berbew | ff9d59a12f35a2dbb295302fee0c75fb07bebfa159890c09d0bc6b641de5f46e

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 17:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-11_7fbbdf825f57f829d610b1f3a6bac96c_elex_wannacry.exe
Size 412KB
Sample261012-v7temsht2m
SHA256 ff9d59a12f35a2dbb295302fee0c75fb07bebfa159890c09d0bc6b641de5f46e
MD5 7fbbdf825f57f829d610b1f3a6bac96c
SHA1 d128e5d0212d29e919e2bc24ffb9ad0c7a47b4dd
SHA512 cc5c9a7add9e3e4b932af60df1b13b34db46a396a35360873da1414f61cccb7bc16b9736c0e9d06d3de7367392e3a49920d287b741fb07ce6078f3a3731764ba
SSDEEP 6144:gU/S8VaZKfnIpLbHM/lV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:e8EZSIpEQ/NcZ7/NZ
TLSH
T1BF9492296A3019E6DDED1BB5AC0259D88181E9F124F1E17E6533EFDCC8F4DA9C848F81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpoepa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlefebfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nngoddkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njploeoi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olcbfp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojllkcdk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfcmpdjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fcfhhk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jianpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kikafjoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmijliej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmdihgkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdckpqod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njnpie32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olaeqp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hodgei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jlidkh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jpgmaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jlnnfghd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmdqai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Megdmhbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Olaeqp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pckfdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hckjjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hfnpacjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbcmhb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lboeknkf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmdihgkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mikjmhaq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgimmkgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Odocbmfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbgfca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmdqai32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbaiip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfoapo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lplpcc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mipchg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdehep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nlefebfg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jidkek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kboldq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lefkfk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldoadabi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mingbhon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndcdfnpa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgbijg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjeoablq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fooecl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fooecl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hcimei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mingbhon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njnpie32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njploeoi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oncopcqj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqfdgn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jecejm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmijliej.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbebdpca.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocpghj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdkcnklf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpncbemh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kfoapo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pflpfcbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pflpfcbe.exe

Executes dropped EXE 64 IoCs

pid	Process
4764	Fcfhhk32.exe
3496	Fooecl32.exe
2948	Gbpnegbo.exe
5580	Gdqgfbop.exe
5024	Gdeqaa32.exe
3008	Hcimei32.exe
3436	Hckjjh32.exe
1704	Hodgei32.exe
4588	Hfnpacjb.exe
3064	Hkkhjj32.exe
4688	Ibijbc32.exe
5792	Ildkpiqo.exe
5436	Ilfhfh32.exe
2112	Jlidkh32.exe
1496	Jbcmhb32.exe
2524	Jimeelkc.exe
4968	Jpgmaf32.exe
5156	Jecejm32.exe
5452	Jlnnfghd.exe
760	Jbgfca32.exe
2768	Jianpl32.exe
5964	Jcgbmd32.exe
2628	Jidkek32.exe
1968	Kpncbemh.exe
5940	Kekljlkp.exe
5416	Klddgfbl.exe
1168	Kboldq32.exe
1368	Kmdqai32.exe
848	Kbaiip32.exe
4728	Kikafjoc.exe
4528	Kpeibdfp.exe
1292	Kfoapo32.exe
2504	Kmijliej.exe
4608	Kbebdpca.exe
1280	Kipkaj32.exe
2792	Ldeonbkd.exe
2684	Lefkfk32.exe
2412	Lplpcc32.exe
1852	Lffhpnhe.exe
3276	Llbphdfl.exe
1484	Lfhdem32.exe
2008	Llemnd32.exe
2232	Lboeknkf.exe
3028	Lmdihgkl.exe
4048	Ldoadabi.exe
5548	Mikjmhaq.exe
4228	Mdanjaqf.exe
1456	Mingbhon.exe
5584	Mdckpqod.exe
2244	Mipchg32.exe
2428	Mdehep32.exe
2360	Megdmhbp.exe
4844	Mplhjabe.exe
5280	Meiabh32.exe
4976	Mpoepa32.exe
4580	Mgimmkgp.exe
2776	Nlefebfg.exe
4092	Nconal32.exe
1304	Nneboemj.exe
2604	Ncakglka.exe
3164	Nngoddkg.exe
3600	Ncdgmkio.exe
5732	Njnpie32.exe
428	Ndcdfnpa.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Mpdnileh.dll	Lmdihgkl.exe
File opened for modification	C:\Windows\SysWOW64\Ocmjcjad.exe	Olcbfp32.exe
File created	C:\Windows\SysWOW64\Gaplfacd.dll	Pnonla32.exe
File created	C:\Windows\SysWOW64\Jimeelkc.exe	Jbcmhb32.exe
File opened for modification	C:\Windows\SysWOW64\Jidkek32.exe	Jcgbmd32.exe
File opened for modification	C:\Windows\SysWOW64\Kpeibdfp.exe	Kikafjoc.exe
File created	C:\Windows\SysWOW64\Lefkfk32.exe	Ldeonbkd.exe
File created	C:\Windows\SysWOW64\Emfnpejl.dll	Nconal32.exe
File created	C:\Windows\SysWOW64\Nngoddkg.exe	Ncakglka.exe
File opened for modification	C:\Windows\SysWOW64\Ofgmdf32.exe	Npjelo32.exe
File created	C:\Windows\SysWOW64\Dnpjpj32.dll	Oncopcqj.exe
File created	C:\Windows\SysWOW64\Ldoadabi.exe	Lmdihgkl.exe
File created	C:\Windows\SysWOW64\Mgimmkgp.exe	Mpoepa32.exe
File opened for modification	C:\Windows\SysWOW64\Olaeqp32.exe	Ofgmdf32.exe
File created	C:\Windows\SysWOW64\Oggjni32.exe	Olaeqp32.exe
File created	C:\Windows\SysWOW64\Pmmelo32.exe	Pfcmpdjp.exe
File created	C:\Windows\SysWOW64\Klddgfbl.exe	Kekljlkp.exe
File created	C:\Windows\SysWOW64\Fclnkgap.dll	Fcfhhk32.exe
File created	C:\Windows\SysWOW64\Plkoeeae.dll	Mikjmhaq.exe
File created	C:\Windows\SysWOW64\Hjhbmn32.dll	Mipchg32.exe
File created	C:\Windows\SysWOW64\Oikbgh32.dll	Mplhjabe.exe
File opened for modification	C:\Windows\SysWOW64\Nlefebfg.exe	Mgimmkgp.exe
File created	C:\Windows\SysWOW64\Kinnei32.dll	Odocbmfd.exe
File created	C:\Windows\SysWOW64\Fpqone32.dll	Pmoabn32.exe
File opened for modification	C:\Windows\SysWOW64\Fooecl32.exe	Fcfhhk32.exe
File created	C:\Windows\SysWOW64\Mganoh32.dll	Mdehep32.exe
File created	C:\Windows\SysWOW64\Ocpghj32.exe	Oncopcqj.exe
File created	C:\Windows\SysWOW64\Fadnlh32.dll	Pgefogop.exe
File created	C:\Windows\SysWOW64\Gjkmdemc.dll	Fooecl32.exe
File created	C:\Windows\SysWOW64\Kipkaj32.exe	Kbebdpca.exe
File opened for modification	C:\Windows\SysWOW64\Mdckpqod.exe	Mingbhon.exe
File created	C:\Windows\SysWOW64\Ncdgmkio.exe	Nngoddkg.exe
File opened for modification	C:\Windows\SysWOW64\Kboldq32.exe	Klddgfbl.exe
File created	C:\Windows\SysWOW64\Gdqgfbop.exe	Gbpnegbo.exe
File created	C:\Windows\SysWOW64\Occole32.dll	Jpgmaf32.exe
File created	C:\Windows\SysWOW64\Pollccqh.dll	Kpeibdfp.exe
File created	C:\Windows\SysWOW64\Cikmbf32.dll	Kipkaj32.exe
File created	C:\Windows\SysWOW64\Njploeoi.exe	Ndcdfnpa.exe
File created	C:\Windows\SysWOW64\Dacmol32.dll	Pmmelo32.exe
File created	C:\Windows\SysWOW64\Kmdqai32.exe	Kboldq32.exe
File created	C:\Windows\SysWOW64\Ilfhfh32.exe	Ildkpiqo.exe
File created	C:\Windows\SysWOW64\Jcgbmd32.exe	Jianpl32.exe
File created	C:\Windows\SysWOW64\Kncfkjpc.dll	Mpoepa32.exe
File created	C:\Windows\SysWOW64\Hjbepgej.dll	Pfcmpdjp.exe
File opened for modification	C:\Windows\SysWOW64\Ibijbc32.exe	Hkkhjj32.exe
File opened for modification	C:\Windows\SysWOW64\Kekljlkp.exe	Kpncbemh.exe
File opened for modification	C:\Windows\SysWOW64\Lfhdem32.exe	Llbphdfl.exe
File opened for modification	C:\Windows\SysWOW64\Mikjmhaq.exe	Ldoadabi.exe
File created	C:\Windows\SysWOW64\Appgbghf.dll	Njnpie32.exe
File opened for modification	C:\Windows\SysWOW64\Ojllkcdk.exe	Odocbmfd.exe
File created	C:\Windows\SysWOW64\Bkbakm32.dll	Ibijbc32.exe
File created	C:\Windows\SysWOW64\Mklnbgao.dll	Lffhpnhe.exe
File created	C:\Windows\SysWOW64\Npjelo32.exe	Njploeoi.exe
File created	C:\Windows\SysWOW64\Ceaoll32.dll	Ildkpiqo.exe
File created	C:\Windows\SysWOW64\Hapgkmbf.dll	Gbpnegbo.exe
File opened for modification	C:\Windows\SysWOW64\Hckjjh32.exe	Hcimei32.exe
File created	C:\Windows\SysWOW64\Hlnbhlof.dll	Hfnpacjb.exe
File created	C:\Windows\SysWOW64\Hfnpacjb.exe	Hodgei32.exe
File created	C:\Windows\SysWOW64\Kallmekb.dll	Llbphdfl.exe
File created	C:\Windows\SysWOW64\Mdanjaqf.exe	Mikjmhaq.exe
File created	C:\Windows\SysWOW64\Incclnha.dll	Ocpghj32.exe
File created	C:\Windows\SysWOW64\Fndcdafh.dll	Pckfdh32.exe
File opened for modification	C:\Windows\SysWOW64\Gbpnegbo.exe	Fooecl32.exe
File created	C:\Windows\SysWOW64\Cpojik32.dll	Kmdqai32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5520	484	WerFault.exe	177

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jecejm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncdgmkio.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oncopcqj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pflpfcbe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcgbmd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kfoapo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lplpcc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofgmdf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkkhjj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nconal32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olaeqp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fooecl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hodgei32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kboldq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbaiip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kikafjoc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oggjni32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqfdgn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmmelo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mplhjabe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gdqgfbop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlidkh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kekljlkp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kmdqai32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mikjmhaq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdckpqod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocpghj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-11_7fbbdf825f57f829d610b1f3a6bac96c_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ilfhfh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jbgfca32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jianpl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lffhpnhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nngoddkg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njploeoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onekeb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Megdmhbp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hcimei32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldeonbkd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncakglka.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqbdclak.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qfolkcpb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jbcmhb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klddgfbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdanjaqf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mipchg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mpoepa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nneboemj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgefogop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnonla32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fcfhhk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lefkfk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjeoablq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbebdpca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldoadabi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgimmkgp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocmjcjad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojllkcdk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfcmpdjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Meiabh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npjelo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgbijg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdehep32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ildkpiqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jimeelkc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lefkfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjjccl32.dll"	Kbebdpca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gdqgfbop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dciflf32.dll"	Mgimmkgp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oncopcqj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkbeoe32.dll"	Jecejm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plkoeeae.dll"	Mikjmhaq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmagbaih.dll"	Olaeqp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjbepgej.dll"	Pfcmpdjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmcniamb.dll"	Hkkhjj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Llbphdfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pckfdh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	2026-10-11_7fbbdf825f57f829d610b1f3a6bac96c_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gbpnegbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jimeelkc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cikmbf32.dll"	Kipkaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lamofk32.dll"	Lplpcc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lmdihgkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Incclnha.dll"	Ocpghj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fcfhhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lgopofnb.dll"	Jidkek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Llbphdfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nconal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhbgipmn.dll"	Pflpfcbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fooecl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kikafjoc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgimmkgp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kboldq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lfhdem32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmfhigmk.dll"	Oggjni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fadnlh32.dll"	Pgefogop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hcimei32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lffhpnhe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mikjmhaq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oggjni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gdeqaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Occole32.dll"	Jpgmaf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jlnnfghd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mikjmhaq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Odocbmfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agagab32.dll"	Pgbijg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kfoapo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mplhjabe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pgbijg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pgefogop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mpoepa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chmofekk.dll"	Nneboemj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Odocbmfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nngoddkg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hkkhjj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jimeelkc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oikbgh32.dll"	Mplhjabe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ocpghj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbffohcd.dll"	Hckjjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pliidmmf.dll"	Lboeknkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ldoadabi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdanjaqf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elgedm32.dll"	Mdanjaqf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nneboemj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pnonla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fclnkgap.dll"	Fcfhhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eciahbno.dll"	Jbcmhb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chdmqpah.dll"	Kekljlkp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjjdacng.dll"	Ldeonbkd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 4764	1152	2026-10-11_7fbbdf825f57f829d610b1f3a6bac96c_elex_wannacry.exe	89
PID 4764 wrote to memory of 3496	4764	Fcfhhk32.exe	90
PID 3496 wrote to memory of 2948	3496	Fooecl32.exe	91
PID 2948 wrote to memory of 5580	2948	Gbpnegbo.exe	92
PID 5580 wrote to memory of 5024	5580	Gdqgfbop.exe	93
PID 5024 wrote to memory of 3008	5024	Gdeqaa32.exe	94
PID 3008 wrote to memory of 3436	3008	Hcimei32.exe	95
PID 3436 wrote to memory of 1704	3436	Hckjjh32.exe	96
PID 1704 wrote to memory of 4588	1704	Hodgei32.exe	97
PID 4588 wrote to memory of 3064	4588	Hfnpacjb.exe	98
PID 3064 wrote to memory of 4688	3064	Hkkhjj32.exe	99
PID 4688 wrote to memory of 5792	4688	Ibijbc32.exe	100
PID 5792 wrote to memory of 5436	5792	Ildkpiqo.exe	101
PID 5436 wrote to memory of 2112	5436	Ilfhfh32.exe	102
PID 2112 wrote to memory of 1496	2112	Jlidkh32.exe	103
PID 1496 wrote to memory of 2524	1496	Jbcmhb32.exe	104
PID 2524 wrote to memory of 4968	2524	Jimeelkc.exe	105
PID 4968 wrote to memory of 5156	4968	Jpgmaf32.exe	106
PID 5156 wrote to memory of 5452	5156	Jecejm32.exe	107
PID 5452 wrote to memory of 760	5452	Jlnnfghd.exe	108
PID 760 wrote to memory of 2768	760	Jbgfca32.exe	109
PID 2768 wrote to memory of 5964	2768	Jianpl32.exe	110
PID 5964 wrote to memory of 2628	5964	Jcgbmd32.exe	111
PID 2628 wrote to memory of 1968	2628	Jidkek32.exe	112
PID 1968 wrote to memory of 5940	1968	Kpncbemh.exe	113
PID 5940 wrote to memory of 5416	5940	Kekljlkp.exe	114
PID 5416 wrote to memory of 1168	5416	Klddgfbl.exe	115
PID 1168 wrote to memory of 1368	1168	Kboldq32.exe	116
PID 1368 wrote to memory of 848	1368	Kmdqai32.exe	117
PID 848 wrote to memory of 4728	848	Kbaiip32.exe	118
PID 4728 wrote to memory of 4528	4728	Kikafjoc.exe	119
PID 4528 wrote to memory of 1292	4528	Kpeibdfp.exe	120
PID 1292 wrote to memory of 2504	1292	Kfoapo32.exe	121
PID 2504 wrote to memory of 4608	2504	Kmijliej.exe	122
PID 4608 wrote to memory of 1280	4608	Kbebdpca.exe	123
PID 1280 wrote to memory of 2792	1280	Kipkaj32.exe	124
PID 2792 wrote to memory of 2684	2792	Ldeonbkd.exe	125
PID 2684 wrote to memory of 2412	2684	Lefkfk32.exe	126
PID 2412 wrote to memory of 1852	2412	Lplpcc32.exe	127
PID 1852 wrote to memory of 3276	1852	Lffhpnhe.exe	128
PID 3276 wrote to memory of 1484	3276	Llbphdfl.exe	129
PID 1484 wrote to memory of 2008	1484	Lfhdem32.exe	130
PID 2008 wrote to memory of 2232	2008	Llemnd32.exe	131
PID 2232 wrote to memory of 3028	2232	Lboeknkf.exe	132
PID 3028 wrote to memory of 4048	3028	Lmdihgkl.exe	133
PID 4048 wrote to memory of 5548	4048	Ldoadabi.exe	134
PID 5548 wrote to memory of 4228	5548	Mikjmhaq.exe	135
PID 4228 wrote to memory of 1456	4228	Mdanjaqf.exe	136
PID 1456 wrote to memory of 5584	1456	Mingbhon.exe	137
PID 5584 wrote to memory of 2244	5584	Mdckpqod.exe	138
PID 2244 wrote to memory of 2428	2244	Mipchg32.exe	139
PID 2428 wrote to memory of 2360	2428	Mdehep32.exe	140
PID 2360 wrote to memory of 4844	2360	Megdmhbp.exe	141
PID 4844 wrote to memory of 5280	4844	Mplhjabe.exe	142
PID 5280 wrote to memory of 4976	5280	Meiabh32.exe	143
PID 4976 wrote to memory of 4580	4976	Mpoepa32.exe	144
PID 4580 wrote to memory of 2776	4580	Mgimmkgp.exe	145
PID 2776 wrote to memory of 4092	2776	Nlefebfg.exe	146
PID 4092 wrote to memory of 1304	4092	Nconal32.exe	147
PID 1304 wrote to memory of 2604	1304	Nneboemj.exe	148
PID 2604 wrote to memory of 3164	2604	Ncakglka.exe	149
PID 3164 wrote to memory of 3600	3164	Nngoddkg.exe	150
PID 3600 wrote to memory of 5732	3600	Ncdgmkio.exe	151
PID 5732 wrote to memory of 428	5732	Njnpie32.exe	152

C:\Users\Admin\AppData\Local\Temp\2026-10-11_7fbbdf825f57f829d610b1f3a6bac96c_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-11_7fbbdf825f57f829d610b1f3a6bac96c_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\SysWOW64\Fcfhhk32.exe
  C:\Windows\system32\Fcfhhk32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Windows\SysWOW64\Fooecl32.exe
    C:\Windows\system32\Fooecl32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3496
  - - C:\Windows\SysWOW64\Gbpnegbo.exe
      C:\Windows\system32\Gbpnegbo.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2948
    - - C:\Windows\SysWOW64\Gdqgfbop.exe
        
        C:\Windows\system32\Gdqgfbop.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5580
      - C:\Windows\SysWOW64\Gdeqaa32.exe
        
        C:\Windows\system32\Gdeqaa32.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5024
        
        C:\Windows\SysWOW64\Hcimei32.exe
        
        C:\Windows\system32\Hcimei32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3008
        
        C:\Windows\SysWOW64\Hckjjh32.exe
        
        C:\Windows\system32\Hckjjh32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3436
        
        C:\Windows\SysWOW64\Hodgei32.exe
        
        C:\Windows\system32\Hodgei32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1704
        
        C:\Windows\SysWOW64\Hfnpacjb.exe
        
        C:\Windows\system32\Hfnpacjb.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4588
        
        C:\Windows\SysWOW64\Hkkhjj32.exe
        
        C:\Windows\system32\Hkkhjj32.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3064
        
        C:\Windows\SysWOW64\Ibijbc32.exe
        
        C:\Windows\system32\Ibijbc32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4688
        
        C:\Windows\SysWOW64\Ildkpiqo.exe
        
        C:\Windows\system32\Ildkpiqo.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5792
        
        C:\Windows\SysWOW64\Ilfhfh32.exe
        
        C:\Windows\system32\Ilfhfh32.exe
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5436
        
        C:\Windows\SysWOW64\Jlidkh32.exe
        
        C:\Windows\system32\Jlidkh32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2112
        
        C:\Windows\SysWOW64\Jbcmhb32.exe
        
        C:\Windows\system32\Jbcmhb32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1496
        
        C:\Windows\SysWOW64\Jimeelkc.exe
        
        C:\Windows\system32\Jimeelkc.exe
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2524
        
        C:\Windows\SysWOW64\Jpgmaf32.exe
        
        C:\Windows\system32\Jpgmaf32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4968
        
        C:\Windows\SysWOW64\Jecejm32.exe
        
        C:\Windows\system32\Jecejm32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5156
        
        C:\Windows\SysWOW64\Jlnnfghd.exe
        
        C:\Windows\system32\Jlnnfghd.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5452
        
        C:\Windows\SysWOW64\Jbgfca32.exe
        
        C:\Windows\system32\Jbgfca32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:760
        
        C:\Windows\SysWOW64\Jianpl32.exe
        
        C:\Windows\system32\Jianpl32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2768
        
        C:\Windows\SysWOW64\Jcgbmd32.exe
        
        C:\Windows\system32\Jcgbmd32.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5964
        
        C:\Windows\SysWOW64\Jidkek32.exe
        
        C:\Windows\system32\Jidkek32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2628
        
        C:\Windows\SysWOW64\Kpncbemh.exe
        
        C:\Windows\system32\Kpncbemh.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1968
        
        C:\Windows\SysWOW64\Kekljlkp.exe
        
        C:\Windows\system32\Kekljlkp.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5940
        
        C:\Windows\SysWOW64\Klddgfbl.exe
        
        C:\Windows\system32\Klddgfbl.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5416
        
        C:\Windows\SysWOW64\Kboldq32.exe
        
        C:\Windows\system32\Kboldq32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1168
        
        C:\Windows\SysWOW64\Kmdqai32.exe
        
        C:\Windows\system32\Kmdqai32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1368
        
        C:\Windows\SysWOW64\Kbaiip32.exe
        
        C:\Windows\system32\Kbaiip32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:848
        
        C:\Windows\SysWOW64\Kikafjoc.exe
        
        C:\Windows\system32\Kikafjoc.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4728
        
        C:\Windows\SysWOW64\Kpeibdfp.exe
        
        C:\Windows\system32\Kpeibdfp.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4528
        
        C:\Windows\SysWOW64\Kfoapo32.exe
        
        C:\Windows\system32\Kfoapo32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1292
        
        C:\Windows\SysWOW64\Kmijliej.exe
        
        C:\Windows\system32\Kmijliej.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2504
        
        C:\Windows\SysWOW64\Kbebdpca.exe
        
        C:\Windows\system32\Kbebdpca.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4608
        
        C:\Windows\SysWOW64\Kipkaj32.exe
        
        C:\Windows\system32\Kipkaj32.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1280
        
        C:\Windows\SysWOW64\Ldeonbkd.exe
        
        C:\Windows\system32\Ldeonbkd.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2792
        
        C:\Windows\SysWOW64\Lefkfk32.exe
        
        C:\Windows\system32\Lefkfk32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2684
        
        C:\Windows\SysWOW64\Lplpcc32.exe
        
        C:\Windows\system32\Lplpcc32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2412
        
        C:\Windows\SysWOW64\Lffhpnhe.exe
        
        C:\Windows\system32\Lffhpnhe.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1852
        
        C:\Windows\SysWOW64\Llbphdfl.exe
        
        C:\Windows\system32\Llbphdfl.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3276
        
        C:\Windows\SysWOW64\Lfhdem32.exe
        
        C:\Windows\system32\Lfhdem32.exe
        42⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1484
        
        C:\Windows\SysWOW64\Llemnd32.exe
        
        C:\Windows\system32\Llemnd32.exe
        43⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2008
        
        C:\Windows\SysWOW64\Lboeknkf.exe
        
        C:\Windows\system32\Lboeknkf.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2232
        
        C:\Windows\SysWOW64\Lmdihgkl.exe
        
        C:\Windows\system32\Lmdihgkl.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3028
        
        C:\Windows\SysWOW64\Ldoadabi.exe
        
        C:\Windows\system32\Ldoadabi.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4048
        
        C:\Windows\SysWOW64\Mikjmhaq.exe
        
        C:\Windows\system32\Mikjmhaq.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5548
        
        C:\Windows\SysWOW64\Mdanjaqf.exe
        
        C:\Windows\system32\Mdanjaqf.exe
        48⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4228
        
        C:\Windows\SysWOW64\Mingbhon.exe
        
        C:\Windows\system32\Mingbhon.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1456
        
        C:\Windows\SysWOW64\Mdckpqod.exe
        
        C:\Windows\system32\Mdckpqod.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5584
        
        C:\Windows\SysWOW64\Mipchg32.exe
        
        C:\Windows\system32\Mipchg32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2244
        
        C:\Windows\SysWOW64\Mdehep32.exe
        
        C:\Windows\system32\Mdehep32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2428
        
        C:\Windows\SysWOW64\Megdmhbp.exe
        
        C:\Windows\system32\Megdmhbp.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2360
        
        C:\Windows\SysWOW64\Mplhjabe.exe
        
        C:\Windows\system32\Mplhjabe.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4844
        
        C:\Windows\SysWOW64\Meiabh32.exe
        
        C:\Windows\system32\Meiabh32.exe
        55⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5280
        
        C:\Windows\SysWOW64\Mpoepa32.exe
        
        C:\Windows\system32\Mpoepa32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4976
        
        C:\Windows\SysWOW64\Mgimmkgp.exe
        
        C:\Windows\system32\Mgimmkgp.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4580
        
        C:\Windows\SysWOW64\Nlefebfg.exe
        
        C:\Windows\system32\Nlefebfg.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2776
        
        C:\Windows\SysWOW64\Nconal32.exe
        
        C:\Windows\system32\Nconal32.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4092
        
        C:\Windows\SysWOW64\Nneboemj.exe
        
        C:\Windows\system32\Nneboemj.exe
        60⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1304
        
        C:\Windows\SysWOW64\Ncakglka.exe
        
        C:\Windows\system32\Ncakglka.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2604
        
        C:\Windows\SysWOW64\Nngoddkg.exe
        
        C:\Windows\system32\Nngoddkg.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3164
        
        C:\Windows\SysWOW64\Ncdgmkio.exe
        
        C:\Windows\system32\Ncdgmkio.exe
        63⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3600
        
        C:\Windows\SysWOW64\Njnpie32.exe
        
        C:\Windows\system32\Njnpie32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5732
        
        C:\Windows\SysWOW64\Ndcdfnpa.exe
        
        C:\Windows\system32\Ndcdfnpa.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:428
        
        C:\Windows\SysWOW64\Njploeoi.exe
        
        C:\Windows\system32\Njploeoi.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1352
        
        C:\Windows\SysWOW64\Npjelo32.exe
        
        C:\Windows\system32\Npjelo32.exe
        67⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1812
        
        C:\Windows\SysWOW64\Ofgmdf32.exe
        
        C:\Windows\system32\Ofgmdf32.exe
        68⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4460
        
        C:\Windows\SysWOW64\Olaeqp32.exe
        
        C:\Windows\system32\Olaeqp32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:480
        
        C:\Windows\SysWOW64\Oggjni32.exe
        
        C:\Windows\system32\Oggjni32.exe
        70⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1552
        
        C:\Windows\SysWOW64\Olcbfp32.exe
        
        C:\Windows\system32\Olcbfp32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3256
        
        C:\Windows\SysWOW64\Ocmjcjad.exe
        
        C:\Windows\system32\Ocmjcjad.exe
        72⤵
        System Location Discovery: System Language Discovery
        
        PID:5684
        
        C:\Windows\SysWOW64\Oncopcqj.exe
        
        C:\Windows\system32\Oncopcqj.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2920
        
        C:\Windows\SysWOW64\Ocpghj32.exe
        
        C:\Windows\system32\Ocpghj32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4364
        
        C:\Windows\SysWOW64\Onekeb32.exe
        
        C:\Windows\system32\Onekeb32.exe
        75⤵
        System Location Discovery: System Language Discovery
        
        PID:3004
        
        C:\Windows\SysWOW64\Odocbmfd.exe
        
        C:\Windows\system32\Odocbmfd.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:2552
        
        C:\Windows\SysWOW64\Ojllkcdk.exe
        
        C:\Windows\system32\Ojllkcdk.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3024
        
        C:\Windows\SysWOW64\Oqfdgn32.exe
        
        C:\Windows\system32\Oqfdgn32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4308
        
        C:\Windows\SysWOW64\Pfcmpdjp.exe
        
        C:\Windows\system32\Pfcmpdjp.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2308
        
        C:\Windows\SysWOW64\Pmmelo32.exe
        
        C:\Windows\system32\Pmmelo32.exe
        80⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4300
        
        C:\Windows\SysWOW64\Pgbijg32.exe
        
        C:\Windows\system32\Pgbijg32.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4292
        
        C:\Windows\SysWOW64\Pmoabn32.exe
        
        C:\Windows\system32\Pmoabn32.exe
        82⤵
        Drops file in System32 directory
        
        PID:2564
        
        C:\Windows\SysWOW64\Pgefogop.exe
        
        C:\Windows\system32\Pgefogop.exe
        83⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5704
        
        C:\Windows\SysWOW64\Pnonla32.exe
        
        C:\Windows\system32\Pnonla32.exe
        84⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5820
        
        C:\Windows\SysWOW64\Pckfdh32.exe
        
        C:\Windows\system32\Pckfdh32.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6024
        
        C:\Windows\SysWOW64\Pjeoablq.exe
        
        C:\Windows\system32\Pjeoablq.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1300
        
        C:\Windows\SysWOW64\Pdkcnklf.exe
        
        C:\Windows\system32\Pdkcnklf.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4396
        
        C:\Windows\SysWOW64\Pflpfcbe.exe
        
        C:\Windows\system32\Pflpfcbe.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5464
        
        C:\Windows\SysWOW64\Pqbdclak.exe
        
        C:\Windows\system32\Pqbdclak.exe
        89⤵
        System Location Discovery: System Language Discovery
        
        PID:4472
        
        C:\Windows\SysWOW64\Qfolkcpb.exe
        
        C:\Windows\system32\Qfolkcpb.exe
        90⤵
        System Location Discovery: System Language Discovery
        
        PID:484
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 484 -s 448
        91⤵
        Program crash
        
        PID:5520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 484 -ip 484
1⤵
PID:5760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Fcfhhk32.exe

Path C:\Windows\SysWOW64\Fcfhhk32.exe
Size 412KB
SHA256 2f038f3ae36e5b2b777992e85640a6562d0237326c8f6254a33e1ded3ceee25e
MD5 9ce2d8b2b80a9d32b27d67550486bf8e
SHA1 a1f38360a956be2f294d36f2d81a61686854b9cd
SHA512 091581bded4f9a40902dcdb636b66e74afed96ad0bc13fdca88fa17289bcfd23267c02b78b24738f727f1de7e33062c9130110aec98f845f44e91f0155e3d692
SSDEEP 6144:UbRSHt0L6zV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:Ub4OLb/NcZ7/NZ
TLSH
T1769494696A3019E9DDED1BB5EC1249D89285E9F118F1E13E6233DFDCD8E4EA1C804F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fooecl32.exe

Path C:\Windows\SysWOW64\Fooecl32.exe
Size 412KB
SHA256 dd8984d28cefb315dea8994c2b3179f9dab4785a3eb3013e0acd517d8a431e56
MD5 fd7afdcf5a0f13518b83aa6ec0dd2199
SHA1 0145ac985d4239ddab7773ada58cb8b30f5c6c4d
SHA512 3498b0eae728c71bb6b4c2ed638913b7ca1ecab881bf9b86e9371de9f2c3b9d14528eadd072333c6631308386df4c27a7546006e576077c017bef7bed86423a3
SSDEEP 6144:hYgdjjmqV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:hYgM/NcZ7/NZ
TLSH
T1619482656A3419EADDED5BB5EC1209D88681E9F154F1E13E6233DFDCD8E8DA2C804F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gbpnegbo.exe

Path C:\Windows\SysWOW64\Gbpnegbo.exe
Size 412KB
SHA256 452fa8007d76b78db6f7fe37510f1eaa67a15cde893b5dca3193dd1c474c1473
MD5 62859de688358620e4ffb579c90fed71
SHA1 41eddbf352fd1c7a62aeb03e9863851d30888549
SHA512 23048015f628df3eee367d8705b7647ba2eaecdc8a0e613b7b2c0cb62f4e566eb66f09421bdc502d30aa2435ec5e82a11061f99f1e2720ff364d8e874fa52c7e
SSDEEP 6144:3EuklOV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:UX/NcZ7/NZ
TLSH
T1199482256A3059E6DDED1BB5AC4249D88181E9F019F5E13E6D33DFDCC8E8EA5D808F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gdeqaa32.exe

Path C:\Windows\SysWOW64\Gdeqaa32.exe
Size 412KB
SHA256 2b1f41b5f4b988eeb375833de5e25f227d3ca8a2ca1ca12d90ddb9d5346a438a
MD5 09fa1bfbcb9c4f211e4efcb3b2a71c0f
SHA1 4f556ccaed253c2df35852bd32f74947687c679e
SHA512 e760974da6f326cc3dc59fe64f92f9d20ca65c34feea08d939619b1639fd7d1cf9cd01fc0e34390fc81b07e0314fd005f029d0bb31a03d733c4842f4e2e0686c
SSDEEP 6144:z+I20dV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:z+r/NcZ7/NZ
TLSH
T17C9461296A3019EADDEE1BB5AC1249D98181E9B614F1E13E6133DFDCD8F4DA2C804FC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gdqgfbop.exe

Path C:\Windows\SysWOW64\Gdqgfbop.exe
Size 412KB
SHA256 e6db8a8b3bd4f040bf00d7c875da6ec1e50885a945efe0e343a73a00745d1fe1
MD5 52be4baf4168edbbe29155c04bba6823
SHA1 63d79f8183968c09f6dab2305718efc1ae15f9e4
SHA512 db32f3a5e744c4f0105a5dc6c4040f847480fab5632e5afa5226224c0cef198086cacbe0156a50ce79ba23d2b6b60ddcf40eceb5d24540ea93dc38d256044519
SSDEEP 6144:AggTxLXuG8V/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:AggTxjt/NcZ7/NZ
TLSH
T1759480652A7019EADDED5BB6AC1249DC8181F9B114F1E13E6233DFDCC8E5DA2C809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hcimei32.exe

Path C:\Windows\SysWOW64\Hcimei32.exe
Size 412KB
SHA256 584263f908f4ff89eaad2822fedda7182067595d337314741ead37aa93bda825
MD5 bdea1f55900654d4ba3a99f75845b2a8
SHA1 27d61219ea3e2ce298ef3cc789e9e761865d56bd
SHA512 511a964347defd8ccfdfac3b3dd4877e3d0a8ba24efc92235a8c4118f8982dc2019620d3acc8f5115094ff4423a4723db48f0a775b9b68d74943b947c6d5a223
SSDEEP 6144:JSmTV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:8T/NcZ7/NZ
TLSH
T1F99482296A301AE6DFED1BF5AC1249D88181E9B104F5E1BE6137EFDDC8E4DA1C805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hckjjh32.exe

Path C:\Windows\SysWOW64\Hckjjh32.exe
Size 412KB
SHA256 ce70c603dfaa7096524071ef429f50defd41c99560ad5852d6af50185fdb8864
MD5 53db963523fdcb349355afef84a74336
SHA1 ed4427a0389d798ae035ee20a1815e46c85b25ec
SHA512 11c96e12d2e6d6c719ee09f0aafd7f3919da29df287a49094230f2f41a80e1e812fb85bcb16168cf39d64bd69b678c6b01ba281723a92214184b11348a8ae5d6
SSDEEP 6144:73thFLRlBV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:RzRe/NcZ7/NZ
TLSH
T1059460266A3419E6DDED5BF6AC1249D89181E9F114F1E23E6233DFDCC8E4DA2CC05B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hfnpacjb.exe

Path C:\Windows\SysWOW64\Hfnpacjb.exe
Size 412KB
SHA256 9b398f441e8431fd77e8cf3bc9461b0b666d161fa0fed455e918839bef06f714
MD5 290cf8b4c35c8fd27dde2350ac32ee3c
SHA1 8d4d3ba56bf54863a853770367a8399033f4b6d1
SHA512 0c0324a200bc46f9d09a96dffa0792e6c61b9806e687e63047d5dfb78b1179097339b7b30a58c4bbebc087b65518c82f465d899df9054b235fafd30ea505a74c
SSDEEP 6144:2Px8zoxGdHV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:af/NcZ7/NZ
TLSH
T183945E696A3019EAEDED6FB5AC4259DC8181E9B114F5E13F6133DFDCC8E4DA2C804B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hkkhjj32.exe

Path C:\Windows\SysWOW64\Hkkhjj32.exe
Size 412KB
SHA256 6d606bd56596cc1e14668021eb0c1fed4c9a27e788f519db1e5e040109d5cf34
MD5 aef76a8655d878664d007cb3a83af860
SHA1 c2fa846e3630074a78f69490690ef243a8a218b8
SHA512 3c2fb1cc7d5995f5d1ac26b86d3bbf5c3b6f9a7c7d0d21e8915d88e31c6a69e634426cefcea461d4e33a75b39be428f0a7a32d53f339871beec5cac895da6d2e
SSDEEP 6144:esiFn1JqY3V/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:fITw/NcZ7/NZ
TLSH
T1449484696A3019E6DDED1BB5AC124AD98181E9F214F1E13E6233DFDDC8E4DA2DC05F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hodgei32.exe

Path C:\Windows\SysWOW64\Hodgei32.exe
Size 412KB
SHA256 cda9a608f5cb0ece53b8e27b291bc7305fe25e1c1ce412b5134bc995f53c5ea3
MD5 553e9892bddb1c2af872748b69369873
SHA1 d371684427a459d6b25cde1489d5dfd07cd34e33
SHA512 5e118b0be8a04c8d9f1914094ab8db39f0f5f5a5286a474b548941f4fa4a3ad7065ccc617ffbc2dcbedff4ba014c9cc4d6c2cd96666e17152f7afa59eab29e18
SSDEEP 6144:7LcauwXX4V/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:71uC/NcZ7/NZ
TLSH
T1C29481656A301AE6DEED1BB5AC0259D88181E9F114F1E13E6133DFDCD8E4DA2DC0AF81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ibijbc32.exe

Path C:\Windows\SysWOW64\Ibijbc32.exe
Size 412KB
SHA256 0c03dcea1298bbc4657686892f4032a309b76b2eb73bfe435423fc627cf9e2e4
MD5 a49616efe37c24974ea2fbe216061099
SHA1 4d733c334f3c234f68e1d956ac9a438c5b6f6ef5
SHA512 fbcf68181b340f4ef14af901f2b0d1309a5487b4f52b4beb9e2caa6a49692f0dbb12177163483ba2ca0e20a03c66257aa54b7e490c3811ca52d9370b5bed5b8e
SSDEEP 6144:vUcArcV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:8F/NcZ7/NZ
TLSH
T1699450656A3419E6DDFD1BB5BC520AE88181E5F114F2E13E6533DFDCC8E6DA2C808B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ildkpiqo.exe

Path C:\Windows\SysWOW64\Ildkpiqo.exe
Size 412KB
SHA256 83a4776c44c1bd8a35235fc02450c618fb6f5cce8824fea08d35a9110a7be299
MD5 31fabdac0b7c3f68b9f3782a2123fa70
SHA1 30ecec0692b0eabba8408e026b1016a3a6258b50
SHA512 d285ec291364cef0927d43549a42d78915db57c813c9012fd4db4b098e66d4c3634aee131323de76ecb06d3332046c0f2d1623f412096c032e9e250d3b20d064
SSDEEP 6144:Zoa3pMVQV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:yCpMv/NcZ7/NZ
TLSH
T13F94A4252A3419E5DDED2BB5AC4209E88281E9F614F5E13E6533DFDDC8E4DA6CC04F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ilfhfh32.exe

Path C:\Windows\SysWOW64\Ilfhfh32.exe
Size 412KB
SHA256 f62c07fea02ac6fc1045b6361fe100f50f9e59d570695e7aa8ee05076689046d
MD5 ca7d8e8b3975c994352af3e0c1f67552
SHA1 79f6c0be55fe5a190d7b426504e6cb8318bd56f2
SHA512 20098b4ec30006bbde6b46a23992cf2144de56db0157e79e2048edc54499acb4dc9b9616491299ef3f9d3fba54408c7ac7ed873003796d6b52fa882ca28761c2
SSDEEP 6144:kC0F4lGTV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:DvlH/NcZ7/NZ
TLSH
T1B79481256A305DE6DDED1BB9AC1389D88181F5B104F1E23E6573EFDCD8E4D6AC808B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jbcmhb32.exe

Path C:\Windows\SysWOW64\Jbcmhb32.exe
Size 412KB
SHA256 22f1e3db1c3272522064709ce2ce6dc0a5a0ffc79ce365808a6da1b2e9813daa
MD5 0211a1c73199945425e31d9e522a4a02
SHA1 054a02784362f895a06fc1e2d48547097ed73c29
SHA512 eb0289388b2993f02e3744f8326e7ced02512565adc174da7f9d0c360b3386bda12bd4ae6632a0d3fe394c771ad9460ae31fab719e69b2103a9a44e77cf65da1
SSDEEP 6144:W3wq2V/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:W3wG/NcZ7/NZ
TLSH
T1C19492696A3019EADDEE1BB5AC1249D88581E8F118F5F13E6133DFDCC8E4DA2D804F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jbgfca32.exe

Path C:\Windows\SysWOW64\Jbgfca32.exe
Size 412KB
SHA256 4a6c32b164fe979e34b1179f0ece4abe5ee4bea8ecb8729ef6216c99eff6e637
MD5 327ea5ca9013abc54e2a1b31b4913923
SHA1 1f728bdcbf6352040e561f3b832bd84043b1b321
SHA512 6c3afe2598901d3dbe3f9640bc4ebb0d6a868cda8f0638a3968e6a8f2f02c401abdbc23218bd9cea52d772dd6c6b0052339e4d7514df6a911a0bc9aaeb542369
SSDEEP 6144:mpnM397aV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:ok9D/NcZ7/NZ
TLSH
T13A9492296A3019EADDED1BB5AC124AE99181E9F114F1E53E6133DFDCC8E4DA2DC04F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jcgbmd32.exe

Path C:\Windows\SysWOW64\Jcgbmd32.exe
Size 412KB
SHA256 c7d4c07e3c98a91b67f7ef6a7ceef9f3b18962551c459a0c15ef1a020c373302
MD5 28704a6101260431898ff344206aee47
SHA1 bf6c64d52724491bd0c8e4d9521fba73ca48baa6
SHA512 597c3ef07250dd838c92091d1060ba74a441dd331eed77eaa3897dbd5e028599b139eec23da6aac7835a6b26795c2868ef57bf24f501589d3985ed1422f79053
SSDEEP 6144:JQMnxpojr5EZV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:JQMxpojr5r/NcZ7/NZ
TLSH
T170947F692A342DE6EDED1BB5AC0249D88181E9B115F1F53E6633DFDCC8E4DA2D844F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jecejm32.exe

Path C:\Windows\SysWOW64\Jecejm32.exe
Size 412KB
SHA256 d43ff4f5907fff43b764ae81c936f0ebf18ba0ba53ffeaa4f3818b43ad4ab1bf
MD5 4d1adfdcd4ea8030db1d119ab7f25ebc
SHA1 5e0af4970036e92e27d93fb2ec5dc23279b3f6a0
SHA512 923e5cc21bf48ef6a5c75c0b3a8966a76f0374900422659f140dc24f074519abbd99940e394f169945b076ab48706700fdb4aef504a7b560ec5731f8a9aa1a0a
SSDEEP 6144:qs4O8UV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:DV6/NcZ7/NZ
TLSH
T1709471656A301EEADDEE1BB5AC0349D89181E9B114F1E13E6137DFDCC9E4EA2C804F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jianpl32.exe

Path C:\Windows\SysWOW64\Jianpl32.exe
Size 412KB
SHA256 5f4167250845dac04fe93b955df42260951f8b77d134ffc9627fc03dcdab5371
MD5 bfa0bd99f99f45372e070c43ffa47700
SHA1 781d7a6a3f04317845e2cee92c1c384ba0959e5d
SHA512 3715ee540ce1291b429391024ce8ef18f5e9b9484b6f84a4a71a8c9ad8c63eaf421206bfb7638d77b17c37785fd0697d0b20691a207c92967188296c69ed4a3f
SSDEEP 6144:jk2U1eNV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:gbN/NcZ7/NZ
TLSH
T13C9470657A341AEADDEE1BB5AC1209D88181E9F154F1E17E6133DFDCD8F4DA2C808B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jidkek32.exe

Path C:\Windows\SysWOW64\Jidkek32.exe
Size 412KB
SHA256 53e25d65091f7cb5b876f7026af0a3e16e4c08d18e4327ceadfc9d662bd3c1ea
MD5 8a787f11518fbf4372f66a01ad667fb7
SHA1 047f4eac9f2d1d69acf2c9b52d0d2d0b91cb1748
SHA512 c3c0c3fe19a5d566a8720249e8e7a78082e553d117e677e5431515a8ec37d4a9c0ac583d5ebf9a1d4c3e3ccfae26b8d2a8df6d9892487d4eed334bf383ad1992
SSDEEP 6144:PIHHAtaV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:Aw/NcZ7/NZ
TLSH
T1D19495666A7019E6DEED2BB5AC1249D88181E9F114F1E13E9133DFDCC9E4DA2CD08F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jimeelkc.exe

Path C:\Windows\SysWOW64\Jimeelkc.exe
Size 412KB
SHA256 3e82edd4e62a537dc636056be605f7b88b5d7c8d3aa7e44e802ea4e160a6356c
MD5 e074c93d42d4b9084932e097959f53f2
SHA1 afa44bdf445c65ab34ef5230e819c04f3b464efc
SHA512 05dcf134501153cf9c6c6ff471a5d9f6cc8de19cc0cf4e5433da3c89978669d7008586a5a685142d5e3880d279690728b80c8136ca9d378a0ed1fce4becc0253
SSDEEP 6144:q6ge9o3G9hoV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:q6gW/NcZ7/NZ
TLSH
T17894702A6A3019EADDED1BF5AC1269D88181E9B114F5F13E6137DFDCC8E4DA2D804F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jlidkh32.exe

Path C:\Windows\SysWOW64\Jlidkh32.exe
Size 412KB
SHA256 c31e9985edb909f1a3fdaa182c8251236dd5721326d1c5ca88407c34266abb20
MD5 1371d9bffcb7270aa27cf449f61c702c
SHA1 298782f8b1149372fbaaf9f38f76ad0a4ebfcbad
SHA512 752e4b05b447944bd0815ede6036a2336fadf9c10001b421abf3bc89a3dbe44228b64862f852100d8c727734692adfd43f743913788f0e55db5faa6fe2ce9d71
SSDEEP 6144:Awq+N98+emV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:tqC98N/NcZ7/NZ
TLSH
T1F19481652A3059EADDFD1BB6AC1349D88181E9B514F1E13E6633DFECD8E4DA2C814F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jlnnfghd.exe

Path C:\Windows\SysWOW64\Jlnnfghd.exe
Size 412KB
SHA256 e9a0d0a6b3c76ab3e69afe0a24a398add1b9e883aeea58fdbc5960ab443414a2
MD5 1f6aad20d59eacdc0c28bd27a2e35019
SHA1 88898572a8d2b0e355adb311d86177ee8aac7c7e
SHA512 962f4ad7c3d166623bc98e14773db531d5b0fd1a033170db1a96f76a69081d8e0ebd1b18e40d5d8105ffbde5d04e3ba4ae79aefad78d85dbcbe9b65be5fa70c6
SSDEEP 6144:BqVtcgsEV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:BqcL/NcZ7/NZ
TLSH
T18A947265AA3119EADDFD1BB5AC1249D84181E6F614F1E23E6133DFDCC8E8DA5C808F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jpgmaf32.exe

Path C:\Windows\SysWOW64\Jpgmaf32.exe
Size 412KB
SHA256 9f9b311694625074ad71961eb1bafe7a53bb1776876e90fbbbb5cdc3e2b44485
MD5 9a0fcf45eed515fdf1dcea43d2273117
SHA1 9b05b57bcf37b6cb3836f35694ce027a8ad1ec04
SHA512 aa6c4675ca2d4ada39f8e686159a4cab412893220c200aee6bfebe88c1d8be5246609ca6cb849bd4aa6a727ee514de1385d597bb3cc160ac2a7da27d2c647c99
SSDEEP 6144:snNwPRV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:s/NcZ7/NZ
TLSH
T1C99484656A3819E6DDED2BB6AC4249D88181E5F124F9F13E6533DFDCC8E4DA2C804F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kbaiip32.exe

Path C:\Windows\SysWOW64\Kbaiip32.exe
Size 412KB
SHA256 201b9969a03209ef2ec6c50d2c98a6a5af2a17ecec542115e58f1bdc66e7fdca
MD5 17d186a167f55cf798b9bc004591440b
SHA1 9e55afee10a9a56579433bc0792ca96ccca930f0
SHA512 046d33e2c4b8cc5d94f7e42de8c0fbb1a06b42da7c51689a86fed75299de11e900dd5b8ccc3111639626d0e1a7e956bb251b45ed2676150a49cd229d8766e5b8
SSDEEP 6144:jHss41f1iV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:jHsz/NcZ7/NZ
TLSH
T1EF9482696B3019EADDED1BB5AC1249D88181E9B514F1E13E6133EFDCC8E4EA2DC05F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kboldq32.exe

Path C:\Windows\SysWOW64\Kboldq32.exe
Size 412KB
SHA256 bb21c4fe9cf002d4347150697bbb75296a97eb2801245878b1c80b94a84bed86
MD5 a2a8ea206419f26c85f55caf4d0a0fb5
SHA1 5e00b894c4f292c2a164f0fc9681b90b046e37b9
SHA512 0cf5065c4012186a071531fdbcc703427266ccd067530425d533ac776b5f2dd52eb7a73a4e32372cd60f097c456a8f7de35dd9812622411be17b8aba2b59fe8b
SSDEEP 6144:kmTuV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:km3/NcZ7/NZ
TLSH
T127945D696A3419EADDED1BF5AC0249D88181E9F114F2E57F6133DFDCC8E4DA2C818B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kekljlkp.exe

Path C:\Windows\SysWOW64\Kekljlkp.exe
Size 412KB
SHA256 0936b6e5fe24cf30f07463228862ac33ce5cb7ebbb11f4b661e25a88b912ca32
MD5 aa58b6060e5c76574583e71ce82ee3e9
SHA1 ae821cd22417e49e3f1b8672475bba6787e4f01c
SHA512 6d12d1ca35776b8863c970ec09969e9f5874f75726d0b66204805557e5e1aa96a2a016c067fe9b21a7c33c8693fe6e156d4d5f92a9126f46aa76603de5c69941
SSDEEP 6144:ZfZt3HlV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:Zj4/NcZ7/NZ
TLSH
T12E9482696A351AE6DDED2BB9AC1209D881C1E9F114F2E13E6133DFDCC8E4DA5D804F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kfoapo32.exe

Path C:\Windows\SysWOW64\Kfoapo32.exe
Size 412KB
SHA256 642e29a769ae3036c3ff4e26a2483e076948ac31379fe0ba69e31fe73cae96f6
MD5 2cdebd88deaed4ccb7c80069c2c723db
SHA1 fdf537e09dcf50d24bab758eec9e913379f01ba2
SHA512 d1af5d08f305f1a6d39a9d429baa361fe31427b166dbb1707b2120c621fb08bcc6d78a7067bf6e95e9da803898743c461ec1c7a585e1ce7848b6c18a82760b98
SSDEEP 6144:kxazfQl9YV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:kxa8lj/NcZ7/NZ
TLSH
T14A9493296A3819E6DDFD1BB5AC1249D8A181E9F104F1E13E6933DFDCC8E5DA1C808F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kikafjoc.exe

Path C:\Windows\SysWOW64\Kikafjoc.exe
Size 412KB
SHA256 f9214aada171af7651eb0e865c814c9e0432fd87592e7bd1fc01d1c07fdd8f22
MD5 d53c06d85dd9c1b08c484793d00f617e
SHA1 81fdbba5624fdb672b618f77e0542336b6a341ec
SHA512 cde66bf8fbfc398dc148a9fd89e5a8c1ea1c2867adf10421dd3a42cc97314524964d67b586e555a262e62fe6060b6f66853fc7b0ad2f98071f39b837b42806df
SSDEEP 6144:+WEpOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO1OOO/5OO2OOOOOOOd3O5O563OOOc:+e/NcZ7/NZ
TLSH
T18D9484656B302AEADDED5BB5AC1249E84181E9B524F1E13F6533DFDCC8E4DA2C804F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Klddgfbl.exe

Path C:\Windows\SysWOW64\Klddgfbl.exe
Size 412KB
SHA256 25b102c74979b9403a53c947f9a0de16462203c5d33266a89b7ad44ba39b3d94
MD5 1847a960772ec359b4e8600f6d15c8df
SHA1 7242b53e3745cd2f69dff9a86957d1ac57cc48ec
SHA512 c6d355841b51f2667a8d52574d9aece954ee7879cbef953127ebda9438d4cc0d8714b96adb75d6bc2fb7e258a83fdc15fe71ee4c5d92bf0897c0230350ba2bee
SSDEEP 6144:NR98kV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:NR96/NcZ7/NZ
TLSH
T1EE9484696A311DE6DDED1BB5AC624AD98181E9F118F1E13E6233DFDCC8E4DA1D804F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kmdqai32.exe

Path C:\Windows\SysWOW64\Kmdqai32.exe
Size 412KB
SHA256 3ae29b6e355788f22e29ac4fd111b4a265678b9292b5583cca8fa9441a558766
MD5 4444232a2b916f3de79d070aa6f2cb8b
SHA1 8c551fb40f0ab4030b7421c11774979fd9543505
SHA512 41d5a92efcf96d82df1020dda4abf96f87748cbeebe01ea30b432638c362c92b7cb71e9d772df7bc4ff9e3458c91136419395027346dbd4e382fb559050d4a8a
SSDEEP 6144:g1MR/oV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:g1MRJ/NcZ7/NZ
TLSH
T1879483696A30A9E6DEFD1BB5AC0249D89181E9F114F1E13E6133DFDCD8E4D66C808F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kpeibdfp.exe

Path C:\Windows\SysWOW64\Kpeibdfp.exe
Size 412KB
SHA256 118d95563635a5e19eae5685e18d0fcb57a06a8b3ad1b8070ecd8a04e4baab72
MD5 8db69041ff11891e7cfda09b9ce5450e
SHA1 26e7bc108f8e5df83a99b12cf4f70a1d07442f19
SHA512 9bc99d5554210b01914f13f27099788af6fb4b9bf19069ef695b497d9ba24b03391465e74f3aea6eb487c21f4833e895553eb3dff3f5d942b826e37e3ecd401f
SSDEEP 6144:1gTb6pxCV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:OTbK/NcZ7/NZ
TLSH
T1B99461656A3019FADDED1FB6AC1249D88181E9B114F1E13E6533DFDCC8E8DA2C845F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kpncbemh.exe

Path C:\Windows\SysWOW64\Kpncbemh.exe
Size 412KB
SHA256 df0ba6af8b91537abf240094c2fee595b0a9323120a0063f09c2a4b426953cac
MD5 360e60c8493692ce63bc16ad0828a7ea
SHA1 d6ddb9016e425111f67b23798613f009c03171bb
SHA512 c409cfbcb29ee47bcb54a8c03852884c9252e5b53dca5837ced438b4aad136f6337c06ef8cbb230cf813268dfdcf5a35d76f4cffd11e2ecb03552c8d86224a3f
SSDEEP 6144:4JNUkcXgnB2+DV/Ah1G/AcQ///NR5fLYG3eujPQ///NRf:ERB2z/NcZ7/NZ
TLSH
T10B947125AA341AE6DDEE1BB5BD1289D88581E9F114F1E13E6173DFDCC8E4DA2C804F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/428-385-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/480-405-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/760-140-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/848-203-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1152-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1152-1-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/1152-460-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1168-189-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1280-240-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1292-224-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1300-496-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1304-360-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1352-390-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1368-196-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1456-305-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1484-270-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1496-105-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1552-410-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1704-56-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1812-395-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1852-260-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1968-168-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2008-275-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2112-98-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2232-280-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2244-315-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2308-455-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2360-325-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2412-255-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2428-320-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2504-230-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2524-112-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2552-440-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2564-472-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2604-365-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2628-161-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2684-250-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2768-147-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2776-350-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2792-245-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2920-425-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2948-483-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2948-21-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3004-435-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3008-42-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3008-501-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3024-445-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3028-285-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3064-70-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3164-370-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3256-415-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3276-265-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3436-50-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3436-507-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3496-14-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3496-477-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3600-375-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4048-290-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4092-355-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4228-300-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4292-466-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4300-461-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4308-450-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4364-430-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4396-502-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4460-400-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4528-217-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4580-345-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4588-63-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4608-235-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4688-77-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4728-210-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4764-471-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4764-7-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4844-330-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4968-119-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4976-340-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5024-35-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5024-495-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5156-126-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5280-335-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5416-182-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5436-92-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5452-133-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5548-295-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5580-28-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5580-489-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5584-310-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5684-420-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5704-478-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5732-380-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5792-84-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5820-484-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5940-175-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5964-154-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6024-490-0x0000000000400000-0x000000000046D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads