berbew | 8f6a8c90c6ba8c96fb6a015f2d67b8f30991aeb7668a794de48bb5cca8711efd

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 20:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_1c0aac91a9808d069e7d3293ddcdd31c_elex_wannacry.exe
Size 320KB
Sample260810-zmp9psyapc
SHA256 8f6a8c90c6ba8c96fb6a015f2d67b8f30991aeb7668a794de48bb5cca8711efd
MD5 1c0aac91a9808d069e7d3293ddcdd31c
SHA1 b5e4278cc8790f2c95913ff6fecf29591656f746
SHA512 1087501a7705507f27b33027ba20345ce444ff208f13eb94a58cc8c0468ac348cadaee0a5670b25be7d70aeda38fd0a124359fccd1ea0057546b8e3e15175870
SSDEEP 3072:dY56nRE59GL64NTwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:dqIWzOTV/Ah1G/AcQ///NR5fn
TLSH
T1DD64401A267009EACEED1FB5EC1249D89181E9F414F5E13E6127EFDCD8E4DA2E805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oihmedma.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqoefand.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oflmnh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcpnhl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjaleemj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pakdbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Opbean32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ppdbgncl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcbkml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oifppdpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcbkml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pafkgphl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oophlo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ppgomnai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjaleemj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pblajhje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjcikejg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Obnehj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Omdieb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pbcncibp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ppgomnai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfepdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmphaaln.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pakdbp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oophlo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oikjkc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfepdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojhiogdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmkofa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmphaaln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjcikejg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjjfdfbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Paihlpfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcgdhkem.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pciqnk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pblajhje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqmhqapg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oihmedma.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbcncibp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfagighf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Paihlpfi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	2026-08-10_1c0aac91a9808d069e7d3293ddcdd31c_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	2026-08-10_1c0aac91a9808d069e7d3293ddcdd31c_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Obnehj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcpnhl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjlcjf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjoppf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oflmnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oikjkc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ppdbgncl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjjfdfbb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcegclgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pciqnk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oifppdpd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Omdieb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oqoefand.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pimfpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfccogfc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Obqanjdb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqbala32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pimfpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjlcjf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pafkgphl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfccogfc.exe

Executes dropped EXE 40 IoCs

pid	Process
2216	Oifppdpd.exe
5020	Oqmhqapg.exe
3884	Oophlo32.exe
3212	Obnehj32.exe
4940	Ofjqihnn.exe
4928	Oihmedma.exe
1124	Omdieb32.exe
2272	Oqoefand.exe
2008	Opbean32.exe
960	Obqanjdb.exe
4548	Oflmnh32.exe
4068	Ojhiogdd.exe
1772	Oikjkc32.exe
1544	Pqbala32.exe
4200	Ppdbgncl.exe
4188	Pcpnhl32.exe
4836	Pbcncibp.exe
3248	Pjjfdfbb.exe
2908	Pimfpc32.exe
4876	Pmhbqbae.exe
4792	Ppgomnai.exe
4256	Pcbkml32.exe
3224	Pfagighf.exe
2532	Pjlcjf32.exe
2304	Pmkofa32.exe
3964	Pafkgphl.exe
3032	Pcegclgp.exe
4480	Pfccogfc.exe
2748	Pjoppf32.exe
3060	Pmmlla32.exe
4780	Paihlpfi.exe
2424	Pcgdhkem.exe
3204	Pfepdg32.exe
2352	Pjaleemj.exe
3192	Pmphaaln.exe
1084	Pakdbp32.exe
2816	Pciqnk32.exe
4652	Pblajhje.exe
4916	Pjcikejg.exe
1588	Pififb32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Pcegclgp.exe	Pafkgphl.exe
File created	C:\Windows\SysWOW64\Ebdpoomj.dll	Oophlo32.exe
File created	C:\Windows\SysWOW64\Omdieb32.exe	Oihmedma.exe
File created	C:\Windows\SysWOW64\Ljgmjm32.dll	Opbean32.exe
File created	C:\Windows\SysWOW64\Pcpnhl32.exe	Ppdbgncl.exe
File opened for modification	C:\Windows\SysWOW64\Pafkgphl.exe	Pmkofa32.exe
File opened for modification	C:\Windows\SysWOW64\Oqmhqapg.exe	Oifppdpd.exe
File created	C:\Windows\SysWOW64\Deaiemli.dll	Pmphaaln.exe
File created	C:\Windows\SysWOW64\Bmgjnl32.dll	Pcpnhl32.exe
File created	C:\Windows\SysWOW64\Pencqe32.dll	Paihlpfi.exe
File opened for modification	C:\Windows\SysWOW64\Pjaleemj.exe	Pfepdg32.exe
File created	C:\Windows\SysWOW64\Oifppdpd.exe	2026-08-10_1c0aac91a9808d069e7d3293ddcdd31c_elex_wannacry.exe
File created	C:\Windows\SysWOW64\Onnnbnbp.dll	Pafkgphl.exe
File created	C:\Windows\SysWOW64\Dhlbgmif.dll	Pfepdg32.exe
File opened for modification	C:\Windows\SysWOW64\Oophlo32.exe	Oqmhqapg.exe
File created	C:\Windows\SysWOW64\Nhoped32.dll	Pmhbqbae.exe
File opened for modification	C:\Windows\SysWOW64\Pciqnk32.exe	Pakdbp32.exe
File created	C:\Windows\SysWOW64\Fljhbbae.dll	Omdieb32.exe
File created	C:\Windows\SysWOW64\Aeodmbol.dll	Pblajhje.exe
File created	C:\Windows\SysWOW64\Gaaklfpn.dll	Pjcikejg.exe
File opened for modification	C:\Windows\SysWOW64\Omdieb32.exe	Oihmedma.exe
File created	C:\Windows\SysWOW64\Pnkibcle.dll	Pjjfdfbb.exe
File created	C:\Windows\SysWOW64\Fknofqcc.dll	Pmkofa32.exe
File opened for modification	C:\Windows\SysWOW64\Paihlpfi.exe	Pmmlla32.exe
File opened for modification	C:\Windows\SysWOW64\Pfepdg32.exe	Pcgdhkem.exe
File opened for modification	C:\Windows\SysWOW64\Ofjqihnn.exe	Obnehj32.exe
File created	C:\Windows\SysWOW64\Opbean32.exe	Oqoefand.exe
File opened for modification	C:\Windows\SysWOW64\Ppdbgncl.exe	Pqbala32.exe
File opened for modification	C:\Windows\SysWOW64\Pbcncibp.exe	Pcpnhl32.exe
File created	C:\Windows\SysWOW64\Pfagighf.exe	Pcbkml32.exe
File created	C:\Windows\SysWOW64\Pjoppf32.exe	Pfccogfc.exe
File created	C:\Windows\SysWOW64\Cohddjgl.dll	Pfccogfc.exe
File created	C:\Windows\SysWOW64\Lodabb32.dll	Oqmhqapg.exe
File opened for modification	C:\Windows\SysWOW64\Opbean32.exe	Oqoefand.exe
File created	C:\Windows\SysWOW64\Ppgomnai.exe	Pmhbqbae.exe
File opened for modification	C:\Windows\SysWOW64\Pfccogfc.exe	Pcegclgp.exe
File created	C:\Windows\SysWOW64\Pmphaaln.exe	Pjaleemj.exe
File created	C:\Windows\SysWOW64\Mpiedk32.dll	Pciqnk32.exe
File created	C:\Windows\SysWOW64\Pfgbakef.dll	Pjoppf32.exe
File created	C:\Windows\SysWOW64\Pfepdg32.exe	Pcgdhkem.exe
File opened for modification	C:\Windows\SysWOW64\Pjjfdfbb.exe	Pbcncibp.exe
File created	C:\Windows\SysWOW64\Gflonn32.dll	Oihmedma.exe
File created	C:\Windows\SysWOW64\Oqoefand.exe	Omdieb32.exe
File created	C:\Windows\SysWOW64\Icbcjhfb.dll	Obqanjdb.exe
File created	C:\Windows\SysWOW64\Pqbala32.exe	Oikjkc32.exe
File opened for modification	C:\Windows\SysWOW64\Pqbala32.exe	Oikjkc32.exe
File created	C:\Windows\SysWOW64\Pjjfdfbb.exe	Pbcncibp.exe
File opened for modification	C:\Windows\SysWOW64\Pjoppf32.exe	Pfccogfc.exe
File created	C:\Windows\SysWOW64\Gcilohid.dll	Pakdbp32.exe
File created	C:\Windows\SysWOW64\Agolng32.dll	Oifppdpd.exe
File created	C:\Windows\SysWOW64\Pmmlla32.exe	Pjoppf32.exe
File opened for modification	C:\Windows\SysWOW64\Pjcikejg.exe	Pblajhje.exe
File created	C:\Windows\SysWOW64\Ofjqihnn.exe	Obnehj32.exe
File created	C:\Windows\SysWOW64\Hpoejj32.dll	Ofjqihnn.exe
File opened for modification	C:\Windows\SysWOW64\Obqanjdb.exe	Opbean32.exe
File created	C:\Windows\SysWOW64\Pafkgphl.exe	Pmkofa32.exe
File created	C:\Windows\SysWOW64\Mpagaf32.dll	Pmmlla32.exe
File created	C:\Windows\SysWOW64\Pciqnk32.exe	Pakdbp32.exe
File created	C:\Windows\SysWOW64\Pmkofa32.exe	Pjlcjf32.exe
File created	C:\Windows\SysWOW64\Oqmhqapg.exe	Oifppdpd.exe
File created	C:\Windows\SysWOW64\Obnehj32.exe	Oophlo32.exe
File created	C:\Windows\SysWOW64\Oihmedma.exe	Ofjqihnn.exe
File created	C:\Windows\SysWOW64\Pakdbp32.exe	Pmphaaln.exe
File created	C:\Windows\SysWOW64\Nffaen32.dll	Pcbkml32.exe

Program crash 1 IoCs

pid	pid_target	Process
1560	1588	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oflmnh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pafkgphl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcgdhkem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pakdbp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_1c0aac91a9808d069e7d3293ddcdd31c_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oifppdpd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofjqihnn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojhiogdd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqmhqapg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Omdieb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oikjkc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcpnhl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjjfdfbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcbkml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmkofa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcegclgp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oophlo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmhbqbae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfagighf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjaleemj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pififb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqoefand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Obqanjdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjoppf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmmlla32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfepdg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmphaaln.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjcikejg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Obnehj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oihmedma.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opbean32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppdbgncl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pbcncibp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pimfpc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjlcjf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Paihlpfi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqbala32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppgomnai.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfccogfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pciqnk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pblajhje.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Obqanjdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhnoigkk.dll"	Ojhiogdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ojhiogdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjcikejg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agolng32.dll"	Oifppdpd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pjjfdfbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Deaiemli.dll"	Pmphaaln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nohjfifo.dll"	Pcgdhkem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mpagaf32.dll"	Pmmlla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fljhbbae.dll"	Omdieb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oqoefand.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oqmhqapg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pcbkml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjoppf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ppdbgncl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pcpnhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oqmhqapg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfgbakef.dll"	Pjoppf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljgmjm32.dll"	Opbean32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qckcba32.dll"	Ppdbgncl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pfagighf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pmkofa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pfepdg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oikjkc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pakdbp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oophlo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebdpoomj.dll"	Oophlo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pqbala32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pblajhje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dhlbgmif.dll"	Pfepdg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	2026-08-10_1c0aac91a9808d069e7d3293ddcdd31c_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpoejj32.dll"	Ofjqihnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pqbala32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pfccogfc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmmlla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmgjnl32.dll"	Pcpnhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pafkgphl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cohddjgl.dll"	Pfccogfc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ojhiogdd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	2026-08-10_1c0aac91a9808d069e7d3293ddcdd31c_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oqoefand.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnkibcle.dll"	Pjjfdfbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oajgdm32.dll"	Pjlcjf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pjoppf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pmmlla32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pblajhje.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oihmedma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpqgeihg.dll"	Pfagighf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcilohid.dll"	Pakdbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kqkplq32.dll"	Pbcncibp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmhbqbae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlmadjhb.dll"	Pjaleemj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gflonn32.dll"	Oihmedma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Opbean32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pbcncibp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmkofa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pcgdhkem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Omdieb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klhhpb32.dll"	Obnehj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpkdfd32.dll"	Oikjkc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pfepdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pciqnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oifppdpd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pbcncibp.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 716 wrote to memory of 2216	716	2026-08-10_1c0aac91a9808d069e7d3293ddcdd31c_elex_wannacry.exe	85
PID 2216 wrote to memory of 5020	2216	Oifppdpd.exe	86
PID 5020 wrote to memory of 3884	5020	Oqmhqapg.exe	87
PID 3884 wrote to memory of 3212	3884	Oophlo32.exe	88
PID 3212 wrote to memory of 4940	3212	Obnehj32.exe	89
PID 4940 wrote to memory of 4928	4940	Ofjqihnn.exe	90
PID 4928 wrote to memory of 1124	4928	Oihmedma.exe	91
PID 1124 wrote to memory of 2272	1124	Omdieb32.exe	92
PID 2272 wrote to memory of 2008	2272	Oqoefand.exe	93
PID 2008 wrote to memory of 960	2008	Opbean32.exe	94
PID 960 wrote to memory of 4548	960	Obqanjdb.exe	95
PID 4548 wrote to memory of 4068	4548	Oflmnh32.exe	96
PID 4068 wrote to memory of 1772	4068	Ojhiogdd.exe	97
PID 1772 wrote to memory of 1544	1772	Oikjkc32.exe	98
PID 1544 wrote to memory of 4200	1544	Pqbala32.exe	99
PID 4200 wrote to memory of 4188	4200	Ppdbgncl.exe	100
PID 4188 wrote to memory of 4836	4188	Pcpnhl32.exe	101
PID 4836 wrote to memory of 3248	4836	Pbcncibp.exe	102
PID 3248 wrote to memory of 2908	3248	Pjjfdfbb.exe	103
PID 2908 wrote to memory of 4876	2908	Pimfpc32.exe	104
PID 4876 wrote to memory of 4792	4876	Pmhbqbae.exe	105
PID 4792 wrote to memory of 4256	4792	Ppgomnai.exe	106
PID 4256 wrote to memory of 3224	4256	Pcbkml32.exe	107
PID 3224 wrote to memory of 2532	3224	Pfagighf.exe	108
PID 2532 wrote to memory of 2304	2532	Pjlcjf32.exe	109
PID 2304 wrote to memory of 3964	2304	Pmkofa32.exe	110
PID 3964 wrote to memory of 3032	3964	Pafkgphl.exe	111
PID 3032 wrote to memory of 4480	3032	Pcegclgp.exe	112
PID 4480 wrote to memory of 2748	4480	Pfccogfc.exe	113
PID 2748 wrote to memory of 3060	2748	Pjoppf32.exe	114
PID 3060 wrote to memory of 4780	3060	Pmmlla32.exe	115
PID 4780 wrote to memory of 2424	4780	Paihlpfi.exe	116
PID 2424 wrote to memory of 3204	2424	Pcgdhkem.exe	117
PID 3204 wrote to memory of 2352	3204	Pfepdg32.exe	118
PID 2352 wrote to memory of 3192	2352	Pjaleemj.exe	119
PID 3192 wrote to memory of 1084	3192	Pmphaaln.exe	120
PID 1084 wrote to memory of 2816	1084	Pakdbp32.exe	121
PID 2816 wrote to memory of 4652	2816	Pciqnk32.exe	122
PID 4652 wrote to memory of 4916	4652	Pblajhje.exe	123
PID 4916 wrote to memory of 1588	4916	Pjcikejg.exe	124

C:\Users\Admin\AppData\Local\Temp\2026-08-10_1c0aac91a9808d069e7d3293ddcdd31c_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_1c0aac91a9808d069e7d3293ddcdd31c_elex_wannacry.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:716
- C:\Windows\SysWOW64\Oifppdpd.exe
  C:\Windows\system32\Oifppdpd.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Windows\SysWOW64\Oqmhqapg.exe
    C:\Windows\system32\Oqmhqapg.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:5020
  - - C:\Windows\SysWOW64\Oophlo32.exe
      C:\Windows\system32\Oophlo32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3884
    - - C:\Windows\SysWOW64\Obnehj32.exe
        
        C:\Windows\system32\Obnehj32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3212
      - C:\Windows\SysWOW64\Ofjqihnn.exe
        
        C:\Windows\system32\Ofjqihnn.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4940
        
        C:\Windows\SysWOW64\Oihmedma.exe
        
        C:\Windows\system32\Oihmedma.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4928
        
        C:\Windows\SysWOW64\Omdieb32.exe
        
        C:\Windows\system32\Omdieb32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1124
        
        C:\Windows\SysWOW64\Oqoefand.exe
        
        C:\Windows\system32\Oqoefand.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2272
        
        C:\Windows\SysWOW64\Opbean32.exe
        
        C:\Windows\system32\Opbean32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2008
        
        C:\Windows\SysWOW64\Obqanjdb.exe
        
        C:\Windows\system32\Obqanjdb.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:960
        
        C:\Windows\SysWOW64\Oflmnh32.exe
        
        C:\Windows\system32\Oflmnh32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4548
        
        C:\Windows\SysWOW64\Ojhiogdd.exe
        
        C:\Windows\system32\Ojhiogdd.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4068
        
        C:\Windows\SysWOW64\Oikjkc32.exe
        
        C:\Windows\system32\Oikjkc32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1772
        
        C:\Windows\SysWOW64\Pqbala32.exe
        
        C:\Windows\system32\Pqbala32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1544
        
        C:\Windows\SysWOW64\Ppdbgncl.exe
        
        C:\Windows\system32\Ppdbgncl.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4200
        
        C:\Windows\SysWOW64\Pcpnhl32.exe
        
        C:\Windows\system32\Pcpnhl32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4188
        
        C:\Windows\SysWOW64\Pbcncibp.exe
        
        C:\Windows\system32\Pbcncibp.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4836
        
        C:\Windows\SysWOW64\Pjjfdfbb.exe
        
        C:\Windows\system32\Pjjfdfbb.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3248
        
        C:\Windows\SysWOW64\Pimfpc32.exe
        
        C:\Windows\system32\Pimfpc32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2908
        
        C:\Windows\SysWOW64\Pmhbqbae.exe
        
        C:\Windows\system32\Pmhbqbae.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4876
        
        C:\Windows\SysWOW64\Ppgomnai.exe
        
        C:\Windows\system32\Ppgomnai.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4792
        
        C:\Windows\SysWOW64\Pcbkml32.exe
        
        C:\Windows\system32\Pcbkml32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4256
        
        C:\Windows\SysWOW64\Pfagighf.exe
        
        C:\Windows\system32\Pfagighf.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3224
        
        C:\Windows\SysWOW64\Pjlcjf32.exe
        
        C:\Windows\system32\Pjlcjf32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2532
        
        C:\Windows\SysWOW64\Pmkofa32.exe
        
        C:\Windows\system32\Pmkofa32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2304
        
        C:\Windows\SysWOW64\Pafkgphl.exe
        
        C:\Windows\system32\Pafkgphl.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3964
        
        C:\Windows\SysWOW64\Pcegclgp.exe
        
        C:\Windows\system32\Pcegclgp.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3032
        
        C:\Windows\SysWOW64\Pfccogfc.exe
        
        C:\Windows\system32\Pfccogfc.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4480
        
        C:\Windows\SysWOW64\Pjoppf32.exe
        
        C:\Windows\system32\Pjoppf32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2748
        
        C:\Windows\SysWOW64\Pmmlla32.exe
        
        C:\Windows\system32\Pmmlla32.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3060
        
        C:\Windows\SysWOW64\Paihlpfi.exe
        
        C:\Windows\system32\Paihlpfi.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4780
        
        C:\Windows\SysWOW64\Pcgdhkem.exe
        
        C:\Windows\system32\Pcgdhkem.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2424
        
        C:\Windows\SysWOW64\Pfepdg32.exe
        
        C:\Windows\system32\Pfepdg32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3204
        
        C:\Windows\SysWOW64\Pjaleemj.exe
        
        C:\Windows\system32\Pjaleemj.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2352
        
        C:\Windows\SysWOW64\Pmphaaln.exe
        
        C:\Windows\system32\Pmphaaln.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3192
        
        C:\Windows\SysWOW64\Pakdbp32.exe
        
        C:\Windows\system32\Pakdbp32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1084
        
        C:\Windows\SysWOW64\Pciqnk32.exe
        
        C:\Windows\system32\Pciqnk32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2816
        
        C:\Windows\SysWOW64\Pblajhje.exe
        
        C:\Windows\system32\Pblajhje.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4652
        
        C:\Windows\SysWOW64\Pjcikejg.exe
        
        C:\Windows\system32\Pjcikejg.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4916
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        41⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1588
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 400
        42⤵
        Program crash
        
        PID:1560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1588 -ip 1588
1⤵
PID:1796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Obnehj32.exe

Path C:\Windows\SysWOW64\Obnehj32.exe
Size 320KB
SHA256 9c7c453eab4a59ad7d7fd9361780765402ec931c22f97b100ba91222c4ce699c
MD5 d1a2fefe22c0e45d117e12fb864cc984
SHA1 8e71ce9a7fbe97a45ff48bf1022c75a68df49bad
SHA512 ab739dc4fa7f9147c2507d53bc7d38e17e442688b19cd8ef9c9942db4d360068cadd6c7636aaf224d44b0c158b012c6f6b955a3718a40343a336696367623de2
SSDEEP 3072:76L7cpAu5OfZwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:7KgAjZV/Ah1G/AcQ///NR5fn
TLSH
T105642F192A3409EACEED1BB5AC025ED89541E9F118F1E13E6523DFECD8F4D62D884F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Obqanjdb.exe

Path C:\Windows\SysWOW64\Obqanjdb.exe
Size 320KB
SHA256 ed7ef7a1e731c5f2c993cb41be08c953859f472b82fab44368426210239f0b28
MD5 67d97582778acb6cf080eb66dc09d814
SHA1 eb28167b7ef76337e1e9f6976c91a1b03b1955ba
SHA512 8f60d5d5f93124c701e27c82b82b76ce5a77666a2738e18f87502f07021642a032f3f3f2968942996dfa4cff9b8c022e70d23737f2d6abad4b7ac7d8e7189f3e
SSDEEP 3072:xGaIKT8S2elHRG4BwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:xGaHTjplxfBV/Ah1G/AcQ///NR5fn
TLSH
T1286442192A3409EACEED1FB6AD124AD89141E8F015F1E63E5123DFDCDCE4EA2D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ofjqihnn.exe

Path C:\Windows\SysWOW64\Ofjqihnn.exe
Size 320KB
SHA256 7995b082c43e64af5d106734583f6f001c78eba57593d8bdfdf6e9201828d56b
MD5 1ff8815bed27e3378e90d6a9d6018fbb
SHA1 dae58a68c65dce92ef0c0b25a635e8b2e2ea2a05
SHA512 928c3675cdf1d5e45081df1f9f4ca4dc48632e10f79ff65022227270eee274119726076ded1715385e77e3dfd580c44c06cc5896106f5fa89626544b5a1458aa
SSDEEP 6144:MN4U34UneJY0V/zV/Ah1G/AcQ///NR5fn:MN4U7neJY0Vi/Nv
TLSH
T1EB64FC19263409EACEED1BB6AC1259D89191E9F414F1E13E7133DFDCD8E8DA2C816F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Oflmnh32.exe

Path C:\Windows\SysWOW64\Oflmnh32.exe
Size 320KB
SHA256 f9715aa96b191b85cfe6829c79684a3b60293d0c549d88bbafac739eb5f7b44a
MD5 5fa829366e6fc47cade6aa3eacc59632
SHA1 4f004fe037fb664890c6a405d31c296dcfe2d061
SHA512 cfaae7950576bc9891034db0d96dbfdfd40591767f3139dda029d2beb82ba5702a31ab34394bd0fbc2d52810af7483068384a8d519c7f2787d6d7c39a4b1e633
SSDEEP 3072:wEnkzoFi//B+eJH9WwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:LsP00WV/Ah1G/AcQ///NR5fn
TLSH
T1F4641F1B667409EACEED1BB5AD0249D89151E8F118F1E53E6223DFECDCE4DA2C805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Oifppdpd.exe

Path C:\Windows\SysWOW64\Oifppdpd.exe
Size 320KB
SHA256 9cdc805b78599763f362b4dcf4a1063d5d094d67448c3ef5ef380b87a0d6656f
MD5 8cb94465ca37eddd122bbb7ce8c342f7
SHA1 6c3a620df840a86d89954c68887ec555354f96ab
SHA512 113c72c693827c4de863cb8055f21b400bb4d7ae8a996e006559c419ca6d8f17d2029c9f7432028971038b8c6fe5276126c5ac9ccd80991644c127aca723f2db
SSDEEP 3072:d+BJFfhuFq+h9lkW+wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:d+Rfh8+W+V/Ah1G/AcQ///NR5fn
TLSH
T1F1644219263409EACDEE1BB5AC1249D89141F8F114F5E13E7123DFDCD8E9EA2D819F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Oihmedma.exe

Path C:\Windows\SysWOW64\Oihmedma.exe
Size 320KB
SHA256 e0e7d1ff9768e54df24b35d5cbb33699c1435ca4ae18075d0ca372f72e14e4c0
MD5 097661b682f61ff0178bf5e61a0c4a7d
SHA1 b0d129ef14eff103770dbfe4b3272ae312190e1a
SHA512 8d70292d716b38b155c9bf634333999dd4de58fd6eb4438c267a0d3253d9fc6fa993c0e713cb8276773157f08f94e5fe51a48e5b8006a753b9cf6918c1b97977
SSDEEP 3072:Rt4mQxeuI4RbwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:34r84RbV/Ah1G/AcQ///NR5fn
TLSH
T1BE640D5A263409EACEED1FB5BC1249D95141E9F014F1E23E6123DFECD8E4DA2E819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Oikjkc32.exe

Path C:\Windows\SysWOW64\Oikjkc32.exe
Size 320KB
SHA256 1d3f59de41ffced05286b8a1dfae8d4372393a57d3e9a3adde73315035be17ae
MD5 5bc51bc3f5579a56171f34b843d10612
SHA1 f63ae50c4367dd42ff578cfecdfa3a05b418ef84
SHA512 44ef2370c0dc34e4bcb5edd6d6e412ff099c346d6b54b2087984014ff17ee2c282133528d0d16e416e3467cdd07a82cbb58bb4972115d84fe7bf5d11fb66a015
SSDEEP 3072:WHVMySsD8wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:WHVMySO8V/Ah1G/AcQ///NR5fn
TLSH
T1926430591A380DEACDED1BB6AC0249D89541E9F115F1E23E6163DFDCD8E8EA2DC04F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ojhiogdd.exe

Path C:\Windows\SysWOW64\Ojhiogdd.exe
Size 320KB
SHA256 173c5b8b17521132f272565e9c6e21e8720f5b57ae033afa903f9a33dd39af48
MD5 dbf2aae3fd4669a58d44255e792ce487
SHA1 88847ce3511e573fb96a1808c92228d75aff700d
SHA512 ab3275a0740606ad16ceca254b902b9876a5f02a5be57684a8e4f136f84f2c85b350be531d25c29c50b2adb8625af0395cf1aaa572396adcbc819b4869e79375
SSDEEP 3072:x529IjQ7ZKolEwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:x5jjQ7ZbEV/Ah1G/AcQ///NR5fn
TLSH
T10964EB192A3009EACDED6BB5AC1249D85182E9F014F1E13E6123EFDDD8F4DB6D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Omdieb32.exe

Path C:\Windows\SysWOW64\Omdieb32.exe
Size 320KB
SHA256 f5efff9ce4c55070be30ab94a41a9c0ebd34a0a94885e5d6f23457cb7500bd05
MD5 d057ad360c01bf9cd8441d5968b19fc7
SHA1 55e35aed02c73664daa6e130e22682fec3198fe1
SHA512 7d004a26396b31d3e71d423356d128b6452c30d3604057f32a7c03b07a930cff9a276734ed80ea82813942164394f7f453bd425174d174d8c521158fa4bb744b
SSDEEP 3072:3B3/QQAZTy5NSwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:RvPNSV/Ah1G/AcQ///NR5fn
TLSH
T1E0644019263409EACEED1FB6AD2249DC9181E8F014F5E13E6123DFDCC8E4DA2D859F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Oophlo32.exe

Path C:\Windows\SysWOW64\Oophlo32.exe
Size 320KB
SHA256 8b1094ac4cbd77795039e4045af25fb6c14fd57e7eeb377ff2c5de747eb9866b
MD5 e12a53f2abf2285efa86915a1d58d5af
SHA1 d44de02868a1fbafe249d93d939b597eba458ed6
SHA512 8ebd17c5ae8da90c1ae1c1127ee442829909ecba1ce0b4e35aaee845b09ea973a30a83c137ea0c8a73f9e3cd0de52d8e0f7d24604b2554bbbb501a6fc3f9af07
SSDEEP 3072:Y0VDo1GlGUwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Y0xoDUV/Ah1G/AcQ///NR5fn
TLSH
T1D7642F192A7409EACEED5BB5AC025AE85141E9F014F1E13E6123DFDDC8F4DA6CC19F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Opbean32.exe

Path C:\Windows\SysWOW64\Opbean32.exe
Size 320KB
SHA256 53226b558eef5b49e127a77f1943914db3ac035a15ba3af3eda35d2ae481fa22
MD5 111023ab458e7ded109128ee39255d4e
SHA1 9bbb29d17f9474748fa6e0d7ecd93778e15b38a9
SHA512 d5156a95310086e01b41d1c7e68d816093d3e028e4579cffe4b1a5d4ae3c0898bb0ea8c9f4694ff9c834fe5651e259408525c554d4eaef59212c272a0270c7b5
SSDEEP 3072:4xHyObIjhU1QFwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:4wyIjh/FV/Ah1G/AcQ///NR5fn
TLSH
T1136443192A3009EACDED9FB6AC1259D85141F9F014F2E13E6523DFDCD8E4EA2C859F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Oqmhqapg.exe

Path C:\Windows\SysWOW64\Oqmhqapg.exe
Size 320KB
SHA256 393261487a30bfe3e9d13e78e2c59fd12855e42fc9922c3a4cac7dabfec214af
MD5 21a5be64409e183992dfc25083c72318
SHA1 ebcaa555caa617726621eba2855de800a696e24c
SHA512 316e4b6a46a5066a4e1620dbcbc6506d390113616aad291ef4c79c9ed7c49943b771dc66203f3047c6fa57da6db90395b2ba3ff899ec8d9f551a106fa246e7c5
SSDEEP 6144:eC+c1O4ddk/BH5FWbV/Ah1G/AcQ///NR5fn:ellHX/Nv
TLSH
T1ED642F19563409EACEED1BB6AC1259DC5145EAF118F1E13E6127EFDCD8E4DA2CC28F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Oqoefand.exe

Path C:\Windows\SysWOW64\Oqoefand.exe
Size 320KB
SHA256 791410564e384946eb7ecb280045ecb57e21dfab747dceb668b58a68aaf51a62
MD5 02eb268dc11338e1e1208b61197ff859
SHA1 a91957b2fb620548aac7d792580264c197898e45
SHA512 ed231d23a9d766882745e9a45538c8cad4f31229e021490aa26625d5618a1dbf8b021961be45e125590c7518c8be3d6514323a8721417f8cb4550aeda3021720
SSDEEP 3072:DWyFL8mzGAMzT1wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:DWrYGAMzT1V/Ah1G/AcQ///NR5fn
TLSH
T18564DA192A340DEACEED1BB6AD1289D89145F9F054F2E13E6523DFDCD8E4DA2C805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pafkgphl.exe

Path C:\Windows\SysWOW64\Pafkgphl.exe
Size 320KB
SHA256 d79e77264ccedd98ae32d8914993371b112c391ad120b5e4a71f282390fbbe72
MD5 ab8a4dc387ec2c47bbfe209024b58bb8
SHA1 2f7b6e4cd012a0a0cdcc4d8ff88e1eaec698c7d7
SHA512 cad62cb48cd9cbec381d3aeca729b84aeeac48e4c8b5f8ad73539c01269ecdc192e8eb55a85a7e608346e8df572bb348947a2c63d5e4382f6f24e9cbc1bf7962
SSDEEP 3072:1BYRllxKBhPbuMOwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:1akhPqMOV/Ah1G/AcQ///NR5fn
TLSH
T195642F1A2A3409EACDED1BB6BC425DD85251E9F014F1E17E6123DFECD8E4DA6C805F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Paihlpfi.exe

Path C:\Windows\SysWOW64\Paihlpfi.exe
Size 320KB
SHA256 19b022fc310fc7a8141173c7beb05aaf3dae0fccf1293742e16fc2770bd6ca4a
MD5 9c1c07632e42147b4bfceab631f37035
SHA1 843226b4898d24bad13160ff2aa4c5557a21e247
SHA512 affccf7d0d927c52dcf2bd26cdef64f28c3c9202b28f7754ea5f1ba070c711f54fec10bec55e4b608ab4be9d73455c7e1ee8e628d388fde9f8436a299c471afe
SSDEEP 3072:t8yDvI+UTxiJ5QwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:t1JUVg5QV/Ah1G/AcQ///NR5fn
TLSH
T18D642F1A2A340DEACEED1BB6AC0259DD5141E9F014F1E17EA123DFDCD8E4DA2C819F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pbcncibp.exe

Path C:\Windows\SysWOW64\Pbcncibp.exe
Size 320KB
SHA256 5446c150421424be0de54c0fad03b70b5cea9e191f3edbb114b8a3054a75c370
MD5 979178a795f7fca25a8c4e4bbace9143
SHA1 ee7ae7fbd8d35a61b5fe2ec753c8d6d20abf90ca
SHA512 08556b6f616ae1672800bb28f2f5c8c86ef96025150906bdb770ecbca99f5f4bf3181472c3515e4bc3f3423e9e39b8bac443d2ab1841af7c8f36f0f07668834e
SSDEEP 3072:lMJit5V3QfhsfyyrfwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:lz7SJAfV/Ah1G/AcQ///NR5fn
TLSH
T136640B1A263409EADEED5FB5AD1259E88181E5B018F5F13E6123DFDDC8E4DA2CC06F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pcbkml32.exe

Path C:\Windows\SysWOW64\Pcbkml32.exe
Size 320KB
SHA256 f96adeae132bec87fa7bb4eae51c4ddfb6a5a45fdfea03a59dfce962d1aa8c0f
MD5 c4674f0c417e6597e0e169e8db8a4d48
SHA1 a85f0033328f156f6ca1a52e69eaed125faf0481
SHA512 6bec91053c22c56fac2a6af0c2e2025372eb92282828f75f81721f9ed2f2ca62ca192fe88b40929bdb06fa15b0e46450b63b0d703020299c5f4c647d30aebee1
SSDEEP 3072:7jHHVa+rzLKZisawS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:/c+rnc9aV/Ah1G/AcQ///NR5fn
TLSH
T140640C19263109EACDED1BB5AC228DE89141E8F054F1E13E6123EFDDD8F5DA6C909F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pcegclgp.exe

Path C:\Windows\SysWOW64\Pcegclgp.exe
Size 320KB
SHA256 1f281322080963d8fbd7199e1ba53b7766da9d7608432ff036667a53e63cff8d
MD5 81b83bf2c7c5c298ae34af29a50f41cd
SHA1 06db58131fdf4c27197c05ce0a361584e642c3eb
SHA512 76f70058474f02457fd794fa3bae99235bfbdd83e70b8f9966062626163aee2755f72219460a484d6f8f661e302a13bc01a8952f2c96be8fe6387d98783c7f95
SSDEEP 3072:rg/lxkIvyDs+wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:axkW+V/Ah1G/AcQ///NR5fn
TLSH
T1B9641F192A3059EACEED1BB5AC424DD8A145F5F014F1E23E6623DFDDC8E4DA2C825F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pcgdhkem.exe

Path C:\Windows\SysWOW64\Pcgdhkem.exe
Size 320KB
SHA256 39c381fb4ab5223cd9226f19de4e74778cf067fb519ff7d5041d1a6d4501afd8
MD5 5a10a0039ca326ee51ffe8b7027b0074
SHA1 6b1b76cf08f52bb89ab407a982c693b76a924fb1
SHA512 83d682fcc701741b4a966749749d7371a1985ed11e06f2df5f09145e25ec4a8b32ff36543f79712213772f75c4a34a45d66afa8aee33bbaa7ef51741b636fdf8
SSDEEP 3072:6eg/hiDLHU4o8V1owS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:6L/hsdV1oV/Ah1G/AcQ///NR5fn
TLSH
T11F644119263009EACEED1BB5AC0259DC5142E5F425F1E53E6223DFDCDCE8DA2C895F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pcpnhl32.exe

Path C:\Windows\SysWOW64\Pcpnhl32.exe
Size 320KB
SHA256 ec1a482551a1f20b5c6f438a913be81ba8cb34fe9863426c7d90771b5f546749
MD5 2eea81d8ffb8eb0713360b907625d490
SHA1 1a76f695696707ae4c535e74f2df0ad57bbd4674
SHA512 46cca2d0d8fa85a90bb875fae8779919ce420cc053d5c50a2b0754a7c2a2eda0e01ee2dfb9231f9215dc4115be5f203756ee1d83bb2ce592f69387ec49d06df5
SSDEEP 3072:NGtTjwSXW7sbs9gT/hwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:NG5MAWwThV/Ah1G/AcQ///NR5fn
TLSH
T13264DA1A2A3409EACDFD5BB6BC5249D85141FAB014F2E13E6623DFDCD8E4DA6C805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pfagighf.exe

Path C:\Windows\SysWOW64\Pfagighf.exe
Size 320KB
SHA256 df9bfcb01421c7ff4f695b7dbd2991a9a866f6358b93215c655d8d54cd58cc6e
MD5 f133b2486dc86a6abab267cacf706425
SHA1 04244496b475df4e95ddd339f15e07e00878412a
SHA512 3a5e5291f5ad1b3c08ffa795960dc8cdcb805a277f3b615de245ab1cd6f5558dfe8afc4d396d911601f05069e483cdfb37cde13c6c71d71dc318c54d00bb6b76
SSDEEP 3072:JovLZKuFhkZTRwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:qvLlXkRRV/Ah1G/AcQ///NR5fn
TLSH
T1FB64311A263809EACDED5FB6AC1259D95141E9F118F1E13E6123DFDCE8E4DA2DC08F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pfccogfc.exe

Path C:\Windows\SysWOW64\Pfccogfc.exe
Size 320KB
SHA256 e25df33794b1f7f64bc736d68452160ebb6bef9b91e93277077d5257df0e2a64
MD5 d8192e5fc54eb42a5fddff2afbe961e1
SHA1 8fb4dc221cc257adcd1f6ca83ce77cde09a6dd7b
SHA512 ae48eaf6f483a73584a446dcbe86bf6eb5c2a13fe9bf068b94882d13dc21c61a172565240b0938d03ae05ba2bd8072845152633d33c591672ecd1ac28aa4c269
SSDEEP 6144:9frFt5S4uLzwJsgaoya3DV/Ah1G/AcQ///NR5fn:9frFt5S4uLzwJsgah/Nv
TLSH
T1D864E9192E300DEACDED1BB6AC12ADE85141E9B015F1E23E6123DFDDD9E4DA6D804F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pimfpc32.exe

Path C:\Windows\SysWOW64\Pimfpc32.exe
Size 320KB
SHA256 27a5ab7a05628373657679ec3e1ef62b7a2e3806f1bfbf7a8a5602fb3328bc76
MD5 bc6d2374634bf945d99a1e6690a27be3
SHA1 3df260cbb2c92257aa8d4fd309115b20622d1b97
SHA512 d212ff1b89078745b1435167a74edfee4710683be05c2b15333085330d1e79b2c9041036d8f363723c5f85780dd494ff184550f401c87623869f5c038df35cad
SSDEEP 3072:W695+ngqQwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:V5AQV/Ah1G/AcQ///NR5fn
TLSH
T1AC645119263009EACEED1FB5AC1269DA5141E9F054F1E17E6223DFDCC8E4DA2CC19F89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pjjfdfbb.exe

Path C:\Windows\SysWOW64\Pjjfdfbb.exe
Size 320KB
SHA256 019befdc62959937453fa5b675241d9f43f12615e876ed3ca89a3d76e67f7964
MD5 57dc6f92624985dcd079d2552fd3321c
SHA1 7146273b39737e6729075da0d74d892ed59ea120
SHA512 a91cf55d809869f322f49ccf6dec076b0378e5c0ac97c4f3c15fb523b28db262803463379803d3c2e525c5f29c72bf7302dc93a8e9b189d0446c25042df28069
SSDEEP 3072:XufWOdvEUowS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:efWOdvEUoV/Ah1G/AcQ///NR5fn
TLSH
T10264EB1A2A7809EACEED2FB5AC124DD85181E9B114F1E13E6123DFDCD8F4DA2D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pjlcjf32.exe

Path C:\Windows\SysWOW64\Pjlcjf32.exe
Size 320KB
SHA256 45ae8ff11f25a56e1bcff3c0c499058de53239a7369ba521ddd00e05ae53a93d
MD5 ec6601ccca090ae5d73fdeeb8f1aabec
SHA1 27f2ba81c740b266e182325f41f75b929adda63a
SHA512 efa56c288f858240767b2d29a1d9f75da7d9cec8aacba067cdd456c725a760777ab3207f2fd421df7da181941ce0bda01f0d17e3bf7e67209c327286ccd73647
SSDEEP 3072:qtmk8AF3nI/rixHXLxowS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:amk8Ai/rixHXVoV/Ah1G/AcQ///NR5fn
TLSH
T19964101A263449EADEED1BB5BC1259DC5181E9F028F1E13E6123DFDCD8E4DA2C819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pjoppf32.exe

Path C:\Windows\SysWOW64\Pjoppf32.exe
Size 320KB
SHA256 825194551a6bc1a5468aed03b3c5fa81aa589cb426ece5a2cdde3b0e3cb135c1
MD5 f8f94d3ff5e4c38d213d315d992718b7
SHA1 14e1f4ad8033ef908e79c71937b1fd830558d94b
SHA512 dc7170e27d3abd32af50386c79cfabc08a2c0d23bd7e253d76f1015ea625b7a5f2f66116bb028388507ee934e6c18f4897cfb2c993c34861fe513238958cedee
SSDEEP 3072:7m5G3WZMJwgme8XmwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:yHOuxXmV/Ah1G/AcQ///NR5fn
TLSH
T18F6431192A3809EACEED1FB5AC1289D85181E5F014F1E13E6123DFEDD8F4DA2E815F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pmhbqbae.exe

Path C:\Windows\SysWOW64\Pmhbqbae.exe
Size 320KB
SHA256 7b20276fedc33ee80f5de04ba7128d294333788c7e59513f393ea2c25399483a
MD5 07675954d74060012319a1a2c8da3d48
SHA1 175af670aa288291d9c513a50fe5ff0e4d1c6dbb
SHA512 34e75d70f3e028c66da02ce6dccbde39a14c058a9a4c1104904a2478a12e868cfed322c272e6b58e3c58cb1ee70a79eaa61c0ab1d1c6ac7cc6911acd4ef1f2a8
SSDEEP 3072:kngEYvEPIXlTwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:kngpEalTV/Ah1G/AcQ///NR5fn
TLSH
T143641E192A7409EACDED5BB5AC1249D89141E9F014F2E23E6223DFDCDCE4DBAC805F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pmkofa32.exe

Path C:\Windows\SysWOW64\Pmkofa32.exe
Size 320KB
SHA256 5adf6c868c5ada9855407c4de8bdba31e7b9adf568bd40fc4755ba64f2c4707f
MD5 b17222cc58b71732d3e6a05797ce40f6
SHA1 cdf51b7f2868e729c50455289c6b9c5eba9c99ad
SHA512 a944f7e65a874c3d256402aa6333a36321ee67bd2a7a3b8778240172cfda670e432f9b6e30a960ec0570d83674f949c9b07862559ee7028dd99997aeaa7f91b4
SSDEEP 3072:68zgN1zjwwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Y1HwV/Ah1G/AcQ///NR5fn
TLSH
T1F0642219163009EACDED1BF5AC1289D85186E9F028F2E13E6123DFDDD8E4DA6D819FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pmmlla32.exe

Path C:\Windows\SysWOW64\Pmmlla32.exe
Size 320KB
SHA256 89648e4132b67a7ceb51d41952184c4747f3d7e8ffd2959fa72bd5595187653e
MD5 c2a7229e299364a7329ec5a51027c343
SHA1 6d2ab8ce087b9a4e92e2a3185758ae3b8d39790e
SHA512 46724bec4987027a3d5676c0febcd8df476af6c570c89b04a371a24452e0d1b0c210c7b7896b3c89b9108e24871622416284cfc5344eef3b3ec1327bbb0b3e38
SSDEEP 3072:DcMkpKQJzTfwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:NKfV/Ah1G/AcQ///NR5fn
TLSH
T173642E192A3109EACEED1BB5AC0289E85541E5F218F1E13E6123DFDDECE4DA3D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ppdbgncl.exe

Path C:\Windows\SysWOW64\Ppdbgncl.exe
Size 320KB
SHA256 f72a2fb56f1137e3d36bfb44d0312895a1a148ab34925a9088ee0e327d5d258d
MD5 dfd4f9208ff5b477debf45464a289c9b
SHA1 2ef83855e8382424894e0f09828152bb5265be7a
SHA512 003044d2c5c5421bc119b8a9ee3c5f9c02e4ed789b97afdf378b1e801bf4c0194a661ee9feca475fb6f7f46d9f61ff37a28120581f072a23d4c1648a3ddfd668
SSDEEP 3072:aqPtKiXJwy9rXJBFwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:aqPtKWBvBFV/Ah1G/AcQ///NR5fn
TLSH
T1FC64201A2A3409EACEED1BF5AC124AD89181E9F454F1E13E6123DFDCC8E4DA6DC15F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ppgomnai.exe

Path C:\Windows\SysWOW64\Ppgomnai.exe
Size 320KB
SHA256 4e312b2b33e5a5671e7eb3bbba94dfc46956e0b908f7644cb0a30a22935650c8
MD5 846fe53cf9afdfe4ae3aee7a8866cad8
SHA1 a7d547eb20d996f9c1b76952891a84c33b0e1f80
SHA512 46bb7efe2ae9f9a46cca7798fc029cdf41932670d651f79bd17893ed58bbb8c55438f5de4b595df0f5295e6e5e4e726c9fe9198413f339b5f6257d027372d0e3
SSDEEP 3072:x4JytyWNduB7F8smRSDqEAlbxjwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:OJyK2lbxjV/Ah1G/AcQ///NR5fn
TLSH
T14364FD192A3409EACDFE5BB6AC8249ED5141E9F024F1E13E6123DFDCD8E4DA6C815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pqbala32.exe

Path C:\Windows\SysWOW64\Pqbala32.exe
Size 320KB
SHA256 5b1fd04c1dc8a3440c4c5e2fb0cd05a6eb2084ada7c430dadb7e9266e61275d9
MD5 5143cdc59d1822d1be191f727071f426
SHA1 1c38f79bfc352b1b86e9cbf3c03f86b9963473b3
SHA512 62b800030c9b116b670bfd0e02e1fa3014c15c5efa37a8cdf8b8dd1051317cc73a4d881a34d4d965cc6d67d768f80a5866f5e44cae61e6c76a0e4eff19750c3d
SSDEEP 3072:N0ms3H86nYipAzGjl+VLV2iwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:N0msvY+AzkqsiV/Ah1G/AcQ///NR5fn
TLSH
T150643F1E2A3449EACDED1FB5AC0249D89581E8F014F5E23E6923DFDCD8E4DA2D914F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/716-382-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/716-1-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/716-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/960-362-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/960-86-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1084-310-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1084-281-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1124-62-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1124-368-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1544-118-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1544-354-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1588-300-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1588-302-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1772-356-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1772-110-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2008-364-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2008-78-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2216-9-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2216-380-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2272-366-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2272-70-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2304-205-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2304-332-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2352-314-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2424-318-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2532-197-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2532-334-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2748-324-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2748-236-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2816-308-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2816-287-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2908-344-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3032-220-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3032-328-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3060-322-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3060-244-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3192-312-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3192-275-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3204-316-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3212-38-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3212-374-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3224-336-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3224-189-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3248-346-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3248-150-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3884-376-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3884-30-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3964-330-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4068-102-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4068-358-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4188-134-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4188-350-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4200-352-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4200-126-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4256-181-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4256-338-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4480-326-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4480-228-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4548-94-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4548-360-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4652-293-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4652-306-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4780-320-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4780-252-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4792-173-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4792-340-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4836-348-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4836-142-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4876-165-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4876-342-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4916-304-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4916-299-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4928-370-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4928-54-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4940-46-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4940-372-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5020-378-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5020-21-0x0000000000400000-0x000000000046D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads