berbew | 0a72d0b25e84fe072886d46acfee16ea96df88ea85d7f3067264b6facd5f394d

Analysis

max time kernel
148s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 20:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_67c6b66f3f8ef45ae10a71933a85d588_elex_wannacry.exe
Size 320KB
Sample260810-y25ghaxeka
SHA256 0a72d0b25e84fe072886d46acfee16ea96df88ea85d7f3067264b6facd5f394d
MD5 67c6b66f3f8ef45ae10a71933a85d588
SHA1 282d3f7ff92374f784d8817a2c2bd34184a4a375
SHA512 e148586d8855966c8c7c7a158080d5b02506a7aaf5a7f3c4172c07207683f620acdf3cd791fcb3b6c829b148dbd589439196a54e3b4c1d13025a62da31d2e140
SSDEEP 3072:yWgwVqF59E6jksUEwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:yWgwU1EilUEV/Ah1G/AcQ///NR5fn
TLSH
T13F640C5A263409EACEFD2FB9AD1249D89181E9F014F1E13E6123DFDCD8E4DA2D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Piolkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nlcidopb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocfdgg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcdqhecd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abcppq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nhjjip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nofoki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ohncdobq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odedipge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Omaeem32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pehjfm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmoagk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oljoen32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pehjfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pbljoafi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aealll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mllccpfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Obfhmd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdngpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcfmneaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pomncfge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amfhgj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohncdobq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Okmpqjad.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pomncfge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qkdohg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nkeipk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlgbon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Podkmgop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Abpcja32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeopfl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nofoki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ochamg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oheienli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Omaeem32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofijnbkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Okfbgiij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Odbgdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocdgahag.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odbgdp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfppoa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pkmhgh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcfmneaa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amfhgj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oljoen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pkmhgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfppoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Odedipge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Noaeqjpe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndnnianm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkjckkcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nkjckkcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oloipmfd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfbmdabh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkhfek32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nconfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oheienli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Obnnnc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Piaiqlak.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qppkhfec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qelcamcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qpbgnecp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odgqopeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdqcenmg.exe

Executes dropped EXE 64 IoCs

pid	Process
4868	Mafofggd.exe
4744	Mddkbbfg.exe
1104	Mllccpfj.exe
4748	Ndidna32.exe
1896	Ndlacapp.exe
3256	Nlcidopb.exe
916	Nkeipk32.exe
4552	Noaeqjpe.exe
2992	Ndnnianm.exe
4168	Nhjjip32.exe
3112	Nkhfek32.exe
2700	Nocbfjmc.exe
2324	Nconfh32.exe
3928	Nfnjbdep.exe
2708	Ndpjnq32.exe
680	Nlgbon32.exe
2736	Nkjckkcg.exe
2888	Nofoki32.exe
2020	Ncaklhdi.exe
1416	Nfpghccm.exe
1060	Odbgdp32.exe
2360	Ohncdobq.exe
3680	Oljoen32.exe
2464	Okmpqjad.exe
1364	Ocdgahag.exe
2424	Obfhmd32.exe
3544	Odedipge.exe
1952	Ohqpjo32.exe
2504	Okolfj32.exe
3716	Ocfdgg32.exe
5004	Ofdqcc32.exe
876	Odgqopeb.exe
3864	Oloipmfd.exe
2952	Oomelheh.exe
3472	Ochamg32.exe
5052	Ofgmib32.exe
2780	Oheienli.exe
2688	Omaeem32.exe
4408	Oooaah32.exe
4388	Obnnnc32.exe
5048	Ofijnbkb.exe
4024	Ohhfknjf.exe
5080	Okfbgiij.exe
2076	Ocmjhfjl.exe
4128	Oflfdbip.exe
2484	Pdngpo32.exe
2232	Pmeoqlpl.exe
3324	Podkmgop.exe
3364	Pbbgicnd.exe
4664	Pdqcenmg.exe
3840	Pilpfm32.exe
5092	Pkklbh32.exe
2144	Pcbdcf32.exe
1700	Pfppoa32.exe
1312	Piolkm32.exe
4084	Pkmhgh32.exe
3332	Pcdqhecd.exe
964	Pfbmdabh.exe
3372	Piaiqlak.exe
3948	Pkoemhao.exe
540	Pcfmneaa.exe
1796	Pfeijqqe.exe
2760	Pehjfm32.exe
4368	Pmoagk32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Kkacdofa.dll	Oloipmfd.exe
File opened for modification	C:\Windows\SysWOW64\Nkjckkcg.exe	Nlgbon32.exe
File created	C:\Windows\SysWOW64\Kpmmhc32.dll	Odedipge.exe
File created	C:\Windows\SysWOW64\Pehjfm32.exe	Pfeijqqe.exe
File created	C:\Windows\SysWOW64\Pbljoafi.exe	Pomncfge.exe
File created	C:\Windows\SysWOW64\Jknmpb32.dll	Pomncfge.exe
File created	C:\Windows\SysWOW64\Apddce32.exe	Amfhgj32.exe
File created	C:\Windows\SysWOW64\Bebggf32.dll	Ncaklhdi.exe
File opened for modification	C:\Windows\SysWOW64\Okmpqjad.exe	Oljoen32.exe
File created	C:\Windows\SysWOW64\Ohpcjnil.dll	Omaeem32.exe
File created	C:\Windows\SysWOW64\Kjmole32.dll	Pfppoa32.exe
File opened for modification	C:\Windows\SysWOW64\Nconfh32.exe	Nocbfjmc.exe
File created	C:\Windows\SysWOW64\Flekgd32.dll	Nfnjbdep.exe
File created	C:\Windows\SysWOW64\Ofdqcc32.exe	Ocfdgg32.exe
File created	C:\Windows\SysWOW64\Fflnkhef.dll	Pilpfm32.exe
File opened for modification	C:\Windows\SysWOW64\Nkhfek32.exe	Nhjjip32.exe
File created	C:\Windows\SysWOW64\Pcdqhecd.exe	Pkmhgh32.exe
File created	C:\Windows\SysWOW64\Ifoglp32.dll	Abpcja32.exe
File opened for modification	C:\Windows\SysWOW64\Nocbfjmc.exe	Nkhfek32.exe
File opened for modification	C:\Windows\SysWOW64\Okolfj32.exe	Ohqpjo32.exe
File created	C:\Windows\SysWOW64\Podkmgop.exe	Pmeoqlpl.exe
File opened for modification	C:\Windows\SysWOW64\Piaiqlak.exe	Pfbmdabh.exe
File created	C:\Windows\SysWOW64\Mfppnk32.dll	Qelcamcj.exe
File opened for modification	C:\Windows\SysWOW64\Omaeem32.exe	Oheienli.exe
File opened for modification	C:\Windows\SysWOW64\Oooaah32.exe	Omaeem32.exe
File opened for modification	C:\Windows\SysWOW64\Obnnnc32.exe	Oooaah32.exe
File opened for modification	C:\Windows\SysWOW64\Pkklbh32.exe	Pilpfm32.exe
File created	C:\Windows\SysWOW64\Cieonn32.dll	Pkklbh32.exe
File created	C:\Windows\SysWOW64\Aeopfl32.exe	Abpcja32.exe
File opened for modification	C:\Windows\SysWOW64\Ndpjnq32.exe	Nfnjbdep.exe
File created	C:\Windows\SysWOW64\Piolkm32.exe	Pfppoa32.exe
File opened for modification	C:\Windows\SysWOW64\Abpcja32.exe	Qpbgnecp.exe
File created	C:\Windows\SysWOW64\Eknanh32.dll	Nhjjip32.exe
File opened for modification	C:\Windows\SysWOW64\Nlgbon32.exe	Ndpjnq32.exe
File opened for modification	C:\Windows\SysWOW64\Ncaklhdi.exe	Nofoki32.exe
File opened for modification	C:\Windows\SysWOW64\Ocfdgg32.exe	Okolfj32.exe
File created	C:\Windows\SysWOW64\Oheienli.exe	Ofgmib32.exe
File opened for modification	C:\Windows\SysWOW64\Ndlacapp.exe	Ndidna32.exe
File created	C:\Windows\SysWOW64\Nofoki32.exe	Nkjckkcg.exe
File opened for modification	C:\Windows\SysWOW64\Obfhmd32.exe	Ocdgahag.exe
File created	C:\Windows\SysWOW64\Odedipge.exe	Obfhmd32.exe
File created	C:\Windows\SysWOW64\Pfbmdabh.exe	Pcdqhecd.exe
File opened for modification	C:\Windows\SysWOW64\Nlcidopb.exe	Ndlacapp.exe
File created	C:\Windows\SysWOW64\Nbdenofm.dll	Nofoki32.exe
File created	C:\Windows\SysWOW64\Oljoen32.exe	Ohncdobq.exe
File created	C:\Windows\SysWOW64\Okolfj32.exe	Ohqpjo32.exe
File created	C:\Windows\SysWOW64\Pqoppk32.dll	Ofijnbkb.exe
File created	C:\Windows\SysWOW64\Hkidlkmq.dll	Ohhfknjf.exe
File created	C:\Windows\SysWOW64\Pfppoa32.exe	Pcbdcf32.exe
File created	C:\Windows\SysWOW64\Hfqgoo32.dll	Qpbgnecp.exe
File created	C:\Windows\SysWOW64\Mafofggd.exe	2026-08-10_67c6b66f3f8ef45ae10a71933a85d588_elex_wannacry.exe
File created	C:\Windows\SysWOW64\Joboincl.dll	Oljoen32.exe
File opened for modification	C:\Windows\SysWOW64\Ocdgahag.exe	Okmpqjad.exe
File created	C:\Windows\SysWOW64\Ochamg32.exe	Oomelheh.exe
File created	C:\Windows\SysWOW64\Bbndhppc.dll	Pdngpo32.exe
File opened for modification	C:\Windows\SysWOW64\Abcppq32.exe	Apddce32.exe
File opened for modification	C:\Windows\SysWOW64\Mafofggd.exe	2026-08-10_67c6b66f3f8ef45ae10a71933a85d588_elex_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\Nkeipk32.exe	Nlcidopb.exe
File created	C:\Windows\SysWOW64\Abohmm32.dll	Nconfh32.exe
File opened for modification	C:\Windows\SysWOW64\Nofoki32.exe	Nkjckkcg.exe
File opened for modification	C:\Windows\SysWOW64\Odbgdp32.exe	Nfpghccm.exe
File created	C:\Windows\SysWOW64\Gkhikf32.dll	Pbbgicnd.exe
File created	C:\Windows\SysWOW64\Odlpkg32.dll	Pcfmneaa.exe
File created	C:\Windows\SysWOW64\Ofijnbkb.exe	Obnnnc32.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qppkhfec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmeoqlpl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apddce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mllccpfj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlcidopb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfnjbdep.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofdqcc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofijnbkb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oflfdbip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdqcenmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pkklbh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfpghccm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcbdcf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmoagk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pomncfge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qelcamcj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abpcja32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abcppq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nofoki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmckbjdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nkjckkcg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oloipmfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oheienli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Okfbgiij.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdngpo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pbbgicnd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qbngeadf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nconfh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_67c6b66f3f8ef45ae10a71933a85d588_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Piolkm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odedipge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nkeipk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlgbon32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncaklhdi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Okolfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amhdmi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nkhfek32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oomelheh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcdqhecd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pkoemhao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofgmib32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Podkmgop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pilpfm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeopfl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amfhgj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aealll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mddkbbfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pkmhgh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Piaiqlak.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pbljoafi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Noaeqjpe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ndnnianm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nocbfjmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odbgdp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pehjfm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nhjjip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ndpjnq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oljoen32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Obfhmd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Omaeem32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oooaah32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Obnnnc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocmjhfjl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfbmdabh.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggociklh.dll"	Abcppq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nocbfjmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Odgqopeb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qelcamcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gckjdhni.dll"	Aeopfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nfpghccm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pgoikbje.dll"	Ochamg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pbbgicnd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pfppoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odemep32.dll"	Noaeqjpe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ofijnbkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qppkhfec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qmckbjdl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mllccpfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nkhfek32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pcbdcf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ocfdgg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pbljoafi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pbljoafi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mllccpfj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ohncdobq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Podkmgop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oloipmfd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	2026-08-10_67c6b66f3f8ef45ae10a71933a85d588_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Piaiqlak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odlpkg32.dll"	Pcfmneaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Abpcja32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kefjdppe.dll"	2026-08-10_67c6b66f3f8ef45ae10a71933a85d588_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nkjckkcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pbgnqacq.dll"	Oooaah32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Podkmgop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kannaq32.dll"	Pkoemhao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pcfmneaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aealll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nlgbon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncaklhdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lchfjc32.dll"	Ocdgahag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oljoen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ofdqcc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkacdofa.dll"	Oloipmfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Amfhgj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ofgmib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qpbgnecp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pfppoa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pfbmdabh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qkdohg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eobdnbdn.dll"	Okfbgiij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pbbgicnd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dapijd32.dll"	Piaiqlak.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	2026-08-10_67c6b66f3f8ef45ae10a71933a85d588_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nhjjip32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Apddce32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Noaeqjpe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Okfbgiij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pmeoqlpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eflmkg32.dll"	Podkmgop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfomcn32.dll"	Pcbdcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkiigchm.dll"	Piolkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfppnk32.dll"	Qelcamcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ngkpgkbd.dll"	Nkeipk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nofoki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gipjam32.dll"	Odbgdp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ohqpjo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Odgqopeb.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 312 wrote to memory of 4868	312	2026-08-10_67c6b66f3f8ef45ae10a71933a85d588_elex_wannacry.exe	84
PID 4868 wrote to memory of 4744	4868	Mafofggd.exe	85
PID 4744 wrote to memory of 1104	4744	Mddkbbfg.exe	86
PID 1104 wrote to memory of 4748	1104	Mllccpfj.exe	87
PID 4748 wrote to memory of 1896	4748	Ndidna32.exe	88
PID 1896 wrote to memory of 3256	1896	Ndlacapp.exe	89
PID 3256 wrote to memory of 916	3256	Nlcidopb.exe	90
PID 916 wrote to memory of 4552	916	Nkeipk32.exe	91
PID 4552 wrote to memory of 2992	4552	Noaeqjpe.exe	92
PID 2992 wrote to memory of 4168	2992	Ndnnianm.exe	93
PID 4168 wrote to memory of 3112	4168	Nhjjip32.exe	94
PID 3112 wrote to memory of 2700	3112	Nkhfek32.exe	95
PID 2700 wrote to memory of 2324	2700	Nocbfjmc.exe	96
PID 2324 wrote to memory of 3928	2324	Nconfh32.exe	97
PID 3928 wrote to memory of 2708	3928	Nfnjbdep.exe	98
PID 2708 wrote to memory of 680	2708	Ndpjnq32.exe	99
PID 680 wrote to memory of 2736	680	Nlgbon32.exe	100
PID 2736 wrote to memory of 2888	2736	Nkjckkcg.exe	101
PID 2888 wrote to memory of 2020	2888	Nofoki32.exe	102
PID 2020 wrote to memory of 1416	2020	Ncaklhdi.exe	103
PID 1416 wrote to memory of 1060	1416	Nfpghccm.exe	104
PID 1060 wrote to memory of 2360	1060	Odbgdp32.exe	105
PID 2360 wrote to memory of 3680	2360	Ohncdobq.exe	106
PID 3680 wrote to memory of 2464	3680	Oljoen32.exe	107
PID 2464 wrote to memory of 1364	2464	Okmpqjad.exe	108
PID 1364 wrote to memory of 2424	1364	Ocdgahag.exe	109
PID 2424 wrote to memory of 3544	2424	Obfhmd32.exe	110
PID 3544 wrote to memory of 1952	3544	Odedipge.exe	111
PID 1952 wrote to memory of 2504	1952	Ohqpjo32.exe	112
PID 2504 wrote to memory of 3716	2504	Okolfj32.exe	113
PID 3716 wrote to memory of 5004	3716	Ocfdgg32.exe	114
PID 5004 wrote to memory of 876	5004	Ofdqcc32.exe	115
PID 876 wrote to memory of 3864	876	Odgqopeb.exe	116
PID 3864 wrote to memory of 2952	3864	Oloipmfd.exe	117
PID 2952 wrote to memory of 3472	2952	Oomelheh.exe	118
PID 3472 wrote to memory of 5052	3472	Ochamg32.exe	119
PID 5052 wrote to memory of 2780	5052	Ofgmib32.exe	120
PID 2780 wrote to memory of 2688	2780	Oheienli.exe	121
PID 2688 wrote to memory of 4408	2688	Omaeem32.exe	122
PID 4408 wrote to memory of 4388	4408	Oooaah32.exe	123
PID 4388 wrote to memory of 5048	4388	Obnnnc32.exe	124
PID 5048 wrote to memory of 4024	5048	Ofijnbkb.exe	125
PID 4024 wrote to memory of 5080	4024	Ohhfknjf.exe	126
PID 5080 wrote to memory of 2076	5080	Okfbgiij.exe	127
PID 2076 wrote to memory of 4128	2076	Ocmjhfjl.exe	128
PID 4128 wrote to memory of 2484	4128	Oflfdbip.exe	129
PID 2484 wrote to memory of 2232	2484	Pdngpo32.exe	130
PID 2232 wrote to memory of 3324	2232	Pmeoqlpl.exe	131
PID 3324 wrote to memory of 3364	3324	Podkmgop.exe	132
PID 3364 wrote to memory of 4664	3364	Pbbgicnd.exe	133
PID 4664 wrote to memory of 3840	4664	Pdqcenmg.exe	134
PID 3840 wrote to memory of 5092	3840	Pilpfm32.exe	135
PID 5092 wrote to memory of 2144	5092	Pkklbh32.exe	136
PID 2144 wrote to memory of 1700	2144	Pcbdcf32.exe	137
PID 1700 wrote to memory of 1312	1700	Pfppoa32.exe	138
PID 1312 wrote to memory of 4084	1312	Piolkm32.exe	139
PID 4084 wrote to memory of 3332	4084	Pkmhgh32.exe	140
PID 3332 wrote to memory of 964	3332	Pcdqhecd.exe	141
PID 964 wrote to memory of 3372	964	Pfbmdabh.exe	142
PID 3372 wrote to memory of 3948	3372	Piaiqlak.exe	143
PID 3948 wrote to memory of 540	3948	Pkoemhao.exe	144
PID 540 wrote to memory of 1796	540	Pcfmneaa.exe	145
PID 1796 wrote to memory of 2760	1796	Pfeijqqe.exe	146
PID 2760 wrote to memory of 4368	2760	Pehjfm32.exe	147

C:\Users\Admin\AppData\Local\Temp\2026-08-10_67c6b66f3f8ef45ae10a71933a85d588_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_67c6b66f3f8ef45ae10a71933a85d588_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:312
- C:\Windows\SysWOW64\Mafofggd.exe
  C:\Windows\system32\Mafofggd.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Windows\SysWOW64\Mddkbbfg.exe
    C:\Windows\system32\Mddkbbfg.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4744
  - - C:\Windows\SysWOW64\Mllccpfj.exe
      C:\Windows\system32\Mllccpfj.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1104
    - - C:\Windows\SysWOW64\Ndidna32.exe
        
        C:\Windows\system32\Ndidna32.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4748
      - C:\Windows\SysWOW64\Ndlacapp.exe
        
        C:\Windows\system32\Ndlacapp.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1896
        
        C:\Windows\SysWOW64\Nlcidopb.exe
        
        C:\Windows\system32\Nlcidopb.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3256
        
        C:\Windows\SysWOW64\Nkeipk32.exe
        
        C:\Windows\system32\Nkeipk32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:916
        
        C:\Windows\SysWOW64\Noaeqjpe.exe
        
        C:\Windows\system32\Noaeqjpe.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4552
        
        C:\Windows\SysWOW64\Ndnnianm.exe
        
        C:\Windows\system32\Ndnnianm.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2992
        
        C:\Windows\SysWOW64\Nhjjip32.exe
        
        C:\Windows\system32\Nhjjip32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4168
        
        C:\Windows\SysWOW64\Nkhfek32.exe
        
        C:\Windows\system32\Nkhfek32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3112
        
        C:\Windows\SysWOW64\Nocbfjmc.exe
        
        C:\Windows\system32\Nocbfjmc.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2700
        
        C:\Windows\SysWOW64\Nconfh32.exe
        
        C:\Windows\system32\Nconfh32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2324
        
        C:\Windows\SysWOW64\Nfnjbdep.exe
        
        C:\Windows\system32\Nfnjbdep.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3928
        
        C:\Windows\SysWOW64\Ndpjnq32.exe
        
        C:\Windows\system32\Ndpjnq32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2708
        
        C:\Windows\SysWOW64\Nlgbon32.exe
        
        C:\Windows\system32\Nlgbon32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:680
        
        C:\Windows\SysWOW64\Nkjckkcg.exe
        
        C:\Windows\system32\Nkjckkcg.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2736
        
        C:\Windows\SysWOW64\Nofoki32.exe
        
        C:\Windows\system32\Nofoki32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2888
        
        C:\Windows\SysWOW64\Ncaklhdi.exe
        
        C:\Windows\system32\Ncaklhdi.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2020
        
        C:\Windows\SysWOW64\Nfpghccm.exe
        
        C:\Windows\system32\Nfpghccm.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1416
        
        C:\Windows\SysWOW64\Odbgdp32.exe
        
        C:\Windows\system32\Odbgdp32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1060
        
        C:\Windows\SysWOW64\Ohncdobq.exe
        
        C:\Windows\system32\Ohncdobq.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2360
        
        C:\Windows\SysWOW64\Oljoen32.exe
        
        C:\Windows\system32\Oljoen32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3680
        
        C:\Windows\SysWOW64\Okmpqjad.exe
        
        C:\Windows\system32\Okmpqjad.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2464
        
        C:\Windows\SysWOW64\Ocdgahag.exe
        
        C:\Windows\system32\Ocdgahag.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1364
        
        C:\Windows\SysWOW64\Obfhmd32.exe
        
        C:\Windows\system32\Obfhmd32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2424
        
        C:\Windows\SysWOW64\Odedipge.exe
        
        C:\Windows\system32\Odedipge.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3544
        
        C:\Windows\SysWOW64\Ohqpjo32.exe
        
        C:\Windows\system32\Ohqpjo32.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1952
        
        C:\Windows\SysWOW64\Okolfj32.exe
        
        C:\Windows\system32\Okolfj32.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2504
        
        C:\Windows\SysWOW64\Ocfdgg32.exe
        
        C:\Windows\system32\Ocfdgg32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3716
        
        C:\Windows\SysWOW64\Ofdqcc32.exe
        
        C:\Windows\system32\Ofdqcc32.exe
        32⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5004
        
        C:\Windows\SysWOW64\Odgqopeb.exe
        
        C:\Windows\system32\Odgqopeb.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:876
        
        C:\Windows\SysWOW64\Oloipmfd.exe
        
        C:\Windows\system32\Oloipmfd.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3864
        
        C:\Windows\SysWOW64\Oomelheh.exe
        
        C:\Windows\system32\Oomelheh.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2952
        
        C:\Windows\SysWOW64\Ochamg32.exe
        
        C:\Windows\system32\Ochamg32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3472
        
        C:\Windows\SysWOW64\Ofgmib32.exe
        
        C:\Windows\system32\Ofgmib32.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5052
        
        C:\Windows\SysWOW64\Oheienli.exe
        
        C:\Windows\system32\Oheienli.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2780
        
        C:\Windows\SysWOW64\Omaeem32.exe
        
        C:\Windows\system32\Omaeem32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2688
        
        C:\Windows\SysWOW64\Oooaah32.exe
        
        C:\Windows\system32\Oooaah32.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4408
        
        C:\Windows\SysWOW64\Obnnnc32.exe
        
        C:\Windows\system32\Obnnnc32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4388
        
        C:\Windows\SysWOW64\Ofijnbkb.exe
        
        C:\Windows\system32\Ofijnbkb.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5048
        
        C:\Windows\SysWOW64\Ohhfknjf.exe
        
        C:\Windows\system32\Ohhfknjf.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4024
        
        C:\Windows\SysWOW64\Okfbgiij.exe
        
        C:\Windows\system32\Okfbgiij.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5080
        
        C:\Windows\SysWOW64\Ocmjhfjl.exe
        
        C:\Windows\system32\Ocmjhfjl.exe
        45⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2076
        
        C:\Windows\SysWOW64\Oflfdbip.exe
        
        C:\Windows\system32\Oflfdbip.exe
        46⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4128
        
        C:\Windows\SysWOW64\Pdngpo32.exe
        
        C:\Windows\system32\Pdngpo32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2484
        
        C:\Windows\SysWOW64\Pmeoqlpl.exe
        
        C:\Windows\system32\Pmeoqlpl.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2232
        
        C:\Windows\SysWOW64\Podkmgop.exe
        
        C:\Windows\system32\Podkmgop.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3324
        
        C:\Windows\SysWOW64\Pbbgicnd.exe
        
        C:\Windows\system32\Pbbgicnd.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3364
        
        C:\Windows\SysWOW64\Pdqcenmg.exe
        
        C:\Windows\system32\Pdqcenmg.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4664
        
        C:\Windows\SysWOW64\Pilpfm32.exe
        
        C:\Windows\system32\Pilpfm32.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3840
        
        C:\Windows\SysWOW64\Pkklbh32.exe
        
        C:\Windows\system32\Pkklbh32.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5092
        
        C:\Windows\SysWOW64\Pcbdcf32.exe
        
        C:\Windows\system32\Pcbdcf32.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2144
        
        C:\Windows\SysWOW64\Pfppoa32.exe
        
        C:\Windows\system32\Pfppoa32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1700
        
        C:\Windows\SysWOW64\Piolkm32.exe
        
        C:\Windows\system32\Piolkm32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1312
        
        C:\Windows\SysWOW64\Pkmhgh32.exe
        
        C:\Windows\system32\Pkmhgh32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4084
        
        C:\Windows\SysWOW64\Pcdqhecd.exe
        
        C:\Windows\system32\Pcdqhecd.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3332
        
        C:\Windows\SysWOW64\Pfbmdabh.exe
        
        C:\Windows\system32\Pfbmdabh.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:964
        
        C:\Windows\SysWOW64\Piaiqlak.exe
        
        C:\Windows\system32\Piaiqlak.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3372
        
        C:\Windows\SysWOW64\Pkoemhao.exe
        
        C:\Windows\system32\Pkoemhao.exe
        61⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3948
        
        C:\Windows\SysWOW64\Pcfmneaa.exe
        
        C:\Windows\system32\Pcfmneaa.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:540
        
        C:\Windows\SysWOW64\Pfeijqqe.exe
        
        C:\Windows\system32\Pfeijqqe.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1796
        
        C:\Windows\SysWOW64\Pehjfm32.exe
        
        C:\Windows\system32\Pehjfm32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2760
        
        C:\Windows\SysWOW64\Pmoagk32.exe
        
        C:\Windows\system32\Pmoagk32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4368
        
        C:\Windows\SysWOW64\Pomncfge.exe
        
        C:\Windows\system32\Pomncfge.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4536
        
        C:\Windows\SysWOW64\Pbljoafi.exe
        
        C:\Windows\system32\Pbljoafi.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3004
        
        C:\Windows\SysWOW64\Qfgfpp32.exe
        
        C:\Windows\system32\Qfgfpp32.exe
        68⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Qkdohg32.exe
        
        C:\Windows\system32\Qkdohg32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5168
        
        C:\Windows\SysWOW64\Qppkhfec.exe
        
        C:\Windows\system32\Qppkhfec.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5208
        
        C:\Windows\SysWOW64\Qbngeadf.exe
        
        C:\Windows\system32\Qbngeadf.exe
        71⤵
        System Location Discovery: System Language Discovery
        
        PID:5248
        
        C:\Windows\SysWOW64\Qelcamcj.exe
        
        C:\Windows\system32\Qelcamcj.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5288
        
        C:\Windows\SysWOW64\Qmckbjdl.exe
        
        C:\Windows\system32\Qmckbjdl.exe
        73⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5328
        
        C:\Windows\SysWOW64\Qpbgnecp.exe
        
        C:\Windows\system32\Qpbgnecp.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5368
        
        C:\Windows\SysWOW64\Abpcja32.exe
        
        C:\Windows\system32\Abpcja32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5408
        
        C:\Windows\SysWOW64\Aeopfl32.exe
        
        C:\Windows\system32\Aeopfl32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5448
        
        C:\Windows\SysWOW64\Amfhgj32.exe
        
        C:\Windows\system32\Amfhgj32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5488
        
        C:\Windows\SysWOW64\Apddce32.exe
        
        C:\Windows\system32\Apddce32.exe
        78⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5528
        
        C:\Windows\SysWOW64\Abcppq32.exe
        
        C:\Windows\system32\Abcppq32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5568
        
        C:\Windows\SysWOW64\Aealll32.exe
        
        C:\Windows\system32\Aealll32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5608
        
        C:\Windows\SysWOW64\Amhdmi32.exe
        
        C:\Windows\system32\Amhdmi32.exe
        81⤵
        System Location Discovery: System Language Discovery
        
        PID:5648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Mafofggd.exe

Path C:\Windows\SysWOW64\Mafofggd.exe
Size 320KB
SHA256 5b7bfc92642ddde555a1c2695667582be5dcac0d83f28107286754826ebd163c
MD5 c32d3b8a71dc2b0772f3bff0505e3fe0
SHA1 068d3624fbe838d2c78909704c2c19352e40c291
SHA512 7e8dc685cbd62171929f0661bc93af5f010f3f14ff44a60ae73b5c6d99487c1eb24968fa4ecb75e69fa615dfbac94d714f011733cd9cc8a956c6b27864455ad9
SSDEEP 3072:FiyQWeeHPPYtTDwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:FLo0AtTDV/Ah1G/AcQ///NR5fn
TLSH
T12E64DA5A2A700DEACDED1FB5AC124DD99141E9B014F1E23E6523EFDCD8E4DA2D809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mddkbbfg.exe

Path C:\Windows\SysWOW64\Mddkbbfg.exe
Size 320KB
SHA256 d382c4eb0c7b5312e47abb59792e05c744a04ab082d40093bf09a2f817c581ef
MD5 c14eeb224754a86cdc67b0263e90b944
SHA1 f9c7c0d12ba374a26a75130ccaf5e458a33d2a94
SHA512 71bf27e0db554c5ba8fc27e294fa71359ea5de9f51b40a24e5626b18db85335dc8758f038be0068ce3a427ac5aab1a70bb96df64a81079ae92adb9f290c84e50
SSDEEP 3072:L1WKFHe3AE17LSOQwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:LdexWOQV/Ah1G/AcQ///NR5fn
TLSH
T151640C59263009EACEED5BB9EC5249D89141E9F01CF1E13E6227DFDCD8E4DA6C858F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mllccpfj.exe

Path C:\Windows\SysWOW64\Mllccpfj.exe
Size 320KB
SHA256 788cf2993cd79350d91514e2784e50e8e44262c952819735007482032d29ceee
MD5 5f8a909ff612d52afd0d9e08ded3bb90
SHA1 07b06f1d7554fbcd9e94064c11025c5cb95d797f
SHA512 ab36e0699dc8dd8ff05a97c5b5af2310eb972e2d97b4c973cc06be50574f141d5482c8c2fabef90161e93b3e19d66250cd86b7d3e6411bb82ea5b949140e851c
SSDEEP 3072:xP70tNaP/kmk8Mut7RKwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:14vadXtRKV/Ah1G/AcQ///NR5fn
TLSH
T1C0640E1A26350AEBCDFD1BB5AD1249D99181E9F014F1E13E6123EFDCD8E4DA6C818F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ncaklhdi.exe

Path C:\Windows\SysWOW64\Ncaklhdi.exe
Size 320KB
SHA256 ca02c0f2474786c759b5b26d076b24e0b7b10bd17f05f739ea668c1b44867f76
MD5 c176c8f6e9003980fd73be3968a516fa
SHA1 1b6d8e79e2d301b62feca8f4051721d844a21e57
SHA512 0b31a06e4e1e006661ef6e0278b89a0fabbf432df153fdba15202f2239d3083c3ac91e7d1ba8bf769831981833e29e8d384448cc556e6aca2f642240a63f6bb0
SSDEEP 3072:/8iRkpDqwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:zRaqV/Ah1G/AcQ///NR5fn
TLSH
T102644F192A7019EACEED1BB5AD1249DC9181E8F014F1E13F6523DFDCD8E4DA6D80AF81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nconfh32.exe

Path C:\Windows\SysWOW64\Nconfh32.exe
Size 320KB
SHA256 0fefb14fea31047c2620ef2f0ee36b153c59cb60eed09fdabb5fc766f7bb1911
MD5 1c71a8f55fca64b84c42451132a8ceab
SHA1 d081430f75a9f95e9d7c13ec39d37e20c4cf192e
SHA512 1a63bc3498f32341e079084034eab41b7f9ec33bc1f04b9d2468b05c5644ec10ea8bc5fb18b8ee2798fcf2ed380f1f3e5620cbf33829d5baa4a97f5fe1e0315f
SSDEEP 3072:+A4KCjWlDB3uwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:gKR3uV/Ah1G/AcQ///NR5fn
TLSH
T17864EA1A2A740DEACEED1BB5AD1249D85245E8F014F5E23E61679FDCD8F4EA2CC04F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ndidna32.exe

Path C:\Windows\SysWOW64\Ndidna32.exe
Size 320KB
SHA256 3202d9c8cd62292f349ae4885351afec38b3f23ba3bf199bc4a98584f2f9c9f6
MD5 c965563ded3e460fa0bd5ffc3140f452
SHA1 317464cd9c80b35b8bc9e52982cdcea1352a8ca0
SHA512 39dd0ea33a389fe351594e5d04352c4b7d1987952f9388c0a6dc1dc614e64a136b40df6d4050e3de6a96bc55a6f883ef1d7d920acb2121915584a0c3637181b1
SSDEEP 6144:NKiN1QEZ/Pi1b1W/R5M4hVubXHpV/Ah1G/AcQ///NR5fn:AiN1QEZ/Pi1b1W/R5M4bubc/Nv
TLSH
T1E7643019663409EACEFD1BB9AC0249D99151F9F064F1E13E6123DFDCC8E8DA2D814F92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ndlacapp.exe

Path C:\Windows\SysWOW64\Ndlacapp.exe
Size 320KB
SHA256 49b0a42eb2b8a507ceeaa8420d962fd30a99eda5f5978981d93ee198f79f3c06
MD5 f637b0fe176e356df41899360cf8d9da
SHA1 f2eb744394f4f0a1070fd4da8438596de104c342
SHA512 ac275e5010165da615f881ed9cf0547f90dbeed81ba6ef0dfb393d9210cca7f2ee762c248bf35368309f22184e286f4236143f6c111fceb37f08b4bf3756b5b5
SSDEEP 6144:CbcgBBBBBBBBBBBBBBVAZBV/Ah1G/AcQ///NR5fn:XW/Nv
TLSH
T1986431592A3009EACEED1FB5AC5689E89241E9F014F1E13E6123DFDDD9E4DA2C805FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ndnnianm.exe

Path C:\Windows\SysWOW64\Ndnnianm.exe
Size 320KB
SHA256 227749aea580b8f4888315ddfa755dbb3dacb52902787d6d4a9007a32df48a6d
MD5 90c83968a3014c723af3fc104a32dd6e
SHA1 da112614bd9d8fd25abdd30f48e70bd3c54c525b
SHA512 7eba29852431724405d43473b3700e5b9ea570441f1b084bd61d9fb8592ac7134948f0a28fecb06a8c14fadf077f034ea2328fb9f5d0a0ae525c97b72a981840
SSDEEP 3072:aZDnfa+Q6A1zUEwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:atnfaH6uoEV/Ah1G/AcQ///NR5fn
TLSH
T14B641E59263409FACEED5BB5AD2249D89191EAF014F1E13E6523DFDCCCE4DA2C808F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ndpjnq32.exe

Path C:\Windows\SysWOW64\Ndpjnq32.exe
Size 320KB
SHA256 00aa8cda8e35e2fd2515274d40f113de0be7d0e06fd04adeb0848bb1a947f9e9
MD5 046bdf3844f78d097ec12f404cd1bcb0
SHA1 fd8ab52d46cee34fd5b830290746c622b5eec77d
SHA512 ceeee0a85d3205173cbc17c331ec7299c4ea9de135e737bdad12af499d7ed26f42995a66bce5b50cc9a7f43a49e2f340a1ce9211723bde8e61eb192c8246f5ff
SSDEEP 3072:MKNPSCvkOB1y3z/ax/wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:MKNPS6V3x/V/Ah1G/AcQ///NR5fn
TLSH
T1D4640D19263419EACEED2BB6AC1269D85185F9F014F1E13E6123DFDDC8F4DA2C819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nfnjbdep.exe

Path C:\Windows\SysWOW64\Nfnjbdep.exe
Size 320KB
SHA256 764e8bebef72dc5115dc8811b85262fd6d9b9a95994de14b5e6d0aca6be121c4
MD5 7533218d5cfd6162f9e7439c7e8cc8af
SHA1 76f46b61266d14abcfc86882e5a593d13e246cb5
SHA512 33f27697b38fa62156723495869247ca9049b6da8e75a0e1c22d4d071d5e88c50db62073bab2631520cded324ea728c8dc05d8cd380ff12308b672cf13370488
SSDEEP 3072:JObsovZrAyNRR2lwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Eb3xTNRR2lV/Ah1G/AcQ///NR5fn
TLSH
T18E6453196A3419EACDED1FB9AC1249D99181E9F014F1E13E6123DFECC8E4DA2DC19F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nfpghccm.exe

Path C:\Windows\SysWOW64\Nfpghccm.exe
Size 320KB
SHA256 3dff08b717f8e7e252792a81d4367a720c97dbfcc469881247ff0e6942ab8713
MD5 1d9c6c67c768a724d306dce3912eeece
SHA1 72dfd12e865d2ad3c9af5b3492957b1e0b8bd75b
SHA512 af79cd9b61b4c635f98ce40999fa9e477ea1bb797a406196ca5fa9f85046ee51458561b0939bd9aad11c4f095c3e621f358567e1d987b48ba2c0fd702c49b231
SSDEEP 3072:UTJHIbWVmOEbllDb1tp1rwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:OHIkE11rV/Ah1G/AcQ///NR5fn
TLSH
T171640D1A263049EACDFD1BB5AE0249D85181F9F114F1E13E6127DFECD8E8DA6D809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nhjjip32.exe

Path C:\Windows\SysWOW64\Nhjjip32.exe
Size 320KB
SHA256 4d266bcecf7d5535ef67e29d172a78603ee55bc3e1078d841dca09805241a5c3
MD5 3e36f692f128ceba827b2e1f4bc3d164
SHA1 c41befccce6f2eb431e749b2b417b05b65446a14
SHA512 0f95ec59905840796295bff495e6b9c8c122a7e3478a8e863b0805d09d61b4432383293940ab480db7fe5ef0d66266d7aac16659a53a6616b5b79fa62997a838
SSDEEP 3072:mrxkDELA7Tv5fjEfwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:UA7D5rEfV/Ah1G/AcQ///NR5fn
TLSH
T171643F1A263409EBCDED1FB6AC1249D85181E9F014F5E13E6923DFDCD8E4DA2D809F86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nkeipk32.exe

Path C:\Windows\SysWOW64\Nkeipk32.exe
Size 320KB
SHA256 b3596c7aa08865a7108189c5c7e6bae9059efb17048cb22de42cb2f780347620
MD5 901a0bbe3db91178b742f3f050800a33
SHA1 b498216d813ecc404d17e17032ed23457d114ef0
SHA512 8b63ffde21af7d10a09f4d53923b5cb1d5ce54eec9ecd676e058ff3a95cd7e0f21a1eed9b8e943eb4c2f59adf7a0644cfc245955e09292fdf8b3ef511cf9352f
SSDEEP 3072:5+1HkQc0yswS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:5+jysV/Ah1G/AcQ///NR5fn
TLSH
T1CA643F1926B409EBCEED1FB6AD1249D89181E9F015F1E13E6123EFDCD8E4DA2C815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nkhfek32.exe

Path C:\Windows\SysWOW64\Nkhfek32.exe
Size 320KB
SHA256 d77c307971db41eadba24bdf81985a43dab5565baf1d101e314e3eaf9d283ddc
MD5 4a53871fdce5ecbef2c8e17e88a204f5
SHA1 36c48191b41ff547b1d721c8b31407e12cc58675
SHA512 100ef63f4543c205ee0d2a9eb1f8bd15cc4ee3201fa575bcfd9a1cc71236884380024caf2eb1c079b2507a90e5166ead72251aa07c07980fe94302aecc9e2159
SSDEEP 3072:7kzWTxxpqGwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:ZTxxpqGV/Ah1G/AcQ///NR5fn
TLSH
T1CA64EA1A1A3009EACEED1BB5AC1259DC9141E9F014F1E53E6123DFDDD8F8EA2D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nkjckkcg.exe

Path C:\Windows\SysWOW64\Nkjckkcg.exe
Size 320KB
SHA256 16e12c504850d9c034834d0d30e84f0c30ce8f8752bf6084644160ace0e3205d
MD5 8de8fe77b6cc84ccb10c451ce1e84b6e
SHA1 d3d9a6928d8ab93f036709737a507d0ea4996c53
SHA512 2f43f3dfad46c5dacd9843f31e5d3684b5538ccb252804e8cf3652b2192402ebf9dd0b52c9b1e94a135390cd5647d4ce9531ce9c2ba283f1775900b612bc496f
SSDEEP 3072:CfFvrv/Mt5CDjXQc7WUpwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:CfRz8qjdaUpV/Ah1G/AcQ///NR5fn
TLSH
T1DE641D1926390AEACEED1BB5AC2249DC9541E9F014F1E23E6533DFDCC8E5DA2C815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nlcidopb.exe

Path C:\Windows\SysWOW64\Nlcidopb.exe
Size 320KB
SHA256 216015fbfebb5f7cbcd083db4f0121291c1c52e9cc5f44f9319b3fcc0c451590
MD5 8dffee5aef9c01fadd48da72f86fc1af
SHA1 c2baade3e233a06e063b2e5880670d7bbc11610d
SHA512 adf371f71bbd040fa406e1413ef2e83ddcf01b88340569ac8eba730c2687ba01cb928603e28dbda6119d412bce5fdef74d35cb946becb6185d7fc683b2b9250d
SSDEEP 3072:w2Ouaz/KJKr/ag5TwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:etSo35TV/Ah1G/AcQ///NR5fn
TLSH
T13F644119263009EACEED1FB6AC524ADA5141E8F05CF1E13E6623DFDCD9E4DA2C814F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nlgbon32.exe

Path C:\Windows\SysWOW64\Nlgbon32.exe
Size 320KB
SHA256 89f608bbd4248f515ba98632343252355634fd6def0d800c8be92d7ed7f3d182
MD5 ad2c78632c92fbbf7cde5afa4cd2a5e7
SHA1 445626ccf0522f2ebcbf06d280d71b52c0d4b48f
SHA512 9f94c968ad6154a5183ec6d2ee36ec1c60969f3d497e2954aa90beab9b7bd037bb05cb0669934184332343878c753a3ba922d3d6edf072e1e38dc54b6a574934
SSDEEP 3072:OLbf2APEm7qwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:SzgCqV/Ah1G/AcQ///NR5fn
TLSH
T1B864D7192A340DEACEEE1BB5EC4249D89191E8F154F1E13E6523DFDCD8E4DA2D809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Noaeqjpe.exe

Path C:\Windows\SysWOW64\Noaeqjpe.exe
Size 320KB
SHA256 54449a37e105d8033a8f8a34af75dd60654a0e0d73bfde2fc32dd2b4d33c1019
MD5 f4ddcda2fbae3bc11c95905e6da01161
SHA1 f2d30f29583aef34f57f4111023fe8f4e2471111
SHA512 53c0bdfe650def19ea7a6d3a734d5f1a16cf9974d3f31f9b4d4dcc195d4409ab60262427a187d46ca430c5a942a2fe6e4f0767ad47ba6d53a43cc228e0129bb3
SSDEEP 3072:Y1U2azZebaE1SskwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:thN0aTskV/Ah1G/AcQ///NR5fn
TLSH
T10664E95A2A3409EACEED1FB5AC124DD89141E9B254F1E13E6123DFDCD9E4DA2CC18F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nocbfjmc.exe

Path C:\Windows\SysWOW64\Nocbfjmc.exe
Size 320KB
SHA256 a6b6dfb39b09db47e842d5cea69e626c97acdb023d8e2c9b053e7b36c45270d7
MD5 6150b791585357e408d417c5328fcb8a
SHA1 2f7ed08132d60ebdbd9366018aed90c2d375fe8a
SHA512 130430f60a71cfc9e89d15a7bcfa0e2b4a2b7c74cdc8c23507b7bc33fb5166f40e3a82eef9ea2e98f031a23bb951ed0f0ca6ed3bcc525975b4d31b8153879a70
SSDEEP 3072:pkpeesfn+W7MlGs1vYwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:pkpeRfnxYL1YV/Ah1G/AcQ///NR5fn
TLSH
T1716422291A3419EACDED2BB5AC1249E85141E9F014F1E17E6233DFDCD8E4DE2D816F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nofoki32.exe

Path C:\Windows\SysWOW64\Nofoki32.exe
Size 320KB
SHA256 55841d40bcb20fbf60d1405ea622cb8a5cb185221e87b7bfa53c86bcb1bf0c5c
MD5 d209edba4f9cebc5bfed92794bce903b
SHA1 345f7f3037b0b1a2a67ff9f83e6bcc535c4e40dc
SHA512 5c8c5fab57f9a9de0d22024ab9a4ee8598b7df6e09ae15b1689d71e5eaf08073a9330970cd6d4679cdd652c54ca272a256ff4b5566c5e04c012b94b60ff690ac
SSDEEP 3072:l1SQ7g/3bfmsZuwPvwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:bSQMjuwHV/Ah1G/AcQ///NR5fn
TLSH
T16D64D81A2A341DEACEED1FB5AC1249DC5191E9F014F1E53E61239FECD8E4DA2C816F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Obfhmd32.exe

Path C:\Windows\SysWOW64\Obfhmd32.exe
Size 320KB
SHA256 42d068dacc03596ac4954d6ba93495258a0301ad5c1a06519011d59dc7ad8466
MD5 17e344423bdb917b82aecc37730bd592
SHA1 d4940b71981c09889d64980baf638e4b12c1d7c1
SHA512 5d0b135d58cc5644872251f1e64e84475d11f4f465cbcb3fc1099bc490525e9fade274ea1dfdb404762138a2c0ec8cf9a324ef73cc4b7a36206ea1ab4b1e4b1a
SSDEEP 3072:GrmaefdgoewS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:GrEdheV/Ah1G/AcQ///NR5fn
TLSH
T1F864FC192A3809EACEFD1BF5AC1249D85145E9F019F1E13E6623EFDCD8E5DA2C805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ocdgahag.exe

Path C:\Windows\SysWOW64\Ocdgahag.exe
Size 320KB
SHA256 f2c5475690a32ed590f61c85f0ddad953c65915a55331caf26b46054a46c8632
MD5 836b8a066ea129bd68a706b47a9cb396
SHA1 42ecc22abc8f18ee0d59c3ebbaf3eeedec09f3f7
SHA512 46e4a516ab00ca5d95337b0b86c550b455b50b77bc94b1b1819efb446d202eb7be6444ce4fb0297a575becc7f0bc5a132406961ef5cd7b43a26851d56490bf3a
SSDEEP 3072:gshpkuaSETbQ3dwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:rrrdV/Ah1G/AcQ///NR5fn
TLSH
T1C7640D1A2A7409EACEED1FB5AC1249D85181E9F014F2E13E6123DFDCE8E5DA6C815FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ocfdgg32.exe

Path C:\Windows\SysWOW64\Ocfdgg32.exe
Size 320KB
SHA256 fb44ced0e85c129cb5eaddc04eb1ad07b843f1dbe3616bebb7960f03db1efa80
MD5 9f5d7ca62f9c18744c025a2b39efc02a
SHA1 8744bf38baa0791d11d15a1c550840e9d4d22c5a
SHA512 4bb201702cb0ee5be451306b8697df4bc811d9374c464803bcbe3d838d656f7aaa5a31defdb11ce944ebe58400e6aa29a0dd1c55b4ed5565a136ff2485c02e1e
SSDEEP 3072:rq6ps2hZ+Y/nUjSfnwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:RLnV/Ah1G/AcQ///NR5fn
TLSH
T14D643F196A710AEACEED1BB5AC0249DC4141E8F014F1E17E2537EFDCD8E4DA2E954F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Odbgdp32.exe

Path C:\Windows\SysWOW64\Odbgdp32.exe
Size 320KB
SHA256 85de0413ae88b5805e97c37e90fcf877eda550394eb9f23ab9ed91632ec992fd
MD5 ebf523f02e727d5feaba1c831f1f253b
SHA1 6f8cb3b9986f842ab68d3502cb43ce2f7613cb96
SHA512 7f733f61ca9f25530fc51b949a2c0ed530297f7006350921802399dac1b4403cdbdf47c830e1dd441f4942b69c911721cac7458aae8aba33cf8870074158fd84
SSDEEP 3072:hObD6VPX8wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:nv8V/Ah1G/AcQ///NR5fn
TLSH
T17C64211A2A3409EACDED1FB5AC1249D89141E9F018F1E53EB523DFDCD8E4DA6C815F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Odedipge.exe

Path C:\Windows\SysWOW64\Odedipge.exe
Size 320KB
SHA256 be775d5dac6ddec8e3683debbebfacc107f88e956163b85a83bd53efa5266962
MD5 2d41421ad06c72847b49ee41fe7028ca
SHA1 7aed999a62e1658103d30bffe631f2e3b23f9914
SHA512 8173eb00e3b7fa5c4bd25902897876f78b60bdc2b78d449c1f1cd265b5f6436652648fb3425d8d2ba1cff1fdacbc7d9fdcc1cca5fa641da778c9aae6cca8cc27
SSDEEP 3072:0EDYsAj4cQNNRpXzwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:0AzD3NFzV/Ah1G/AcQ///NR5fn
TLSH
T135644F2A2A3519EACEED1BB5AC2249DC9181E4F015F1E13E6163DFDCDCE4DA2D804F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Odgqopeb.exe

Path C:\Windows\SysWOW64\Odgqopeb.exe
Size 320KB
SHA256 eb918c281f89c3174c5aea45d57ad9d7c76d6eea35dbd25a5821c3843560eafe
MD5 545b9d144306d4ac2244e582e7332c85
SHA1 97e5a237117ea5478941a2d6561b7ebc6a8553b7
SHA512 a44d05db741f94b8cac65e0d944db405bed6d5db9e595ba4d76c9aba3f611131e21ce192557d51ed1ff93a56042c9070977be219bb9e571590bef3e425d8536a
SSDEEP 3072:qrFOFG8JPmlpFwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:yFmJPipFV/Ah1G/AcQ///NR5fn
TLSH
T14F640C192A7419EACDED5BB5EC1649D86181E8F014F2E13E6123DFDCD9F8DA2C814F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ofdqcc32.exe

Path C:\Windows\SysWOW64\Ofdqcc32.exe
Size 320KB
SHA256 dd2a2dcaf758309b9cf0615cc3ba728698265f331b40d0c274e32db736013cc1
MD5 f234bb01a67ad2d65939afabbd610018
SHA1 a08c28d78fa63d50fdc824b42c09e935bd384f43
SHA512 5efde6705ab2ca62597b3ee4311d34006392a01e4612469f4b6c4a236a8a7e6bbf7695f71544855f464ae8d886a328eb8001b2be6183afa9c702cdd973be70a0
SSDEEP 3072:s+aQHySZ+cPT8wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:s+a1SZ9PT8V/Ah1G/AcQ///NR5fn
TLSH
T13C64EC1A163009EECEED1BB5AC1249D85141E8F114F6E17E6133DFEED8E4DA2D819F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ohncdobq.exe

Path C:\Windows\SysWOW64\Ohncdobq.exe
Size 320KB
SHA256 84c303dca7b60451d8e133e6dc8c58168e38c168a3641be101f20b94a1debca0
MD5 7321a42c9973bd59dd3d3a834308b440
SHA1 28945912dbc2a5674ca5390c721e99c6f3c0f8c2
SHA512 8b3346ee5b53d8aec106778a3749be014c946d88ee241714803be629319507fbbb7b566ee0c94c05de32ca23c40c7e668de368d19c4bfd8a93c67bf4075252ff
SSDEEP 3072:CDPz9xsuPNZwERpqPGdwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:os7WRdV/Ah1G/AcQ///NR5fn
TLSH
T18164421926301AEACEED1FB5AC2249D99141E5F018F1E13E6523EFDCD8E4DA2EC15F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ohqpjo32.exe

Path C:\Windows\SysWOW64\Ohqpjo32.exe
Size 320KB
SHA256 e33e455a7163b5f4ff464b11cb7e548434b0f756539b632dfad1cf2338453e85
MD5 84b0cf8bc891c4d2af37cec4ca6e6f89
SHA1 7d8912a7c74c42cfb02e0f4da915959a5401c048
SHA512 c4176af6f54439740de399b61431f57b6e403cf0033b9e62db436a8efe8ece0fca9cb07f41bac57edda7b8b3ed940ce1e282cc2aba7e99ef8802e5e1729345a9
SSDEEP 3072:x9laC6N06uuMl9paqmAou7wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Ia6Ml9A3mV/Ah1G/AcQ///NR5fn
TLSH
T17A6431592A340AEACDEE1FB6AC1749D85141E4F014F1E13E6623DFDCD8E4EA2D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Okmpqjad.exe

Path C:\Windows\SysWOW64\Okmpqjad.exe
Size 320KB
SHA256 158eb702e316738e0c93d089348fff27ae61484be77749cd1be0a96b86d86da0
MD5 ab4d21d19ddc3906eede1ba1e37069a4
SHA1 3353118b05fa858488e4d5a5c26edf4d9f291f80
SHA512 54bec43dc44a15ac3e695598136ed00a4d07d70717599562daa8a324ff65065ae3a23f303a16b38c9fe89becb48d0512ee7f4a6f7b46a58ac3185383114bc684
SSDEEP 3072:UltpICPhV1pYwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:ULiCDYV/Ah1G/AcQ///NR5fn
TLSH
T1A36432192A3409EACEED1FB5AC1269DC9141EAF014F1E13E6923DFDCD8E4DA6C815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Okolfj32.exe

Path C:\Windows\SysWOW64\Okolfj32.exe
Size 320KB
SHA256 bc8cc12602302339089a2345e201920cb50c12ff8a74253fa75a86522381394c
MD5 a19c5c8bf929c504c4eb10cd791bb3c8
SHA1 eb22b145e51ba1004598cd41627a18f80dd1da06
SHA512 f6226a40a1267b604047cd2c84439059fbc177288a9a624d965d3dbed8d594f0245211ef74fb75707de328985ebe9cb2f1f15d90a09c34cac8b8731f9c345f01
SSDEEP 3072:MSbdVDKGAK1DQd8MVBwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:NJVDweQd5BV/Ah1G/AcQ///NR5fn
TLSH
T13F6430192A3009EACEED1FF6AC1249D85181E9F018F1E27E6123DFDCD8E5DA2C855F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Oljoen32.exe

Path C:\Windows\SysWOW64\Oljoen32.exe
Size 320KB
SHA256 b5d1c0b10bb2d8699cf70eda5ecb373feb37476d197bdcae3437b1d6fcaf8811
MD5 a6550c8ac6435031d4aab5d528ff40be
SHA1 45c48e0f56754cdf6df4162d6498834d3e97fb9a
SHA512 1a845df8d0ff67b042af9ea9e98754bdc30a24a63efe0d09af240625b50aa25c109b4fe3bf0e5669dcaa61f44648c776356d47438a9650e781ed59a8f2f3bf6e
SSDEEP 3072:nsZWX86DyhwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:sZW8jhV/Ah1G/AcQ///NR5fn
TLSH
T179642F1A263409EACDED1BB7BC5249D85281E8F114F1E13EA223DFDCD8E4DA6C815F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/312-539-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/312-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/312-1-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/540-431-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/680-133-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/680-613-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/876-260-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/916-580-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/916-61-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1060-173-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1104-24-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1104-544-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1312-396-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1364-205-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1416-165-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1700-390-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1796-437-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1896-546-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1896-46-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1952-229-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2020-157-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2144-384-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2232-348-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2324-109-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2324-586-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2360-181-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2424-213-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2464-197-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2504-237-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2688-296-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2700-101-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2700-585-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2708-125-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2708-588-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2736-141-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2736-622-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2760-443-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2780-290-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2888-623-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2888-149-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2952-272-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2992-582-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2992-77-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3004-461-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3112-584-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3112-93-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3256-53-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3256-565-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3324-354-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3332-408-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3364-360-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3372-420-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3472-278-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3544-221-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3680-189-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3840-372-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3864-266-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3928-117-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3928-587-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3948-425-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4024-320-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4084-402-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4128-337-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4168-583-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4168-85-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4368-450-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4388-308-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4408-302-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4536-455-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4552-581-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4552-69-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4664-366-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4744-543-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4744-21-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4748-37-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4748-545-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4868-542-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4868-8-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5004-252-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5048-314-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5052-284-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5080-326-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5092-378-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5136-467-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5168-473-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5208-479-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5248-485-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5288-492-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5328-497-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5368-503-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5408-509-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5448-515-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5488-521-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5528-527-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5568-533-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5648-541-0x0000000000400000-0x000000000046D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads