:\Windows\SysWOW64\Kkegbpca.exe	Khfkfedn.exe
File created	C:\Windows\SysWOW64\Ompbfo32.dll	Hghfnioq.exe
File opened for modification	C:\Windows\SysWOW64\Icachjbb.exe	Iabglnco.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6016	3876	WerFault.exe	208

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kefbdjgm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klpjad32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kkegbpca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kaopoj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hgcmbj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iapjgo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibbcfa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kemhei32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hghfnioq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jdalog32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdffjgpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_c3b55c085a58d78582d82fe9ad9bc4e2_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlkafdco.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llimgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbpnjdkg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibdplaho.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Idhiii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jbbmmo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kejloi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Igjbci32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jhfbog32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdhbpf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lkiamp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ieqpbm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jacpcl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlidpe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Leoejh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hjaioe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hnpaec32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibpgqa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ihaidhgf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kkgdhp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kocphojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldfoad32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gglfbkin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hbiapb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hjfbjdnd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ilkhog32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khihld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ielfgmnj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iajmmm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Laffpi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iccpniqp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klgqabib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkcbnh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibnjkbog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iagqgn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jhhodg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jjgkab32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Koimbpbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hejjanpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbgfhnhi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbjbnnfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldikgdpe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klmnkdal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kaaldjil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ijpepcfj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jbijgp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jhkljfok.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jbppgona.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jaemilci.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llkjmb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lknjhokg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldbefe32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jnedgq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jlidpe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kdhbpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kkgdhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eqfnqg32.dll"	Kocphojh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kemhei32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lbqinm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eopbppjf.dll"	Ilkhog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jbbmmo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jeaiij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekheml32.dll"	Koljgppp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kocphojh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Llimgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fooqlnoa.dll"	Llimgb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lbcedmnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjpjea32.dll"	Ibpgqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojglddfj.dll"	Jhhodg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbnefjjd.dll"	Jaqcnl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kahinkaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kalcik32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lhpnlclc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdelednc.dll"	Hejjanpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ibpgqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eilbckfb.dll"	Lkiamp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idjcam32.dll"	Lhpnlclc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Najlgpeb.dll"	Llkjmb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	2026-08-03_c3b55c085a58d78582d82fe9ad9bc4e2_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ilfodgeg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jlkafdco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpjkgoka.dll"	Loemnnhe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hjaioe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hbknebqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Igmoih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ibbcfa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kbjbnnfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jbijgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jejbhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elmoqj32.dll"	Jbppgona.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jbppgona.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jbbmmo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lkiamp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gccebdmn.dll"	Igjbci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jogqlpde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfdkqcmb.dll"	Kaaldjil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Logicn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbhkbjdi.dll"	Gbpnjdkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ciddcagg.dll"	Hgeihiac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ihaidhgf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Idhiii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eepbdodb.dll"	Jhfbog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qhomgchl.dll"	Jlfhke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khecje32.dll"	Kdffjgpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kdmlkfjb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hejjanpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgpchp32.dll"	Hjfbjdnd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Infhebbh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Obcckehh.dll"	Iagqgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjmheb32.dll"	Ilmedf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qbddhbhn.dll"	Ihceigec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pceijm32.dll"	Jaemilci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kaaldjil.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jhfbog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndnoffic.dll"	Kefbdjgm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kopcbo32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 2796	3352	2026-08-03_c3b55c085a58d78582d82fe9ad9bc4e2_elex_wannacry.exe	87
PID 2796 wrote to memory of 4048	2796	Gbpnjdkg.exe	88
PID 4048 wrote to memory of 3696	4048	Gcqjal32.exe	89
PID 3696 wrote to memory of 4200	3696	Gglfbkin.exe	90
PID 4200 wrote to memory of 4264	4200	Hgcmbj32.exe	91
PID 4264 wrote to memory of 3852	4264	Hjaioe32.exe	92
PID 3852 wrote to memory of 4528	3852	Hbiapb32.exe	93
PID 4528 wrote to memory of 2984	4528	Hegmlnbp.exe	94
PID 2984 wrote to memory of 1808	2984	Hgeihiac.exe	95
PID 1808 wrote to memory of 2380	1808	Hnpaec32.exe	96
PID 2380 wrote to memory of 2600	2380	Hbknebqi.exe	97
PID 2600 wrote to memory of 3196	2600	Hannao32.exe	98
PID 3196 wrote to memory of 3408	3196	Hejjanpm.exe	99
PID 3408 wrote to memory of 2104	3408	Hghfnioq.exe	100
PID 2104 wrote to memory of 1824	2104	Hkcbnh32.exe	101
PID 1824 wrote to memory of 3608	1824	Hjfbjdnd.exe	102
PID 3608 wrote to memory of 1768	3608	Ibnjkbog.exe	103
PID 1768 wrote to memory of 4584	1768	Iapjgo32.exe	104
PID 4584 wrote to memory of 2088	4584	Ielfgmnj.exe	105
PID 2088 wrote to memory of 4340	2088	Igjbci32.exe	106
PID 4340 wrote to memory of 3520	4340	Ilfodgeg.exe	107
PID 3520 wrote to memory of 4708	3520	Ijiopd32.exe	108
PID 4708 wrote to memory of 2220	4708	Ibpgqa32.exe	109
PID 2220 wrote to memory of 4784	2220	Iabglnco.exe	110
PID 4784 wrote to memory of 4676	4784	Icachjbb.exe	111
PID 4676 wrote to memory of 4064	4676	Igmoih32.exe	112
PID 4064 wrote to memory of 552	4064	Ijkled32.exe	113
PID 552 wrote to memory of 4752	552	Infhebbh.exe	114
PID 4752 wrote to memory of 3276	4752	Ibbcfa32.exe	115
PID 3276 wrote to memory of 2868	3276	Ieqpbm32.exe	116
PID 2868 wrote to memory of 5000	2868	Iccpniqp.exe	117
PID 5000 wrote to memory of 368	5000	Ilkhog32.exe	118
PID 368 wrote to memory of 3808	368	Ijmhkchl.exe	119
PID 3808 wrote to memory of 2836	3808	Inidkb32.exe	120
PID 2836 wrote to memory of 3812	2836	Ibdplaho.exe	121
PID 3812 wrote to memory of 1484	3812	Iagqgn32.exe	122
PID 1484 wrote to memory of 4444	1484	Icfmci32.exe	123
PID 4444 wrote to memory of 1760	4444	Ihaidhgf.exe	124
PID 1760 wrote to memory of 2528	1760	Ilmedf32.exe	125
PID 2528 wrote to memory of 2224	2528	Ijpepcfj.exe	126
PID 2224 wrote to memory of 3092	2224	Ibgmaqfl.exe	127
PID 3092 wrote to memory of 2584	3092	Iajmmm32.exe	128
PID 2584 wrote to memory of 4488	2584	Idhiii32.exe	129
PID 4488 wrote to memory of 3928	4488	Ihceigec.exe	130
PID 3928 wrote to memory of 5052	3928	Ijbbfc32.exe	131
PID 5052 wrote to memory of 4400	5052	Jnnnfalp.exe	132
PID 4400 wrote to memory of 2640	4400	Jbijgp32.exe	133
PID 2640 wrote to memory of 3772	2640	Jehfcl32.exe	134
PID 3772 wrote to memory of 4092	3772	Jdjfohjg.exe	135
PID 4092 wrote to memory of 4812	4092	Jhfbog32.exe	136
PID 4812 wrote to memory of 4028	4812	Jjdokb32.exe	137
PID 4028 wrote to memory of 4148	4028	Jnpjlajn.exe	138
PID 4148 wrote to memory of 4192	4148	Janghmia.exe	139
PID 4192 wrote to memory of 4184	4192	Jejbhk32.exe	140
PID 4184 wrote to memory of 4904	4184	Jhhodg32.exe	141
PID 4904 wrote to memory of 3956	4904	Jldkeeig.exe	142
PID 3956 wrote to memory of 3304	3956	Jjgkab32.exe	143
PID 3304 wrote to memory of 4748	3304	Jbncbpqd.exe	144
PID 4748 wrote to memory of 4100	4748	Jaqcnl32.exe	145
PID 4100 wrote to memory of 1072	4100	Jdopjh32.exe	146
PID 1072 wrote to memory of 636	1072	Jhkljfok.exe	147
PID 636 wrote to memory of 4948	636	Jlfhke32.exe	148
PID 4948 wrote to memory of 3716	4948	Jnedgq32.exe	149
PID 3716 wrote to memory of 2552	3716	Jbppgona.exe	150

C:\Users\Admin\AppData\Local\Temp\2026-08-03_c3b55c085a58d78582d82fe9ad9bc4e2_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_c3b55c085a58d78582d82fe9ad9bc4e2_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Windows\SysWOW64\Gbpnjdkg.exe
  C:\Windows\system32\Gbpnjdkg.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Windows\SysWOW64\Gcqjal32.exe
    C:\Windows\system32\Gcqjal32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4048
  - - C:\Windows\SysWOW64\Gglfbkin.exe
      C:\Windows\system32\Gglfbkin.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3696
    - - C:\Windows\SysWOW64\Hgcmbj32.exe
        
        C:\Windows\system32\Hgcmbj32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4200
      - C:\Windows\SysWOW64\Hjaioe32.exe
        
        C:\Windows\system32\Hjaioe32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4264
        
        C:\Windows\SysWOW64\Hbiapb32.exe
        
        C:\Windows\system32\Hbiapb32.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3852
        
        C:\Windows\SysWOW64\Hegmlnbp.exe
        
        C:\Windows\system32\Hegmlnbp.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4528
        
        C:\Windows\SysWOW64\Hgeihiac.exe
        
        C:\Windows\system32\Hgeihiac.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2984
        
        C:\Windows\SysWOW64\Hnpaec32.exe
        
        C:\Windows\system32\Hnpaec32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1808
        
        C:\Windows\SysWOW64\Hbknebqi.exe
        
        C:\Windows\system32\Hbknebqi.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2380
        
        C:\Windows\SysWOW64\Hannao32.exe
        
        C:\Windows\system32\Hannao32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2600
        
        C:\Windows\SysWOW64\Hejjanpm.exe
        
        C:\Windows\system32\Hejjanpm.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3196
        
        C:\Windows\SysWOW64\Hghfnioq.exe
        
        C:\Windows\system32\Hghfnioq.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3408
        
        C:\Windows\SysWOW64\Hkcbnh32.exe
        
        C:\Windows\system32\Hkcbnh32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2104
        
        C:\Windows\SysWOW64\Hjfbjdnd.exe
        
        C:\Windows\system32\Hjfbjdnd.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1824
        
        C:\Windows\SysWOW64\Ibnjkbog.exe
        
        C:\Windows\system32\Ibnjkbog.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3608
        
        C:\Windows\SysWOW64\Iapjgo32.exe
        
        C:\Windows\system32\Iapjgo32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1768
        
        C:\Windows\SysWOW64\Ielfgmnj.exe
        
        C:\Windows\system32\Ielfgmnj.exe
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4584
        
        C:\Windows\SysWOW64\Igjbci32.exe
        
        C:\Windows\system32\Igjbci32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2088
        
        C:\Windows\SysWOW64\Ilfodgeg.exe
        
        C:\Windows\system32\Ilfodgeg.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4340
        
        C:\Windows\SysWOW64\Ijiopd32.exe
        
        C:\Windows\system32\Ijiopd32.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3520
        
        C:\Windows\SysWOW64\Ibpgqa32.exe
        
        C:\Windows\system32\Ibpgqa32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4708
        
        C:\Windows\SysWOW64\Iabglnco.exe
        
        C:\Windows\system32\Iabglnco.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2220
        
        C:\Windows\SysWOW64\Icachjbb.exe
        
        C:\Windows\system32\Icachjbb.exe
        25⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4784
        
        C:\Windows\SysWOW64\Igmoih32.exe
        
        C:\Windows\system32\Igmoih32.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4676
        
        C:\Windows\SysWOW64\Ijkled32.exe
        
        C:\Windows\system32\Ijkled32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4064
        
        C:\Windows\SysWOW64\Infhebbh.exe
        
        C:\Windows\system32\Infhebbh.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:552
        
        C:\Windows\SysWOW64\Ibbcfa32.exe
        
        C:\Windows\system32\Ibbcfa32.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4752
        
        C:\Windows\SysWOW64\Ieqpbm32.exe
        
        C:\Windows\system32\Ieqpbm32.exe
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3276
        
        C:\Windows\SysWOW64\Iccpniqp.exe
        
        C:\Windows\system32\Iccpniqp.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2868
        
        C:\Windows\SysWOW64\Ilkhog32.exe
        
        C:\Windows\system32\Ilkhog32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5000
        
        C:\Windows\SysWOW64\Ijmhkchl.exe
        
        C:\Windows\system32\Ijmhkchl.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:368
        
        C:\Windows\SysWOW64\Inidkb32.exe
        
        C:\Windows\system32\Inidkb32.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3808
        
        C:\Windows\SysWOW64\Ibdplaho.exe
        
        C:\Windows\system32\Ibdplaho.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2836
        
        C:\Windows\SysWOW64\Iagqgn32.exe
        
        C:\Windows\system32\Iagqgn32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3812
        
        C:\Windows\SysWOW64\Icfmci32.exe
        
        C:\Windows\system32\Icfmci32.exe
        37⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1484
        
        C:\Windows\SysWOW64\Ihaidhgf.exe
        
        C:\Windows\system32\Ihaidhgf.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4444
        
        C:\Windows\SysWOW64\Ilmedf32.exe
        
        C:\Windows\system32\Ilmedf32.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1760
        
        C:\Windows\SysWOW64\Ijpepcfj.exe
        
        C:\Windows\system32\Ijpepcfj.exe
        40⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2528
        
        C:\Windows\SysWOW64\Ibgmaqfl.exe
        
        C:\Windows\system32\Ibgmaqfl.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2224
        
        C:\Windows\SysWOW64\Iajmmm32.exe
        
        C:\Windows\system32\Iajmmm32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3092
        
        C:\Windows\SysWOW64\Idhiii32.exe
        
        C:\Windows\system32\Idhiii32.exe
        43⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2584
        
        C:\Windows\SysWOW64\Ihceigec.exe
        
        C:\Windows\system32\Ihceigec.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4488
        
        C:\Windows\SysWOW64\Ijbbfc32.exe
        
        C:\Windows\system32\Ijbbfc32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3928
        
        C:\Windows\SysWOW64\Jnnnfalp.exe
        
        C:\Windows\system32\Jnnnfalp.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5052
        
        C:\Windows\SysWOW64\Jbijgp32.exe
        
        C:\Windows\system32\Jbijgp32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4400
        
        C:\Windows\SysWOW64\Jehfcl32.exe
        
        C:\Windows\system32\Jehfcl32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2640
        
        C:\Windows\SysWOW64\Jdjfohjg.exe
        
        C:\Windows\system32\Jdjfohjg.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3772
        
        C:\Windows\SysWOW64\Jhfbog32.exe
        
        C:\Windows\system32\Jhfbog32.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4092
        
        C:\Windows\SysWOW64\Jjdokb32.exe
        
        C:\Windows\system32\Jjdokb32.exe
        51⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4812
        
        C:\Windows\SysWOW64\Jnpjlajn.exe
        
        C:\Windows\system32\Jnpjlajn.exe
        52⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4028
        
        C:\Windows\SysWOW64\Janghmia.exe
        
        C:\Windows\system32\Janghmia.exe
        53⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4148
        
        C:\Windows\SysWOW64\Jejbhk32.exe
        
        C:\Windows\system32\Jejbhk32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4192
        
        C:\Windows\SysWOW64\Jhhodg32.exe
        
        C:\Windows\system32\Jhhodg32.exe
        55⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4184
        
        C:\Windows\SysWOW64\Jldkeeig.exe
        
        C:\Windows\system32\Jldkeeig.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4904
        
        C:\Windows\SysWOW64\Jjgkab32.exe
        
        C:\Windows\system32\Jjgkab32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3956
        
        C:\Windows\SysWOW64\Jbncbpqd.exe
        
        C:\Windows\system32\Jbncbpqd.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3304
        
        C:\Windows\SysWOW64\Jaqcnl32.exe
        
        C:\Windows\system32\Jaqcnl32.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4748
        
        C:\Windows\SysWOW64\Jdopjh32.exe
        
        C:\Windows\system32\Jdopjh32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4100
        
        C:\Windows\SysWOW64\Jhkljfok.exe
        
        C:\Windows\system32\Jhkljfok.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1072
        
        C:\Windows\SysWOW64\Jlfhke32.exe
        
        C:\Windows\system32\Jlfhke32.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:636
        
        C:\Windows\SysWOW64\Jnedgq32.exe
        
        C:\Windows\system32\Jnedgq32.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4948
        
        C:\Windows\SysWOW64\Jbppgona.exe
        
        C:\Windows\system32\Jbppgona.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3716
        
        C:\Windows\SysWOW64\Jacpcl32.exe
        
        C:\Windows\system32\Jacpcl32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2552
        
        C:\Windows\SysWOW64\Jdalog32.exe
        
        C:\Windows\system32\Jdalog32.exe
        66⤵
        System Location Discovery: System Language Discovery
        
        PID:2700
        
        C:\Windows\SysWOW64\Jhmhpfmi.exe
        
        C:\Windows\system32\Jhmhpfmi.exe
        67⤵
        Drops file in System32 directory
        
        PID:2448
        
        C:\Windows\SysWOW64\Jlidpe32.exe
        
        C:\Windows\system32\Jlidpe32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2632
        
        C:\Windows\SysWOW64\Jogqlpde.exe
        
        C:\Windows\system32\Jogqlpde.exe
        69⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1604
        
        C:\Windows\SysWOW64\Jbbmmo32.exe
        
        C:\Windows\system32\Jbbmmo32.exe
        70⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3844
        
        C:\Windows\SysWOW64\Jaemilci.exe
        
        C:\Windows\system32\Jaemilci.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4592
        
        C:\Windows\SysWOW64\Jeaiij32.exe
        
        C:\Windows\system32\Jeaiij32.exe
        72⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5124
        
        C:\Windows\SysWOW64\Jhoeef32.exe
        
        C:\Windows\system32\Jhoeef32.exe
        73⤵
        Drops file in System32 directory
        
        PID:5160
        
        C:\Windows\SysWOW64\Jlkafdco.exe
        
        C:\Windows\system32\Jlkafdco.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5196
        
        C:\Windows\SysWOW64\Koimbpbc.exe
        
        C:\Windows\system32\Koimbpbc.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5232
        
        C:\Windows\SysWOW64\Kbeibo32.exe
        
        C:\Windows\system32\Kbeibo32.exe
        76⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Kahinkaf.exe
        
        C:\Windows\system32\Kahinkaf.exe
        77⤵
        Modifies registry class
        
        PID:5304
        
        C:\Windows\SysWOW64\Kdffjgpj.exe
        
        C:\Windows\system32\Kdffjgpj.exe
        78⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5340
        
        C:\Windows\SysWOW64\Khabke32.exe
        
        C:\Windows\system32\Khabke32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5376
        
        C:\Windows\SysWOW64\Klmnkdal.exe
        
        C:\Windows\system32\Klmnkdal.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5416
        
        C:\Windows\SysWOW64\Koljgppp.exe
        
        C:\Windows\system32\Koljgppp.exe
        81⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5448
        
        C:\Windows\SysWOW64\Kbgfhnhi.exe
        
        C:\Windows\system32\Kbgfhnhi.exe
        82⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5484
        
        C:\Windows\SysWOW64\Kefbdjgm.exe
        
        C:\Windows\system32\Kefbdjgm.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5520
        
        C:\Windows\SysWOW64\Kdhbpf32.exe
        
        C:\Windows\system32\Kdhbpf32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5556
        
        C:\Windows\SysWOW64\Klpjad32.exe
        
        C:\Windows\system32\Klpjad32.exe
        85⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5592
        
        C:\Windows\SysWOW64\Kongmo32.exe
        
        C:\Windows\system32\Kongmo32.exe
        86⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Kbjbnnfg.exe
        
        C:\Windows\system32\Kbjbnnfg.exe
        87⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5664
        
        C:\Windows\SysWOW64\Kalcik32.exe
        
        C:\Windows\system32\Kalcik32.exe
        88⤵
        Modifies registry class
        
        PID:5700
        
        C:\Windows\SysWOW64\Kdkoef32.exe
        
        C:\Windows\system32\Kdkoef32.exe
        89⤵
        Drops file in System32 directory
        
        PID:5736
        
        C:\Windows\SysWOW64\Khfkfedn.exe
        
        C:\Windows\system32\Khfkfedn.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5772
        
        C:\Windows\SysWOW64\Kkegbpca.exe
        
        C:\Windows\system32\Kkegbpca.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5808
        
        C:\Windows\SysWOW64\Kopcbo32.exe
        
        C:\Windows\system32\Kopcbo32.exe
        92⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5844
        
        C:\Windows\SysWOW64\Kaopoj32.exe
        
        C:\Windows\system32\Kaopoj32.exe
        93⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5880
        
        C:\Windows\SysWOW64\Kejloi32.exe
        
        C:\Windows\system32\Kejloi32.exe
        94⤵
        System Location Discovery: System Language Discovery
        
        PID:5916
        
        C:\Windows\SysWOW64\Kdmlkfjb.exe
        
        C:\Windows\system32\Kdmlkfjb.exe
        95⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5952
        
        C:\Windows\SysWOW64\Khihld32.exe
        
        C:\Windows\system32\Khihld32.exe
        96⤵
        System Location Discovery: System Language Discovery
        
        PID:5988
        
        C:\Windows\SysWOW64\Kkgdhp32.exe
        
        C:\Windows\system32\Kkgdhp32.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6028
        
        C:\Windows\SysWOW64\Kocphojh.exe
        
        C:\Windows\system32\Kocphojh.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6060
        
        C:\Windows\SysWOW64\Kaaldjil.exe
        
        C:\Windows\system32\Kaaldjil.exe
        99⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6096
        
        C:\Windows\SysWOW64\Kemhei32.exe
        
        C:\Windows\system32\Kemhei32.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6132
        
        C:\Windows\SysWOW64\Kdpiqehp.exe
        
        C:\Windows\system32\Kdpiqehp.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4480
        
        C:\Windows\SysWOW64\Klgqabib.exe
        
        C:\Windows\system32\Klgqabib.exe
        102⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:540
        
        C:\Windows\SysWOW64\Lkiamp32.exe
        
        C:\Windows\system32\Lkiamp32.exe
        103⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3896
        
        C:\Windows\SysWOW64\Loemnnhe.exe
        
        C:\Windows\system32\Loemnnhe.exe
        104⤵
        Modifies registry class
        
        PID:3160
        
        C:\Windows\SysWOW64\Lbqinm32.exe
        
        C:\Windows\system32\Lbqinm32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4196
        
        C:\Windows\SysWOW64\Leoejh32.exe
        
        C:\Windows\system32\Leoejh32.exe
        106⤵
        System Location Discovery: System Language Discovery
        
        PID:2952
        
        C:\Windows\SysWOW64\Ldbefe32.exe
        
        C:\Windows\system32\Ldbefe32.exe
        107⤵
        System Location Discovery: System Language Discovery
        
        PID:1160
        
        C:\Windows\SysWOW64\Lhmafcnf.exe
        
        C:\Windows\system32\Lhmafcnf.exe
        108⤵
        Drops file in System32 directory
        
        PID:3532
        
        C:\Windows\SysWOW64\Llimgb32.exe
        
        C:\Windows\system32\Llimgb32.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4164
        
        C:\Windows\SysWOW64\Logicn32.exe
        
        C:\Windows\system32\Logicn32.exe
        110⤵
        Modifies registry class
        
        PID:5100
        
        C:\Windows\SysWOW64\Lbcedmnl.exe
        
        C:\Windows\system32\Lbcedmnl.exe
        111⤵
        Modifies registry class
        
        PID:3364
        
        C:\Windows\SysWOW64\Laffpi32.exe
        
        C:\Windows\system32\Laffpi32.exe
        112⤵
        System Location Discovery: System Language Discovery
        
        PID:4692
        
        C:\Windows\SysWOW64\Lddble32.exe
        
        C:\Windows\system32\Lddble32.exe
        113⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Lhpnlclc.exe
        
        C:\Windows\system32\Lhpnlclc.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5192
        
        C:\Windows\SysWOW64\Llkjmb32.exe
        
        C:\Windows\system32\Llkjmb32.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5256
        
        C:\Windows\SysWOW64\Lknjhokg.exe
        
        C:\Windows\system32\Lknjhokg.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5324
        
        C:\Windows\SysWOW64\Lojfin32.exe
        
        C:\Windows\system32\Lojfin32.exe
        117⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Lahbei32.exe
        
        C:\Windows\system32\Lahbei32.exe
        118⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Ledoegkm.exe
        
        C:\Windows\system32\Ledoegkm.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5504
        
        C:\Windows\SysWOW64\Ldfoad32.exe
        
        C:\Windows\system32\Ldfoad32.exe
        120⤵
        System Location Discovery: System Language Discovery
        
        PID:5564
        
        C:\Windows\SysWOW64\Llngbabj.exe
        
        C:\Windows\system32\Llngbabj.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5672
        
        C:\Windows\SysWOW64\Lbhool32.exe
        
        C:\Windows\system32\Lbhool32.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5836
        
        C:\Windows\SysWOW64\Ldikgdpe.exe
        
        C:\Windows\system32\Ldikgdpe.exe
        123⤵
        System Location Discovery: System Language Discovery
        
        PID:3876
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 400
        124⤵
        Program crash
        
        PID:6016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3876 -ip 3876
1⤵
PID:4648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Gbpnjdkg.exe

Path C:\Windows\SysWOW64\Gbpnjdkg.exe
Size 320KB
SHA256 d1829593c86ba0e5f6851c40f1acafab72c8f38d6fb5cb578c6c94d367fe6fce
MD5 66d6be19f5878f20d39353bb359f2075
SHA1 bf6e287eded79a4f8972607bb70f921738b41fbf
SHA512 1c8b75a861ef35defc34cb2b3b2f0b929e2389af617120ec99fab539cdc908dea5f55793e3a6c9b330a95a0eb2ff5b9f3d1638271d8e6a6c4c0c5d42037f3ca1
SSDEEP 3072:EJAoJCrZMRMwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:ElEZiMV/Ah1G/AcQ///NR5fn
TLSH
T1B1644F162A3109EACDED1BB5AE4249D88141FAF115F5E53E2133DFDCD8E4DA2D809F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gcqjal32.exe

Path C:\Windows\SysWOW64\Gcqjal32.exe
Size 320KB
SHA256 31a3d38c696600f49c9ab9843f6322def451ec628c7a165c6a0e5fda817810a7
MD5 f1dbc479f1d2b06a22d4ea8cfd7c1415
SHA1 15f34c778a1c19093dce9ac2c4c36a8d63089430
SHA512 cabbeaad3a8fdd48ab19f1f788ec969c8f4b1454f2dd9b6f3251ec92c97828c62a210df934e852fa533052451116f09391e8c0acb44c82fffbbbf9df440bf223
SSDEEP 3072:j9uFNWCwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:j9osCV/Ah1G/AcQ///NR5fn
TLSH
T179642E192A3509FACEED1FB5AC1249D89182E9F014F5E13E6123DFDCD8E4EA2D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gglfbkin.exe

Path C:\Windows\SysWOW64\Gglfbkin.exe
Size 320KB
SHA256 872eafad5c469580be189150f344cf3d5ce9a0e2ec5d89dd22a671eb3e9c5b98
MD5 385fc493bd07aa4479fa78fb87e0ca4b
SHA1 d965f30d3b945980a684090e51ce19690b0854ab
SHA512 94c0e687c2fe6dc05744c5329a057324e3fcec2234aa84b9c5457d44479fb7c5bd980a13d0facaccad17a58d2741c0ac8d9d9c74fd8470b43b386780cfa0f6ae
SSDEEP 3072:zV0BP/zneodkBAlqVnDwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:zV2HzneoU4qVnDV/Ah1G/AcQ///NR5fn
TLSH
T13F642F1A26340AEACEED1FB5AC0249D89181F8F114F1E13E6523DFDCD8E4DA6E855F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hannao32.exe

Path C:\Windows\SysWOW64\Hannao32.exe
Size 320KB
SHA256 45412311dfa52d79fd51610728300d7b2e90c81acca08bd1369b58dd09ea9ed9
MD5 cd3b07655bf3f60692a654229971f1bb
SHA1 c8bfd752c3d4da94018077199b24ba1108d84052
SHA512 11b450d4f9aea3f083152e8d55a66f6ced9ac1d5ff27c6aa372f6975734f6be7bf52a0831bf7abc04ba61ae4c9d0af740935a3f7fc46f323e7b73350749e380d
SSDEEP 3072:BQiaKzbb5XmMrwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:ydKzbvrV/Ah1G/AcQ///NR5fn
TLSH
T18164FB192A3419EACEED5BBAFC1249D89141E8F114F1E57E6123DFDCC8E4DA2C819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hbiapb32.exe

Path C:\Windows\SysWOW64\Hbiapb32.exe
Size 320KB
SHA256 9b341a2f67212b3809587e883e9f398147354f3684d09de378cef9f4a478577f
MD5 97b680259b8a1cb6387ac2c975b18744
SHA1 44de022b398f38384f0dfe99e410683750b6f8d6
SHA512 943c9a52f6c4e5ab49d3a30a537cd2d01546cd660e24e70f67b37260a2e027e1bf741f152d2f24e862754a7f8736d66d22828ee1bda9939d80af0ef8ee90a522
SSDEEP 3072:RDhqaAurJjqwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Rd9qV/Ah1G/AcQ///NR5fn
TLSH
T14964CA2A2A3409EACDED1BB5AD125DD89241E9B414F1E13EA123DFDCC8F4DA2DC15F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hbknebqi.exe

Path C:\Windows\SysWOW64\Hbknebqi.exe
Size 320KB
SHA256 4136f8e79b760b88b7591361e1c80ea8b8453ac668f194843b94c32bf86a502e
MD5 cac3ff8b3074d805fa62730047556b7c
SHA1 2ecd1f6e3466ed6c6c17e180115835e7ffa823ff
SHA512 7965c5066aa2e71b07f16621e9d31bca4c2a54609229d2d4e7f9944f01dd788f03ec617cc737f301c68363e7246a3ee8b77dbd4da3e4a2508d94c8caeb7e9686
SSDEEP 3072:cqwehLVmDLqOrPwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:cqwehVmD+KPV/Ah1G/AcQ///NR5fn
TLSH
T13164FB192E3409EACDED2BB6AC1249D85141E9F124F1E17E6133DFDCD8E8DA2C919F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hegmlnbp.exe

Path C:\Windows\SysWOW64\Hegmlnbp.exe
Size 320KB
SHA256 d019e9171f72a0501064183d4c7409e6499f6023adb7abf519521ec303394407
MD5 136c86ed0da2476e9e7d7b81b5b2d14c
SHA1 a1e66890586eca3b7207cbea63c5be0451849d73
SHA512 ba79ebc4c62c40c638cd4e21c9f191a457cc359e806414419b79b50bdfe3bdc96f82d7f8017fd9f97705df6779838e9704a8edef1796ca1c210eadc80e2227d2
SSDEEP 3072:Lfl9oGAwdUXcREZGHN3WzFwwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:LicCFwV/Ah1G/AcQ///NR5fn
TLSH
T104641E59263409EECDED1FB5AC2249E89182E8F014F1E17E6523DFDCC8E4DA2D819F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hejjanpm.exe

Path C:\Windows\SysWOW64\Hejjanpm.exe
Size 320KB
SHA256 fc3ff6e843b4cce9e66b1f7bdbbae28d0b5293d53517c20e4b96e5a6a42712da
MD5 46a3e3529cc7c468896d68c1388f28e0
SHA1 bdad8e9e9012144b9db7d7434e3559d81e81991e
SHA512 71bbf713e3de1b4cadf831ca79972c568f7b8850e6383eaedd09f1c66f80c334009f04209549cf6c0d6a23644e706a0005200754b6a833750f69e9f97afd19ef
SSDEEP 3072:Yx/Rm4rgF70hxXX24tRbfPwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:X4UF705rPV/Ah1G/AcQ///NR5fn
TLSH
T1EA64EC192A3409EACEEE1BB6AC1649DC9141E9F054F1E13E5563DFDCD8F4DA2C809F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hgcmbj32.exe

Path C:\Windows\SysWOW64\Hgcmbj32.exe
Size 320KB
SHA256 bc697bff5381845e911ff144b39aef6d210b620761c6e2978b294e8a28290fd6
MD5 3aa848e50305daf3284f9c9e75e47c20
SHA1 9eb0446bbfdd66cefb91e2d6aa36db3f80d9f72c
SHA512 5d5fbbf8c0e5aead02c089e38dbf99c37bb0eee414f864a84931218d3312e028726ec28d50830d402eb9c8ff1b1edcc13622353ab84833e16ec973afc12c2e62
SSDEEP 3072:EE18d59bFfbNPdHWL9wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:ETd59bFfbN69V/Ah1G/AcQ///NR5fn
TLSH
T1F0643F196A3009EACEED1BB5AC5249D89141E9F014F5F23EA123DFECD8E4DA6C815FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hgeihiac.exe

Path C:\Windows\SysWOW64\Hgeihiac.exe
Size 320KB
SHA256 0569e373e8cae7a01bf7ca309ec05a1c1aa8a8ce4e3e9f0dbe19b431257aa31f
MD5 73c77f3a7abd926325dfab8a2aaabc62
SHA1 b1c814b51758d6f7340a4636f775fe242612362a
SHA512 54c21b93f0e3012de043f16132797510db7e6abe1bfdb062eeae0924f7a83d3fa0c966b6fffafd997be8235c0fc2c4d47c177edae8c1bb60029fb07019b6fe97
SSDEEP 3072:lJsUqhKQo7+J7hzEwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:lWNsQo+zEV/Ah1G/AcQ///NR5fn
TLSH
T1FB643F192A3409EADEED1FB6AC025DD85151E9F014F1E23E6123DFDCD9E4DA2C829F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hghfnioq.exe

Path C:\Windows\SysWOW64\Hghfnioq.exe
Size 320KB
SHA256 980c7df722832fc1d56c67a703c4a3d7cf38d104918c85ddb0998c152a839f1c
MD5 bd1a3f674fe6d97be66f7db741a6ca14
SHA1 cd79bfa0ff4a21acd42cd28a4fe9d6902ad9a867
SHA512 517b20a6158cd2edef2d121682ff15dd4ea2f1d21cdfaeae8c46106cdc499e52ad705c3e97402dccda92ac72f9e2653d58a535a5e380c2005e5b099f319080be
SSDEEP 3072:XwyqXk5Jv9BxxxxxxxxxxxxxxVil8VwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5fn:mUdbVV/Ah1G/AcQ///NR5fn
TLSH
T13B640B1A2A350DEACEED1BB6AC1249D85181F8F015F1E13E6123DFDDC8E5DAAC815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hjaioe32.exe

Path C:\Windows\SysWOW64\Hjaioe32.exe
Size 320KB
SHA256 515c661c53d6e57d78f83bb66a4251caa2eda660f1c7ac96260a66c1b72075fc
MD5 9a6f8c73e5d3f010b3f02d662a847abe
SHA1 24ecb1a2c868c0e5c0e6a6c2cacea6e76a19d537
SHA512 0bc58a6597af200d7dc24ff52fdd7c187e9d70233fee1bf2619bb1f26503216e5d23eba28824ff3ae25e84fa7d5a06d9161c3694b67598751f0e6e595794b13e
SSDEEP 3072:Mg9CkE/fVxuHSrYVrgwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:MypEVxwSrGgV/Ah1G/AcQ///NR5fn
TLSH
T1A5643F1A66700AEADEED1FB5EC0249D89141E9F014F1E27E6163DFDCD8E4DA6C818F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hjfbjdnd.exe

Path C:\Windows\SysWOW64\Hjfbjdnd.exe
Size 320KB
SHA256 0718bc8fe9df973cdbd9ab05d23d04ac1e5b0517f8baf589fffa6631d082a06f
MD5 031baf4ec64a9dd06fa696902dc5a1b3
SHA1 9c6bcddb5dd5c2ad0628a50e10cd52fb465f0bb3
SHA512 d6d05e1988a1d265261775433b90fd35bc36f7a7aff119dda4ba97b127e7eb1d36047b266e4a31fa9596ba13672bcfef12d9f1700bf23708956e8c589f6a45eb
SSDEEP 3072:QV1TUwGsWIQz6u5X8QwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:G1YwJW+u5MQV/Ah1G/AcQ///NR5fn
TLSH
T1DB64431926380DEACDED1FB5AE124AD86181E9F018F5E13E5123DFECD8E4DA2D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hkcbnh32.exe

Path C:\Windows\SysWOW64\Hkcbnh32.exe
Size 320KB
SHA256 10f635464a968a42bd9d265a220e80f79915e1e4469fd01706f6a664b9fe311f
MD5 05f8fdaa5b19048779f36727d31d64f2
SHA1 4165454175ae6e237767f556e9b9e306f3a9786e
SHA512 085d154d0d1ec6897550c7933f12005a5424e46068a6a306c8bbecb8c1dc040cf386075055d4db928ea6abd5e4884d0d253291fd7fa3d7be57ed623cec7db29b
SSDEEP 3072:ZkkGcZayyAarlGVVxwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:3GckAiOxV/Ah1G/AcQ///NR5fn
TLSH
T1C6642019263819EECEED1BB6AC1269D89181E4F014F1E17E6133DFECD8E4DA2D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hnpaec32.exe

Path C:\Windows\SysWOW64\Hnpaec32.exe
Size 320KB
SHA256 601823bc18a1d20e714e4cff17f352873a9fd0b8e5c214b56c1fbf8f06fffef0
MD5 d21beffd03d5c313faaee4eb8e204b16
SHA1 822d5315ec27e961bbae1366599583863a5e7975
SHA512 102311c676454a49f2307d710d02ed1c291ea5bb0adb3a6fedef7aefb1406a64a8749b101586623559c9f51a47a47084072c2140b5b960cf63aec5a6fba4d9b2
SSDEEP 3072:2x01XekwjsdwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:2a1XerjsdV/Ah1G/AcQ///NR5fn
TLSH
T15D64301A2A3409EACEED1FB5AC0249E85191E9F414F1E13E6523DFDCD8E4DA2D809FD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Iabglnco.exe

Path C:\Windows\SysWOW64\Iabglnco.exe
Size 320KB
SHA256 7d359f376d9577f8b8039a9eae1036576a2047aa2546e64cca9fff2ad03de3e8
MD5 bb11ca9f8c4fef689fddb595a773d841
SHA1 b1db0587ecbf96d4a10ddc0f261000dd38e27c86
SHA512 a69ca9d0ad19d3731ac53220288ca8d1f0e2f81d79d419cef2e819293b8594df1f19341e95437227984366b1b9154411bda3fed85ed3da974b82484e1bad85f3
SSDEEP 3072:+KkwURbvN7SbPwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:+aex2PV/Ah1G/AcQ///NR5fn
TLSH
T180641D992A3009EACEED1BB5AD1289D85141E9F115F1E23E6123DFDCDCE4DA2D809FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Iapjgo32.exe

Path C:\Windows\SysWOW64\Iapjgo32.exe
Size 320KB
SHA256 9ea8a3a1a87a74a84927b947faf4e2ffe43ce32375feb5c89ae96ae6de78a9ff
MD5 b98a1cd9603f31f92aba006943573854
SHA1 f7f2a94be23dc3529ce3610cde2537c2ef833898
SHA512 4db53a90d03eff128634a7869b7d1808d1303aabc6fabacf98683ff931871e4d6850770c9f78c955c30f2e7aa0ccfa8ee3179e9deab9a7c5c8f97b0e1f3c7168
SSDEEP 3072:wE/F1dlZdwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:wmdlZdV/Ah1G/AcQ///NR5fn
TLSH
T1D1643129263009EACDED1FB6AD124DD9A181E5F419F1E13E6123DFECD8E4DA2C815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ibbcfa32.exe

Path C:\Windows\SysWOW64\Ibbcfa32.exe
Size 320KB
SHA256 8582f7f282c8850cffefeb919719db2492bc2990ddbe1844523e750e8acfa0f7
MD5 70973eb29ead8b9358a4065b87f97186
SHA1 f07bd6a825ead30b28e79eea5192f32611f46094
SHA512 82396a7a1b146b4ffea2297d0ea538dee4e082d92631d4bb37a71c8eb87da6b834b0aabc7ae6dd9ed08f7044d7caca707ca000b674d73a9b97934b9684997928
SSDEEP 3072:4amrlBpJXwVH1YwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:4NfTX01YV/Ah1G/AcQ///NR5fn
TLSH
T11F644F1A2A3049EACEED1FB5AC1249D85199E8F514F1E13F6123DFECC8E4DA2C815F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ibnjkbog.exe

Path C:\Windows\SysWOW64\Ibnjkbog.exe
Size 320KB
SHA256 7ac89eb5b7fff709e4b489b602ea9c8033dc2ff25bb7ec4d816c7d38e6e8f879
MD5 e9ae76f0cb0aa7e1de2b36a4ae57ffee
SHA1 d227ad6e435f1bb5e4c88f78632c7166b8360381
SHA512 363c7685f15f15f8d1e6954987ee769e99723b80c834ca33f9cd6d631d35115aa1f03b84b3220e8e682aabc406ab8f29e3f90907aa1b8aa2c4b38d722b24cb6a
SSDEEP 3072:s3x9pabghJo/fJCCACZo7wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:GAghm/Fo7V/Ah1G/AcQ///NR5fn
TLSH
T1696420192A3019EBCFED1BB5AC024AD86581E8F154F5E13E6123DFDCD8E4DA2E815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ibpgqa32.exe

Path C:\Windows\SysWOW64\Ibpgqa32.exe
Size 320KB
SHA256 cdcd83df3d11d35febd27c92f3a8a2ecdc619984095c90774e0b9e57480341e6
MD5 dc02c942a2d1ab5bd5ff004f4ed1077b
SHA1 75e7bf6d97f638176dac892e97b71b126a172814
SHA512 b7d8435dc5299fa668e5a5144317a8e59ca23c42f08f4215d4ad2d558ec248d7cbb2deac134749274a43afc1775da27c663adcfb30fa7e2a151a0ccb394dbd31
SSDEEP 3072:WNDvYo6CQHS9gxtJ3QowS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:yqCQHS9gTVQoV/Ah1G/AcQ///NR5fn
TLSH
T18D641029163409EACDED1BB5AC0249E85146F4F014F1E23EA223DFDDD8E4DAAE855FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Icachjbb.exe

Path C:\Windows\SysWOW64\Icachjbb.exe
Size 320KB
SHA256 844d63c0b1a6c25e256f8f21c65dd11de91e094e490b340329810d3c1835d4d3
MD5 ac290b2f86e372b33ed483ed0edb95f7
SHA1 fd4814831eb6e99c46e38479e146b7d1d2cb7e9e
SHA512 9b8be0f31f895cbbddfcc9febfd7ecb212b507fe921598c3c1071ee82ea73f31ef785fc1ba355d9d0f1aada7cdd8a0b1bc898a04dbc7e19d2a835dd5115dc1b6
SSDEEP 3072:IZYPS6RhXl/JRwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:3vRV/Ah1G/AcQ///NR5fn
TLSH
T10064FD292A3409EACEED7BB5AC1259D8514AF9F014F1E13E6123DFDCD8E4DA2C815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Iccpniqp.exe

Path C:\Windows\SysWOW64\Iccpniqp.exe
Size 320KB
SHA256 f9e2b5534b413d38eb5eab7a1de5292b8b559ec5344c2b003a1b89891d8edf04
MD5 8750da59cba3a9b0d0c4b5e691d7d8db
SHA1 ca3564b5e24c62de6020f3453de4c5ea9fead769
SHA512 1da067efc9808c1d5e787171091980680af37b2de404288f99930806dad95024d6e64ee125f9e4a1ea079bd969954f12cc10a3c52db576862144a3149122cea2
SSDEEP 3072:1zd7aPF6Oqbzemj1POwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:ZYd9q2OOV/Ah1G/AcQ///NR5fn
TLSH
T195642F19263049EACEED1BB7AD0249D86191E9F054F1E23E6223DFDCD8E4DB6C815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ielfgmnj.exe

Path C:\Windows\SysWOW64\Ielfgmnj.exe
Size 320KB
SHA256 d20095eb2cbb4ec36590cd4ee95ffea0e1726b90829edbeff195f13b2cda4f1c
MD5 4d7334d7dc8e2b4615f31cab8b7175d6
SHA1 5738cedbdfcc587d78a05d830b2eabfd2d2bd1cc
SHA512 a33f95d9c2a462b55ceb32b6f97a1003ae9c5d69bfca624e5f56fa7b8251fa9d8f2c93db0ac3b317a11bfda609e1c34dd64ed4718e4128875db58bf85d349574
SSDEEP 3072:C6jR1KPly1n45shEuwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:DjR1KdMEWEuV/Ah1G/AcQ///NR5fn
TLSH
T1076440592A3849EACDED1FB5AC1349D89581E8F024F1E23E2123DFDCD8E4DA6D905F84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ieqpbm32.exe

Path C:\Windows\SysWOW64\Ieqpbm32.exe
Size 320KB
SHA256 2679a7815fa5d8b36440e7c0e94da85dfb39e922c0a75c00ab6d6a3650e4b8c6
MD5 a5f2d556e72d4289465c4d1f1e429684
SHA1 3561febca6111a174f234e242e2272d1fde7c866
SHA512 377e578382c3b90162040dcf3bb20ab9e2c136e843e3d2efee95667072727e39c04a60bc71a07a51e9016be65c0f06eafbba20511b1390994d4c0d115b3d3263
SSDEEP 3072:GwVUY8IiyYhc+UK2Nhu1LwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:SIiMbupV/Ah1G/AcQ///NR5fn
TLSH
T14464301A2A3409EADEED1FB6AD0259D85181E8F014F1E53E6163EFDCD8E4DB6C805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Igjbci32.exe

Path C:\Windows\SysWOW64\Igjbci32.exe
Size 320KB
SHA256 d0fa62d77af4f11bf8bf3ff6f30082fbcd3e2383081de7bb34640fb4fad73e43
MD5 5b4ea4e8d898999c33514ca644a576d5
SHA1 036f6c48561818509b262dfc96780c8b8680061b
SHA512 768c8ecf9d28df3a5cf22b6f88a3e811029d1cab94bf344d495c58705728f8c55a466543ea25394eb69e32f37e9f535829d88e37d1b7167f770743f1c4554848
SSDEEP 3072:ZItFR65MYIRD34wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:meM7J34V/Ah1G/AcQ///NR5fn
TLSH
T159642E19763009EAEEED2BB6EC0249D89141E9F114F5E23E6123DFDCD8E4DA2D805F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Igmoih32.exe

Path C:\Windows\SysWOW64\Igmoih32.exe
Size 320KB
SHA256 96e6c3caba8fd202df24ff24555eb9b6b88c5ee7d3f3cc8be4457bf88438cb89
MD5 bdb4de7479e3c7248daeb275435c6317
SHA1 12e024a57a4d1357647d94d678bbea4a50c9bfc2
SHA512 78b8b003dd50772fee5d49ecacb39c83c73db67ce59f1b1763957f43b272581b4b671a2f6f92b182e9885be0ed73686688c7a5b56c4327629974c99143d1d27a
SSDEEP 3072:2/79Ot09QuDVwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:2/7VzVV/Ah1G/AcQ///NR5fn
TLSH
T13A64DA19263409EACDED1BB5EC125DD8A145E9B014F1E13E6A23DFECE8F4DA2D805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ijiopd32.exe

Path C:\Windows\SysWOW64\Ijiopd32.exe
Size 320KB
SHA256 4883d8b8b688e6a4a20da9b27e9daa441500893ea81580170698753495bf3bcb
MD5 0aff654443b62d1df4b39003632bd0e9
SHA1 cca3c6a6133b154cc231a6d1eea920f406ef20a0
SHA512 9ab3a018a0adf00a59506609b5c14d1941722d1e0890cda88a7f0099a38caf3351b90ba90dbbf8c68e52379f3b0c10d719df71221886245f4fa561a31b348108
SSDEEP 3072:+apiK+/Zl5z9Ui0wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:+6a/5D0V/Ah1G/AcQ///NR5fn
TLSH
T14D641C592A3409EACEED1BB6AC1249D99541E9F014F1E23E6133DFDCD8E4DA6C818FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ijkled32.exe

Path C:\Windows\SysWOW64\Ijkled32.exe
Size 320KB
SHA256 3d930a27916fd442951a472f5644b01481e64a3fd6c0412f0e0d9ca0a59643c5
MD5 81abd550fb10b37efb6f1ba32077964f
SHA1 0df3d10b9d5b6c71116a0e532b94d925ff823e03
SHA512 2e17298df9c2ea74b6ad529dacef721241498403e345a0d8c81cbd22e26219f44e2136e8293022f38beb802b803c5766a5969f887a630a4b5eda930d0a630088
SSDEEP 3072:hPQZPI/tlQDJIChwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:OZQ/tlYhV/Ah1G/AcQ///NR5fn
TLSH
T102640D2A2A3019EADEED2FB5AC124DD85181E8F054F1E13E6523DFDCD8E4DA6C815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ijmhkchl.exe

Path C:\Windows\SysWOW64\Ijmhkchl.exe
Size 320KB
SHA256 4e45b40965decc0733dd9f1d036fb13d44d8cc6bcdf674c275c8e94bf6949187
MD5 55dfea6c70d8316aeec00cc583fb3f8c
SHA1 726bd00a8f6ee9f2d7db7054b10f3be6bb87f0de
SHA512 cacc96d6a5fe6b3e218b3b7c522cba2eefdac978162ec8cc7747a2de012ddc63a6692e45c7c12a5b4129ab5f8d4ac3c16fc55e988209e05eda61cf99d63ce34a
SSDEEP 3072:QT7c8drMJnOcwylTYwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:MYI8wKYV/Ah1G/AcQ///NR5fn
TLSH
T1F7641F192A340BEACEED5BB5AC1689D85149E8F014F1F13E6123DFDCD8E4DA6C809F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ilfodgeg.exe

Path C:\Windows\SysWOW64\Ilfodgeg.exe
Size 320KB
SHA256 2d84850cae9084c75cb7056037da670ae02970c40592d62e67bcfdb7662a9a5f
MD5 134e0d1d4f3f4059dbc192da8c0c24a9
SHA1 1f64b8686815ba0f3e167a4fe94c80299aa12b50
SHA512 8ffdc4bc07578b5a1d3c81717e1eac94281c202f30c37ffe5b4e1918cae23078f0c0472ab8cb26e66a4107489521f59870feacec576386e112787cb929b043b1
SSDEEP 3072:Qtupa5zhxtxY/Bf8wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Qcpa5zhxnof8V/Ah1G/AcQ///NR5fn
TLSH
T10764105926340AEACEFD1FB6AD0249D85141E5F018F1E23E6123DFDCDAE4EA6D805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ilkhog32.exe

Path C:\Windows\SysWOW64\Ilkhog32.exe
Size 320KB
SHA256 59cfa2e78c741486b8cb0f5bc36cc921afeb2f443382fbfb3d944975c008d85f
MD5 d121086894adeecd5d003eaa917d8448
SHA1 b1dc005eaad13d62e317c95268d157e6b4807740
SHA512 a71baac0bfea6f186bce507b040ed4d2d9bf2d48de8a011b45a458fd118433a535e884df9c19cd9352338a40d23f9ef953678f67d1284130dbbf0ac238c53747
SSDEEP 3072:U8cLsiehVhmwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:1SsiehfmV/Ah1G/AcQ///NR5fn
TLSH
T1E9644119163409EACEED1FB5AC1259D89281E9F418F1E23E6123EFDCD8F4DA2D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Infhebbh.exe

Path C:\Windows\SysWOW64\Infhebbh.exe
Size 320KB
SHA256 81c9bc36160563cfed27c71eb2b7de4ff64bfca31d1335a8003b5eea17f76969
MD5 4212b372e2a4a59353564d912dad879f
SHA1 010181eae150826d4a36af2312d220c1da0aff62
SHA512 20497b6ef6fd6a49dd59cd2e264c2756860c8186940be84190e7aab68f404e487443f6eaef230e4253cac4c20134e6e78311e57da8d7ad269dbd0cbc2eefc476
SSDEEP 3072:0FOc53GIE/58zAmNwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:0w7mzAmNV/Ah1G/AcQ///NR5fn
TLSH
T1516444191A3409EBCDED1FB5AE0249D85142E5F018F1E53E552BDFDDC8E4EAAC818F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/368-695-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/540-781-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/552-687-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/636-721-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1072-720-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1160-771-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1604-723-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1768-681-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1808-668-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1824-679-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2088-683-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2104-678-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2224-699-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2380-669-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2552-722-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2584-702-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2600-670-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2640-708-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2796-9-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2868-690-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2952-734-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2952-773-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2984-667-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3092-700-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3160-777-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3160-732-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3196-673-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3276-689-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3304-717-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3352-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3352-1-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/3364-763-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3364-735-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3408-676-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3532-769-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3608-680-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3696-25-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3772-709-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3808-696-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3844-724-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3852-666-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3876-737-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3896-731-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3896-779-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3956-716-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4028-711-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4048-21-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4064-686-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4092-710-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4100-719-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4148-712-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4164-767-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4184-714-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4192-713-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4196-775-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4196-733-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4200-32-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4264-46-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4340-684-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4480-783-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4488-704-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4584-682-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4592-725-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4676-685-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4692-761-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4748-718-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4752-688-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4904-715-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5000-691-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5100-765-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5124-726-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5144-759-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5160-727-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5192-757-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5256-738-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5256-755-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5324-739-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5324-753-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5340-728-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5372-751-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5376-729-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5416-730-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5440-749-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5504-747-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5564-745-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5672-743-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5836-741-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5844-801-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5880-799-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5916-797-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5952-795-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5988-793-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6028-791-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6060-789-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6096-787-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6132-785-0x0000000000400000-0x000000000046D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads