berbew | 78b04056719b229b48a49cefd968b58557470bf303350c47bf216c3da0a61d1c

Analysis

max time kernel
149s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 15:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-11_92e68fd0e9e4cfc3e44422c7f99ac494_elex_wannacry.exe
Size 412KB
Sample261012-s9d2maxydw
SHA256 78b04056719b229b48a49cefd968b58557470bf303350c47bf216c3da0a61d1c
MD5 92e68fd0e9e4cfc3e44422c7f99ac494
SHA1 dd3de11fc839dd90aaed674152c57c4eccae4ef9
SHA512 b8f392b4ff333f6447b2c0c5bd57e8a9eb3bb68fd4e2fa2d4c0905448e0a354e602e6f240c49fa4218c8b5064fa0011aef6bfc0c06b2eed0a00f6051200dc090
SSDEEP 6144:NSyp7spGHRV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:fRU/NcZ7/NZ
TLSH
T10294836A6A3019EADDED1BB6AC1249D85581EAF114F1E13E6133DFDCC8E4DE1D808F81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipqnknld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jfopcgpk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jplmglbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Liekgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbfoeiei.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hcnnjoam.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Habndbpf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iakajagl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfffcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kcfiof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njcpok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ffbnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gfnnel32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gcdkdpih.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfacai32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfalhgni.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgdbedmc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqbagd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ogqcon32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpegfm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpocciba.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbfoeiei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Okjbimal.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pkoldl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jfffcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Odpjmcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Obdkfg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onklkhnn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fofigd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmdend32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibjqlj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ijfbhflj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Idnfal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jdjfmjhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kanffogf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nklfho32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Elepei32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffbnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbiooolb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fmapag32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfnnel32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hameic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hfjmajbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hmdend32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	2026-10-11_92e68fd0e9e4cfc3e44422c7f99ac494_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hcbgen32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifhibhfc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipqnknld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jibejb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kapclned.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kaemgn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmnjan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hcnnjoam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldhbnhlm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnlfclip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdfopf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Naaejj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbhkjicf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Okjbimal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ficgkico.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jmpnppap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdlcbjfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgnekcei.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpmodg32.exe

Executes dropped EXE 64 IoCs

pid	Process
4136	Efdbhpbn.exe
4152	Eoocfegl.exe
6096	Elepei32.exe
3204	Fofigd32.exe
1680	Ffbnin32.exe
3480	Fbiooolb.exe
2676	Ficgkico.exe
3836	Fmapag32.exe
4452	Gmfilfep.exe
3332	Gfnnel32.exe
1844	Gmkbgf32.exe
3704	Gcdkdpih.exe
408	Gfedfk32.exe
5692	Hameic32.exe
3252	Hfjmajbc.exe
1396	Hmdend32.exe
1952	Hcnnjoam.exe
2468	Hjhfgi32.exe
2584	Habndbpf.exe
3108	Hbcklkee.exe
2492	Himche32.exe
4400	Hcbgen32.exe
2832	Hfacai32.exe
1204	Iafgob32.exe
1800	Icedkn32.exe
1444	Ijolhg32.exe
1356	Iaiddajo.exe
5824	Ibjqlj32.exe
5452	Iidiidgj.exe
5480	Iakajagl.exe
4880	Ifhibhfc.exe
2244	Ipqnknld.exe
5516	Ijfbhflj.exe
1160	Imdndbkn.exe
3324	Idnfal32.exe
1940	Jikojcaa.exe
4984	Jpegfm32.exe
1788	Jfopcgpk.exe
3648	Jaddpppa.exe
1740	Jfalhgni.exe
5952	Jagqfp32.exe
5684	Jbhmnhcm.exe
3540	Jibejb32.exe
4672	Jplmglbf.exe
2928	Jfffcf32.exe
5996	Jmpnppap.exe
2604	Jdjfmjhm.exe
6008	Kkdnjd32.exe
3984	Kanffogf.exe
576	Kdlcbjfj.exe
2780	Kkfkod32.exe
3620	Kapclned.exe
5348	Kbapdfkb.exe
4684	Kilhqq32.exe
4112	Kpepmkjl.exe
2044	Kkkdjcjb.exe
5576	Kaemgn32.exe
1944	Kcfiof32.exe
4968	Kkmapc32.exe
5992	Kpjjhj32.exe
1508	Lgdbedmc.exe
1488	Lmnjan32.exe
2388	Ldhbnhlm.exe
4204	Liekgo32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ffbnin32.exe	Fofigd32.exe
File created	C:\Windows\SysWOW64\Ficgkico.exe	Fbiooolb.exe
File created	C:\Windows\SysWOW64\Ihidjh32.dll	Gmfilfep.exe
File created	C:\Windows\SysWOW64\Nmajndjb.dll	Mgbnfb32.exe
File created	C:\Windows\SysWOW64\Jjfobp32.dll	Mcnhfb32.exe
File created	C:\Windows\SysWOW64\Onfbpi32.exe	Ocqncp32.exe
File opened for modification	C:\Windows\SysWOW64\Efdbhpbn.exe	2026-10-11_92e68fd0e9e4cfc3e44422c7f99ac494_elex_wannacry.exe
File created	C:\Windows\SysWOW64\Kkdnjd32.exe	Jdjfmjhm.exe
File created	C:\Windows\SysWOW64\Kapclned.exe	Kkfkod32.exe
File opened for modification	C:\Windows\SysWOW64\Kkmapc32.exe	Kcfiof32.exe
File created	C:\Windows\SysWOW64\Lajpbbei.dll	Lgdbedmc.exe
File opened for modification	C:\Windows\SysWOW64\Mpmodg32.exe	Mkpglqgj.exe
File created	C:\Windows\SysWOW64\Okjbimal.exe	Odpjmcjp.exe
File opened for modification	C:\Windows\SysWOW64\Lijdbofo.exe	Ldmlih32.exe
File created	C:\Windows\SysWOW64\Mdaedgdb.exe	Lngmhm32.exe
File opened for modification	C:\Windows\SysWOW64\Gmfilfep.exe	Fmapag32.exe
File created	C:\Windows\SysWOW64\Efcnhmeg.dll	Fbiooolb.exe
File opened for modification	C:\Windows\SysWOW64\Fmapag32.exe	Ficgkico.exe
File created	C:\Windows\SysWOW64\Kkfkod32.exe	Kdlcbjfj.exe
File opened for modification	C:\Windows\SysWOW64\Ijfbhflj.exe	Ipqnknld.exe
File created	C:\Windows\SysWOW64\Jagqfp32.exe	Jfalhgni.exe
File opened for modification	C:\Windows\SysWOW64\Jbhmnhcm.exe	Jagqfp32.exe
File opened for modification	C:\Windows\SysWOW64\Ldhbnhlm.exe	Lmnjan32.exe
File created	C:\Windows\SysWOW64\Mgbnfb32.exe	Mphfjhjf.exe
File created	C:\Windows\SysWOW64\Mnlfclip.exe	Mgbnfb32.exe
File created	C:\Windows\SysWOW64\Mdfopf32.exe	Mnlfclip.exe
File created	C:\Windows\SysWOW64\Dhkggplm.dll	Nkgmmpab.exe
File created	C:\Windows\SysWOW64\Fmapag32.exe	Ficgkico.exe
File opened for modification	C:\Windows\SysWOW64\Mgbnfb32.exe	Mphfjhjf.exe
File opened for modification	C:\Windows\SysWOW64\Pkoldl32.exe	Peddhb32.exe
File created	C:\Windows\SysWOW64\Pqkdmc32.exe	Pkoldl32.exe
File created	C:\Windows\SysWOW64\Gmkbgf32.exe	Gfnnel32.exe
File opened for modification	C:\Windows\SysWOW64\Habndbpf.exe	Hjhfgi32.exe
File opened for modification	C:\Windows\SysWOW64\Jikojcaa.exe	Idnfal32.exe
File created	C:\Windows\SysWOW64\Delcgpmm.dll	Idnfal32.exe
File created	C:\Windows\SysWOW64\Hokeebcd.dll	Jaddpppa.exe
File created	C:\Windows\SysWOW64\Hjoabfcc.dll	Jbhmnhcm.exe
File created	C:\Windows\SysWOW64\Jfffcf32.exe	Jplmglbf.exe
File created	C:\Windows\SysWOW64\Kkllelnj.dll	Jdjfmjhm.exe
File created	C:\Windows\SysWOW64\Bikoli32.dll	Hbcklkee.exe
File opened for modification	C:\Windows\SysWOW64\Ifhibhfc.exe	Iakajagl.exe
File created	C:\Windows\SysWOW64\Oeglogfo.dll	Naaejj32.exe
File created	C:\Windows\SysWOW64\Aoalnm32.dll	Ncbaabom.exe
File opened for modification	C:\Windows\SysWOW64\Onklkhnn.exe	Ogqcon32.exe
File created	C:\Windows\SysWOW64\Akljinhl.dll	Pkoldl32.exe
File opened for modification	C:\Windows\SysWOW64\Jfalhgni.exe	Jaddpppa.exe
File opened for modification	C:\Windows\SysWOW64\Kanffogf.exe	Kkdnjd32.exe
File created	C:\Windows\SysWOW64\Dogcjkih.dll	Lgikpc32.exe
File opened for modification	C:\Windows\SysWOW64\Mphfjhjf.exe	Mjnnmn32.exe
File opened for modification	C:\Windows\SysWOW64\Mdfopf32.exe	Mnlfclip.exe
File created	C:\Windows\SysWOW64\Pipniemf.dll	Mgggaamn.exe
File created	C:\Windows\SysWOW64\Chdica32.dll	2026-10-11_92e68fd0e9e4cfc3e44422c7f99ac494_elex_wannacry.exe
File created	C:\Windows\SysWOW64\Ffbnin32.exe	Fofigd32.exe
File created	C:\Windows\SysWOW64\Hdglka32.dll	Hameic32.exe
File created	C:\Windows\SysWOW64\Ddpgfjhm.dll	Iidiidgj.exe
File created	C:\Windows\SysWOW64\Jibejb32.exe	Jbhmnhcm.exe
File created	C:\Windows\SysWOW64\Fdobnfoh.dll	Iaiddajo.exe
File created	C:\Windows\SysWOW64\Akdameeh.dll	Kpepmkjl.exe
File created	C:\Windows\SysWOW64\Lgdbedmc.exe	Kpjjhj32.exe
File created	C:\Windows\SysWOW64\Edpogbee.dll	Lnccmnak.exe
File created	C:\Windows\SysWOW64\Pojhjc32.dll	Onaieifh.exe
File created	C:\Windows\SysWOW64\Fbgjeohk.dll	Elepei32.exe
File opened for modification	C:\Windows\SysWOW64\Hfacai32.exe	Hcbgen32.exe
File created	C:\Windows\SysWOW64\Jcmmfocn.dll	Jpegfm32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1500	2072	WerFault.exe	200

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Habndbpf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gmkbgf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfffcf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kapclned.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnhfokoc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqmhlego.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Obdkfg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ficgkico.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jikojcaa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jaddpppa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdaedgdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjhqcmjo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-11_92e68fd0e9e4cfc3e44422c7f99ac494_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fofigd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hfjmajbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hcnnjoam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldmlih32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mphfjhjf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgggaamn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibjqlj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hcbgen32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ijfbhflj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcnhfb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oggqho32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kilhqq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjnnmn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mnlfclip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eoocfegl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmdend32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldhbnhlm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdlcbjfj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdfopf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogqcon32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpepmkjl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kcfiof32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmnjan32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onfbpi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Okjbimal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onklkhnn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kanffogf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lgdbedmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lgikpc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jagqfp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpocciba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgbnfb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Okeinn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Elepei32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ifhibhfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nbfoeiei.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncihbaie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gmfilfep.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipqnknld.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jplmglbf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kkdnjd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpjjhj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lnccmnak.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mallojmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njcpok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ffbnin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpegfm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nkgmmpab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iaiddajo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncbaabom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lgnekcei.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ifhibhfc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jikojcaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kpjjhj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Onaieifh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okoogdck.dll"	Odkaac32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Okeinn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kipibaoi.dll"	Oqbagd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbiooolb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jfffcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjagmjpi.dll"	Liekgo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mallojmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddaljhid.dll"	Nbhkjicf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ficgkico.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gmfilfep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hmdend32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hfacai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iaiddajo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jfalhgni.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jibejb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jibejb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ibjqlj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjjqmgmj.dll"	Kaemgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kpjjhj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lgikpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbbdnb32.dll"	Mdaedgdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efeggaqg.dll"	Mkpglqgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aoalnm32.dll"	Ncbaabom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ipqnknld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fmapag32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgggaamn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgggaamn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njcpok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mglekloo.dll"	Ogqcon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbgjeohk.dll"	Elepei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efcnhmeg.dll"	Fbiooolb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hcnnjoam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okonpc32.dll"	Himche32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lmnjan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgbnfb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Onfbpi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bindmcbj.dll"	Gfedfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdobnfoh.dll"	Iaiddajo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kbapdfkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aegkonkj.dll"	Kkmapc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ffbnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iafgob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Benoof32.dll"	Ijolhg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jmpnppap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nbfoeiei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohnpbe32.dll"	Jfopcgpk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akdameeh.dll"	Kpepmkjl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lmnjan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gcdkdpih.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hameic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Himche32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pkoldl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmbjhjdf.dll"	Hmdend32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Knpodbbl.dll"	Imdndbkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lgfceo32.dll"	Kcfiof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kcfiof32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mcnhfb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkanbk32.dll"	Ffbnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihidjh32.dll"	Gmfilfep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gmkbgf32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 4136	4168	2026-10-11_92e68fd0e9e4cfc3e44422c7f99ac494_elex_wannacry.exe	89
PID 4136 wrote to memory of 4152	4136	Efdbhpbn.exe	90
PID 4152 wrote to memory of 6096	4152	Eoocfegl.exe	91
PID 6096 wrote to memory of 3204	6096	Elepei32.exe	92
PID 3204 wrote to memory of 1680	3204	Fofigd32.exe	93
PID 1680 wrote to memory of 3480	1680	Ffbnin32.exe	94
PID 3480 wrote to memory of 2676	3480	Fbiooolb.exe	95
PID 2676 wrote to memory of 3836	2676	Ficgkico.exe	96
PID 3836 wrote to memory of 4452	3836	Fmapag32.exe	97
PID 4452 wrote to memory of 3332	4452	Gmfilfep.exe	98
PID 3332 wrote to memory of 1844	3332	Gfnnel32.exe	99
PID 1844 wrote to memory of 3704	1844	Gmkbgf32.exe	100
PID 3704 wrote to memory of 408	3704	Gcdkdpih.exe	101
PID 408 wrote to memory of 5692	408	Gfedfk32.exe	102
PID 5692 wrote to memory of 3252	5692	Hameic32.exe	103
PID 3252 wrote to memory of 1396	3252	Hfjmajbc.exe	104
PID 1396 wrote to memory of 1952	1396	Hmdend32.exe	105
PID 1952 wrote to memory of 2468	1952	Hcnnjoam.exe	106
PID 2468 wrote to memory of 2584	2468	Hjhfgi32.exe	107
PID 2584 wrote to memory of 3108	2584	Habndbpf.exe	108
PID 3108 wrote to memory of 2492	3108	Hbcklkee.exe	109
PID 2492 wrote to memory of 4400	2492	Himche32.exe	110
PID 4400 wrote to memory of 2832	4400	Hcbgen32.exe	111
PID 2832 wrote to memory of 1204	2832	Hfacai32.exe	112
PID 1204 wrote to memory of 1800	1204	Iafgob32.exe	113
PID 1800 wrote to memory of 1444	1800	Icedkn32.exe	114
PID 1444 wrote to memory of 1356	1444	Ijolhg32.exe	115
PID 1356 wrote to memory of 5824	1356	Iaiddajo.exe	116
PID 5824 wrote to memory of 5452	5824	Ibjqlj32.exe	117
PID 5452 wrote to memory of 5480	5452	Iidiidgj.exe	118
PID 5480 wrote to memory of 4880	5480	Iakajagl.exe	119
PID 4880 wrote to memory of 2244	4880	Ifhibhfc.exe	120
PID 2244 wrote to memory of 5516	2244	Ipqnknld.exe	121
PID 5516 wrote to memory of 1160	5516	Ijfbhflj.exe	122
PID 1160 wrote to memory of 3324	1160	Imdndbkn.exe	123
PID 3324 wrote to memory of 1940	3324	Idnfal32.exe	124
PID 1940 wrote to memory of 4984	1940	Jikojcaa.exe	125
PID 4984 wrote to memory of 1788	4984	Jpegfm32.exe	126
PID 1788 wrote to memory of 3648	1788	Jfopcgpk.exe	127
PID 3648 wrote to memory of 1740	3648	Jaddpppa.exe	128
PID 1740 wrote to memory of 5952	1740	Jfalhgni.exe	129
PID 5952 wrote to memory of 5684	5952	Jagqfp32.exe	130
PID 5684 wrote to memory of 3540	5684	Jbhmnhcm.exe	131
PID 3540 wrote to memory of 4672	3540	Jibejb32.exe	132
PID 4672 wrote to memory of 2928	4672	Jplmglbf.exe	133
PID 2928 wrote to memory of 5996	2928	Jfffcf32.exe	134
PID 5996 wrote to memory of 2604	5996	Jmpnppap.exe	135
PID 2604 wrote to memory of 6008	2604	Jdjfmjhm.exe	136
PID 6008 wrote to memory of 3984	6008	Kkdnjd32.exe	137
PID 3984 wrote to memory of 576	3984	Kanffogf.exe	138
PID 576 wrote to memory of 2780	576	Kdlcbjfj.exe	139
PID 2780 wrote to memory of 3620	2780	Kkfkod32.exe	140
PID 3620 wrote to memory of 5348	3620	Kapclned.exe	141
PID 5348 wrote to memory of 4684	5348	Kbapdfkb.exe	142
PID 4684 wrote to memory of 4112	4684	Kilhqq32.exe	143
PID 4112 wrote to memory of 2044	4112	Kpepmkjl.exe	144
PID 2044 wrote to memory of 5576	2044	Kkkdjcjb.exe	145
PID 5576 wrote to memory of 1944	5576	Kaemgn32.exe	146
PID 1944 wrote to memory of 4968	1944	Kcfiof32.exe	147
PID 4968 wrote to memory of 5992	4968	Kkmapc32.exe	148
PID 5992 wrote to memory of 1508	5992	Kpjjhj32.exe	149
PID 1508 wrote to memory of 1488	1508	Lgdbedmc.exe	150
PID 1488 wrote to memory of 2388	1488	Lmnjan32.exe	151
PID 2388 wrote to memory of 4204	2388	Ldhbnhlm.exe	152

C:\Users\Admin\AppData\Local\Temp\2026-10-11_92e68fd0e9e4cfc3e44422c7f99ac494_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-11_92e68fd0e9e4cfc3e44422c7f99ac494_elex_wannacry.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Windows\SysWOW64\Efdbhpbn.exe
  C:\Windows\system32\Efdbhpbn.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Windows\SysWOW64\Eoocfegl.exe
    C:\Windows\system32\Eoocfegl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4152
  - - C:\Windows\SysWOW64\Elepei32.exe
      C:\Windows\system32\Elepei32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:6096
    - - C:\Windows\SysWOW64\Fofigd32.exe
        
        C:\Windows\system32\Fofigd32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3204
      - C:\Windows\SysWOW64\Ffbnin32.exe
        
        C:\Windows\system32\Ffbnin32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1680
        
        C:\Windows\SysWOW64\Fbiooolb.exe
        
        C:\Windows\system32\Fbiooolb.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3480
        
        C:\Windows\SysWOW64\Ficgkico.exe
        
        C:\Windows\system32\Ficgkico.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2676
        
        C:\Windows\SysWOW64\Fmapag32.exe
        
        C:\Windows\system32\Fmapag32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3836
        
        C:\Windows\SysWOW64\Gmfilfep.exe
        
        C:\Windows\system32\Gmfilfep.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4452
        
        C:\Windows\SysWOW64\Gfnnel32.exe
        
        C:\Windows\system32\Gfnnel32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3332
        
        C:\Windows\SysWOW64\Gmkbgf32.exe
        
        C:\Windows\system32\Gmkbgf32.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1844
        
        C:\Windows\SysWOW64\Gcdkdpih.exe
        
        C:\Windows\system32\Gcdkdpih.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3704
        
        C:\Windows\SysWOW64\Gfedfk32.exe
        
        C:\Windows\system32\Gfedfk32.exe
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:408
        
        C:\Windows\SysWOW64\Hameic32.exe
        
        C:\Windows\system32\Hameic32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5692
        
        C:\Windows\SysWOW64\Hfjmajbc.exe
        
        C:\Windows\system32\Hfjmajbc.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3252
        
        C:\Windows\SysWOW64\Hmdend32.exe
        
        C:\Windows\system32\Hmdend32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1396
        
        C:\Windows\SysWOW64\Hcnnjoam.exe
        
        C:\Windows\system32\Hcnnjoam.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1952
        
        C:\Windows\SysWOW64\Hjhfgi32.exe
        
        C:\Windows\system32\Hjhfgi32.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2468
        
        C:\Windows\SysWOW64\Habndbpf.exe
        
        C:\Windows\system32\Habndbpf.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2584
        
        C:\Windows\SysWOW64\Hbcklkee.exe
        
        C:\Windows\system32\Hbcklkee.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3108
        
        C:\Windows\SysWOW64\Himche32.exe
        
        C:\Windows\system32\Himche32.exe
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2492
        
        C:\Windows\SysWOW64\Hcbgen32.exe
        
        C:\Windows\system32\Hcbgen32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4400
        
        C:\Windows\SysWOW64\Hfacai32.exe
        
        C:\Windows\system32\Hfacai32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2832
        
        C:\Windows\SysWOW64\Iafgob32.exe
        
        C:\Windows\system32\Iafgob32.exe
        25⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1204
        
        C:\Windows\SysWOW64\Icedkn32.exe
        
        C:\Windows\system32\Icedkn32.exe
        26⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1800
        
        C:\Windows\SysWOW64\Ijolhg32.exe
        
        C:\Windows\system32\Ijolhg32.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1444
        
        C:\Windows\SysWOW64\Iaiddajo.exe
        
        C:\Windows\system32\Iaiddajo.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1356
        
        C:\Windows\SysWOW64\Ibjqlj32.exe
        
        C:\Windows\system32\Ibjqlj32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5824
        
        C:\Windows\SysWOW64\Iidiidgj.exe
        
        C:\Windows\system32\Iidiidgj.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5452
        
        C:\Windows\SysWOW64\Iakajagl.exe
        
        C:\Windows\system32\Iakajagl.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5480
        
        C:\Windows\SysWOW64\Ifhibhfc.exe
        
        C:\Windows\system32\Ifhibhfc.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4880
        
        C:\Windows\SysWOW64\Ipqnknld.exe
        
        C:\Windows\system32\Ipqnknld.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2244
        
        C:\Windows\SysWOW64\Ijfbhflj.exe
        
        C:\Windows\system32\Ijfbhflj.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5516
        
        C:\Windows\SysWOW64\Imdndbkn.exe
        
        C:\Windows\system32\Imdndbkn.exe
        35⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1160
        
        C:\Windows\SysWOW64\Idnfal32.exe
        
        C:\Windows\system32\Idnfal32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3324
        
        C:\Windows\SysWOW64\Jikojcaa.exe
        
        C:\Windows\system32\Jikojcaa.exe
        37⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1940
        
        C:\Windows\SysWOW64\Jpegfm32.exe
        
        C:\Windows\system32\Jpegfm32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4984
        
        C:\Windows\SysWOW64\Jfopcgpk.exe
        
        C:\Windows\system32\Jfopcgpk.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1788
        
        C:\Windows\SysWOW64\Jaddpppa.exe
        
        C:\Windows\system32\Jaddpppa.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3648
        
        C:\Windows\SysWOW64\Jfalhgni.exe
        
        C:\Windows\system32\Jfalhgni.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1740
        
        C:\Windows\SysWOW64\Jagqfp32.exe
        
        C:\Windows\system32\Jagqfp32.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5952
        
        C:\Windows\SysWOW64\Jbhmnhcm.exe
        
        C:\Windows\system32\Jbhmnhcm.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5684
        
        C:\Windows\SysWOW64\Jibejb32.exe
        
        C:\Windows\system32\Jibejb32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3540
        
        C:\Windows\SysWOW64\Jplmglbf.exe
        
        C:\Windows\system32\Jplmglbf.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4672
        
        C:\Windows\SysWOW64\Jfffcf32.exe
        
        C:\Windows\system32\Jfffcf32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2928
        
        C:\Windows\SysWOW64\Jmpnppap.exe
        
        C:\Windows\system32\Jmpnppap.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5996
        
        C:\Windows\SysWOW64\Jdjfmjhm.exe
        
        C:\Windows\system32\Jdjfmjhm.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2604
        
        C:\Windows\SysWOW64\Kkdnjd32.exe
        
        C:\Windows\system32\Kkdnjd32.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6008
        
        C:\Windows\SysWOW64\Kanffogf.exe
        
        C:\Windows\system32\Kanffogf.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3984
        
        C:\Windows\SysWOW64\Kdlcbjfj.exe
        
        C:\Windows\system32\Kdlcbjfj.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:576
        
        C:\Windows\SysWOW64\Kkfkod32.exe
        
        C:\Windows\system32\Kkfkod32.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2780
        
        C:\Windows\SysWOW64\Kapclned.exe
        
        C:\Windows\system32\Kapclned.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3620
        
        C:\Windows\SysWOW64\Kbapdfkb.exe
        
        C:\Windows\system32\Kbapdfkb.exe
        54⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5348
        
        C:\Windows\SysWOW64\Kilhqq32.exe
        
        C:\Windows\system32\Kilhqq32.exe
        55⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4684
        
        C:\Windows\SysWOW64\Kpepmkjl.exe
        
        C:\Windows\system32\Kpepmkjl.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4112
        
        C:\Windows\SysWOW64\Kkkdjcjb.exe
        
        C:\Windows\system32\Kkkdjcjb.exe
        57⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2044
        
        C:\Windows\SysWOW64\Kaemgn32.exe
        
        C:\Windows\system32\Kaemgn32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5576
        
        C:\Windows\SysWOW64\Kcfiof32.exe
        
        C:\Windows\system32\Kcfiof32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1944
        
        C:\Windows\SysWOW64\Kkmapc32.exe
        
        C:\Windows\system32\Kkmapc32.exe
        60⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4968
        
        C:\Windows\SysWOW64\Kpjjhj32.exe
        
        C:\Windows\system32\Kpjjhj32.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5992
        
        C:\Windows\SysWOW64\Lgdbedmc.exe
        
        C:\Windows\system32\Lgdbedmc.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1508
        
        C:\Windows\SysWOW64\Lmnjan32.exe
        
        C:\Windows\system32\Lmnjan32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1488
        
        C:\Windows\SysWOW64\Ldhbnhlm.exe
        
        C:\Windows\system32\Ldhbnhlm.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2388
        
        C:\Windows\SysWOW64\Liekgo32.exe
        
        C:\Windows\system32\Liekgo32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4204
        
        C:\Windows\SysWOW64\Lpocciba.exe
        
        C:\Windows\system32\Lpocciba.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2392
        
        C:\Windows\SysWOW64\Lgikpc32.exe
        
        C:\Windows\system32\Lgikpc32.exe
        67⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1828
        
        C:\Windows\SysWOW64\Lnccmnak.exe
        
        C:\Windows\system32\Lnccmnak.exe
        68⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1300
        
        C:\Windows\SysWOW64\Ldmlih32.exe
        
        C:\Windows\system32\Ldmlih32.exe
        69⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:728
        
        C:\Windows\SysWOW64\Lijdbofo.exe
        
        C:\Windows\system32\Lijdbofo.exe
        70⤵
        
        PID:3388
        
        C:\Windows\SysWOW64\Lpcmoi32.exe
        
        C:\Windows\system32\Lpcmoi32.exe
        71⤵
        
        PID:1532
        
        C:\Windows\SysWOW64\Lgnekcei.exe
        
        C:\Windows\system32\Lgnekcei.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4276
        
        C:\Windows\SysWOW64\Lngmhm32.exe
        
        C:\Windows\system32\Lngmhm32.exe
        73⤵
        Drops file in System32 directory
        
        PID:2196
        
        C:\Windows\SysWOW64\Mdaedgdb.exe
        
        C:\Windows\system32\Mdaedgdb.exe
        74⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5564
        
        C:\Windows\SysWOW64\Mjnnmn32.exe
        
        C:\Windows\system32\Mjnnmn32.exe
        75⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3428
        
        C:\Windows\SysWOW64\Mphfjhjf.exe
        
        C:\Windows\system32\Mphfjhjf.exe
        76⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4784
        
        C:\Windows\SysWOW64\Mgbnfb32.exe
        
        C:\Windows\system32\Mgbnfb32.exe
        77⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2100
        
        C:\Windows\SysWOW64\Mnlfclip.exe
        
        C:\Windows\system32\Mnlfclip.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2232
        
        C:\Windows\SysWOW64\Mdfopf32.exe
        
        C:\Windows\system32\Mdfopf32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1728
        
        C:\Windows\SysWOW64\Mkpglqgj.exe
        
        C:\Windows\system32\Mkpglqgj.exe
        80⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2720
        
        C:\Windows\SysWOW64\Mpmodg32.exe
        
        C:\Windows\system32\Mpmodg32.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4572
        
        C:\Windows\SysWOW64\Mgggaamn.exe
        
        C:\Windows\system32\Mgggaamn.exe
        82⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5364
        
        C:\Windows\SysWOW64\Mallojmd.exe
        
        C:\Windows\system32\Mallojmd.exe
        83⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4532
        
        C:\Windows\SysWOW64\Mcnhfb32.exe
        
        C:\Windows\system32\Mcnhfb32.exe
        84⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3380
        
        C:\Windows\SysWOW64\Mjhqcmjo.exe
        
        C:\Windows\system32\Mjhqcmjo.exe
        85⤵
        System Location Discovery: System Language Discovery
        
        PID:1352
        
        C:\Windows\SysWOW64\Ndmepe32.exe
        
        C:\Windows\system32\Ndmepe32.exe
        86⤵
        
        PID:3088
        
        C:\Windows\SysWOW64\Nkgmmpab.exe
        
        C:\Windows\system32\Nkgmmpab.exe
        87⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3436
        
        C:\Windows\SysWOW64\Naaejj32.exe
        
        C:\Windows\system32\Naaejj32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4308
        
        C:\Windows\SysWOW64\Ncbaabom.exe
        
        C:\Windows\system32\Ncbaabom.exe
        89⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3888
        
        C:\Windows\SysWOW64\Nnhfokoc.exe
        
        C:\Windows\system32\Nnhfokoc.exe
        90⤵
        System Location Discovery: System Language Discovery
        
        PID:3528
        
        C:\Windows\SysWOW64\Ndbnkefp.exe
        
        C:\Windows\system32\Ndbnkefp.exe
        91⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Nklfho32.exe
        
        C:\Windows\system32\Nklfho32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4976
        
        C:\Windows\SysWOW64\Nbfoeiei.exe
        
        C:\Windows\system32\Nbfoeiei.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:252
        
        C:\Windows\SysWOW64\Ngbgmpcq.exe
        
        C:\Windows\system32\Ngbgmpcq.exe
        94⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Nbhkjicf.exe
        
        C:\Windows\system32\Nbhkjicf.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5524
        
        C:\Windows\SysWOW64\Ncihbaie.exe
        
        C:\Windows\system32\Ncihbaie.exe
        96⤵
        System Location Discovery: System Language Discovery
        
        PID:2464
        
        C:\Windows\SysWOW64\Njcpok32.exe
        
        C:\Windows\system32\Njcpok32.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1752
        
        C:\Windows\SysWOW64\Oqmhlego.exe
        
        C:\Windows\system32\Oqmhlego.exe
        98⤵
        System Location Discovery: System Language Discovery
        
        PID:3764
        
        C:\Windows\SysWOW64\Oggqho32.exe
        
        C:\Windows\system32\Oggqho32.exe
        99⤵
        System Location Discovery: System Language Discovery
        
        PID:3300
        
        C:\Windows\SysWOW64\Onaieifh.exe
        
        C:\Windows\system32\Onaieifh.exe
        100⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5892
        
        C:\Windows\SysWOW64\Odkaac32.exe
        
        C:\Windows\system32\Odkaac32.exe
        101⤵
        Modifies registry class
        
        PID:4900
        
        C:\Windows\SysWOW64\Okeinn32.exe
        
        C:\Windows\system32\Okeinn32.exe
        102⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5860
        
        C:\Windows\SysWOW64\Oqbagd32.exe
        
        C:\Windows\system32\Oqbagd32.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5404
        
        C:\Windows\SysWOW64\Ocqncp32.exe
        
        C:\Windows\system32\Ocqncp32.exe
        104⤵
        Drops file in System32 directory
        
        PID:6092
        
        C:\Windows\SysWOW64\Onfbpi32.exe
        
        C:\Windows\system32\Onfbpi32.exe
        105⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2632
        
        C:\Windows\SysWOW64\Odpjmcjp.exe
        
        C:\Windows\system32\Odpjmcjp.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5304
        
        C:\Windows\SysWOW64\Okjbimal.exe
        
        C:\Windows\system32\Okjbimal.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1696
        
        C:\Windows\SysWOW64\Obdkfg32.exe
        
        C:\Windows\system32\Obdkfg32.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3680
        
        C:\Windows\SysWOW64\Ogqcon32.exe
        
        C:\Windows\system32\Ogqcon32.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1684
        
        C:\Windows\SysWOW64\Onklkhnn.exe
        
        C:\Windows\system32\Onklkhnn.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4720
        
        C:\Windows\SysWOW64\Peddhb32.exe
        
        C:\Windows\system32\Peddhb32.exe
        111⤵
        Drops file in System32 directory
        
        PID:2692
        
        C:\Windows\SysWOW64\Pkoldl32.exe
        
        C:\Windows\system32\Pkoldl32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:4600
        
        C:\Windows\SysWOW64\Pqkdmc32.exe
        
        C:\Windows\system32\Pqkdmc32.exe
        113⤵
        
        PID:2072
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 448
        114⤵
        Program crash
        
        PID:1500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2072 -ip 2072
1⤵
PID:2608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Efdbhpbn.exe

Path C:\Windows\SysWOW64\Efdbhpbn.exe
Size 412KB
SHA256 224996c19fa8032f2492ed9453bbe4b58a84750ac769985cc0abdfc0a0a48c8a
MD5 9318dce20c2f4b4c3c8beec64cca0d54
SHA1 d6af08181396f18472cccdf3a489b210272ea168
SHA512 0efa7f319273c38595a07edf5b75d303b33325e8a7e6a124d070c927439eb02bc40f0388d484a00b8b505fc39479c42497cb7c0184d79647798cecd3389772a2
SSDEEP 6144:DY8nq7V/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:D//NcZ7/NZ
TLSH
T145946E252A341DEADDED1BF5EC424AD88181E9B214F5E13E61339FDDC9E4DA2C808F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Elepei32.exe

Path C:\Windows\SysWOW64\Elepei32.exe
Size 412KB
SHA256 288fe3d6c0469e72df0c5de5325448bdca520044641f3d7358de36b7c2277ba9
MD5 b261e615b6acf6964cf3f188665ff13a
SHA1 d6bb40a087630377d1dd63314106f3f64fbffbab
SHA512 416698a316079beda92bbf6b9eeab7d4d082fb3c5a747d27078891f14700097c352eb9fe122ae47673dd82393b815b5fa4bc559a14ef08df24bf463fd471d904
SSDEEP 6144:l1Xc8zvV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:I8y/NcZ7/NZ
TLSH
T13E9472656A3019E6DDED1FB5AC1209D94682F8B214F2E23EA133DFDDC8E4DA5CC05B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eoocfegl.exe

Path C:\Windows\SysWOW64\Eoocfegl.exe
Size 412KB
SHA256 d6d7598ea914c077b3cca6187a4aec00741998d44f1eafbc6451400dc235b7d4
MD5 cc1b73970e112a3fc92bf63f557b06fc
SHA1 a044d68d6f949186204d9377acc462ada28306a5
SHA512 0c10776712664835e9244a3c28683eb0f474ebe18dfff1116b1dd6b0288e462e3fdea9f15d4a083c1979d0665f0d17d2ed88fe26620f75883248748560886932
SSDEEP 6144:lHV6/UaVfV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:lazs/NcZ7/NZ
TLSH
T19494A4266A302AE5DDED1BB5AC5209D88181E9F119F1E93E6133DFDCC8E4DA5CC44F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fbiooolb.exe

Path C:\Windows\SysWOW64\Fbiooolb.exe
Size 412KB
SHA256 122cb8608e51145517d2eb15c96abb1eeed5fc3946605b46da9e21bf84cdf774
MD5 cd714f1a4cecf76e11d9edc388d6d9a5
SHA1 5e9825401622df9933c23e6becd3e81c34a6f645
SHA512 dfd2795067f9f91aa52fb5562d2940999d04ad1cc00067b67b438e8040ce39c0e492f9614f82770fb1ad0f66ce6a55db3ff9937c04977ba471e5115f5c3b3473
SSDEEP 6144:tHEjfV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:tP/NcZ7/NZ
TLSH
T1FC948225667819E9DDED1BB5AC028DD88186E8B114F1F13FA133DFDCC9E4DA2E814B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ffbnin32.exe

Path C:\Windows\SysWOW64\Ffbnin32.exe
Size 412KB
SHA256 c4bb72249d18bd96364ae7b139d0366eb6641b84403f397988bf6d5dc3ef3142
MD5 58c0a46b75074e5d5afd2e617c22fc99
SHA1 938cea994220b7d81ceec3753ec72eb1457d69b4
SHA512 008e15ff439fc12a397b6fdeb5b7eb9bf56190ae29d172705af2c1ea9fa76103083b6b229041bd154a34695cfbf940522344305f34c70926316e390fef6eaa10
SSDEEP 6144:V1zlWi9fV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:V1z0iw/NcZ7/NZ
TLSH
T1F59482652A3019EADDFD1BB5AC5209D88181E5F124F1E13E6933DFDCC8E4DA6C998F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ficgkico.exe

Path C:\Windows\SysWOW64\Ficgkico.exe
Size 412KB
SHA256 a8bc11154a410280879fb6537bef5261184eb702e104e834f518c704550f4c36
MD5 2af79e636f4f8270d2b0cf4e7bc18ea3
SHA1 20ee86f5a3254f514090e231aa73846e9e054dea
SHA512 4fb1f5b8ca2b02f91b96e1850229dd563d34a3dd2cc88ff82536b8da5fb0e9b4da86debe4c67933c8366d2ea0c5c2feae51bf1242bc87f1aa2d9ccb0c71a3ee8
SSDEEP 6144:o7E6mRBgV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:EE/h/NcZ7/NZ
TLSH
T19A9472256A3059E6EDED1BB5AC124AD94181E9B118F1E23E9173DFECC8F4DA6CC04F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fmapag32.exe

Path C:\Windows\SysWOW64\Fmapag32.exe
Size 412KB
SHA256 44c368beb8743067720c510df57aed076301917bfc8e48777c1cf9aeb23cf257
MD5 790f146037619a7470ae00a388da68bd
SHA1 c822d2e647ed37634bfa071c3bfa50788662cdd2
SHA512 9ffec08feaab3f8bdbfd4c8e7da95594d518f65ef847fbeac63d852289fcbc27ad29e8b7881101b7539060562e8ef91294fd08c23fa813b662594f294de06f82
SSDEEP 6144:LAGXqhV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:LAGXt/NcZ7/NZ
TLSH
T1D69492256A7419EADEED2BB5AC0209D98181E9F114F2E13E6533DFDDD8E4DA2CC04F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fofigd32.exe

Path C:\Windows\SysWOW64\Fofigd32.exe
Size 412KB
SHA256 007644adf6a36916f75f472ca27d0f8fb0800abbddfb1d263ddedef82a56d5cb
MD5 cbfe431d0d2f220243e6068acedfe865
SHA1 87ed4f8985ac58983d01dd6a83139c1e783be190
SHA512 3fe19f3f4744d6ed82df78cd7e35a894f6eb0073f6712420b5e9e0dfac1c083c1c6ea047c92146101cad21f8be56f069115e2b67d9c478ef4e9cb2b65c1f3015
SSDEEP 6144:elc0EV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:eL/NcZ7/NZ
TLSH
T1889472692A341EE6DDED1BB5AC5209D89181E9B218F1F13EA233DFDCD8E4D61C814F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gcdkdpih.exe

Path C:\Windows\SysWOW64\Gcdkdpih.exe
Size 412KB
SHA256 2219fa9d2eadc93903b24a1ddaf52e9e0c798f34dd95c7f97dbf1a7eebaf5ca0
MD5 32e423bebba1996ea5c42cc6acceccf4
SHA1 6101632bb5ed659fda27beaccd6719bdb627262c
SHA512 86e30b4fd9bfc22379eb1951aeb4e2e6cef508b75a31e9af4ab7aac69acb6aec2ff9d6cbaf6c723539f58d9fe85e241cd08b90c224fa2031ab4108544faeb3bf
SSDEEP 6144:/BtbrV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:pw/NcZ7/NZ
TLSH
T1539493692A3019E9DDED9BB9AD1269D88281E5F115F1E13E6133DFDCC8E4DA2CC04F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gfedfk32.exe

Path C:\Windows\SysWOW64\Gfedfk32.exe
Size 412KB
SHA256 9d3e9af8fcfc68e443526bfeb8938b30eb3daeeb95e1fc509b4d05fb0c174e3e
MD5 bd3406e2bba8624115a06fe70648fb36
SHA1 4c6ad4ae30ee1f9b48ab874e5d975f482cd6339b
SHA512 1b0211b2332d93ca22b9514aab924af6b87c65b10a293a49169d9f6265221c1c241def19333503e28f00905dc96e97ec920137afb9e1d1a267d128769446cd89
SSDEEP 6144:MQ6GOQsNV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:BOQT/NcZ7/NZ
TLSH
T117946F696A3419EADDFD1BB5AC524AD88181E9B125F1F13E6133DFDCC8E4DA2C804F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gfnnel32.exe

Path C:\Windows\SysWOW64\Gfnnel32.exe
Size 412KB
SHA256 5843e48366c590c915b4f297747765d8a0536033018dc8e80c5fb98d4f40d062
MD5 6b16ec78d61ac080b25c38bb8f815982
SHA1 d1ffb16b89d73295131ee9210a3eb66dbffcc024
SHA512 0cdca8c96d4053b0cd48c4910cc7a099ced19e9ae8f4fb7e46226a4560dea997fdec218d2118ee4fc764d7d1d2cfaa124efdcc69fa88bc03f3f29ed054da41f6
SSDEEP 6144:Rk+db28V/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:R5q/NcZ7/NZ
TLSH
T1A59492A92A3019EADDED1BB6AC0249D88185E9F114F1F13E6533DFDDC8E4DA9C804F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gmfilfep.exe

Path C:\Windows\SysWOW64\Gmfilfep.exe
Size 412KB
SHA256 0901469741a14a14c791ea55e84578873143f9bc88fa61a7b45cd638a8517abb
MD5 cdb48ba56e23d2cc1c42fb2133be851d
SHA1 35554797e3dd893e982020df9bb7f790af929ddb
SHA512 2c0fcbdf05d1de5767850899881d07d82fa85bde0fa2d8603ab0a1378f35787b01e2ee0d784b9fc5f7b81e1e991d8daef86f1be39a3ec37604c9f507d2a8c85e
SSDEEP 6144:HPwcJGV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:1h/NcZ7/NZ
TLSH
T17A946169AA3019EADDED1BB5AC1249DC9181E9B114F1F13E6133DFECC8E4DA6C805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gmkbgf32.exe

Path C:\Windows\SysWOW64\Gmkbgf32.exe
Size 412KB
SHA256 0a655cb9897df7686a2414f1fb6def8f0fdbf894cfe4cfc06a3d7e6b0204d42e
MD5 2c814812ae657cdc6de6aa5235bd1820
SHA1 4e9bc1e224b1ead6729dff5b1f39dd31f260c7f1
SHA512 94ba2bd093da1696f2837adf28a9901a524926af333509b94d23b58dfa53630c6782d81bd7406cce87366fb398d6185369bd94a8fb86abbca594b2196c3ff96c
SSDEEP 6144:jYb+nCPsXrJV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:kb+ng/NcZ7/NZ
TLSH
T19E9460266A3019EADDED2BF5FC5259D88181E9B115F1E13E6133EFDCC8E4DA6C804B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Habndbpf.exe

Path C:\Windows\SysWOW64\Habndbpf.exe
Size 412KB
SHA256 30ceb16874ca0f36fdb6c2e56a67913785f0bc32d81392c983ce4e6b0b9ad95d
MD5 912a1d3738a2acfa13b447d1de301849
SHA1 680a3aa69033f0d1579541383a2b118d4bb01487
SHA512 81c82f7bfa7775e45982eb02a4834712f343994696067de4aff73859ab2ebf2343fd62645ac9ddfc1e45182a14e60685756a61b67f7cafcb030f34e046746946
SSDEEP 6144:HZFZepI/V/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:HZFMb/NcZ7/NZ
TLSH
T127945F666A3019E6EDED1FF5AC1249DA8181E9B114F1E13E7133DFDCC8E4EA6C904B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hameic32.exe

Path C:\Windows\SysWOW64\Hameic32.exe
Size 412KB
SHA256 d3834dc43c752a351fb2b16f11be39d81ce408f4a1b9c12c790ca3175d0e2804
MD5 ee6f5d8b9715fc866251f89616deae0c
SHA1 c04904f5bed69aa87706a044acd76e1b20fc48cf
SHA512 50b18b34de8d9eba9591109f06e956f1e51b14367cb02668e7dcf03b0ef140f008751079aeeea93e2d804e8f4044d775145b59873bf56452d26e34e78d0014af
SSDEEP 6144:GXkO1V/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:I8/NcZ7/NZ
TLSH
T1199470296A305DE6DDED1BB9FC0259D84181E9B118F5E63E6133DFDCC8E4EA1C804B92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hbcklkee.exe

Path C:\Windows\SysWOW64\Hbcklkee.exe
Size 412KB
SHA256 6851d5cf9fa6313ded9add50c6e30ed718b53e8982048ee6f1671101ae090555
MD5 cb973f6022df39c1935e393dc37e8660
SHA1 f949b9a2badca88bad1fd7c5fa15ef3e413c6364
SHA512 fb49c12f747b4fa11b31b87465a5ce5f44586607e829290cb1666f310cd9c47df345c2916d3b6d948419a45262d9216a3449905628a3213597d12730e071a494
SSDEEP 6144:GSUsV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:Gn/NcZ7/NZ
TLSH
T1529491256B3059EAEDED1BB6AC0219D88581E9F114F1E13E6173DFDCC8E4D66C80AF84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hcbgen32.exe

Path C:\Windows\SysWOW64\Hcbgen32.exe
Size 412KB
SHA256 ab6cfee26d7b3ab69a6001f4df70f351bcf1412145cb0061e9d72044611e124a
MD5 67dc1b8a5905317f59ff50b8b88ddc58
SHA1 45560dd76d1a7cef4ade6e56f77732f3bec60864
SHA512 6440754e2a20bbe06f37461874f6addcf28f42a9bd76d073b8a33ef64ea775e02838f57c99fb934c46accf7563ccc9e08531aff51a600e7ff27d3939fb932c3c
SSDEEP 6144:sMnGsSweqV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:sSH8/NcZ7/NZ
TLSH
T1579481692A3059E6DDED2BB5AC124AD881C1E9B114F1E13E9133EFDCC8E5DA9DC44F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hcnnjoam.exe

Path C:\Windows\SysWOW64\Hcnnjoam.exe
Size 412KB
SHA256 d17e29725db956132c5b5f9c59bf117deafa10c252f782d50c6f99bb15ea5ef9
MD5 729eec3749621de634b8e806fc887546
SHA1 01a8ee13ff2fab38503684b678b9cfb8dad74e3f
SHA512 b7870aa236f996da974c5fe5defd96bb44b9b8b90ec9ff5befb44136d1dd24e3c2c5b551ae4f84f0e726bd15b2057ee486b485ab089889d84c92caa23bcdd812
SSDEEP 6144:l0csJV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:e8/NcZ7/NZ
TLSH
T11694626A6A3019E5EDEE1BB5AC0249D881C5E5B218F5F13E5133DFDCD8E4DA1CC09B82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hfacai32.exe

Path C:\Windows\SysWOW64\Hfacai32.exe
Size 412KB
SHA256 9caf948b40fd6b7e9e88f5f15b87a3688653c59b548330b998f8fb62577ce687
MD5 44919a1eab89c05b2907fcb4c67699c7
SHA1 eaae2fe0ecfb91f7f1de95f14e7a469664105df6
SHA512 868bf3cf84b19921a7a2e5c81e4424168e31ee8d452d52b05b196add4c917ae4f96f186931b144605a47b5fe160816d1a95250ed68f36454079a41801b81e715
SSDEEP 6144:lvUDAjTP2V/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:iDAPT/NcZ7/NZ
TLSH
T1919484696A341DE5DDEE1BB5AC0209E89281E9F115F1E13E6133DFECC8E4DA6D804F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hfjmajbc.exe

Path C:\Windows\SysWOW64\Hfjmajbc.exe
Size 412KB
SHA256 919f5bd9b5baa08134f19f17aab5e78aec675f1b8733bb4b276779769cdee9c4
MD5 ac384d48f0a27184e654ffd782f48299
SHA1 ef6e21e434b0779250cefcfabe5fe1c470d11e2a
SHA512 4fde43e855e0a960e1d0d0780807f0d75bbab00c8d4805e4f844b76bb2b49f965e81ef0cc9ef79201c574e07c3ca17298a0b87c4ce73a5af931af4f79a0012c5
SSDEEP 6144:8QlPgV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:8Qlx/NcZ7/NZ
TLSH
T16E94A229AA7059E6DDED1BB5AD5249D89281E9F114F0E13F6133DFDCC8E4DA2C808F84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Himche32.exe

Path C:\Windows\SysWOW64\Himche32.exe
Size 412KB
SHA256 d53a5a9246c7c226735d17b130bf1a5aaad4f468c933ccc3a3fed34039321717
MD5 29e03380fa8c191e22e39cb26e4b2027
SHA1 36176612d41a7eb6389a8209c61caf428bfd7eed
SHA512 abb979ec86e2cfcc5956a1f3a41a1b40a47b1468726fbb0abfdb5d3646937d0b251fadef8db56d0dd2a0962146df807389b56fe32b479dbfb31ad800b481c740
SSDEEP 6144:SSQoYFdB4Pj9MOWf0YV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:S0jMdS/NcZ7/NZ
TLSH
T1AA949429AA3019E6DEED1BB5AC1209D89181EAF254F5E13E6537DFDCC8E5D62CC04F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hjhfgi32.exe

Path C:\Windows\SysWOW64\Hjhfgi32.exe
Size 412KB
SHA256 ab79ca423d979708d4ba064fe0e33988bbf5b194b008c71c086320698028d5ef
MD5 43a59c4c58e7c7ca786951d41774dfe7
SHA1 ebf62d82062c3c5dd822cb6a1a9cb10409957591
SHA512 ab033225c218e5445eea172d04a2397eed3568a8eb4872aecc49afc2bb97608fc6be60cf5338e4e55d0bc009bd6a0c8185d69e3d579fb327644b68ad02f04786
SSDEEP 6144:jajcwGsV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:jaG/NcZ7/NZ
TLSH
T18194826AAA3019E5DDED1BB5AC1209D881C1E9F114F2E13E6133EFDDC8E5DA2C805F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hmdend32.exe

Path C:\Windows\SysWOW64\Hmdend32.exe
Size 412KB
SHA256 d5dfbdc8de28d3f35d25f3e9bb8a401b417286c247a5baa4e91441d4ad882327
MD5 3f41e6704693bc4469ad8c4ae6db4461
SHA1 a8c87983211ac5d5497ef44dc68a1d9e92fd6b6b
SHA512 52741496d298efaf161a3939dc2aef8e1feb1c37d9d133b7448731d0a28bdc14588bc8b5324f16e6a4a8ca8ade86e9b28bd723f8c497165b2345079739f76d5f
SSDEEP 6144:1NnxqIV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:1NnG/NcZ7/NZ
TLSH
T1749482256A3019FADDED1BB5AC124AD88181E9F514F1E13E6933DFDCC8E4DA2D884F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Iafgob32.exe

Path C:\Windows\SysWOW64\Iafgob32.exe
Size 412KB
SHA256 caba01e902f381b97d6adc9cf404ed889d656cc26a1871ce5fd005f4058346d3
MD5 600732844d9d74cff51b8c0817e01916
SHA1 185348057c637ba622620c1003e129ed665cd42e
SHA512 d2fd58753c64228bc85feae2318fadc419cab1c67424f0bb2b402567e12a0e5ba987b3452ff111722416d77cd6863f8351431d443d3714a0a84a276607df281d
SSDEEP 6144:rUgi9ot7VJEStV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:rULWs/NcZ7/NZ
TLSH
T1029460656B301AE9DDEE1BB5BC1209D88285E9B214F1E13F6133DFDCC8E4DA6C845B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Iaiddajo.exe

Path C:\Windows\SysWOW64\Iaiddajo.exe
Size 412KB
SHA256 626224956d5bedab7f6145816c77211eda400a2e2b5d32fad98cb3ac5d318486
MD5 098a9c8cb7bfe20114a57036396c8037
SHA1 2f7d1e921c702a8c6734bdc3eea28c3e9efaf138
SHA512 e2e605856c58195837d19125c3ba1d0becaa339bbb14f6a69933896d4f0fc3a1104379e1b66b1e6e1cfebbd92776a01675e35c6aefdf5050db5e2c3b5e6c542a
SSDEEP 6144:Ue4td06eV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:UemX/NcZ7/NZ
TLSH
T1A89460692A701AE6EDED1BB5BC2209D88181E9F114F1E13E6533DFDDC8E4DA2D844F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Iakajagl.exe

Path C:\Windows\SysWOW64\Iakajagl.exe
Size 412KB
SHA256 7332c6262fbcc4d2ad0afffa0309d5071b16d9f3d68c55d4e799648c9fc15f87
MD5 79e1fef5e1b7523ecebc71741c6f71b2
SHA1 9b91d9db47d511d3864a8d3273a03bf52235aa3c
SHA512 a075708f0155b840fb717527ec21a399945567864b3e89f4b8769885fa6070f5d97157c3f7be90d90f8261031e5c8376a95dd9f0c447a7bae9917b4e423b5bb4
SSDEEP 6144:/0kd+YgfLV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:/0sZR/NcZ7/NZ
TLSH
T17A9482652A311AEADDED1BB5AC4219DE8185E5F114F2E53E6173DFDCC8E4DA2C808F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ibjqlj32.exe

Path C:\Windows\SysWOW64\Ibjqlj32.exe
Size 412KB
SHA256 28029cb69ab5fc38c93a3c4a4f82ecf1397c81f0ff79b1068fab567d1263482a
MD5 5104e6e8c32be05d51547409c2f974e4
SHA1 0492926ebbdafa9f52fd6d208ae15ec059954c5d
SHA512 3c6535f7d30181ef9eae38646477cc303574b625b6b8fd36e68b08d67c2ae1fce44ffa6d6f32f6f3f44cd78461e2390f926334cba28e9948811b070a78231b19
SSDEEP 6144:3CKpkIkpVsV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:35prkR/NcZ7/NZ
TLSH
T107946F256E3019EADDED1BB9AD1249D891C1E9B118F1E17EA533DFDCC8E4DA6C804F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Icedkn32.exe

Path C:\Windows\SysWOW64\Icedkn32.exe
Size 412KB
SHA256 7a7cb66ae94bdb3d2120b372408cc378127be109a7ffa6a5260c252ea1ac23e7
MD5 da8259bfa2015d07f6872d2ee4db0d5c
SHA1 aef6accda9507fe98fe501a1f98e3f3296d72016
SHA512 ae7bf129fdfe6b40ce76d78ac70dfdc870136e3a3fd6eecba1c9a6c068e9843eadec5cdd7db3087a1cb683e0047de5e5dc669b0dda055ac8c203923288608ecb
SSDEEP 6144:p9JOzbCrV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:pyH/NcZ7/NZ
TLSH
T1BB9483256A302DEADDED1BB9AC1249D88181E9F554F1E13E6633DFDDC8E4DA2C814F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ifhibhfc.exe

Path C:\Windows\SysWOW64\Ifhibhfc.exe
Size 412KB
SHA256 19bd319bc8f8b641a0c1ddc69321e5b7e15f7d4a6a7c4def6a6c3a81c6fefc4a
MD5 afea0f26374ce490016433f69f5ebc6f
SHA1 72842e4ac3d34eac49ffdbc26c645ab9cc07afef
SHA512 195eb4ad0e912cf48bccd19845370b4d8da39cbd6faab0424d81729f0662a0f72084f1b732f6a1ef9948663566b615f683f814e50ae41e2f74025b151cb5467a
SSDEEP 6144:u3JjZYV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:u3JL/NcZ7/NZ
TLSH
T1E0946F696A301AE6DDED2FB6AC0259D88181E9B114F5F13F6533DFDCC8E4DA2C804B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Iidiidgj.exe

Path C:\Windows\SysWOW64\Iidiidgj.exe
Size 412KB
SHA256 37e0dc1e95fec41987f6f69c3bff34aef3eb269898605237c6e1bc0de58ef107
MD5 f43f5d144dc7833d80af36373542669d
SHA1 79458cb48808c7e4a34df1ce38a7410a5616a297
SHA512 db60d6d8c354e3e5399de0b2e6060591b2a8d9374bf091ab646fee79743080806c5b2650967f516494bd6b1aa513e33bfbd8343c1b6ea7f92ab45bff31c596cd
SSDEEP 6144:UOUsHfpI4V/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:UOUCRe/NcZ7/NZ
TLSH
T10194A3292A3019EADDEE1BB5AC1299C88181E9F504F5E17E6133DFDDC9E4E61CC05F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ijolhg32.exe

Path C:\Windows\SysWOW64\Ijolhg32.exe
Size 412KB
SHA256 46bf26714eafb3bfcc7dfa4f7f4b070d624d363b5156019ebca7415d45e3a8c4
MD5 5ed1bf1a9402ec901d0451f6171bcb73
SHA1 9522ea1dca9e07d3e47de7d2d066e328fb4dac3d
SHA512 ad806391bdb4eb5a5b6d35e54abeba3ea4a643fed2a8218bd5321ad3542d43fa9a71912542ef00dd60592183d1843427cfd46213e207dc22eea4d8c904a091e9
SSDEEP 6144:d5JfBUV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:LJfj/NcZ7/NZ
TLSH
T1B094606A6A3419EADDED2BB6AD1249D88181E9F114F1E13E7533DFDCC8E4DA1C804F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ipqnknld.exe

Path C:\Windows\SysWOW64\Ipqnknld.exe
Size 412KB
SHA256 39388aad8438d7fd85b4c138483e44ba6c1c951ee1deb02976c6ea83be1ea9e1
MD5 f21498f58d6f8462b892a48fecac037c
SHA1 c0d28bb0b711794ef531e05ff23c5b8716e8fa71
SHA512 fa77fe19c6ac7ea2c2e8c2351456f347802cca76d1b01197d37ac0072533e72a570184145398ba9d43699c7e74e6b50d7172040e304733596ec9aa3396db6667
SSDEEP 6144:bJZBKMsV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:bvBn/NcZ7/NZ
TLSH
T1CF9482696B3019E6DDED6BB5AC120AD88181E9F114F1E13E6233DFDDD8E4DA1C848F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/408-92-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/576-315-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/728-405-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1160-235-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1204-168-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1300-400-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1352-490-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1356-189-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1396-112-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1444-182-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1488-375-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1508-370-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1532-415-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1680-35-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1680-495-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1728-455-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1740-265-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1788-255-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1800-175-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1828-395-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1844-77-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1940-245-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1944-355-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1952-119-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2044-345-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2100-445-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2196-425-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2232-450-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2244-224-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2388-380-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2392-390-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2468-126-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2492-147-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2584-133-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2604-300-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2676-49-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2676-507-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2720-461-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2780-320-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2832-161-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2928-290-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3088-496-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3108-140-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3204-28-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3204-489-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3252-105-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3324-240-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3332-70-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3380-484-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3388-410-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3428-435-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3436-502-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3480-42-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3480-501-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3540-280-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3620-325-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3648-260-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3704-87-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3836-56-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3984-310-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4112-340-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4136-471-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4136-7-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4152-14-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4152-477-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4168-460-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4168-4-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/4168-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4204-385-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4276-420-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4400-154-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4452-63-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4532-478-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4572-466-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4672-285-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4684-335-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4784-440-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4880-217-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4968-360-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4984-250-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5348-330-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5364-472-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5452-203-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5480-210-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5516-230-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5564-430-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5576-350-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5684-275-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5692-98-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5824-196-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5952-270-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5992-365-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5996-295-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6008-305-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6096-483-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6096-21-0x0000000000400000-0x000000000046D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads