berbew | 8d3f894a931548c39a7140c6e6928386449c2c09c1ef1b3a9c24e98508aa3353

Analysis

max time kernel
148s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 17:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_e1c010fc9320d95d2c20892ccd863848_elex_wannacry.exe
Size 320KB
Sample260804-wc362aee74
SHA256 8d3f894a931548c39a7140c6e6928386449c2c09c1ef1b3a9c24e98508aa3353
MD5 e1c010fc9320d95d2c20892ccd863848
SHA1 5d3008237bc7e728ba32f713c6bd6697b7008346
SHA512 9919e05d9bd169c0be880b5db8c1622b48f8c6a2be6d67ab1fa3c5d56ae19327575f80ab23a9a4acc25165f68f7d0b389b9dc63e68ca46f9c7db437036946a83
SSDEEP 3072:8phTqB5o2RjYu/yIui03ywS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:1vXQyV/Ah1G/AcQ///NR5fn
TLSH
T1E264211A26344AEACEED1BB6AC125AD85141E9F124F1E13E6133DFDCD8E4DA7C805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohncdobq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Piolkm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qihoak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ohhfknjf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbbgicnd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohqpjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Omcbkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pbddobla.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qbngeadf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Abpcja32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Napameoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oloipmfd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qmanljfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amfhgj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcbdcf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acppddig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pkklbh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	2026-08-04_e1c010fc9320d95d2c20892ccd863848_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mebkge32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Napameoi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pomncfge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcijce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aeopfl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdqcenmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oflfdbip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pijcpmhc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pomncfge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qihoak32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmeoqlpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmhkflnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acppddig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pkholi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pkklbh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbgqdb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qmckbjdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfppoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afnlpohj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nheqnpjk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pbimjb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aealll32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohhfknjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcpgmf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmoagk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oflfdbip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmhkflnj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfppoa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afnlpohj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdghhb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pkmhgh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pokanf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdqcenmg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohcmpn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Piolkm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbimjb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qfjcep32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcbdcf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qppkhfec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qmckbjdl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcpgmf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pkmhgh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcdqhecd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeopfl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Omcbkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pbbgicnd.exe

Executes dropped EXE 57 IoCs

pid	Process
4740	Mebkge32.exe
3868	Mdghhb32.exe
4860	Nheqnpjk.exe
4748	Namegfql.exe
1896	Napameoi.exe
5036	Nkjckkcg.exe
1988	Ohncdobq.exe
824	Okmpqjad.exe
4216	Ohqpjo32.exe
4932	Ohcmpn32.exe
4016	Oloipmfd.exe
4820	Odljjo32.exe
2168	Ohhfknjf.exe
3132	Omcbkl32.exe
1780	Oflfdbip.exe
1308	Pijcpmhc.exe
3376	Pmeoqlpl.exe
4032	Pkholi32.exe
3876	Pcpgmf32.exe
1384	Pbbgicnd.exe
3116	Pdqcenmg.exe
216	Pilpfm32.exe
2496	Pmhkflnj.exe
1140	Pkklbh32.exe
1188	Pcbdcf32.exe
4364	Pbddobla.exe
1996	Pfppoa32.exe
2108	Piolkm32.exe
5072	Pmjhlklg.exe
3452	Pkmhgh32.exe
1284	Pcdqhecd.exe
5016	Pbgqdb32.exe
3276	Peempn32.exe
2024	Pmmeak32.exe
4684	Pokanf32.exe
4976	Pbimjb32.exe
1352	Pehjfm32.exe
4436	Pmoagk32.exe
1860	Pomncfge.exe
4324	Pcijce32.exe
4536	Qfgfpp32.exe
4356	Qejfkmem.exe
3456	Qmanljfo.exe
5000	Qppkhfec.exe
2232	Qbngeadf.exe
3056	Qfjcep32.exe
1020	Qihoak32.exe
4808	Qmckbjdl.exe
3324	Qpbgnecp.exe
3044	Abpcja32.exe
4184	Aeopfl32.exe
4720	Amfhgj32.exe
5084	Akihcfid.exe
1632	Acppddig.exe
380	Afnlpohj.exe
116	Aealll32.exe
4900	Amhdmi32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Pcbdcf32.exe	Pkklbh32.exe
File created	C:\Windows\SysWOW64\Qfgfpp32.exe	Pcijce32.exe
File created	C:\Windows\SysWOW64\Ifoglp32.dll	Abpcja32.exe
File opened for modification	C:\Windows\SysWOW64\Amfhgj32.exe	Aeopfl32.exe
File opened for modification	C:\Windows\SysWOW64\Akihcfid.exe	Amfhgj32.exe
File created	C:\Windows\SysWOW64\Aealll32.exe	Afnlpohj.exe
File created	C:\Windows\SysWOW64\Oflfdbip.exe	Omcbkl32.exe
File created	C:\Windows\SysWOW64\Kjmole32.dll	Pfppoa32.exe
File created	C:\Windows\SysWOW64\Daliqjnc.dll	Pbimjb32.exe
File created	C:\Windows\SysWOW64\Pcijce32.exe	Pomncfge.exe
File created	C:\Windows\SysWOW64\Amfhgj32.exe	Aeopfl32.exe
File created	C:\Windows\SysWOW64\Gckjdhni.dll	Aeopfl32.exe
File opened for modification	C:\Windows\SysWOW64\Pmhkflnj.exe	Pilpfm32.exe
File opened for modification	C:\Windows\SysWOW64\Pcijce32.exe	Pomncfge.exe
File created	C:\Windows\SysWOW64\Ejcdfahd.dll	Aealll32.exe
File created	C:\Windows\SysWOW64\Joboincl.dll	Ohncdobq.exe
File opened for modification	C:\Windows\SysWOW64\Omcbkl32.exe	Ohhfknjf.exe
File created	C:\Windows\SysWOW64\Miiepfpf.dll	Ohhfknjf.exe
File opened for modification	C:\Windows\SysWOW64\Pbddobla.exe	Pcbdcf32.exe
File opened for modification	C:\Windows\SysWOW64\Pfppoa32.exe	Pbddobla.exe
File created	C:\Windows\SysWOW64\Oenflo32.dll	Qejfkmem.exe
File opened for modification	C:\Windows\SysWOW64\Nkjckkcg.exe	Napameoi.exe
File opened for modification	C:\Windows\SysWOW64\Ohncdobq.exe	Nkjckkcg.exe
File opened for modification	C:\Windows\SysWOW64\Ohcmpn32.exe	Ohqpjo32.exe
File created	C:\Windows\SysWOW64\Pcdqhecd.exe	Pkmhgh32.exe
File created	C:\Windows\SysWOW64\Pehjfm32.exe	Pbimjb32.exe
File created	C:\Windows\SysWOW64\Ohncdobq.exe	Nkjckkcg.exe
File created	C:\Windows\SysWOW64\Qebeaf32.dll	Pcijce32.exe
File created	C:\Windows\SysWOW64\Qejfkmem.exe	Qfgfpp32.exe
File opened for modification	C:\Windows\SysWOW64\Ohhfknjf.exe	Odljjo32.exe
File created	C:\Windows\SysWOW64\Pbddobla.exe	Pcbdcf32.exe
File opened for modification	C:\Windows\SysWOW64\Peempn32.exe	Pbgqdb32.exe
File created	C:\Windows\SysWOW64\Pnnggcqk.dll	Pokanf32.exe
File created	C:\Windows\SysWOW64\Hblaceei.dll	Pehjfm32.exe
File opened for modification	C:\Windows\SysWOW64\Qfgfpp32.exe	Pcijce32.exe
File created	C:\Windows\SysWOW64\Conllp32.dll	Qfgfpp32.exe
File opened for modification	C:\Windows\SysWOW64\Qfjcep32.exe	Qbngeadf.exe
File created	C:\Windows\SysWOW64\Eflmkg32.dll	Pcpgmf32.exe
File created	C:\Windows\SysWOW64\Piolkm32.exe	Pfppoa32.exe
File created	C:\Windows\SysWOW64\Kkpdnm32.dll	Pmmeak32.exe
File created	C:\Windows\SysWOW64\Mebkge32.exe	2026-08-04_e1c010fc9320d95d2c20892ccd863848_elex_wannacry.exe
File created	C:\Windows\SysWOW64\Fmfbakio.dll	Mdghhb32.exe
File opened for modification	C:\Windows\SysWOW64\Oflfdbip.exe	Omcbkl32.exe
File created	C:\Windows\SysWOW64\Fflnkhef.dll	Pmhkflnj.exe
File created	C:\Windows\SysWOW64\Aeopfl32.exe	Abpcja32.exe
File opened for modification	C:\Windows\SysWOW64\Pkholi32.exe	Pmeoqlpl.exe
File created	C:\Windows\SysWOW64\Okmpqjad.exe	Ohncdobq.exe
File opened for modification	C:\Windows\SysWOW64\Ohqpjo32.exe	Okmpqjad.exe
File created	C:\Windows\SysWOW64\Nheqnpjk.exe	Mdghhb32.exe
File created	C:\Windows\SysWOW64\Pmhkflnj.exe	Pilpfm32.exe
File created	C:\Windows\SysWOW64\Hpacoj32.dll	Pcbdcf32.exe
File opened for modification	C:\Windows\SysWOW64\Pcdqhecd.exe	Pkmhgh32.exe
File created	C:\Windows\SysWOW64\Pbimjb32.exe	Pokanf32.exe
File opened for modification	C:\Windows\SysWOW64\Odljjo32.exe	Oloipmfd.exe
File created	C:\Windows\SysWOW64\Qppkhfec.exe	Qmanljfo.exe
File created	C:\Windows\SysWOW64\Mfppnk32.dll	Qihoak32.exe
File opened for modification	C:\Windows\SysWOW64\Qpbgnecp.exe	Qmckbjdl.exe
File created	C:\Windows\SysWOW64\Abpcja32.exe	Qpbgnecp.exe
File opened for modification	C:\Windows\SysWOW64\Amhdmi32.exe	Aealll32.exe
File created	C:\Windows\SysWOW64\Mdghhb32.exe	Mebkge32.exe
File created	C:\Windows\SysWOW64\Honmnc32.dll	Pmeoqlpl.exe
File created	C:\Windows\SysWOW64\Ncloojfj.dll	Pdqcenmg.exe
File created	C:\Windows\SysWOW64\Cmnegipj.dll	Pkmhgh32.exe
File opened for modification	C:\Windows\SysWOW64\Pbgqdb32.exe	Pcdqhecd.exe

System Location Discovery: System Language Discovery 1 TTPs 58 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qpbgnecp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acppddig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmoagk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mebkge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdghhb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Omcbkl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pijcpmhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nkjckkcg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ohncdobq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pilpfm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pbgqdb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmckbjdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeopfl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amfhgj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afnlpohj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Napameoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ohqpjo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmjhlklg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pokanf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qbngeadf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nheqnpjk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Namegfql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oflfdbip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pkklbh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcbdcf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qfgfpp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pehjfm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qejfkmem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Piolkm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qppkhfec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abpcja32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pbimjb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pomncfge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcijce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmeoqlpl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pkholi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdqcenmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmmeak32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Okmpqjad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oloipmfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ohhfknjf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmhkflnj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pkmhgh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pbddobla.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfppoa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcdqhecd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcpgmf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qihoak32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amhdmi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akihcfid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aealll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pbbgicnd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Peempn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmanljfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qfjcep32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_e1c010fc9320d95d2c20892ccd863848_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ohcmpn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odljjo32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nheqnpjk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pqoppk32.dll"	Odljjo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qmckbjdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifoglp32.dll"	Abpcja32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ohncdobq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ohhfknjf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oflfdbip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjmole32.dll"	Pfppoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pbgqdb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Peempn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Daliqjnc.dll"	Pbimjb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oenflo32.dll"	Qejfkmem.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Okmpqjad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhinoa32.dll"	Qbngeadf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmejnpqp.dll"	Qfjcep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Abpcja32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Akihcfid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggociklh.dll"	Afnlpohj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aealll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfqdbl32.dll"	Nheqnpjk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oloipmfd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pfppoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfqgoo32.dll"	Qpbgnecp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aojbfccl.dll"	2026-08-04_e1c010fc9320d95d2c20892ccd863848_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohhbfe32.dll"	Mebkge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mebkge32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Piolkm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pbgqdb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pcijce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qejfkmem.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qmanljfo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Namegfql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Haafdi32.dll"	Pomncfge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qmanljfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pbphca32.dll"	Qmckbjdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Afnlpohj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chdjpphi.dll"	Oloipmfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pdqcenmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fflnkhef.dll"	Pmhkflnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpacoj32.dll"	Pcbdcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkiigchm.dll"	Pmjhlklg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmoagk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Amfhgj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nkjckkcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmfbakio.dll"	Mdghhb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ohcmpn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pilpfm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmmeak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pmoagk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Abpcja32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ohhfknjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eflmkg32.dll"	Pcpgmf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pkmhgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mdghhb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Piolkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qbngeadf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Omcbkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pijcpmhc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pdqcenmg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Peempn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pomncfge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmjhlklg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Edkamckh.dll"	Pbgqdb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdghhb32.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 4740	1132	2026-08-04_e1c010fc9320d95d2c20892ccd863848_elex_wannacry.exe	84
PID 4740 wrote to memory of 3868	4740	Mebkge32.exe	85
PID 3868 wrote to memory of 4860	3868	Mdghhb32.exe	86
PID 4860 wrote to memory of 4748	4860	Nheqnpjk.exe	87
PID 4748 wrote to memory of 1896	4748	Namegfql.exe	88
PID 1896 wrote to memory of 5036	1896	Napameoi.exe	89
PID 5036 wrote to memory of 1988	5036	Nkjckkcg.exe	90
PID 1988 wrote to memory of 824	1988	Ohncdobq.exe	91
PID 824 wrote to memory of 4216	824	Okmpqjad.exe	92
PID 4216 wrote to memory of 4932	4216	Ohqpjo32.exe	93
PID 4932 wrote to memory of 4016	4932	Ohcmpn32.exe	94
PID 4016 wrote to memory of 4820	4016	Oloipmfd.exe	95
PID 4820 wrote to memory of 2168	4820	Odljjo32.exe	96
PID 2168 wrote to memory of 3132	2168	Ohhfknjf.exe	97
PID 3132 wrote to memory of 1780	3132	Omcbkl32.exe	98
PID 1780 wrote to memory of 1308	1780	Oflfdbip.exe	99
PID 1308 wrote to memory of 3376	1308	Pijcpmhc.exe	100
PID 3376 wrote to memory of 4032	3376	Pmeoqlpl.exe	101
PID 4032 wrote to memory of 3876	4032	Pkholi32.exe	102
PID 3876 wrote to memory of 1384	3876	Pcpgmf32.exe	103
PID 1384 wrote to memory of 3116	1384	Pbbgicnd.exe	104
PID 3116 wrote to memory of 216	3116	Pdqcenmg.exe	105
PID 216 wrote to memory of 2496	216	Pilpfm32.exe	106
PID 2496 wrote to memory of 1140	2496	Pmhkflnj.exe	107
PID 1140 wrote to memory of 1188	1140	Pkklbh32.exe	108
PID 1188 wrote to memory of 4364	1188	Pcbdcf32.exe	109
PID 4364 wrote to memory of 1996	4364	Pbddobla.exe	110
PID 1996 wrote to memory of 2108	1996	Pfppoa32.exe	111
PID 2108 wrote to memory of 5072	2108	Piolkm32.exe	112
PID 5072 wrote to memory of 3452	5072	Pmjhlklg.exe	113
PID 3452 wrote to memory of 1284	3452	Pkmhgh32.exe	114
PID 1284 wrote to memory of 5016	1284	Pcdqhecd.exe	115
PID 5016 wrote to memory of 3276	5016	Pbgqdb32.exe	116
PID 3276 wrote to memory of 2024	3276	Peempn32.exe	117
PID 2024 wrote to memory of 4684	2024	Pmmeak32.exe	118
PID 4684 wrote to memory of 4976	4684	Pokanf32.exe	119
PID 4976 wrote to memory of 1352	4976	Pbimjb32.exe	120
PID 1352 wrote to memory of 4436	1352	Pehjfm32.exe	121
PID 4436 wrote to memory of 1860	4436	Pmoagk32.exe	122
PID 1860 wrote to memory of 4324	1860	Pomncfge.exe	123
PID 4324 wrote to memory of 4536	4324	Pcijce32.exe	124
PID 4536 wrote to memory of 4356	4536	Qfgfpp32.exe	125
PID 4356 wrote to memory of 3456	4356	Qejfkmem.exe	126
PID 3456 wrote to memory of 5000	3456	Qmanljfo.exe	127
PID 5000 wrote to memory of 2232	5000	Qppkhfec.exe	128
PID 2232 wrote to memory of 3056	2232	Qbngeadf.exe	129
PID 3056 wrote to memory of 1020	3056	Qfjcep32.exe	130
PID 1020 wrote to memory of 4808	1020	Qihoak32.exe	131
PID 4808 wrote to memory of 3324	4808	Qmckbjdl.exe	132
PID 3324 wrote to memory of 3044	3324	Qpbgnecp.exe	133
PID 3044 wrote to memory of 4184	3044	Abpcja32.exe	134
PID 4184 wrote to memory of 4720	4184	Aeopfl32.exe	135
PID 4720 wrote to memory of 5084	4720	Amfhgj32.exe	136
PID 5084 wrote to memory of 1632	5084	Akihcfid.exe	137
PID 1632 wrote to memory of 380	1632	Acppddig.exe	138
PID 380 wrote to memory of 116	380	Afnlpohj.exe	139
PID 116 wrote to memory of 4900	116	Aealll32.exe	140

C:\Users\Admin\AppData\Local\Temp\2026-08-04_e1c010fc9320d95d2c20892ccd863848_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_e1c010fc9320d95d2c20892ccd863848_elex_wannacry.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Windows\SysWOW64\Mebkge32.exe
  C:\Windows\system32\Mebkge32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Windows\SysWOW64\Mdghhb32.exe
    C:\Windows\system32\Mdghhb32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3868
  - - C:\Windows\SysWOW64\Nheqnpjk.exe
      C:\Windows\system32\Nheqnpjk.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4860
    - - C:\Windows\SysWOW64\Namegfql.exe
        
        C:\Windows\system32\Namegfql.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4748
      - C:\Windows\SysWOW64\Napameoi.exe
        
        C:\Windows\system32\Napameoi.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1896
        
        C:\Windows\SysWOW64\Nkjckkcg.exe
        
        C:\Windows\system32\Nkjckkcg.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5036
        
        C:\Windows\SysWOW64\Ohncdobq.exe
        
        C:\Windows\system32\Ohncdobq.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1988
        
        C:\Windows\SysWOW64\Okmpqjad.exe
        
        C:\Windows\system32\Okmpqjad.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:824
        
        C:\Windows\SysWOW64\Ohqpjo32.exe
        
        C:\Windows\system32\Ohqpjo32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4216
        
        C:\Windows\SysWOW64\Ohcmpn32.exe
        
        C:\Windows\system32\Ohcmpn32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4932
        
        C:\Windows\SysWOW64\Oloipmfd.exe
        
        C:\Windows\system32\Oloipmfd.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4016
        
        C:\Windows\SysWOW64\Odljjo32.exe
        
        C:\Windows\system32\Odljjo32.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4820
        
        C:\Windows\SysWOW64\Ohhfknjf.exe
        
        C:\Windows\system32\Ohhfknjf.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2168
        
        C:\Windows\SysWOW64\Omcbkl32.exe
        
        C:\Windows\system32\Omcbkl32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3132
        
        C:\Windows\SysWOW64\Oflfdbip.exe
        
        C:\Windows\system32\Oflfdbip.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1780
        
        C:\Windows\SysWOW64\Pijcpmhc.exe
        
        C:\Windows\system32\Pijcpmhc.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1308
        
        C:\Windows\SysWOW64\Pmeoqlpl.exe
        
        C:\Windows\system32\Pmeoqlpl.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3376
        
        C:\Windows\SysWOW64\Pkholi32.exe
        
        C:\Windows\system32\Pkholi32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4032
        
        C:\Windows\SysWOW64\Pcpgmf32.exe
        
        C:\Windows\system32\Pcpgmf32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3876
        
        C:\Windows\SysWOW64\Pbbgicnd.exe
        
        C:\Windows\system32\Pbbgicnd.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1384
        
        C:\Windows\SysWOW64\Pdqcenmg.exe
        
        C:\Windows\system32\Pdqcenmg.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3116
        
        C:\Windows\SysWOW64\Pilpfm32.exe
        
        C:\Windows\system32\Pilpfm32.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:216
        
        C:\Windows\SysWOW64\Pmhkflnj.exe
        
        C:\Windows\system32\Pmhkflnj.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2496
        
        C:\Windows\SysWOW64\Pkklbh32.exe
        
        C:\Windows\system32\Pkklbh32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1140
        
        C:\Windows\SysWOW64\Pcbdcf32.exe
        
        C:\Windows\system32\Pcbdcf32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1188
        
        C:\Windows\SysWOW64\Pbddobla.exe
        
        C:\Windows\system32\Pbddobla.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4364
        
        C:\Windows\SysWOW64\Pfppoa32.exe
        
        C:\Windows\system32\Pfppoa32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1996
        
        C:\Windows\SysWOW64\Piolkm32.exe
        
        C:\Windows\system32\Piolkm32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2108
        
        C:\Windows\SysWOW64\Pmjhlklg.exe
        
        C:\Windows\system32\Pmjhlklg.exe
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5072
        
        C:\Windows\SysWOW64\Pkmhgh32.exe
        
        C:\Windows\system32\Pkmhgh32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3452
        
        C:\Windows\SysWOW64\Pcdqhecd.exe
        
        C:\Windows\system32\Pcdqhecd.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1284
        
        C:\Windows\SysWOW64\Pbgqdb32.exe
        
        C:\Windows\system32\Pbgqdb32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5016
        
        C:\Windows\SysWOW64\Peempn32.exe
        
        C:\Windows\system32\Peempn32.exe
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3276
        
        C:\Windows\SysWOW64\Pmmeak32.exe
        
        C:\Windows\system32\Pmmeak32.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2024
        
        C:\Windows\SysWOW64\Pokanf32.exe
        
        C:\Windows\system32\Pokanf32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4684
        
        C:\Windows\SysWOW64\Pbimjb32.exe
        
        C:\Windows\system32\Pbimjb32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4976
        
        C:\Windows\SysWOW64\Pehjfm32.exe
        
        C:\Windows\system32\Pehjfm32.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1352
        
        C:\Windows\SysWOW64\Pmoagk32.exe
        
        C:\Windows\system32\Pmoagk32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4436
        
        C:\Windows\SysWOW64\Pomncfge.exe
        
        C:\Windows\system32\Pomncfge.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1860
        
        C:\Windows\SysWOW64\Pcijce32.exe
        
        C:\Windows\system32\Pcijce32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4324
        
        C:\Windows\SysWOW64\Qfgfpp32.exe
        
        C:\Windows\system32\Qfgfpp32.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4536
        
        C:\Windows\SysWOW64\Qejfkmem.exe
        
        C:\Windows\system32\Qejfkmem.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4356
        
        C:\Windows\SysWOW64\Qmanljfo.exe
        
        C:\Windows\system32\Qmanljfo.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3456
        
        C:\Windows\SysWOW64\Qppkhfec.exe
        
        C:\Windows\system32\Qppkhfec.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5000
        
        C:\Windows\SysWOW64\Qbngeadf.exe
        
        C:\Windows\system32\Qbngeadf.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2232
        
        C:\Windows\SysWOW64\Qfjcep32.exe
        
        C:\Windows\system32\Qfjcep32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3056
        
        C:\Windows\SysWOW64\Qihoak32.exe
        
        C:\Windows\system32\Qihoak32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1020
        
        C:\Windows\SysWOW64\Qmckbjdl.exe
        
        C:\Windows\system32\Qmckbjdl.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4808
        
        C:\Windows\SysWOW64\Qpbgnecp.exe
        
        C:\Windows\system32\Qpbgnecp.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3324
        
        C:\Windows\SysWOW64\Abpcja32.exe
        
        C:\Windows\system32\Abpcja32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3044
        
        C:\Windows\SysWOW64\Aeopfl32.exe
        
        C:\Windows\system32\Aeopfl32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4184
        
        C:\Windows\SysWOW64\Amfhgj32.exe
        
        C:\Windows\system32\Amfhgj32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4720
        
        C:\Windows\SysWOW64\Akihcfid.exe
        
        C:\Windows\system32\Akihcfid.exe
        54⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5084
        
        C:\Windows\SysWOW64\Acppddig.exe
        
        C:\Windows\system32\Acppddig.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1632
        
        C:\Windows\SysWOW64\Afnlpohj.exe
        
        C:\Windows\system32\Afnlpohj.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:380
        
        C:\Windows\SysWOW64\Aealll32.exe
        
        C:\Windows\system32\Aealll32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:116
        
        C:\Windows\SysWOW64\Amhdmi32.exe
        
        C:\Windows\system32\Amhdmi32.exe
        58⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Mdghhb32.exe

Path C:\Windows\SysWOW64\Mdghhb32.exe
Size 320KB
SHA256 afa28c282104f04b501ff1ccb187982102e6a18c93fa33c15b70136d6e18a29f
MD5 a123b04fcbd292229e549de3117e05e8
SHA1 9350d72cb0482a8c0e5fe97709d1a6f705fa45ed
SHA512 5db6175fb2a56912ee5e28211edae8b1afed8eb5cd4a1f02c266531c2a666b6bba182d3815abbb85ec0d118497948f6869a17291bea892e0b646e0b0b4efc195
SSDEEP 3072:zYZoJW5Ow50qkPy/0wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:z8oJ/w50qkPK0V/Ah1G/AcQ///NR5fn
TLSH
T1C0641F191A3409FACEEE1FB6AC2259D85141E9F015F1E23E6123DFECD8E4DA2D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mebkge32.exe

Path C:\Windows\SysWOW64\Mebkge32.exe
Size 320KB
SHA256 f0cf95be8676205924e60d830e3a59694922cf5b7278fc59cf6ccf181cb00aa2
MD5 35c108191ce171c808a127e91123612c
SHA1 822e613e701cec679d0bc229fc93c8d5c7a8d85d
SHA512 ef7c1df80736ccd43397900b4236b6bbc01f61fa29034f9af413e37505bf4ffc568e32fb65664f1ef97f14e69f95865dcf1d6b9c2bd67a0e41468a4e7ccdcfb0
SSDEEP 3072:rBcxvLJqs8fQ63QPwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:tcxtqryV/Ah1G/AcQ///NR5fn
TLSH
T13264EB29267409EACDED1BB5BC1249D89141EAF024F1E13E5133DFDCD8E8DA6D816F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Namegfql.exe

Path C:\Windows\SysWOW64\Namegfql.exe
Size 320KB
SHA256 d768d5f0ce9ed0262e13d491b8d47201d2a1c66782f5dd5f2ad1c38486d027df
MD5 e001619dfcbccd02626bf8475ef5aa4a
SHA1 dec7f1e69dbef8d822221f5c387e31096e7d920a
SHA512 23861481326564bc12c9f8e88bc29ddaa94700c461347ea17f093d01560194074f3bf3e02aa38e506d6bb45f7429921bad57b1dd1dee6136fc27c79ef1b36d0b
SSDEEP 3072:kRObZk2J21DPzreFiKRdbwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:hkrtPzGRnbV/Ah1G/AcQ///NR5fn
TLSH
T15464EA192A3009EACEED1FB6EC1269D84185E8F014F5E17E6123DFDCD8E4DA2D919F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Napameoi.exe

Path C:\Windows\SysWOW64\Napameoi.exe
Size 320KB
SHA256 45f3f72b2c8bc1f478825768fbb845bb0e455806292f6deabaad746f76f077e3
MD5 058b9f7067be5a0889a509d5c1e50f95
SHA1 09650a4eda3d084c903ee965fc3cbcd91ebc3ff8
SHA512 5c3961447750529f7f256619ec3ca766753ed6f253891a84bf35fc46523ce7ff6aea202dcdcccbcae558327c7f27856e07a81ceeec9e5d7276c1e8a35177ec24
SSDEEP 3072:fFE67EMo4wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:MMo4V/Ah1G/AcQ///NR5fn
TLSH
T1E7641F192A3409EACEED1BB5AC2259D85541E8F914F1E63E6123DFDCC8F4DA2D805F83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nheqnpjk.exe

Path C:\Windows\SysWOW64\Nheqnpjk.exe
Size 320KB
SHA256 668af874d13083d042cb84ed1a0357054886ca5f2f1bab5224dad297479c79d7
MD5 b5ca0674a9ffea1195198dc2540a8291
SHA1 8977789e8fe5133949eaa3871dffa74622270aff
SHA512 2d31c8e8c29bc85996178b7855f5659c544f604857e7a31e81807db5f7f9ca1f4e972aec4a80935827cce2fc85c01e2a6a47a8498b4bc769b5a2540b7ab4980f
SSDEEP 3072:IPBEaeE4S8w1hODwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:uyDw1hODV/Ah1G/AcQ///NR5fn
TLSH
T1E7641019263409EACEED1BB6BC1299D89141E9F114F2E13E6123DFDCD8E4EB2D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nkjckkcg.exe

Path C:\Windows\SysWOW64\Nkjckkcg.exe
Size 320KB
SHA256 437c755c9e2d13aa21a857efa13df719b537a78f466bf81ec6a0ab62561e67e7
MD5 810f234ca2bbf5203b0e55c4176bd907
SHA1 ab96b4f66c9a1e25886d33aaf89aa046f25842c8
SHA512 f2d3ef4aac26c3223deb81a4c7f4514faca1ae0e56fe3d28fdc597b9befe622c31e37d48a661366fb4257c2e82632ad43de81f69764a731f66306aeddf55d84c
SSDEEP 3072:CfFvrv/Mt5CDjXQc7WUXwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:CfRz8qjdaUXV/Ah1G/AcQ///NR5fn
TLSH
T10F641D1926390AEACEED1BB5AC2249DC9541E9F014F1E23E6533DFDCC8E5DA2C815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Odljjo32.exe

Path C:\Windows\SysWOW64\Odljjo32.exe
Size 320KB
SHA256 f160d9690c5225feafcbeb6f01a52cf63942c73b6e89df722822fbf1d5bd6b9b
MD5 e38a54b62323e52490dcb07ac376aef6
SHA1 c1648906b1347c6a41a11b79916d36da0d99d24f
SHA512 911b47b4beb130634c4a1ea8c20eaab234fa588369552935c3fee91a72c9a35249810923b29dc2a577b4def297ea3f2cce082b389f9aa84d905bbce0c182f6c8
SSDEEP 3072:GhcLAQMM9KPHIwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:4cBsIV/Ah1G/AcQ///NR5fn
TLSH
T1FA64FC1A2A340AEACEED1FB5EC1249D89141E9F015F1E13E6123DFDCD8E4DA6D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Oflfdbip.exe

Path C:\Windows\SysWOW64\Oflfdbip.exe
Size 320KB
SHA256 899d178277e53cdf1bdb2fe1404e42a6b2a1f4e51284d1d1605c03e99bcc5bf2
MD5 78a48e7077d660ca1486b52304131d49
SHA1 2d3d5ee3c5dfe667bf0fe0c2e02645d79d7837b2
SHA512 5542b91c500611b26771af195b6cf61f57533b8a365353cfea2fb57190e0ec3dfd72a4e81881d234b68728886d2cd668ca25aa649ca256462d45cfa76058128a
SSDEEP 3072:XKaeeR8mtFMCdMwvimYYwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:RHRRMC6wvsYV/Ah1G/AcQ///NR5fn
TLSH
T12564111A263009EACDFD1BB5EC025AD89241E5F019F1E23E5123DFDCD8E8DA2D855F86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ohcmpn32.exe

Path C:\Windows\SysWOW64\Ohcmpn32.exe
Size 320KB
SHA256 60662a248782999800f68b4e4b38a2b6fe2966d12670e0198b228743a11e6398
MD5 21a6e8b172f5e9572bf1c631cdcac2d4
SHA1 9415dd8538e2e9834c0f0843c9b94b31296d21e3
SHA512 17307fd55a599f81f7974b7ec2f814ccd680d4be23291a1a879be4fd01d21af8a32b44b6a258213ae3a9f058bcee5f8249afacf771b300619d8e56f654a7fbcf
SSDEEP 3072:HJCWEQWyIBgi3c4pbnwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:HItQpIBDdnV/Ah1G/AcQ///NR5fn
TLSH
T16D643F192A3419FACEED1FB6AC1259D89141E8F114F1E23E6123DFDCD8E5DA2D809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ohhfknjf.exe

Path C:\Windows\SysWOW64\Ohhfknjf.exe
Size 320KB
SHA256 0d6dbf2241a7692a3348bfc4da798f9f1d8425018adb74adb4794785b21e3b38
MD5 0e9bce02490fc8a7452bcb2bdadd9f0e
SHA1 a826b5582f7a51818e32a7ec5bbe6c1ae4cc6e1d
SHA512 31cab4dbd933513fad2118a6268f25d1aeb5852890bb7e17971b78ec6fad5b60e9f86002e7a8e22954126d820c3628cb620b67be210d284d89238f6035abd3f2
SSDEEP 3072:H8Djh7psTL9TznDwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:cv1psT5DV/Ah1G/AcQ///NR5fn
TLSH
T1EF643119263409EBCDED2FB5AD1249E89181E9F014F1E23E6123DFDCD8E4EA6D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ohncdobq.exe

Path C:\Windows\SysWOW64\Ohncdobq.exe
Size 320KB
SHA256 84c303dca7b60451d8e133e6dc8c58168e38c168a3641be101f20b94a1debca0
MD5 7321a42c9973bd59dd3d3a834308b440
SHA1 28945912dbc2a5674ca5390c721e99c6f3c0f8c2
SHA512 8b3346ee5b53d8aec106778a3749be014c946d88ee241714803be629319507fbbb7b566ee0c94c05de32ca23c40c7e668de368d19c4bfd8a93c67bf4075252ff
SSDEEP 3072:CDPz9xsuPNZwERpqPGdwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:os7WRdV/Ah1G/AcQ///NR5fn
TLSH
T18164421926301AEACEED1FB5AC2249D99141E5F018F1E13E6523EFDCD8E4DA2EC15F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ohqpjo32.exe

Path C:\Windows\SysWOW64\Ohqpjo32.exe
Size 320KB
SHA256 e33e455a7163b5f4ff464b11cb7e548434b0f756539b632dfad1cf2338453e85
MD5 84b0cf8bc891c4d2af37cec4ca6e6f89
SHA1 7d8912a7c74c42cfb02e0f4da915959a5401c048
SHA512 c4176af6f54439740de399b61431f57b6e403cf0033b9e62db436a8efe8ece0fca9cb07f41bac57edda7b8b3ed940ce1e282cc2aba7e99ef8802e5e1729345a9
SSDEEP 3072:x9laC6N06uuMl9paqmAou7wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Ia6Ml9A3mV/Ah1G/AcQ///NR5fn
TLSH
T17A6431592A340AEACDEE1FB6AC1749D85141E4F014F1E13E6623DFDCD8E4EA2D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Okmpqjad.exe

Path C:\Windows\SysWOW64\Okmpqjad.exe
Size 320KB
SHA256 158eb702e316738e0c93d089348fff27ae61484be77749cd1be0a96b86d86da0
MD5 ab4d21d19ddc3906eede1ba1e37069a4
SHA1 3353118b05fa858488e4d5a5c26edf4d9f291f80
SHA512 54bec43dc44a15ac3e695598136ed00a4d07d70717599562daa8a324ff65065ae3a23f303a16b38c9fe89becb48d0512ee7f4a6f7b46a58ac3185383114bc684
SSDEEP 3072:UltpICPhV1pYwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:ULiCDYV/Ah1G/AcQ///NR5fn
TLSH
T1A36432192A3409EACEED1FB5AC1269DC9141EAF014F1E13E6923DFDCD8E4DA6C815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Oloipmfd.exe

Path C:\Windows\SysWOW64\Oloipmfd.exe
Size 320KB
SHA256 938154e80f81e101c9e025273afee210c5cedce45ccfbf60763d8256f7c62808
MD5 84fc1d52093cc6390cdb4b37453d3c72
SHA1 b83a0e45afc23a1e21d1ec7dc57fd725a6dc6a64
SHA512 710fd4c2443c83ca5918d79290a45d98467f34512c5274901b79e2850194750bc3c9d75fbc071a51a080c4860e69a313f85ec6132b3d672ecf22bef1de2e2061
SSDEEP 3072:EwEQhZ0BXOwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:jZ0ZOV/Ah1G/AcQ///NR5fn
TLSH
T146641F1A2A300DEADEED1BB5AC1249D89141E8F014F6E13E6527DFDCD8E4DB2E815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Omcbkl32.exe

Path C:\Windows\SysWOW64\Omcbkl32.exe
Size 320KB
SHA256 9850b056fccabe23e763343d66882235435c6c1e50e54fedb7fb53cc814ff817
MD5 89415c0e2ef0741cd053d5237d5476b2
SHA1 4e2be25c1a361cc6cacf49f3529206b83d28882f
SHA512 5f9565e8405be2c81e32508140b5b55f31f296b0558083cb09389bc04166679e26a7ed1228c34033bbac8e83843e311aafc48ea992bac2ca8832b4c666e0b473
SSDEEP 3072:2C64Aum6qr51nGarzRFwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:2C64AbLGarzRFV/Ah1G/AcQ///NR5fn
TLSH
T1A5640E2926310AEACDED1BB5BC125DD8A151E9F014F1E13E6123DFDCE8E4DAAC815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pbbgicnd.exe

Path C:\Windows\SysWOW64\Pbbgicnd.exe
Size 320KB
SHA256 4b3c71a03a7a0741fe92767459f9de694f60ab4823c4d5e8296667f40f5bb4ac
MD5 ad4b300f97cd584979daabbb19d7d482
SHA1 c1056457e8bf6dfd9cc135367548be9e8c969524
SHA512 80a072d7de13297ebb210b08eee3de7a87dbc88cca248171eb49d8b92473649527f4621b1004b3c485c6b9ecde9a2513f3d8d6272cdab8c4b40a4b0fa5e86cbb
SSDEEP 3072:oXVGeJuorb9EA5PmK7lMSwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:+8orbiA5PmylMSV/Ah1G/AcQ///NR5fn
TLSH
T15664421A263019EACEED2FB5AC0249DC9181E4F054F1E1BE5523EFDCD9E4DA2D846F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pbddobla.exe

Path C:\Windows\SysWOW64\Pbddobla.exe
Size 320KB
SHA256 6c5093fd6643425a1959cdbcf82929064ec7b4fbf5ec18d8598afa223b3ae9ed
MD5 30368a2016f3a38d2a93e92528fd00c3
SHA1 8fcd760db81e5a453c4ee8a390f1dd9a4311cad4
SHA512 71532bf1f512e20186848fcece5d29c3ef1e2e829a8ebecf1d0781bd4c1247a44ac41129dcb35a520f636be7a5158945bf59be25ab2339a8b86f8b65499c0436
SSDEEP 3072:sne/TPJ37WAhd2wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:sne1rxd2V/Ah1G/AcQ///NR5fn
TLSH
T1526431192A3409EADEED1FB5AC124AE89141E4F054F1E13E7123EFDCD8E8DA6C855F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pbgqdb32.exe

Path C:\Windows\SysWOW64\Pbgqdb32.exe
Size 320KB
SHA256 53f2fd6c9ccd7778207cacfda26a0ffef80014d9cddb203c45b62192ec18f75a
MD5 e604887f3fb91e184bb08d8510151f3e
SHA1 117cbed25fc9b57146624b7849aea933685e9cdd
SHA512 af980e55898317ff14070eede50a26d498cba8401c5810f9d704f0c09ae305242e10b4f1cba3136444f887bdd15cffa71706df920c684cafe601643d027e0c5c
SSDEEP 3072:XlhMMbf4tm2uwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:V+sfD2uV/Ah1G/AcQ///NR5fn
TLSH
T1516442192A3449EADEED1BB6AC0249D89141E6F014F5E13EA167FFDCC8E4DA6CC05F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pcbdcf32.exe

Path C:\Windows\SysWOW64\Pcbdcf32.exe
Size 320KB
SHA256 a5697b5f6e30166346a945781b8e237a0927b557925d29dd38fa89cda08db35a
MD5 23d58e34c1c8f2f76ad81c13182f7a99
SHA1 c6dfdec373e568f2e6707e6b6684772282a9f264
SHA512 15cac44d3bb56422bbe89db9c156890dde2a36cef1ae7fb0a094cfcbfda486682f3af117cfacadf441a9c2c24651fc3684a7c37e2316eee0911c4f17eb8d60ef
SSDEEP 3072:pytvcm/rhMXPx6l5E2HpBwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:pFmEo1BV/Ah1G/AcQ///NR5fn
TLSH
T12964EA192A3409EACEED1FB6ED1259E85141E9B014F2E13E6123DFECD8E4DA2D805FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pcdqhecd.exe

Path C:\Windows\SysWOW64\Pcdqhecd.exe
Size 320KB
SHA256 3ac2e6d2339aced302040f8978eb596b974cee0c52d958d3c2c3dc37a048e194
MD5 a189dbd347634e76e416ea089bf25cb5
SHA1 f2d77a50c1a6c4e6d3abe1dac5f814d3014763ca
SHA512 76de4b684725484934f1042457a371003e95ea56ad4ce1b1fe4c123b8669097fe35a7102eae427e7c872ff2fc6ba2668b3462671e47c2b653ad6d9870549105b
SSDEEP 3072:24EnqGXY2pqrvMOWOwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:2bq37WOV/Ah1G/AcQ///NR5fn
TLSH
T101640D29263449EAEEED1BB5FC5249D85142E8F114F1E13E6223DFDCD8E4DA2D809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pcpgmf32.exe

Path C:\Windows\SysWOW64\Pcpgmf32.exe
Size 320KB
SHA256 8f0a5125041fe6baf3f567f75ffc03d34a98d1235eab56716a9ea18927793d78
MD5 ac4783c5bfa4a0c57f546cb5d19976d2
SHA1 4d85326f40d0e38c86a2553debe541370d8526c0
SHA512 961bdeacec2dc790b01b26b7e200eeea39df80d3a5108f3357fee61440fb62fe50cf1455697e6b1947956479e1c3af5d44dba93e50bea771d7b5ada808bdec5f
SSDEEP 3072:gcraOHykIWB1ZwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:g0/mWHZV/Ah1G/AcQ///NR5fn
TLSH
T173643F1A263009EACDED5BF5AC1299D89141E5F014F1E23E6123EFDCCCE5DA6D829F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pdqcenmg.exe

Path C:\Windows\SysWOW64\Pdqcenmg.exe
Size 320KB
SHA256 056233eb0f23619783beebdafe5bff9ca699ece79b09354645b3abfe392a6753
MD5 cc1ff7047fb340e9e57a0c50565ea18f
SHA1 3089c8cc5920f423d83ec27f6369eddd2db15859
SHA512 01d1d1251da72c98df2c3c0f9c254e96b7f2a7683a0c742fe93c27dab9cd3bb903d8567d9ffcc391bc52f38ef74c59a8ffda46664f87483d274e392b3300624c
SSDEEP 3072:z1S2y5nPW/2CowS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:z11yJO2CoV/Ah1G/AcQ///NR5fn
TLSH
T1456440192A3009EBCEED1FB6AC1249D85165E9F218F1E13E6123DFDCC8E4DA6D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pfppoa32.exe

Path C:\Windows\SysWOW64\Pfppoa32.exe
Size 320KB
SHA256 8ce0a8812ed3c2c03fd4372a692747fe0bd5c31dc3cf8508b311294c20d28bec
MD5 783dcc5d71d1f6159d742d6f4c2edeb5
SHA1 97948d1af117f9b6565f14ebe1361b70df827884
SHA512 c156aae9ea449e57fcea8ffddc735e55e424b3d81df78b468a8f76b405fa663bb48857c69b55e71aa7eb7731d494f9382c8ff6ced9a4f4859c0e2b99a47a04df
SSDEEP 3072:WnXuOeMkeDVQKhlzfjBwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:qXCMZDVQKDjBV/Ah1G/AcQ///NR5fn
TLSH
T189642E1A26300AEACDED5FB5EC1249D89141E9F594F1E13E6123DFDCC8E4DA2D819F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pijcpmhc.exe

Path C:\Windows\SysWOW64\Pijcpmhc.exe
Size 320KB
SHA256 4c521537e6c7b320780818a4215d10000d752ec821fa2929927ae0b430cdf197
MD5 f36f83b834589a06de61e2ea5345acc7
SHA1 3cdaa775635e6342a318832993c81a259c0df6c4
SHA512 3314b1777bf1af8bc0f3037aec65193efebe6bd0291d4baff60d8f41f680aa41048e638dbad2ba45ca7bdc84fdfa1e598f96bfba1e503d5e99f3d7e0fa34dc97
SSDEEP 3072:5C27GlpURwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:EURV/Ah1G/AcQ///NR5fn
TLSH
T183640C692B3509EACEED1FB5AC1249D89141E9F014F1E13E6123EFDCD8E4DA2C819F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pilpfm32.exe

Path C:\Windows\SysWOW64\Pilpfm32.exe
Size 320KB
SHA256 5313574f2cfefc5473f5ac0b51eb62fc332bab4a1c4f44ec8299eb90a18a7448
MD5 eb51d5226ef5772195568d342325d7bc
SHA1 ed62f636526a88c1935b3ee0a1363cca4a655de4
SHA512 5f0b4cd7d4311dcdbf2f91bba956b62337e9a3dfe5ccd2b4d44b6fc0f33ec2757aec9cda3a5056ad1e61145013205970a163715912313fed795b433d7a024e49
SSDEEP 3072:D1CEHQYQvliwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:D1aNiV/Ah1G/AcQ///NR5fn
TLSH
T193643F192A3409EACEED1BF6AC5249D85181E9F014F1E13EA563DFDCC8E4DB6E805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Piolkm32.exe

Path C:\Windows\SysWOW64\Piolkm32.exe
Size 320KB
SHA256 d50491285638ec0c09dececd7671af9207840c321e2895ea50edc78ad1f23deb
MD5 72dbe0f0a9202caf69abcbf14666944f
SHA1 b7445f3a5ff20f8fd80fdd0cd22a88583418e4fe
SHA512 8de171eb31dc29c9edf948c18858aaa04d6a64f525e41dcb83dbfd12c9c7ed03a31abaa6136b16bac6aea7e8877279d77913a0edd7af54364b764fd278ac6e65
SSDEEP 6144:h9qB7oVVcIPPrU8V/Ah1G/AcQ///NR5fn:LqBEDcIPPre/Nv
TLSH
T1E7642E1A2A3409EACDED1BB6AC1249D99181F9F114F1E23E6523DFDCD8E4DA2CC15F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pkholi32.exe

Path C:\Windows\SysWOW64\Pkholi32.exe
Size 320KB
SHA256 433ba39ecc70d22e843c1571a1e9c6841a73afa4e0f816be0b260c7f57477e9e
MD5 bde3d8b2f2f31af3862f8bfdbaf9af24
SHA1 c2a33fbb54d75f3ea6c4cf146c47b9125e972a26
SHA512 c0f9913017f52831ce9362c9fcd0ff42be131ab9ae9a9e9df66905b7fc8817cb7d69d83cdfa720763e59233c91df9a1f058eb2dcb0d1c11b5be140d5b782f512
SSDEEP 3072:6UtWdoMJZhmmMswS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:zkRfMsV/Ah1G/AcQ///NR5fn
TLSH
T1BE641D1A2A3909EACDED1BB5AC1259D96141F9F014F1E13E6123DFDCD9E8DB2C809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pkklbh32.exe

Path C:\Windows\SysWOW64\Pkklbh32.exe
Size 320KB
SHA256 6e5b49bd50c49782370504432809ca70f91298d73f7949ea2982c7c4a06fb7f3
MD5 9ed0124c487677dd2042648cce51c927
SHA1 4e857382e4c884ccac79cb30e100d45a239285bd
SHA512 0b679ac22cd5131c355d51f99a52b63ec831650abd90924d61887f084613a3486c00f3bc3c727ddb15ea5b77138c83f5a20233a24c0e0cf2e77b54b41c4c6588
SSDEEP 3072:KDIfW4ijt4XOjVwQwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:KDIfOMOjVwQV/Ah1G/AcQ///NR5fn
TLSH
T12864D9192A7409EACDED9BB5AC124DD85181F8F064F1E13E6123DFDED8E4DA2C809F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pkmhgh32.exe

Path C:\Windows\SysWOW64\Pkmhgh32.exe
Size 320KB
SHA256 3f1c9662d769e6d91419578a7b2a12ab3a84158fa3ec2a42a3b71a8a063bca55
MD5 931d7531ca977dc6b98189675499ddbf
SHA1 307941e8c220b9c3d71d92b28c36f05bddd25a6f
SHA512 c12657cfb655baae799831cc8b938be06dde2d336c75d97a5855a1c3f11b5d99c3e056b5d44bb25bfc699372a6d784008750b55ad232d09502483e9fa980f6a4
SSDEEP 3072:6wP9bT3h4G45kwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:R+GakV/Ah1G/AcQ///NR5fn
TLSH
T10F642F19263009EACEED1BB6BC0259D85581EAF414F1E23E6123DFDCD8E4DE6D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pmeoqlpl.exe

Path C:\Windows\SysWOW64\Pmeoqlpl.exe
Size 320KB
SHA256 d93b8aacc991b86be898880eaeb6e111bb6bfcbd6729e057d9bbd0931cb44dc2
MD5 b9944ac81adb638200939e66e5e72b89
SHA1 70d507d9b52dd8ae6e8110e961c01833202ca0cc
SHA512 5b34d2024460822957d708bccaf167775d01b9ae52ddf4c4f61b2bb85b98f1122125ab49217c244375b710d6524f5d6453b69453e844d88856f0c0cdd3868b0b
SSDEEP 3072:xfezAn9adfgZ0wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:xXadf00V/Ah1G/AcQ///NR5fn
TLSH
T1FF642E192A3109EACEED1FB5AE1249DC9141E8F014F1E13E6127DFDCC8E4DAAD809F95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pmhkflnj.exe

Path C:\Windows\SysWOW64\Pmhkflnj.exe
Size 320KB
SHA256 38a2acaf19286fcb22811af189e003d42178357055286ea0de2926e8f2b52a2d
MD5 e463632f7af27e54f827427fbdec1563
SHA1 179cd08988ad8657c0076dba40c693c4c535e620
SHA512 f7d7a63103393a7f4ae8507c676ecc285cd43c61683d796b9581925ba85ea81867bbdafc9f6e5ef115a7849f06fa8d4d46938b99f7bb15e3642fd54879ff84dc
SSDEEP 3072:JE+GKiAcF6gwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:JE+RgV/Ah1G/AcQ///NR5fn
TLSH
T11364FD2A2A3449EADDED1FB5AC1249D8D541E8F014F1E23E6123DFDCD8E4DA2D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pmjhlklg.exe

Path C:\Windows\SysWOW64\Pmjhlklg.exe
Size 320KB
SHA256 cde141a6c82ce39034679b00ba6ee80f466261776154d24ae05b91b5b8658900
MD5 15b64b4182591c8eb502da62d1e16b2a
SHA1 8e9b91703b253966d430fd411fbe97e04681c536
SHA512 1b6e5fc12d94061c3b3a59d96d6c86a88d7d3aed4e96e994d5f4863f1250824d9da9a106f438ddaa3422fb7a83478855c169dd2e1c2992150336b4356cb539b3
SSDEEP 3072:md2Gvt70YLYnW3xG6wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:2b7DsnSG6V/Ah1G/AcQ///NR5fn
TLSH
T1BC6410192A3809EACDED1BB5AC1349D85181E9F014F2E13E6527DFECD8E4DA6DC05F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/116-404-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/216-539-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/216-181-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/380-398-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/824-511-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/824-64-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1132-479-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1132-471-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1132-1-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/1132-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1140-197-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1140-543-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1188-205-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1188-545-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1284-557-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1284-253-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1308-133-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1308-527-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1352-292-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1384-533-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1384-165-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1632-392-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1780-525-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1780-125-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1860-303-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1896-41-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1896-505-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1988-61-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1988-509-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1996-221-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1996-549-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2024-273-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2108-229-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2108-551-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2168-521-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2168-109-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2232-339-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2496-541-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2496-189-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3044-368-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3056-345-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3116-173-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3116-536-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3132-117-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3132-523-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3276-267-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3276-553-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3324-362-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3376-529-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3376-141-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3452-559-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3452-245-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3456-327-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3868-16-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3868-473-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3868-483-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3876-157-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3876-531-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4016-517-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4016-88-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4032-149-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4032-537-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4184-374-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4216-77-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4216-513-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4324-309-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4356-321-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4364-547-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4364-213-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4436-297-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4536-315-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4684-279-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4720-380-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4740-481-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4740-472-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4740-8-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4748-487-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4748-36-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4808-356-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4820-102-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4820-519-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4860-485-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4860-24-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4860-477-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4900-406-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4932-515-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4932-84-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4976-285-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5000-333-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5016-555-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5016-261-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5036-49-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5036-507-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5072-582-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5072-237-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5084-386-0x0000000000400000-0x000000000046D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads