berbew | 687738ddaf7e89e7802533a121880b6509a3855f12ed33cd2872dac26137613b

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 19:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_d762056beb4d9154ac55f325244e2cff_elex_wannacry.exe
Size 320KB
Sample260810-yaag2swfrf
SHA256 687738ddaf7e89e7802533a121880b6509a3855f12ed33cd2872dac26137613b
MD5 d762056beb4d9154ac55f325244e2cff
SHA1 fa6932bab29c8f2401a1eee961248df66ec29dde
SHA512 ccc044fc5967fc69426dc5882f35a8faa9ecf9e67ec552cbd18ae56a358663cbe5a856c659e19342d9eaeccae1a6c00966b724759144714898986b39d9c51f83
SSDEEP 3072:b9MPumenF0UIHwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:JRmexIHV/Ah1G/AcQ///NR5fn
TLSH
T1A864FC59263409EACEED1FB6AC0289D85A42F9F014F1E13E5123EFDDC9E4DA6D805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahffqk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fomhnmgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jlidkh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfhkop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcfkkmeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hkkhjj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oflfoepg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Odmgmmhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qgalelin.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcgbmd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Blkdgheg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cobciblp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cahffmel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqbdclak.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qgalelin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gohhik32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocdqcikl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ekqcfpmj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fffqjfom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fkcibnmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lekeajmm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cellfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cellfm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcbibeki.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncfdbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pnjeqbkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hflclcle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kfhkop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngpcmj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eaoenjqa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fklcbocl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Giqlbqcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ifjoma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jehoemmb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdllhdco.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojcidelf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnlafaio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Elbmebbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ilfhfh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcmall32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngmggj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bdfilkbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mebkbi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojefjd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmdihgkl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ghlcga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibijbc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldeonbkd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqknbmhc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pqmjhm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Elbmebbj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkcibnmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iciflfcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jcbibeki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jehoemmb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Olfolp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahjoljqc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Balfko32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dampal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fffqjfom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hfemkdbm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pddmml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmfmfigl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mikjmhaq.exe

Executes dropped EXE 64 IoCs

pid	Process
2884	Pengna32.exe
5700	Qaegcb32.exe
2352	Qjmllgjd.exe
2132	Qgalelin.exe
5704	Aalndaml.exe
5092	Ahffqk32.exe
2040	Abkjnd32.exe
5248	Ahjoljqc.exe
1100	Bngdndfn.exe
2672	Blkdgheg.exe
4876	Bdfilkbb.exe
1312	Balfko32.exe
4656	Baocpnmf.exe
6056	Chhkmh32.exe
6004	Cobciblp.exe
4556	Cellfm32.exe
5784	Cahffmel.exe
2400	Dampal32.exe
720	Dhfhnfhc.exe
2452	Dememj32.exe
1436	Ddbbngjb.exe
2420	Eddodfhp.exe
5044	Ekngqqol.exe
916	Ekqcfpmj.exe
1304	Eamhhjbd.exe
4240	Elbmebbj.exe
4420	Eaoenjqa.exe
1440	Foebmn32.exe
944	Fklcbocl.exe
5928	Ffbgog32.exe
2072	Fomhnmgp.exe
5728	Fffqjfom.exe
5684	Fkcibnmd.exe
4748	Glcelq32.exe
2444	Gcmnijkd.exe
3324	Goconkah.exe
4440	Ghlcga32.exe
5680	Gofkckoe.exe
5108	Gohhik32.exe
2956	Giqlbqcc.exe
5648	Hfemkdbm.exe
3948	Hkaedk32.exe
4508	Hoonjjgk.exe
2848	Hkfookmo.exe
2244	Hflclcle.exe
1144	Heapmp32.exe
5172	Hkkhjj32.exe
4580	Imjddmpl.exe
5428	Icdmqg32.exe
2560	Ilpaei32.exe
5820	Ibijbc32.exe
3276	Iciflfcd.exe
5556	Ildkpiqo.exe
1300	Ifjoma32.exe
5388	Ilfhfh32.exe
3816	Jeolonem.exe
2772	Jlidkh32.exe
2784	Jimeelkc.exe
3940	Jcbibeki.exe
4676	Jfcbcp32.exe
2928	Jcgbmd32.exe
5912	Jehoemmb.exe
3176	Kfhkop32.exe
3208	Kdllhdco.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Mcfkkmeo.exe	Mllcocna.exe
File created	C:\Windows\SysWOW64\Onhhkb32.exe	Ognpoheh.exe
File opened for modification	C:\Windows\SysWOW64\Giqlbqcc.exe	Gohhik32.exe
File opened for modification	C:\Windows\SysWOW64\Hfemkdbm.exe	Giqlbqcc.exe
File created	C:\Windows\SysWOW64\Bikqfc32.dll	Kdqecc32.exe
File created	C:\Windows\SysWOW64\Oeipko32.dll	Mckefmai.exe
File opened for modification	C:\Windows\SysWOW64\Ncfdbk32.exe	Nllleapo.exe
File opened for modification	C:\Windows\SysWOW64\Fffqjfom.exe	Fomhnmgp.exe
File created	C:\Windows\SysWOW64\Ibijbc32.exe	Ilpaei32.exe
File created	C:\Windows\SysWOW64\Ppoadkeg.dll	Kdcbic32.exe
File created	C:\Windows\SysWOW64\Ffkckk32.dll	Mmlphfed.exe
File opened for modification	C:\Windows\SysWOW64\Pdkcnklf.exe	Pjeoablq.exe
File created	C:\Windows\SysWOW64\Laiadfap.dll	Ffbgog32.exe
File created	C:\Windows\SysWOW64\Fffqjfom.exe	Fomhnmgp.exe
File created	C:\Windows\SysWOW64\Hlnbhlof.dll	Heapmp32.exe
File opened for modification	C:\Windows\SysWOW64\Kfhkop32.exe	Jehoemmb.exe
File opened for modification	C:\Windows\SysWOW64\Pqbdclak.exe	Pjhlfb32.exe
File created	C:\Windows\SysWOW64\Aalndaml.exe	Qgalelin.exe
File opened for modification	C:\Windows\SysWOW64\Hkkhjj32.exe	Heapmp32.exe
File opened for modification	C:\Windows\SysWOW64\Jehoemmb.exe	Jcgbmd32.exe
File created	C:\Windows\SysWOW64\Epcmidab.dll	Jcgbmd32.exe
File created	C:\Windows\SysWOW64\Lbmheomi.exe	Llbphdfl.exe
File opened for modification	C:\Windows\SysWOW64\Pddmml32.exe	Pnjeqbkb.exe
File created	C:\Windows\SysWOW64\Pdkcnklf.exe	Pjeoablq.exe
File created	C:\Windows\SysWOW64\Jkopmg32.dll	Pjeoablq.exe
File created	C:\Windows\SysWOW64\Abkjnd32.exe	Ahffqk32.exe
File opened for modification	C:\Windows\SysWOW64\Chhkmh32.exe	Baocpnmf.exe
File created	C:\Windows\SysWOW64\Elbmebbj.exe	Eamhhjbd.exe
File created	C:\Windows\SysWOW64\Fkcibnmd.exe	Fffqjfom.exe
File created	C:\Windows\SysWOW64\Llpcceho.exe	Ldeonbkd.exe
File opened for modification	C:\Windows\SysWOW64\Nljopa32.exe	Ngmggj32.exe
File created	C:\Windows\SysWOW64\Hlamak32.dll	Nllleapo.exe
File created	C:\Windows\SysWOW64\Oleabh32.dll	Onhhkb32.exe
File created	C:\Windows\SysWOW64\Gipeopep.dll	Ahjoljqc.exe
File opened for modification	C:\Windows\SysWOW64\Bdfilkbb.exe	Blkdgheg.exe
File created	C:\Windows\SysWOW64\Cellfm32.exe	Cobciblp.exe
File created	C:\Windows\SysWOW64\Ekngqqol.exe	Eddodfhp.exe
File created	C:\Windows\SysWOW64\Fomhnmgp.exe	Ffbgog32.exe
File created	C:\Windows\SysWOW64\Naiacpeo.dll	Gcmnijkd.exe
File created	C:\Windows\SysWOW64\Hkfookmo.exe	Hoonjjgk.exe
File created	C:\Windows\SysWOW64\Imjddmpl.exe	Hkkhjj32.exe
File created	C:\Windows\SysWOW64\Aiedaoip.dll	Ahffqk32.exe
File opened for modification	C:\Windows\SysWOW64\Gcmnijkd.exe	Glcelq32.exe
File opened for modification	C:\Windows\SysWOW64\Ilfhfh32.exe	Ifjoma32.exe
File created	C:\Windows\SysWOW64\Ahpdli32.dll	Ilfhfh32.exe
File created	C:\Windows\SysWOW64\Mhaepmgf.dll	Ldeonbkd.exe
File created	C:\Windows\SysWOW64\Lgmnqmam.exe	Lmdihgkl.exe
File created	C:\Windows\SysWOW64\Ncpbji32.dll	Mcmall32.exe
File created	C:\Windows\SysWOW64\Jlcnnhjo.dll	Ndfqlnno.exe
File created	C:\Windows\SysWOW64\Hmkfnp32.dll	Pengna32.exe
File created	C:\Windows\SysWOW64\Cobciblp.exe	Chhkmh32.exe
File created	C:\Windows\SysWOW64\Epofikbn.dll	Glcelq32.exe
File opened for modification	C:\Windows\SysWOW64\Mikjmhaq.exe	Lgmnqmam.exe
File created	C:\Windows\SysWOW64\Ocdqcikl.exe	Onhhkb32.exe
File created	C:\Windows\SysWOW64\Pjeoablq.exe	Pqmjhm32.exe
File created	C:\Windows\SysWOW64\Chhkmh32.exe	Baocpnmf.exe
File created	C:\Windows\SysWOW64\Gllehj32.dll	Fklcbocl.exe
File opened for modification	C:\Windows\SysWOW64\Ifjoma32.exe	Ildkpiqo.exe
File created	C:\Windows\SysWOW64\Mklnbgao.dll	Llpcceho.exe
File created	C:\Windows\SysWOW64\Nljopa32.exe	Ngmggj32.exe
File created	C:\Windows\SysWOW64\Ndfqlnno.exe	Njploeoi.exe
File opened for modification	C:\Windows\SysWOW64\Qjmllgjd.exe	Qaegcb32.exe
File opened for modification	C:\Windows\SysWOW64\Ekqcfpmj.exe	Ekngqqol.exe
File opened for modification	C:\Windows\SysWOW64\Eaoenjqa.exe	Elbmebbj.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2372	2888	WerFault.exe	205

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cobciblp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hflclcle.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Imjddmpl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Blkdgheg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ifjoma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jimeelkc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lekeajmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oflfoepg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Balfko32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqmjhm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llpcceho.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eamhhjbd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ffbgog32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iciflfcd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcgbmd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmkfah32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojjoedfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abkjnd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkcibnmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Glcelq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcbibeki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llbphdfl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onhhkb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqbdclak.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngpcmj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ognpoheh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnjeqbkb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnlafaio.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjeoablq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qfolkcpb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baocpnmf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eaoenjqa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gofkckoe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkfookmo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdqecc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngmggj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdkcnklf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahffqk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fklcbocl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hoonjjgk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Icdmqg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mikjmhaq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocdqcikl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olfolp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ekqcfpmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ildkpiqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdnincal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcfkkmeo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nigjifgc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odmgmmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdllhdco.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqdgan32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjhlfb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfcbcp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ekngqqol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ilpaei32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kfhkop32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gohhik32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcmall32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_d762056beb4d9154ac55f325244e2cff_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cahffmel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Goconkah.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jehoemmb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kemhpl32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Llbphdfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlegifbk.dll"	Njploeoi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ahffqk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dampal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffmkieab.dll"	Ekqcfpmj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jcgbmd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kmijliej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mckefmai.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nigjifgc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jeolonem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncfdbk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pnjeqbkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Foebmn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejkmkh32.dll"	Goconkah.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gofkckoe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jimeelkc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nllleapo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Olfolp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhaepmgf.dll"	Ldeonbkd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eamhhjbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ffbgog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hacacl32.dll"	Mebkbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffkckk32.dll"	Mmlphfed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjeoablq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ahjoljqc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ekqcfpmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kemhpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mmlphfed.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eaoenjqa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mpadpm32.dll"	Fkcibnmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ilpaei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpbcpboc.dll"	Ildkpiqo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kfhkop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nigjifgc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nljopa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ffbgog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phljflhe.dll"	Fomhnmgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mikjmhaq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naqhjb32.dll"	Mcfkkmeo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ojcidelf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifqikhho.dll"	Pjcbkbnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aalndaml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncjjbhfe.dll"	Eamhhjbd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ghlcga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hkhhknoh.dll"	Mllcocna.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Laiadfap.dll"	Ffbgog32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ilpaei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kdllhdco.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mebkbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mcfkkmeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfolobpo.dll"	Ncfdbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlcnnhjo.dll"	Ndfqlnno.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ojefjd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmjnjo32.dll"	2026-08-10_d762056beb4d9154ac55f325244e2cff_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aalndaml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bngdndfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fffqjfom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hfemkdbm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnpaam32.dll"	Kdllhdco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ldeonbkd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ndfqlnno.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	2026-08-10_d762056beb4d9154ac55f325244e2cff_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hoonjjgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Odhman32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5732 wrote to memory of 2884	5732	2026-08-10_d762056beb4d9154ac55f325244e2cff_elex_wannacry.exe	89
PID 2884 wrote to memory of 5700	2884	Pengna32.exe	90
PID 5700 wrote to memory of 2352	5700	Qaegcb32.exe	91
PID 2352 wrote to memory of 2132	2352	Qjmllgjd.exe	92
PID 2132 wrote to memory of 5704	2132	Qgalelin.exe	93
PID 5704 wrote to memory of 5092	5704	Aalndaml.exe	94
PID 5092 wrote to memory of 2040	5092	Ahffqk32.exe	95
PID 2040 wrote to memory of 5248	2040	Abkjnd32.exe	96
PID 5248 wrote to memory of 1100	5248	Ahjoljqc.exe	97
PID 1100 wrote to memory of 2672	1100	Bngdndfn.exe	98
PID 2672 wrote to memory of 4876	2672	Blkdgheg.exe	99
PID 4876 wrote to memory of 1312	4876	Bdfilkbb.exe	100
PID 1312 wrote to memory of 4656	1312	Balfko32.exe	101
PID 4656 wrote to memory of 6056	4656	Baocpnmf.exe	102
PID 6056 wrote to memory of 6004	6056	Chhkmh32.exe	103
PID 6004 wrote to memory of 4556	6004	Cobciblp.exe	104
PID 4556 wrote to memory of 5784	4556	Cellfm32.exe	105
PID 5784 wrote to memory of 2400	5784	Cahffmel.exe	106
PID 2400 wrote to memory of 720	2400	Dampal32.exe	107
PID 720 wrote to memory of 2452	720	Dhfhnfhc.exe	108
PID 2452 wrote to memory of 1436	2452	Dememj32.exe	109
PID 1436 wrote to memory of 2420	1436	Ddbbngjb.exe	110
PID 2420 wrote to memory of 5044	2420	Eddodfhp.exe	111
PID 5044 wrote to memory of 916	5044	Ekngqqol.exe	112
PID 916 wrote to memory of 1304	916	Ekqcfpmj.exe	113
PID 1304 wrote to memory of 4240	1304	Eamhhjbd.exe	114
PID 4240 wrote to memory of 4420	4240	Elbmebbj.exe	115
PID 4420 wrote to memory of 1440	4420	Eaoenjqa.exe	116
PID 1440 wrote to memory of 944	1440	Foebmn32.exe	117
PID 944 wrote to memory of 5928	944	Fklcbocl.exe	118
PID 5928 wrote to memory of 2072	5928	Ffbgog32.exe	119
PID 2072 wrote to memory of 5728	2072	Fomhnmgp.exe	120
PID 5728 wrote to memory of 5684	5728	Fffqjfom.exe	121
PID 5684 wrote to memory of 4748	5684	Fkcibnmd.exe	122
PID 4748 wrote to memory of 2444	4748	Glcelq32.exe	123
PID 2444 wrote to memory of 3324	2444	Gcmnijkd.exe	124
PID 3324 wrote to memory of 4440	3324	Goconkah.exe	125
PID 4440 wrote to memory of 5680	4440	Ghlcga32.exe	126
PID 5680 wrote to memory of 5108	5680	Gofkckoe.exe	127
PID 5108 wrote to memory of 2956	5108	Gohhik32.exe	128
PID 2956 wrote to memory of 5648	2956	Giqlbqcc.exe	129
PID 5648 wrote to memory of 3948	5648	Hfemkdbm.exe	130
PID 3948 wrote to memory of 4508	3948	Hkaedk32.exe	131
PID 4508 wrote to memory of 2848	4508	Hoonjjgk.exe	132
PID 2848 wrote to memory of 2244	2848	Hkfookmo.exe	133
PID 2244 wrote to memory of 1144	2244	Hflclcle.exe	134
PID 1144 wrote to memory of 5172	1144	Heapmp32.exe	135
PID 5172 wrote to memory of 4580	5172	Hkkhjj32.exe	136
PID 4580 wrote to memory of 5428	4580	Imjddmpl.exe	137
PID 5428 wrote to memory of 2560	5428	Icdmqg32.exe	138
PID 2560 wrote to memory of 5820	2560	Ilpaei32.exe	139
PID 5820 wrote to memory of 3276	5820	Ibijbc32.exe	140
PID 3276 wrote to memory of 5556	3276	Iciflfcd.exe	141
PID 5556 wrote to memory of 1300	5556	Ildkpiqo.exe	142
PID 1300 wrote to memory of 5388	1300	Ifjoma32.exe	143
PID 5388 wrote to memory of 3816	5388	Ilfhfh32.exe	144
PID 3816 wrote to memory of 2772	3816	Jeolonem.exe	145
PID 2772 wrote to memory of 2784	2772	Jlidkh32.exe	146
PID 2784 wrote to memory of 3940	2784	Jimeelkc.exe	147
PID 3940 wrote to memory of 4676	3940	Jcbibeki.exe	148
PID 4676 wrote to memory of 2928	4676	Jfcbcp32.exe	149
PID 2928 wrote to memory of 5912	2928	Jcgbmd32.exe	150
PID 5912 wrote to memory of 3176	5912	Jehoemmb.exe	151
PID 3176 wrote to memory of 3208	3176	Kfhkop32.exe	152

C:\Users\Admin\AppData\Local\Temp\2026-08-10_d762056beb4d9154ac55f325244e2cff_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_d762056beb4d9154ac55f325244e2cff_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5732
- C:\Windows\SysWOW64\Pengna32.exe
  C:\Windows\system32\Pengna32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\SysWOW64\Qaegcb32.exe
    C:\Windows\system32\Qaegcb32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:5700
  - - C:\Windows\SysWOW64\Qjmllgjd.exe
      C:\Windows\system32\Qjmllgjd.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2352
    - - C:\Windows\SysWOW64\Qgalelin.exe
        
        C:\Windows\system32\Qgalelin.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2132
      - C:\Windows\SysWOW64\Aalndaml.exe
        
        C:\Windows\system32\Aalndaml.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5704
        
        C:\Windows\SysWOW64\Ahffqk32.exe
        
        C:\Windows\system32\Ahffqk32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5092
        
        C:\Windows\SysWOW64\Abkjnd32.exe
        
        C:\Windows\system32\Abkjnd32.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2040
        
        C:\Windows\SysWOW64\Ahjoljqc.exe
        
        C:\Windows\system32\Ahjoljqc.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5248
        
        C:\Windows\SysWOW64\Bngdndfn.exe
        
        C:\Windows\system32\Bngdndfn.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1100
        
        C:\Windows\SysWOW64\Blkdgheg.exe
        
        C:\Windows\system32\Blkdgheg.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2672
        
        C:\Windows\SysWOW64\Bdfilkbb.exe
        
        C:\Windows\system32\Bdfilkbb.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4876
        
        C:\Windows\SysWOW64\Balfko32.exe
        
        C:\Windows\system32\Balfko32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1312
        
        C:\Windows\SysWOW64\Baocpnmf.exe
        
        C:\Windows\system32\Baocpnmf.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4656
        
        C:\Windows\SysWOW64\Chhkmh32.exe
        
        C:\Windows\system32\Chhkmh32.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:6056
        
        C:\Windows\SysWOW64\Cobciblp.exe
        
        C:\Windows\system32\Cobciblp.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6004
        
        C:\Windows\SysWOW64\Cellfm32.exe
        
        C:\Windows\system32\Cellfm32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4556
        
        C:\Windows\SysWOW64\Cahffmel.exe
        
        C:\Windows\system32\Cahffmel.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5784
        
        C:\Windows\SysWOW64\Dampal32.exe
        
        C:\Windows\system32\Dampal32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2400
        
        C:\Windows\SysWOW64\Dhfhnfhc.exe
        
        C:\Windows\system32\Dhfhnfhc.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:720
        
        C:\Windows\SysWOW64\Dememj32.exe
        
        C:\Windows\system32\Dememj32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2452
        
        C:\Windows\SysWOW64\Ddbbngjb.exe
        
        C:\Windows\system32\Ddbbngjb.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1436
        
        C:\Windows\SysWOW64\Eddodfhp.exe
        
        C:\Windows\system32\Eddodfhp.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2420
        
        C:\Windows\SysWOW64\Ekngqqol.exe
        
        C:\Windows\system32\Ekngqqol.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5044
        
        C:\Windows\SysWOW64\Ekqcfpmj.exe
        
        C:\Windows\system32\Ekqcfpmj.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:916
        
        C:\Windows\SysWOW64\Eamhhjbd.exe
        
        C:\Windows\system32\Eamhhjbd.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1304
        
        C:\Windows\SysWOW64\Elbmebbj.exe
        
        C:\Windows\system32\Elbmebbj.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4240
        
        C:\Windows\SysWOW64\Eaoenjqa.exe
        
        C:\Windows\system32\Eaoenjqa.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4420
        
        C:\Windows\SysWOW64\Foebmn32.exe
        
        C:\Windows\system32\Foebmn32.exe
        29⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1440
        
        C:\Windows\SysWOW64\Fklcbocl.exe
        
        C:\Windows\system32\Fklcbocl.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:944
        
        C:\Windows\SysWOW64\Ffbgog32.exe
        
        C:\Windows\system32\Ffbgog32.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5928
        
        C:\Windows\SysWOW64\Fomhnmgp.exe
        
        C:\Windows\system32\Fomhnmgp.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2072
        
        C:\Windows\SysWOW64\Fffqjfom.exe
        
        C:\Windows\system32\Fffqjfom.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5728
        
        C:\Windows\SysWOW64\Fkcibnmd.exe
        
        C:\Windows\system32\Fkcibnmd.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5684
        
        C:\Windows\SysWOW64\Glcelq32.exe
        
        C:\Windows\system32\Glcelq32.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4748
        
        C:\Windows\SysWOW64\Gcmnijkd.exe
        
        C:\Windows\system32\Gcmnijkd.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2444
        
        C:\Windows\SysWOW64\Goconkah.exe
        
        C:\Windows\system32\Goconkah.exe
        37⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3324
        
        C:\Windows\SysWOW64\Ghlcga32.exe
        
        C:\Windows\system32\Ghlcga32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4440
        
        C:\Windows\SysWOW64\Gofkckoe.exe
        
        C:\Windows\system32\Gofkckoe.exe
        39⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5680
        
        C:\Windows\SysWOW64\Gohhik32.exe
        
        C:\Windows\system32\Gohhik32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5108
        
        C:\Windows\SysWOW64\Giqlbqcc.exe
        
        C:\Windows\system32\Giqlbqcc.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2956
        
        C:\Windows\SysWOW64\Hfemkdbm.exe
        
        C:\Windows\system32\Hfemkdbm.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5648
        
        C:\Windows\SysWOW64\Hkaedk32.exe
        
        C:\Windows\system32\Hkaedk32.exe
        43⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3948
        
        C:\Windows\SysWOW64\Hoonjjgk.exe
        
        C:\Windows\system32\Hoonjjgk.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4508
        
        C:\Windows\SysWOW64\Hkfookmo.exe
        
        C:\Windows\system32\Hkfookmo.exe
        45⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2848
        
        C:\Windows\SysWOW64\Hflclcle.exe
        
        C:\Windows\system32\Hflclcle.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2244
        
        C:\Windows\SysWOW64\Heapmp32.exe
        
        C:\Windows\system32\Heapmp32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1144
        
        C:\Windows\SysWOW64\Hkkhjj32.exe
        
        C:\Windows\system32\Hkkhjj32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5172
        
        C:\Windows\SysWOW64\Imjddmpl.exe
        
        C:\Windows\system32\Imjddmpl.exe
        49⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4580
        
        C:\Windows\SysWOW64\Icdmqg32.exe
        
        C:\Windows\system32\Icdmqg32.exe
        50⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5428
        
        C:\Windows\SysWOW64\Ilpaei32.exe
        
        C:\Windows\system32\Ilpaei32.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2560
        
        C:\Windows\SysWOW64\Ibijbc32.exe
        
        C:\Windows\system32\Ibijbc32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5820
        
        C:\Windows\SysWOW64\Iciflfcd.exe
        
        C:\Windows\system32\Iciflfcd.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3276
        
        C:\Windows\SysWOW64\Ildkpiqo.exe
        
        C:\Windows\system32\Ildkpiqo.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5556
        
        C:\Windows\SysWOW64\Ifjoma32.exe
        
        C:\Windows\system32\Ifjoma32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1300
        
        C:\Windows\SysWOW64\Ilfhfh32.exe
        
        C:\Windows\system32\Ilfhfh32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5388
        
        C:\Windows\SysWOW64\Jeolonem.exe
        
        C:\Windows\system32\Jeolonem.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3816
        
        C:\Windows\SysWOW64\Jlidkh32.exe
        
        C:\Windows\system32\Jlidkh32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2772
        
        C:\Windows\SysWOW64\Jimeelkc.exe
        
        C:\Windows\system32\Jimeelkc.exe
        59⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2784
        
        C:\Windows\SysWOW64\Jcbibeki.exe
        
        C:\Windows\system32\Jcbibeki.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3940
        
        C:\Windows\SysWOW64\Jfcbcp32.exe
        
        C:\Windows\system32\Jfcbcp32.exe
        61⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4676
        
        C:\Windows\SysWOW64\Jcgbmd32.exe
        
        C:\Windows\system32\Jcgbmd32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2928
        
        C:\Windows\SysWOW64\Jehoemmb.exe
        
        C:\Windows\system32\Jehoemmb.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5912
        
        C:\Windows\SysWOW64\Kfhkop32.exe
        
        C:\Windows\system32\Kfhkop32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3176
        
        C:\Windows\SysWOW64\Kdllhdco.exe
        
        C:\Windows\system32\Kdllhdco.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3208
        
        C:\Windows\SysWOW64\Kemhpl32.exe
        
        C:\Windows\system32\Kemhpl32.exe
        66⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4796
        
        C:\Windows\SysWOW64\Kdnincal.exe
        
        C:\Windows\system32\Kdnincal.exe
        67⤵
        System Location Discovery: System Language Discovery
        
        PID:1964
        
        C:\Windows\SysWOW64\Kmfmfigl.exe
        
        C:\Windows\system32\Kmfmfigl.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3804
        
        C:\Windows\SysWOW64\Kdqecc32.exe
        
        C:\Windows\system32\Kdqecc32.exe
        69⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:800
        
        C:\Windows\SysWOW64\Kmijliej.exe
        
        C:\Windows\system32\Kmijliej.exe
        70⤵
        Modifies registry class
        
        PID:5796
        
        C:\Windows\SysWOW64\Kdcbic32.exe
        
        C:\Windows\system32\Kdcbic32.exe
        71⤵
        Drops file in System32 directory
        
        PID:836
        
        C:\Windows\SysWOW64\Lmkfah32.exe
        
        C:\Windows\system32\Lmkfah32.exe
        72⤵
        System Location Discovery: System Language Discovery
        
        PID:5568
        
        C:\Windows\SysWOW64\Ldeonbkd.exe
        
        C:\Windows\system32\Ldeonbkd.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:2920
        
        C:\Windows\SysWOW64\Llpcceho.exe
        
        C:\Windows\system32\Llpcceho.exe
        74⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2804
        
        C:\Windows\SysWOW64\Llbphdfl.exe
        
        C:\Windows\system32\Llbphdfl.exe
        75⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1212
        
        C:\Windows\SysWOW64\Lbmheomi.exe
        
        C:\Windows\system32\Lbmheomi.exe
        76⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\Lekeajmm.exe
        
        C:\Windows\system32\Lekeajmm.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4872
        
        C:\Windows\SysWOW64\Lmdihgkl.exe
        
        C:\Windows\system32\Lmdihgkl.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2460
        
        C:\Windows\SysWOW64\Lgmnqmam.exe
        
        C:\Windows\system32\Lgmnqmam.exe
        79⤵
        Drops file in System32 directory
        
        PID:3664
        
        C:\Windows\SysWOW64\Mikjmhaq.exe
        
        C:\Windows\system32\Mikjmhaq.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5992
        
        C:\Windows\SysWOW64\Mebkbi32.exe
        
        C:\Windows\system32\Mebkbi32.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5424
        
        C:\Windows\SysWOW64\Mllcocna.exe
        
        C:\Windows\system32\Mllcocna.exe
        82⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3180
        
        C:\Windows\SysWOW64\Mcfkkmeo.exe
        
        C:\Windows\system32\Mcfkkmeo.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2192
        
        C:\Windows\SysWOW64\Mmlphfed.exe
        
        C:\Windows\system32\Mmlphfed.exe
        84⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5716
        
        C:\Windows\SysWOW64\Mckefmai.exe
        
        C:\Windows\system32\Mckefmai.exe
        85⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3844
        
        C:\Windows\SysWOW64\Mcmall32.exe
        
        C:\Windows\system32\Mcmall32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5020
        
        C:\Windows\SysWOW64\Nigjifgc.exe
        
        C:\Windows\system32\Nigjifgc.exe
        87⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1288
        
        C:\Windows\SysWOW64\Ndmnfofi.exe
        
        C:\Windows\system32\Ndmnfofi.exe
        88⤵
        
        PID:704
        
        C:\Windows\SysWOW64\Nenjng32.exe
        
        C:\Windows\system32\Nenjng32.exe
        89⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Ngmggj32.exe
        
        C:\Windows\system32\Ngmggj32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2172
        
        C:\Windows\SysWOW64\Nljopa32.exe
        
        C:\Windows\system32\Nljopa32.exe
        91⤵
        Modifies registry class
        
        PID:2340
        
        C:\Windows\SysWOW64\Ngpcmj32.exe
        
        C:\Windows\system32\Ngpcmj32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1272
        
        C:\Windows\SysWOW64\Nllleapo.exe
        
        C:\Windows\system32\Nllleapo.exe
        93⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4744
        
        C:\Windows\SysWOW64\Ncfdbk32.exe
        
        C:\Windows\system32\Ncfdbk32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4104
        
        C:\Windows\SysWOW64\Njploeoi.exe
        
        C:\Windows\system32\Njploeoi.exe
        95⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2368
        
        C:\Windows\SysWOW64\Ndfqlnno.exe
        
        C:\Windows\system32\Ndfqlnno.exe
        96⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1208
        
        C:\Windows\SysWOW64\Ojcidelf.exe
        
        C:\Windows\system32\Ojcidelf.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4152
        
        C:\Windows\SysWOW64\Odhman32.exe
        
        C:\Windows\system32\Odhman32.exe
        98⤵
        Modifies registry class
        
        PID:1064
        
        C:\Windows\SysWOW64\Ojefjd32.exe
        
        C:\Windows\system32\Ojefjd32.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4860
        
        C:\Windows\SysWOW64\Oflfoepg.exe
        
        C:\Windows\system32\Oflfoepg.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2704
        
        C:\Windows\SysWOW64\Olfolp32.exe
        
        C:\Windows\system32\Olfolp32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6048
        
        C:\Windows\SysWOW64\Odmgmmhf.exe
        
        C:\Windows\system32\Odmgmmhf.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3336
        
        C:\Windows\SysWOW64\Ojjoedfn.exe
        
        C:\Windows\system32\Ojjoedfn.exe
        103⤵
        System Location Discovery: System Language Discovery
        
        PID:912
        
        C:\Windows\SysWOW64\Oqdgan32.exe
        
        C:\Windows\system32\Oqdgan32.exe
        104⤵
        System Location Discovery: System Language Discovery
        
        PID:3308
        
        C:\Windows\SysWOW64\Ognpoheh.exe
        
        C:\Windows\system32\Ognpoheh.exe
        105⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4272
        
        C:\Windows\SysWOW64\Onhhkb32.exe
        
        C:\Windows\system32\Onhhkb32.exe
        106⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1932
        
        C:\Windows\SysWOW64\Ocdqcikl.exe
        
        C:\Windows\system32\Ocdqcikl.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1884
        
        C:\Windows\SysWOW64\Pnjeqbkb.exe
        
        C:\Windows\system32\Pnjeqbkb.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1468
        
        C:\Windows\SysWOW64\Pddmml32.exe
        
        C:\Windows\system32\Pddmml32.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4816
        
        C:\Windows\SysWOW64\Pnlafaio.exe
        
        C:\Windows\system32\Pnlafaio.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5972
        
        C:\Windows\SysWOW64\Pqknbmhc.exe
        
        C:\Windows\system32\Pqknbmhc.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2116
        
        C:\Windows\SysWOW64\Pjcbkbnc.exe
        
        C:\Windows\system32\Pjcbkbnc.exe
        112⤵
        Modifies registry class
        
        PID:6088
        
        C:\Windows\SysWOW64\Pqmjhm32.exe
        
        C:\Windows\system32\Pqmjhm32.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5976
        
        C:\Windows\SysWOW64\Pjeoablq.exe
        
        C:\Windows\system32\Pjeoablq.exe
        114⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5004
        
        C:\Windows\SysWOW64\Pdkcnklf.exe
        
        C:\Windows\system32\Pdkcnklf.exe
        115⤵
        System Location Discovery: System Language Discovery
        
        PID:3288
        
        C:\Windows\SysWOW64\Pjhlfb32.exe
        
        C:\Windows\system32\Pjhlfb32.exe
        116⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5800
        
        C:\Windows\SysWOW64\Pqbdclak.exe
        
        C:\Windows\system32\Pqbdclak.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5160
        
        C:\Windows\SysWOW64\Qfolkcpb.exe
        
        C:\Windows\system32\Qfolkcpb.exe
        118⤵
        System Location Discovery: System Language Discovery
        
        PID:2888
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 448
        119⤵
        Program crash
        
        PID:2372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2888 -ip 2888
1⤵
PID:5156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Aalndaml.exe

Path C:\Windows\SysWOW64\Aalndaml.exe
Size 320KB
SHA256 845ea01f17da37f169edbcd8bce2960a85cfef7e29a5e1cada86ed8bdc8fc0f3
MD5 80988d0f1e008aca34243b26edbd1bf0
SHA1 5da63da8abbc42c7971c50f71356a0c130a3e23d
SHA512 c2620a33661dab23d94043c7a6ef661d0143862124250d1fbec35f713ce4ac6d8c9bceff3f5db60fa1cf901eecc2c5f2249de13cf37b2dd6d1b88efad59fb414
SSDEEP 3072:6YEMc8ZwRpeUp1N+8XQWGQsPwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:APv1gWZsPV/Ah1G/AcQ///NR5fn
TLSH
T17364DA1A26341DEACEED1BB5AC1259D89141E9F014F1E13EA2239FDCE8F4DB2D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Abkjnd32.exe

Path C:\Windows\SysWOW64\Abkjnd32.exe
Size 320KB
SHA256 a494a6948e711a90cbb432e1956e0ed79b879c9a87dd12db3cf56783af59ad35
MD5 1143c3ddfcd7280873fa4d089cd34710
SHA1 85c9073ca041ebe3985ade1e2bb0db4e4b89714e
SHA512 5138a978ba2be14a94229f66c351000ad0d4d5ccc8c4d5339209a138377868c695c826d9fc525b1cfde6715776d55b1b4e6c1f294a00ad84115537035b6eb4b1
SSDEEP 3072:THW91g6yI+3lwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:THW9C6yRlV/Ah1G/AcQ///NR5fn
TLSH
T162642E1A6A340AEBDDED1FB5AD1249D85181E9F014F2E13E6123DFDCD8E4DA6C908F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ahffqk32.exe

Path C:\Windows\SysWOW64\Ahffqk32.exe
Size 320KB
SHA256 32b7e1edebc1b0d0970e3bde9ac2d5ce97e6d5914b795b4e04bd2f2d10afaf35
MD5 fceb8c5439e31591cafa9e874bd72f66
SHA1 6a76e72067243bf5ee6f808ec0edc00f69c288e6
SHA512 013e2e58ad1b1224094e1b3ce6fcaaf571c7e4842b9231fd13ce70cfb810e4a57de5dfead02bdb5d9f5a06055ee6e4eabeafe44b4640ae47dc9379637957e264
SSDEEP 3072:19ZfeIkuWwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:vkuWV/Ah1G/AcQ///NR5fn
TLSH
T10D640E6A2A3409EACEED1BB9BC124DD86141E9F014F1E23E6163DFDCD8E4D66D814F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ahjoljqc.exe

Path C:\Windows\SysWOW64\Ahjoljqc.exe
Size 320KB
SHA256 639d0358b02f0fa1e469247bca420fad38d05fab9aeac8462c0ca4a2dcd1f8d4
MD5 c5be637b0b7098afd02d63bf4d320ee6
SHA1 6a2f96dddd2a90c814d09e261c385f37126c9aaa
SHA512 bb322ed58427bd0862baf8f36bf21b6e9824e45d6a881f2240c5595a48a0e29b47adcd42fbfc2156c85036292c41829a8141a24d8334eb9adc6a1b306e52baf1
SSDEEP 3072:uFiA3W8tjJNZdteWwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:DAmEtteWV/Ah1G/AcQ///NR5fn
TLSH
T108641C29163009EAEEED1BB6EC5249D891D1E9F014F1E13E2123DFDCC9E6DA6C845F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Balfko32.exe

Path C:\Windows\SysWOW64\Balfko32.exe
Size 320KB
SHA256 d2688068c3b1ca7e7db5c5e62c024f8e290e5c483297ec674ae7ba6346e62473
MD5 a1dc0482fa09b066c82e6be454244af1
SHA1 5bc9d54562676c0479fb833be54905ccd04d2cc7
SHA512 73e1f839a2b32e8353104e4471d7e7cba535dacef462c35fb7ddbe12a6df64e808e8aa7f08551283b9bb7929bb6f03a44425b514a7820e42836385b9b66d1849
SSDEEP 6144:oMyzOHaorCjrWwo3V/Ah1G/AcQ///NR5fn:2zOHaorCjrRB/Nv
TLSH
T192642F192A3409EACEEE1BB5AC1349D99181E9F015F1E13E6123DFDCD8E4DB6D809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Baocpnmf.exe

Path C:\Windows\SysWOW64\Baocpnmf.exe
Size 320KB
SHA256 3cca141caf56711c4979b64a122361925bc11e69ca9ece358a410721be3375c9
MD5 da327de7eabc3b4590ef03ca0c129437
SHA1 83e1f99d2224d23874e806514fd20df80c1629d1
SHA512 65e4e9a7de8c7b2ed0d9f4a0daa6a7c68b5c743d8a3781338baeca18ead68366607de9136143b61f6df74f1cf42974fdbbddb41d75a70a1ede0246962923b352
SSDEEP 3072:y2qsHQU3DOFpwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:1wUCFpV/Ah1G/AcQ///NR5fn
TLSH
T17464E91A2A3509EADEED1BF5AC1249D99181E8F014F1E13E6133DFDCD8E4DA6D844F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bdfilkbb.exe

Path C:\Windows\SysWOW64\Bdfilkbb.exe
Size 320KB
SHA256 ebc260cca6f2322924e810787c6f0ef6c420aa2ee3c927952353de2f546c2382
MD5 515e8ec9713a4d5aa1506cf56d34fd4b
SHA1 9426f30050277f4175870ddd8a457933f438fd98
SHA512 2100a2c01dc134c86177066d2c703ca2040b117e382561654643eb209a376f3ffb1180d95ec5f4234cd444ed2d2789a21e9ff1d816798462d2bc027f621c8487
SSDEEP 3072:QXLXPhl9yIMBXaUwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:M0IGqUV/Ah1G/AcQ///NR5fn
TLSH
T13E644019263409EACEED1FB5AD5249D85141E9F024F2E13E6223DFDCD8F4DA2C819F92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Blkdgheg.exe

Path C:\Windows\SysWOW64\Blkdgheg.exe
Size 320KB
SHA256 092f3f3a021f95c72c2c42a654068f8225aede7f54936d0ffb903086f0f39d63
MD5 eec22f34f7c47c231061044291883306
SHA1 ddaffd3e663a3b4a756734c96298124365208d94
SHA512 7fa25f1dccba9226c41d9665c3545c7c380bb07ad747fd45e1da76bd0f6c3bf18e7bdb14beb16b5080dd79ad3b79a766d7eb73232b9bb2daee00a019f5270f31
SSDEEP 3072:UnB5Cvxc0AwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:2CvK0AV/Ah1G/AcQ///NR5fn
TLSH
T1626430191A3409EECEED1FB5AC1249E89181E8F018F5E23E6123DFDCD8E4DA6D905F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bngdndfn.exe

Path C:\Windows\SysWOW64\Bngdndfn.exe
Size 320KB
SHA256 29a95db3e00663b55d839ca41ee639d5d4e852e14f557a4cf890107ff2e49e62
MD5 9c395ab4dbd4ecd6b4196dea0d820b49
SHA1 44d1c6652fb56df3978d5d9867859ef759b8d7ee
SHA512 65e3d02912c153d9d34589ec32a2f1822ac344ae56d25cb3ac770322ca5d4ca80abe11323449422843ca0ee889adda5430f3d9e61df8e1a35f3dcd094f517012
SSDEEP 3072:AtUiTBtPtjAJtwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:CBtPRUtV/Ah1G/AcQ///NR5fn
TLSH
T1DB6431192A3009EACDED1FB6AC5259DC9141E9F214F1E13E6123EFDCD8E4DA2D816F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cahffmel.exe

Path C:\Windows\SysWOW64\Cahffmel.exe
Size 320KB
SHA256 ccb334968e8192f8d0a472e836afc1bbd7923500e0a34081a59636743098b036
MD5 e44ecf732214b6022f18004fe4dd1b82
SHA1 8cc87e7659b5df2d73bf3710cb79305f72a126cd
SHA512 07a754fd9cacf7ba7d18e0a17f4ed1b3e8a55e2b068658d431ba03af6e771aa1c83cf1bb5aca2ce32b80c55d100afeb099cc905a6857976eb1c7ffce98de4f86
SSDEEP 6144:pQWoSEAjnfWPfx4++kw/+siWYwGV/Ah1G/AcQ///NR5fn:pQWiAjnfWPfx4++k2YM/Nv
TLSH
T1326452292A3409EACDED1FB5AE1259D86191E9F014F1E13E6123DFDCE8E4DA2DD04F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cellfm32.exe

Path C:\Windows\SysWOW64\Cellfm32.exe
Size 320KB
SHA256 90561bdf09e0e862ca676261c761aad397e7718608dcee0cc50515bb9088db0d
MD5 9a9a19eba5e7e2880a3088cebcb88da2
SHA1 2bec042a77c6f5888a9c087d1d85c064d0246339
SHA512 4bf361eb6507c5c36121c0b101f93558f2049dc19c0386640d831d21035e45706f8d57e2773680eafbdbcaf3f6f5350ee1e0a412da4515561d7697519203dbca
SSDEEP 3072:Leajsz5QwSvaE0wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Lrjszew610V/Ah1G/AcQ///NR5fn
TLSH
T16F64EC157A3009EACEFE1BB5AD1249D89141E8F014F1E13EA123DFDCD8E4DA6D919F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Chhkmh32.exe

Path C:\Windows\SysWOW64\Chhkmh32.exe
Size 320KB
SHA256 6ec824df9ed1b4b2034a392dd90f0baf1ba273caadd0b534d314b48ac0bf2447
MD5 aed72c5b94a6f9602295f2efb5b1645d
SHA1 920c7a60c208401d78c4692b4df37f44a9af0ebc
SHA512 2e7d2c244858a27b6638b2c7da9ca5b310d69f5dced572898d6cc32b21d13e8a24527372ab772d4c31e403e2ca8db6c0caa814be1b8336c870dac093e323b63f
SSDEEP 3072:hcfNvXT/GK7Lba8dSQDwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:hY/GiXRoQDV/Ah1G/AcQ///NR5fn
TLSH
T18F64B7192A3809EACDED1FB6BC1249D89141E9F054F1E23E6123DFDCD8E4DAADC15B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cobciblp.exe

Path C:\Windows\SysWOW64\Cobciblp.exe
Size 320KB
SHA256 1824f7e3ef4bb3fdc261fb9ae6c4453a604c45489527ced4c70ba67c445f7893
MD5 48002459fe92232a71903f8b0f517679
SHA1 d3cfde2adf21b838b054196243431bf90108726d
SHA512 d317d2b37b36ae46ef3ca510cc07c709c518f0040e0ba57ba4b6dc19e59983e2f81c2255e0840970971a95e8d698a61745a9d3f3b6fa8491dd630e758db08af4
SSDEEP 3072:vrniso0HwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:TniZ0HV/Ah1G/AcQ///NR5fn
TLSH
T13464DA192A3419EACEED1BB6AC1249DC5141F9F018F2E13E6523DFECD8E4DA2D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dampal32.exe

Path C:\Windows\SysWOW64\Dampal32.exe
Size 320KB
SHA256 b6764a38d956e40791d70fbab7a00007f5e09cdff764759a38d3a742952bca01
MD5 9f57c8538c2b61dece0324b273917d89
SHA1 56f31b6aa48c162d94b1d0e7d0633971161a4a61
SHA512 01a1c4222b9d70f8ca2d1725499f13fdc3ff9413832f8fd790e2daaa4d68f3a8f60d3019c6bd79b8dfbf13efd862c15483511265b2652cce7840b8aabd3dd9e2
SSDEEP 3072:BMbyszVWhtkwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:6WDkV/Ah1G/AcQ///NR5fn
TLSH
T1F464FB1A2A340DEACEED1BB9AD5249D89141F9F414F1E13E6123DFDDD8E4DA2C809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ddbbngjb.exe

Path C:\Windows\SysWOW64\Ddbbngjb.exe
Size 320KB
SHA256 364dc3620029df72120e78ecb86fb3d5d9513c21d7901480954044560cfba471
MD5 91fc473e97a1831b31e13ffebaa66481
SHA1 1a1d68b868e4e750a141fd9d95ae8f8dba523742
SHA512 c6a5f54ba431ffa2b7181bd0683a33afc254e7b15c55df5f5321c5677d54a34a5666d4dd49917adb334b7259e9b14082285e139be4282193b9c89e3dcccbe1c5
SSDEEP 3072:vuXjkDFdUcj1uZL3KEwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:vuXjkDFFjkLaEV/Ah1G/AcQ///NR5fn
TLSH
T19D640E152A3149EACDED1BB5AC025AD85281E9F018F1E17E6163EFDCD8F4DA2D809FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dememj32.exe

Path C:\Windows\SysWOW64\Dememj32.exe
Size 320KB
SHA256 c31266847b4c914ad56a5bb40c32811f5c83053c046c26ec804b9afe5be846a0
MD5 ec6017e5b99f29c4db5014c1e7008c20
SHA1 056cdfc669bda98f73fe67b6d4018a06112de077
SHA512 ffc7c351b18e37787eef016efe314d9521937e8e5feeefaa022cada9b5b91e3408d7135fdae02d0ba23ce20ebf0a88b94c8322bfe4b1391d27fecf2d6e016c92
SSDEEP 3072:OHIuOsS5aVKPwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:OHIu28gPV/Ah1G/AcQ///NR5fn
TLSH
T1C8642F1A663409EACEED1FB6AC1249D89141F9F114F2E13E6123DFDCC8E4DA6D818F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dhfhnfhc.exe

Path C:\Windows\SysWOW64\Dhfhnfhc.exe
Size 320KB
SHA256 d362d958711a9e27cb61b794fef5658ec4e6f89958dcbbfe19a592d10ff4f36e
MD5 ad98600f5c24e4a2e6f1c23333d7dc8b
SHA1 8f6f16c030c2722291be577090c1309e731c42fe
SHA512 6af089c03f7cb4f856cc16c3e839249df50baaf22d9e0bedd29ca639a9671f5cad02eb5572e2a224adaf1c6952a4a9a690c189227310dc96b911632ccf28dbba
SSDEEP 3072:XSVd1xiWrcmA4NwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:CNiAA4NV/Ah1G/AcQ///NR5fn
TLSH
T1A864DB192A3819EACDED5BB5AD124DD85181E9B014F1E23E6173DFECC8E8DA2C814FC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eamhhjbd.exe

Path C:\Windows\SysWOW64\Eamhhjbd.exe
Size 320KB
SHA256 678dad93bab05e37c37cfde3ad27d61782af5131f891e011f26eabf0f0ee191a
MD5 4dd26531a27316fb5637454640adb9d1
SHA1 32cf15a60685975aa45660651d2fde9927f037d1
SHA512 86bd4ab57830a74c12901d969ded43aa036e49631e3b79b7797e5ece864e0f53e858e48c7e04dd7cf117472b1e522649520649891b09b08e937d785207121100
SSDEEP 3072:znWdjtBPyDB4FZwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:zn0TyVkZV/Ah1G/AcQ///NR5fn
TLSH
T1CF6451191A3009EAEDED1BB5AC1359D88581E8F014F2E13E6923DFDCC8E5DA2CC56F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eaoenjqa.exe

Path C:\Windows\SysWOW64\Eaoenjqa.exe
Size 320KB
SHA256 a3a565d0255b347e5f8dc7767fda4520f8098823d2512e9514fa9d42ae6216d2
MD5 99b5472083793820ad856ec0333217ad
SHA1 9f04cf5a2adf9dbc7c29921a85fb0910a461d3d9
SHA512 66b4dd87f76aa7e6c3fbb0ec10f0ffdc62d70a8c4f7efc29eb48ee763dd0c3160081f15947319ca4610080c3767f4d319d2efc30b4952ac12a706c689a024d7c
SSDEEP 3072:VGu2zPf+Nn4yRawS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:NuIRaV/Ah1G/AcQ///NR5fn
TLSH
T14E640D1A263409EADEED1BF5AC4249D89241F9F214F1E13E6123DFDCD9E4DA2D818F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eddodfhp.exe

Path C:\Windows\SysWOW64\Eddodfhp.exe
Size 320KB
SHA256 980d5ae6287cbdce6a0133bbbe92f7ea56ba1a542f8c598be215db31fbd3e85f
MD5 e66c09561be965f157f7370923e65e8c
SHA1 c52cc11137f13f8954f3dc803dec85f8c1670773
SHA512 7d7cb97d9b7e732e89751473e352c99511b87e0cb1e9ab087a85a609d9f10b2f8b42451aa26f0978d08f37a9fb44ccce3e12a55c33f8ec9919278dce315f61c4
SSDEEP 3072:TdvcRST8ib3aGg7yOGOwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:1cgTTg7yTOV/Ah1G/AcQ///NR5fn
TLSH
T16664D9292A3849EACDFD1BB9AC0259D85141F8F014F1E17E6123DFDDD8E4DA3D819B82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ekngqqol.exe

Path C:\Windows\SysWOW64\Ekngqqol.exe
Size 320KB
SHA256 e7a3ce61ad1006b5cfbe5fcbc78e8ab47660cf0950a6337a6baf06b8520af564
MD5 4c1394f4c9f01b444222ab01d380bbe2
SHA1 ff9f5eba92513cdf92e7837aabb1ee20455218ac
SHA512 88aae3f9f48fa15443f89024048eaaeffb8a3e98a5a291105fccd8583e1e5a06cdf3313b9802f337387b9b76d953392349b9fb9416e4480336f3390defa374e7
SSDEEP 3072:wI5J/uG4/A4O+dSlD8ai/wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:w2f4/Aq0aaYV/Ah1G/AcQ///NR5fn
TLSH
T1BD641D1A2A3409EACEED1BB5AD0349D89141E8F014F1E17E7127DFDCD9E4DA6D809F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ekqcfpmj.exe

Path C:\Windows\SysWOW64\Ekqcfpmj.exe
Size 320KB
SHA256 de3eebc0a0c57f5f1fa76abfac9fba2b5bc814884e76ce923ab388a578f487fe
MD5 1b2fbe75b9b1b8a166020256728f0162
SHA1 d469853a62b958c8850f4d3e5c27fb7871df83e6
SHA512 fe92689a9c13a4c4ad1d177c3cbd18e894a5fdba6150a64e5aed74f2ca6d42202aab2d491a47d3288dc02a7ab9c9df20250dc9bb4cd24b147932638ff1bc58af
SSDEEP 6144:BHALE+G1TYXtP3Jja7gstfV/Ah1G/AcQ///NR5fn:BH8GiXH/Nv
TLSH
T1DE641D192A3409EADDED5BB9AC0269DC5141F4F014F1E23EA123DFEDE8E4DA2C855F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Elbmebbj.exe

Path C:\Windows\SysWOW64\Elbmebbj.exe
Size 320KB
SHA256 28e7103e86a7989e0089f2df91d1ea213991c5079e56775b466f78564110082e
MD5 b4f1e64af943b5280cd6f9180d2f2bd8
SHA1 ea466b2e136b3f0e9075d33d801f7be2e2d46038
SHA512 a2270be21d8deb48262f11735504ac56005262bcdb2f3c6d821d60e821e1d98fdc28d8fa040f3817ee6fceee96a17733e725e778f10bbd5293ead57a2370274a
SSDEEP 3072:UJLSwmaT52N8qqiEJIi6iwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:+SnxNSIi6iV/Ah1G/AcQ///NR5fn
TLSH
T18F64301A2A3089EACDFD1BB5AD1249D85145E6F014F1E13E6523DFDCC8E4EA2CC29F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ffbgog32.exe

Path C:\Windows\SysWOW64\Ffbgog32.exe
Size 320KB
SHA256 a573aad812b40f1d9de15b8abd9b350acf5e8bb5d42172558cd91560b92ea3f1
MD5 70a06ae2ad0cab7e0fc7967bd73bd3f7
SHA1 fd373c6be0114a3953701bbba9e1793b91daf81e
SHA512 2978fc0b02acb8f783e05e2c7dfa738db182b5da73838bfdec964ac28c7566d164018468537f0146ea77d864c97f8ebb83219e52ab106e057b362ab727a6859b
SSDEEP 3072:KJ2qSFD8FUykwapwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:KQqSd8FUMcV/Ah1G/AcQ///NR5fn
TLSH
T1A164411A263409EACDED2FB6EC125AD85185E8F014F1E53E6123DFDCC8E5DA2C825F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fffqjfom.exe

Path C:\Windows\SysWOW64\Fffqjfom.exe
Size 320KB
SHA256 937352a35cc5e38290747fff74ad6f44c20f306b7d30bccec81d81377e72b08a
MD5 731604323705cdf1f861f1c5d66cf547
SHA1 d86d02111dea82c38f6fd8a0a6d3187093b79abe
SHA512 b6d70f937dc42a8905d67eb288564cff6cc14679dd3d4189aee21e4a154d7bb83b8b39617a5ab0a991a9dc636eee99c6d3428435f0ae91dc2845a03f13b214e2
SSDEEP 3072:Nc3ilclJodKjwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:rKjV/Ah1G/AcQ///NR5fn
TLSH
T1E96441192A3409EACDEE2FB5AC1249D89141E9F014F1E23EA523DFDCD8E4DA6C855FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fklcbocl.exe

Path C:\Windows\SysWOW64\Fklcbocl.exe
Size 320KB
SHA256 e402d012688ea6682d4afdb1c6ea6d2522594e4083cc4967755418a40815baca
MD5 5ec86b50f0f1e0a826c818ea28b48042
SHA1 2c8338051e8a2608c0fe55de260c8a6455ee8631
SHA512 c78cc02879dae19961036e0b89f9ca96eb75192ecc27dffddd1b1a554bc14c8f28fd4213d2c9ea40a7b683cf42494bc52ef665323e124e6ad86d23a5ee9eb5f5
SSDEEP 3072:Cif5ykwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:vxykV/Ah1G/AcQ///NR5fn
TLSH
T19964401A263159EACEED2BB5AC0249DC5141E8F014F0E13E6127EFDCD9E4DA2E859FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Foebmn32.exe

Path C:\Windows\SysWOW64\Foebmn32.exe
Size 320KB
SHA256 55a6585845f7db4f44b9f14dc83e05346109f76c00000d2e4f14f0548108ec52
MD5 e2da28bede15a1d5b297c16788bac741
SHA1 f535a959d0d00440b3f19254df813ff50a4a0a7f
SHA512 a3ac1644e1bbe8944f20517a9eb50e1b5bde9ef240b3f58a197e9f3a90e5c5a47abbb07064c7a0194f622ac7f742fbb9f2c29a880192907e2385fbc6dac39ef6
SSDEEP 3072:jYXV6nQpTiJFhwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:jYXwyQFhV/Ah1G/AcQ///NR5fn
TLSH
T1DF643E1A2AB409EACEED1BB6EC1349D85181E8F015F1E13E6123DFDDD8E4DA2C815F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fomhnmgp.exe

Path C:\Windows\SysWOW64\Fomhnmgp.exe
Size 320KB
SHA256 79924564c2f10d726b553c41646713e39558e3fbd12882f80f4d4f7356d1907e
MD5 48fe7e58da4450e55d2ac30127366f42
SHA1 5716bb741f0f7bb91c0d50952db5e578a672b647
SHA512 a1b2515f27f8b629332620b126a2fb4f50d98f59163146b836fd6d787b673626d5a6344dcbc42990fa8ca0950d5af5e2087cb59d872b9c70ba5aee43f185f643
SSDEEP 3072:c5K6ubgLalqwZkLwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:bRgJwaLV/Ah1G/AcQ///NR5fn
TLSH
T14C64305A263019EACDED1FF5AC0249D8A585E9F014F1E13E6523DFDCD9E4EA6C808F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pengna32.exe

Path C:\Windows\SysWOW64\Pengna32.exe
Size 320KB
SHA256 d91ca82a10e20f5079714642f4e1d0ba9fb63c82aca31ea5fae1bd4556b1cafc
MD5 c46ba7fd026d7c3530b051c4ea3292e7
SHA1 ec99ed949d632569b6bd15ba8222ba37fecd887a
SHA512 4158951853a54c4883d72b0d10300c457ae09c0563723f9d13d9409c776f45a6984a4abdf9c2579b7880c2cb372fb0867444f98f879cfe1946365afb44927f11
SSDEEP 3072:h3UYDbvjhIKuo82OwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:2UrdgH2OV/Ah1G/AcQ///NR5fn
TLSH
T19264EB992A3409EACEED1BB5EC2249D95181E9F014F1E13E6123EFDCD8F4DA6C815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qaegcb32.exe

Path C:\Windows\SysWOW64\Qaegcb32.exe
Size 320KB
SHA256 75de0a453856756e6b4b4e9ff04e2776a176480e0b47443c91cb1b219d5f2cc5
MD5 b5e03862ecff26099428e658c9655b9d
SHA1 44aa6582ed9f12a726f631229c80dfaf9723de36
SHA512 d3718a84a15641887c907e85bf323b10d45e629b2cdb66953f1653193d032862e8c2fe64084c4bba48cbde56b55aed69b9c7a7a361e513394c1576318d5b37ea
SSDEEP 6144:Czebz/F7Pj+CUG8V/Ah1G/AcQ///NR5fn:Cx8/Nv
TLSH
T197644119263449EADEED2FB5AE0259D89181E8F055F1E13E6223DFDDC8F5DA6C804F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qgalelin.exe

Path C:\Windows\SysWOW64\Qgalelin.exe
Size 320KB
SHA256 500d5d17adba175b011e77d2e4a1cf25d9809c0cf850e6c48eed5c8ac323fc88
MD5 b422d2b9c01666cef3a781d89b3552ae
SHA1 c28feaf380188b79041cafd69d4accc3baebd6b8
SHA512 795b8ba29c6772dd290bb78fcb8c67ec8562fc2ba8130426e75087e978b945fb21c043bb8246ff74018404f8c68cb745c2691a1cf156c4954c06e9e4f9531947
SSDEEP 3072:vvCV+xdr2rXCC6wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:vgqC6V/Ah1G/AcQ///NR5fn
TLSH
T1F564211516304DFAEEEE1BB5AC1289E89145E9F004F1E13E6123DFDDD8E9E62C815F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qjmllgjd.exe

Path C:\Windows\SysWOW64\Qjmllgjd.exe
Size 320KB
SHA256 ba354cc4126a27d61a4afe3bfc1bfa097625da7475043da9315fd740ca2f4a61
MD5 94f1aafa084eced88f5342ae3a1f86b4
SHA1 594598ec7054dc3d2c613aea337e5df2035fd510
SHA512 6ed62498df559987f1505cbf66ae8a3487385f1841d33f833f1fb68cb5e8073c4ccd359d59845dc7187f20134c004bc880480c4fc3c5c56be8981b1d4000188a
SSDEEP 3072:gf7shlXdHIH334aOkPihgUuG1gYwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:goNHIHhKT1gYV/Ah1G/AcQ///NR5fn
TLSH
T133641E1A2A700DEACEED2BB5AC1249D89141E9F414F1E13E6123DFDCD8E4DE6D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/720-133-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/800-405-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/836-418-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/916-169-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/944-203-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1100-66-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1144-295-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1212-435-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1288-502-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1300-335-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1304-175-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1312-84-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1436-148-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1440-197-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1964-395-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1976-440-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2040-507-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2040-49-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2072-218-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2132-489-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2132-28-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2192-478-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2244-290-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2352-21-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2352-483-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2400-126-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2420-154-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2444-240-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2452-141-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2460-450-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2560-315-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2672-70-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2772-350-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2784-355-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2804-430-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2848-285-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2884-471-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2884-7-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2920-425-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2928-370-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2956-265-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3176-380-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3180-472-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3208-385-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3276-325-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3324-245-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3664-455-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3804-400-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3816-345-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3844-490-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3940-360-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3948-275-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4240-182-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4420-189-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4440-250-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4508-280-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4556-112-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4580-305-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4656-92-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4676-365-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4748-235-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4796-390-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4872-445-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4876-77-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5020-496-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5044-162-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5092-501-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5092-42-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5108-260-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5172-300-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5248-56-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5388-343-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5424-466-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5428-310-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5556-330-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5568-420-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5648-273-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5680-255-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5684-233-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5700-14-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5700-477-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5704-35-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5704-495-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5716-484-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5728-224-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5732-460-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5732-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5732-2-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/5784-120-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5796-410-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5820-320-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5912-375-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5928-210-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5992-461-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6004-105-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6056-98-0x0000000000400000-0x000000000046D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads