berbew | 9ecabf409733016c1fa41e3c3688c826f82713a6db260e978228b94f7e15bc0b

Analysis

max time kernel
149s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 09:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-14_e633413758817f002864d6eac845006f_elex_wannacry.exe
Size 320KB
Sample261014-lsxdbafe46
SHA256 9ecabf409733016c1fa41e3c3688c826f82713a6db260e978228b94f7e15bc0b
MD5 e633413758817f002864d6eac845006f
SHA1 408ca03d9a4806442707ca4546becc9c6458acae
SHA512 7878c37283d706f17044e51ee73a4e717a9c0faf49ceae9b2d01b312e8a1bbeb3726b33bb5534eb0115d6a444b0f8ea2fddc9db4b56c6fe6642dab8b8779d47c
SSDEEP 3072:a1AzR2SrwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:vzISrV/Ah1G/AcQ///NR5fn
TLSH
T1C264E9592A7009EACEED1BB5AC024ADC9581E9B415F1E17E6133DFDCD8E4DA2CC09F81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dcpffk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gadimkpb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gnkflo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jpfnqc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdmjmqjf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdbchp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lqdcio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nocphd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Egiohh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fpnfbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gfaaebnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Idhgkcln.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkgkqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnmfdpni.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oooodcci.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fplimi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nocphd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nejkfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oelhljaq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cphgca32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpmqoqbp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enfcjb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfqogfjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hhojqcil.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Idfkednq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Khplnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mbhina32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ecblbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jkplilgk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkoaagmh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgafin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Encgdbqd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fceihh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fanbll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gjkqpa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hhegjdag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hnblmnfa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfonfp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amibqhed.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gadimkpb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpfnqc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jpmdabfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jncapf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdfmcobk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgibjj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgnleiid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iokocmnf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iandjg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jondojna.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kklkej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mbkfcabb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnmfdpni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nombnc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfiiggpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gcqhcgqi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Idonlbff.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mbhina32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nombnc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eglkmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gndpkp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ghanoeel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmifcjif.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iokocmnf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kklkej32.exe

Executes dropped EXE 64 IoCs

pid	Process
5948	Amibqhed.exe
6084	Bgafin32.exe
4992	Bmlofhca.exe
2948	Bpaacblm.exe
2776	Cphgca32.exe
4804	Cfeplh32.exe
5524	Cpmqoqbp.exe
3492	Cfiiggpg.exe
4820	Dcpffk32.exe
2504	Dqdgop32.exe
4448	Dfqogfjo.exe
3040	Dokqfl32.exe
6028	Ejaecdnc.exe
6136	Eopjakkg.exe
3996	Ejennd32.exe
304	Eqpfknbj.exe
2144	Egiohh32.exe
3680	Encgdbqd.exe
2172	Eglkmh32.exe
2572	Enfcjb32.exe
5208	Ecblbi32.exe
2216	Fjldocde.exe
4288	Fceihh32.exe
4492	Fnjmea32.exe
4752	Fplimi32.exe
5448	Fjanjb32.exe
6112	Fpnfbi32.exe
5440	Ffhnocfd.exe
2028	Fanbll32.exe
4180	Fggkifmg.exe
3616	Fmdcamko.exe
5828	Fcnlng32.exe
2464	Gndpkp32.exe
1580	Gcqhcgqi.exe
5552	Gjkqpa32.exe
1688	Gadimkpb.exe
996	Gfaaebnj.exe
4780	Gmkibl32.exe
1912	Ghanoeel.exe
4368	Gnkflo32.exe
2748	Gplbcgbg.exe
5268	Gjagapbn.exe
4304	Galonj32.exe
2860	Hhegjdag.exe
1644	Hmbpbk32.exe
2096	Hhhdpd32.exe
5476	Hnblmnfa.exe
1724	Hdodeedi.exe
5712	Hndibn32.exe
5548	Hpeejfjm.exe
3928	Hfonfp32.exe
5528	Hmifcjif.exe
1756	Hhojqcil.exe
5336	Hmlbij32.exe
2344	Idfkednq.exe
4872	Iokocmnf.exe
3116	Idhgkcln.exe
3552	Ikbphn32.exe
4352	Ifipmo32.exe
5112	Iandjg32.exe
2592	Idonlbff.exe
4152	Iodaikfl.exe
2032	Jpfnqc32.exe
4760	Jphkfc32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Oelhljaq.exe	Oooodcci.exe
File created	C:\Windows\SysWOW64\Mjfblj32.dll	Dokqfl32.exe
File created	C:\Windows\SysWOW64\Fcnlng32.exe	Fmdcamko.exe
File opened for modification	C:\Windows\SysWOW64\Nocphd32.exe	Mdnlkl32.exe
File created	C:\Windows\SysWOW64\Fnjmea32.exe	Fceihh32.exe
File created	C:\Windows\SysWOW64\Hhegjdag.exe	Galonj32.exe
File created	C:\Windows\SysWOW64\Flhlak32.dll	Hfonfp32.exe
File opened for modification	C:\Windows\SysWOW64\Idfkednq.exe	Hmlbij32.exe
File created	C:\Windows\SysWOW64\Mndcnafd.exe	Mdloelpc.exe
File opened for modification	C:\Windows\SysWOW64\Idonlbff.exe	Iandjg32.exe
File created	C:\Windows\SysWOW64\Cphgca32.exe	Bpaacblm.exe
File opened for modification	C:\Windows\SysWOW64\Dcpffk32.exe	Cfiiggpg.exe
File created	C:\Windows\SysWOW64\Ghanoeel.exe	Gmkibl32.exe
File created	C:\Windows\SysWOW64\Hfonfp32.exe	Hpeejfjm.exe
File created	C:\Windows\SysWOW64\Cqhiiapq.dll	Hmifcjif.exe
File created	C:\Windows\SysWOW64\Lmlccq32.dll	Kdfmcobk.exe
File created	C:\Windows\SysWOW64\Lkgkqh32.exe	Lgibjj32.exe
File opened for modification	C:\Windows\SysWOW64\Khplnn32.exe	Kklkej32.exe
File created	C:\Windows\SysWOW64\Cpmqoqbp.exe	Cfeplh32.exe
File created	C:\Windows\SysWOW64\Fggkifmg.exe	Fanbll32.exe
File opened for modification	C:\Windows\SysWOW64\Galonj32.exe	Gjagapbn.exe
File opened for modification	C:\Windows\SysWOW64\Nejkfj32.exe	Nombnc32.exe
File opened for modification	C:\Windows\SysWOW64\Ejaecdnc.exe	Dokqfl32.exe
File created	C:\Windows\SysWOW64\Nhpoieid.dll	Ejennd32.exe
File opened for modification	C:\Windows\SysWOW64\Hnblmnfa.exe	Hhhdpd32.exe
File created	C:\Windows\SysWOW64\Hpeejfjm.exe	Hndibn32.exe
File created	C:\Windows\SysWOW64\Mbhina32.exe	Mkoaagmh.exe
File created	C:\Windows\SysWOW64\Ohmjcpmd.dll	Bpaacblm.exe
File opened for modification	C:\Windows\SysWOW64\Dqdgop32.exe	Dcpffk32.exe
File created	C:\Windows\SysWOW64\Olkbkbih.dll	Fpnfbi32.exe
File opened for modification	C:\Windows\SysWOW64\Kklkej32.exe	Kdbchp32.exe
File opened for modification	C:\Windows\SysWOW64\Ldiiio32.exe	Kdfmcobk.exe
File opened for modification	C:\Windows\SysWOW64\Oooodcci.exe	Nejkfj32.exe
File created	C:\Windows\SysWOW64\Allchp32.dll	Fggkifmg.exe
File created	C:\Windows\SysWOW64\Hmlbij32.exe	Hhojqcil.exe
File created	C:\Windows\SysWOW64\Ijlamjlh.dll	Jncapf32.exe
File created	C:\Windows\SysWOW64\Lgnleiid.exe	Lqdcio32.exe
File created	C:\Windows\SysWOW64\Jgonal32.dll	Hmbpbk32.exe
File opened for modification	C:\Windows\SysWOW64\Knldfe32.exe	Khplnn32.exe
File created	C:\Windows\SysWOW64\Bgemlo32.dll	Egiohh32.exe
File created	C:\Windows\SysWOW64\Klohlg32.dll	Enfcjb32.exe
File opened for modification	C:\Windows\SysWOW64\Gnkflo32.exe	Ghanoeel.exe
File opened for modification	C:\Windows\SysWOW64\Kdbchp32.exe	Koekpi32.exe
File created	C:\Windows\SysWOW64\Khplnn32.exe	Kklkej32.exe
File opened for modification	C:\Windows\SysWOW64\Lqdcio32.exe	Lkgkqh32.exe
File opened for modification	C:\Windows\SysWOW64\Eopjakkg.exe	Ejaecdnc.exe
File created	C:\Windows\SysWOW64\Ibkdmm32.dll	Cphgca32.exe
File created	C:\Windows\SysWOW64\Gplbcgbg.exe	Gnkflo32.exe
File created	C:\Windows\SysWOW64\Eoeeekec.dll	Knldfe32.exe
File created	C:\Windows\SysWOW64\Nnkioq32.exe	Ndbefkjk.exe
File created	C:\Windows\SysWOW64\Nombnc32.exe	Negoaj32.exe
File created	C:\Windows\SysWOW64\Coilnkdh.dll	Nejkfj32.exe
File created	C:\Windows\SysWOW64\Ejaecdnc.exe	Dokqfl32.exe
File opened for modification	C:\Windows\SysWOW64\Amibqhed.exe	2026-10-14_e633413758817f002864d6eac845006f_elex_wannacry.exe
File created	C:\Windows\SysWOW64\Cfeplh32.exe	Cphgca32.exe
File created	C:\Windows\SysWOW64\Caakehij.dll	Gfaaebnj.exe
File created	C:\Windows\SysWOW64\Hhojqcil.exe	Hmifcjif.exe
File opened for modification	C:\Windows\SysWOW64\Idhgkcln.exe	Iokocmnf.exe
File created	C:\Windows\SysWOW64\Jbgkhjeo.dll	Iokocmnf.exe
File opened for modification	C:\Windows\SysWOW64\Jknocljn.exe	Jphkfc32.exe
File created	C:\Windows\SysWOW64\Bgafin32.exe	Amibqhed.exe
File opened for modification	C:\Windows\SysWOW64\Cfeplh32.exe	Cphgca32.exe
File opened for modification	C:\Windows\SysWOW64\Dokqfl32.exe	Dfqogfjo.exe
File opened for modification	C:\Windows\SysWOW64\Gjkqpa32.exe	Gcqhcgqi.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1164	1084	WerFault.exe	191

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nocphd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Egiohh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fceihh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ifipmo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lkgkqh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ndphpk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Negoaj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ejaecdnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hnblmnfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Idfkednq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lamjbc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lgnleiid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mndcnafd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnimia32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnkioq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amibqhed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ghanoeel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hhhdpd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Koekpi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdbchp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ndbefkjk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Niqnli32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nejkfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmlbij32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gadimkpb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gfaaebnj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdpfbp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Knldfe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lqdcio32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ladpcb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mbhina32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eqpfknbj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hhegjdag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpmdabfb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lgibjj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nombnc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oelhljaq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfeplh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fcnlng32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Galonj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpfnqc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdmjmqjf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnmfdpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpmqoqbp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fjanjb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Idhgkcln.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khplnn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldiiio32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdnlkl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oooodcci.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gmkibl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jknocljn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mkoaagmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mbkfcabb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fplimi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gplbcgbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdloelpc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Okfpid32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eopjakkg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jkplilgk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfiiggpg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ffhnocfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gnkflo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hhojqcil.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jkplilgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ecnonb32.dll"	Khplnn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hmifcjif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iokocmnf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enonclfe.dll"	Kdpfbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aaiemjgf.dll"	Negoaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpmcffca.dll"	Dcpffk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djlppb32.dll"	Fceihh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flplcjpa.dll"	Gplbcgbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gplbcgbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hicgcm32.dll"	Ldiiio32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fanbll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gndpkp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gmkibl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hpeejfjm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nejkfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhpoieid.dll"	Ejennd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fceihh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gjagapbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hhhdpd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iokocmnf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kdfmcobk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lqdcio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ndbefkjk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nndnocba.dll"	Ffhnocfd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gnkflo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dalion32.dll"	Lqdcio32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnkioq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naoplkpo.dll"	Nnmfdpni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgonal32.dll"	Hmbpbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anonhl32.dll"	Mbkfcabb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ndphpk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bgafin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dqdgop32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dokqfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eglkmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajcegi32.dll"	Fmdcamko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gfaaebnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hfonfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mappie32.dll"	Jkplilgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eopjakkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olkbkbih.dll"	Fpnfbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbcbcc32.dll"	Hhegjdag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flhlak32.dll"	Hfonfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eqlbnh32.dll"	Idonlbff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jncapf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lkgkqh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mndcnafd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	2026-10-14_e633413758817f002864d6eac845006f_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnjbhmni.dll"	Bgafin32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnmfdpni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Folcdd32.dll"	Oooodcci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lopeamfc.dll"	Oelhljaq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nmqcjihb.dll"	Gndpkp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chkgcq32.dll"	Gjkqpa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aohcbiop.dll"	Kdmjmqjf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bmlofhca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fplimi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hhhdpd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hdodeedi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hmlbij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dcjdmmji.dll"	Idfkednq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnmfdpni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fmdcamko.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 5948	1836	2026-10-14_e633413758817f002864d6eac845006f_elex_wannacry.exe	89
PID 5948 wrote to memory of 6084	5948	Amibqhed.exe	90
PID 6084 wrote to memory of 4992	6084	Bgafin32.exe	91
PID 4992 wrote to memory of 2948	4992	Bmlofhca.exe	92
PID 2948 wrote to memory of 2776	2948	Bpaacblm.exe	93
PID 2776 wrote to memory of 4804	2776	Cphgca32.exe	94
PID 4804 wrote to memory of 5524	4804	Cfeplh32.exe	95
PID 5524 wrote to memory of 3492	5524	Cpmqoqbp.exe	96
PID 3492 wrote to memory of 4820	3492	Cfiiggpg.exe	97
PID 4820 wrote to memory of 2504	4820	Dcpffk32.exe	98
PID 2504 wrote to memory of 4448	2504	Dqdgop32.exe	99
PID 4448 wrote to memory of 3040	4448	Dfqogfjo.exe	100
PID 3040 wrote to memory of 6028	3040	Dokqfl32.exe	101
PID 6028 wrote to memory of 6136	6028	Ejaecdnc.exe	102
PID 6136 wrote to memory of 3996	6136	Eopjakkg.exe	103
PID 3996 wrote to memory of 304	3996	Ejennd32.exe	104
PID 304 wrote to memory of 2144	304	Eqpfknbj.exe	105
PID 2144 wrote to memory of 3680	2144	Egiohh32.exe	106
PID 3680 wrote to memory of 2172	3680	Encgdbqd.exe	107
PID 2172 wrote to memory of 2572	2172	Eglkmh32.exe	108
PID 2572 wrote to memory of 5208	2572	Enfcjb32.exe	109
PID 5208 wrote to memory of 2216	5208	Ecblbi32.exe	110
PID 2216 wrote to memory of 4288	2216	Fjldocde.exe	111
PID 4288 wrote to memory of 4492	4288	Fceihh32.exe	112
PID 4492 wrote to memory of 4752	4492	Fnjmea32.exe	113
PID 4752 wrote to memory of 5448	4752	Fplimi32.exe	114
PID 5448 wrote to memory of 6112	5448	Fjanjb32.exe	115
PID 6112 wrote to memory of 5440	6112	Fpnfbi32.exe	116
PID 5440 wrote to memory of 2028	5440	Ffhnocfd.exe	117
PID 2028 wrote to memory of 4180	2028	Fanbll32.exe	118
PID 4180 wrote to memory of 3616	4180	Fggkifmg.exe	119
PID 3616 wrote to memory of 5828	3616	Fmdcamko.exe	120
PID 5828 wrote to memory of 2464	5828	Fcnlng32.exe	121
PID 2464 wrote to memory of 1580	2464	Gndpkp32.exe	122
PID 1580 wrote to memory of 5552	1580	Gcqhcgqi.exe	123
PID 5552 wrote to memory of 1688	5552	Gjkqpa32.exe	124
PID 1688 wrote to memory of 996	1688	Gadimkpb.exe	125
PID 996 wrote to memory of 4780	996	Gfaaebnj.exe	126
PID 4780 wrote to memory of 1912	4780	Gmkibl32.exe	127
PID 1912 wrote to memory of 4368	1912	Ghanoeel.exe	128
PID 4368 wrote to memory of 2748	4368	Gnkflo32.exe	129
PID 2748 wrote to memory of 5268	2748	Gplbcgbg.exe	130
PID 5268 wrote to memory of 4304	5268	Gjagapbn.exe	131
PID 4304 wrote to memory of 2860	4304	Galonj32.exe	132
PID 2860 wrote to memory of 1644	2860	Hhegjdag.exe	133
PID 1644 wrote to memory of 2096	1644	Hmbpbk32.exe	134
PID 2096 wrote to memory of 5476	2096	Hhhdpd32.exe	135
PID 5476 wrote to memory of 1724	5476	Hnblmnfa.exe	136
PID 1724 wrote to memory of 5712	1724	Hdodeedi.exe	137
PID 5712 wrote to memory of 5548	5712	Hndibn32.exe	138
PID 5548 wrote to memory of 3928	5548	Hpeejfjm.exe	139
PID 3928 wrote to memory of 5528	3928	Hfonfp32.exe	140
PID 5528 wrote to memory of 1756	5528	Hmifcjif.exe	141
PID 1756 wrote to memory of 5336	1756	Hhojqcil.exe	142
PID 5336 wrote to memory of 2344	5336	Hmlbij32.exe	143
PID 2344 wrote to memory of 4872	2344	Idfkednq.exe	144
PID 4872 wrote to memory of 3116	4872	Iokocmnf.exe	145
PID 3116 wrote to memory of 3552	3116	Idhgkcln.exe	146
PID 3552 wrote to memory of 4352	3552	Ikbphn32.exe	147
PID 4352 wrote to memory of 5112	4352	Ifipmo32.exe	148
PID 5112 wrote to memory of 2592	5112	Iandjg32.exe	149
PID 2592 wrote to memory of 4152	2592	Idonlbff.exe	150
PID 4152 wrote to memory of 2032	4152	Iodaikfl.exe	151
PID 2032 wrote to memory of 4760	2032	Jpfnqc32.exe	152

C:\Users\Admin\AppData\Local\Temp\2026-10-14_e633413758817f002864d6eac845006f_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-14_e633413758817f002864d6eac845006f_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Windows\SysWOW64\Amibqhed.exe
  C:\Windows\system32\Amibqhed.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5948
- - C:\Windows\SysWOW64\Bgafin32.exe
    C:\Windows\system32\Bgafin32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:6084
  - - C:\Windows\SysWOW64\Bmlofhca.exe
      C:\Windows\system32\Bmlofhca.exe
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4992
    - - C:\Windows\SysWOW64\Bpaacblm.exe
        
        C:\Windows\system32\Bpaacblm.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2948
      - C:\Windows\SysWOW64\Cphgca32.exe
        
        C:\Windows\system32\Cphgca32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2776
        
        C:\Windows\SysWOW64\Cfeplh32.exe
        
        C:\Windows\system32\Cfeplh32.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4804
        
        C:\Windows\SysWOW64\Cpmqoqbp.exe
        
        C:\Windows\system32\Cpmqoqbp.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5524
        
        C:\Windows\SysWOW64\Cfiiggpg.exe
        
        C:\Windows\system32\Cfiiggpg.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3492
        
        C:\Windows\SysWOW64\Dcpffk32.exe
        
        C:\Windows\system32\Dcpffk32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4820
        
        C:\Windows\SysWOW64\Dqdgop32.exe
        
        C:\Windows\system32\Dqdgop32.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2504
        
        C:\Windows\SysWOW64\Dfqogfjo.exe
        
        C:\Windows\system32\Dfqogfjo.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4448
        
        C:\Windows\SysWOW64\Dokqfl32.exe
        
        C:\Windows\system32\Dokqfl32.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3040
        
        C:\Windows\SysWOW64\Ejaecdnc.exe
        
        C:\Windows\system32\Ejaecdnc.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6028
        
        C:\Windows\SysWOW64\Eopjakkg.exe
        
        C:\Windows\system32\Eopjakkg.exe
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:6136
        
        C:\Windows\SysWOW64\Ejennd32.exe
        
        C:\Windows\system32\Ejennd32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3996
        
        C:\Windows\SysWOW64\Eqpfknbj.exe
        
        C:\Windows\system32\Eqpfknbj.exe
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:304
        
        C:\Windows\SysWOW64\Egiohh32.exe
        
        C:\Windows\system32\Egiohh32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2144
        
        C:\Windows\SysWOW64\Encgdbqd.exe
        
        C:\Windows\system32\Encgdbqd.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3680
        
        C:\Windows\SysWOW64\Eglkmh32.exe
        
        C:\Windows\system32\Eglkmh32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2172
        
        C:\Windows\SysWOW64\Enfcjb32.exe
        
        C:\Windows\system32\Enfcjb32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2572
        
        C:\Windows\SysWOW64\Ecblbi32.exe
        
        C:\Windows\system32\Ecblbi32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5208
        
        C:\Windows\SysWOW64\Fjldocde.exe
        
        C:\Windows\system32\Fjldocde.exe
        23⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2216
        
        C:\Windows\SysWOW64\Fceihh32.exe
        
        C:\Windows\system32\Fceihh32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4288
        
        C:\Windows\SysWOW64\Fnjmea32.exe
        
        C:\Windows\system32\Fnjmea32.exe
        25⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4492
        
        C:\Windows\SysWOW64\Fplimi32.exe
        
        C:\Windows\system32\Fplimi32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4752
        
        C:\Windows\SysWOW64\Fjanjb32.exe
        
        C:\Windows\system32\Fjanjb32.exe
        27⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5448
        
        C:\Windows\SysWOW64\Fpnfbi32.exe
        
        C:\Windows\system32\Fpnfbi32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:6112
        
        C:\Windows\SysWOW64\Ffhnocfd.exe
        
        C:\Windows\system32\Ffhnocfd.exe
        29⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5440
        
        C:\Windows\SysWOW64\Fanbll32.exe
        
        C:\Windows\system32\Fanbll32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2028
        
        C:\Windows\SysWOW64\Fggkifmg.exe
        
        C:\Windows\system32\Fggkifmg.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4180
        
        C:\Windows\SysWOW64\Fmdcamko.exe
        
        C:\Windows\system32\Fmdcamko.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3616
        
        C:\Windows\SysWOW64\Fcnlng32.exe
        
        C:\Windows\system32\Fcnlng32.exe
        33⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5828
        
        C:\Windows\SysWOW64\Gndpkp32.exe
        
        C:\Windows\system32\Gndpkp32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2464
        
        C:\Windows\SysWOW64\Gcqhcgqi.exe
        
        C:\Windows\system32\Gcqhcgqi.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1580
        
        C:\Windows\SysWOW64\Gjkqpa32.exe
        
        C:\Windows\system32\Gjkqpa32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5552
        
        C:\Windows\SysWOW64\Gadimkpb.exe
        
        C:\Windows\system32\Gadimkpb.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1688
        
        C:\Windows\SysWOW64\Gfaaebnj.exe
        
        C:\Windows\system32\Gfaaebnj.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:996
        
        C:\Windows\SysWOW64\Gmkibl32.exe
        
        C:\Windows\system32\Gmkibl32.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4780
        
        C:\Windows\SysWOW64\Ghanoeel.exe
        
        C:\Windows\system32\Ghanoeel.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1912
        
        C:\Windows\SysWOW64\Gnkflo32.exe
        
        C:\Windows\system32\Gnkflo32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4368
        
        C:\Windows\SysWOW64\Gplbcgbg.exe
        
        C:\Windows\system32\Gplbcgbg.exe
        42⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2748
        
        C:\Windows\SysWOW64\Gjagapbn.exe
        
        C:\Windows\system32\Gjagapbn.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5268
        
        C:\Windows\SysWOW64\Galonj32.exe
        
        C:\Windows\system32\Galonj32.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4304
        
        C:\Windows\SysWOW64\Hhegjdag.exe
        
        C:\Windows\system32\Hhegjdag.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2860
        
        C:\Windows\SysWOW64\Hmbpbk32.exe
        
        C:\Windows\system32\Hmbpbk32.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1644
        
        C:\Windows\SysWOW64\Hhhdpd32.exe
        
        C:\Windows\system32\Hhhdpd32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2096
        
        C:\Windows\SysWOW64\Hnblmnfa.exe
        
        C:\Windows\system32\Hnblmnfa.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5476
        
        C:\Windows\SysWOW64\Hdodeedi.exe
        
        C:\Windows\system32\Hdodeedi.exe
        49⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1724
        
        C:\Windows\SysWOW64\Hndibn32.exe
        
        C:\Windows\system32\Hndibn32.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5712
        
        C:\Windows\SysWOW64\Hpeejfjm.exe
        
        C:\Windows\system32\Hpeejfjm.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5548
        
        C:\Windows\SysWOW64\Hfonfp32.exe
        
        C:\Windows\system32\Hfonfp32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3928
        
        C:\Windows\SysWOW64\Hmifcjif.exe
        
        C:\Windows\system32\Hmifcjif.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5528
        
        C:\Windows\SysWOW64\Hhojqcil.exe
        
        C:\Windows\system32\Hhojqcil.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1756
        
        C:\Windows\SysWOW64\Hmlbij32.exe
        
        C:\Windows\system32\Hmlbij32.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5336
        
        C:\Windows\SysWOW64\Idfkednq.exe
        
        C:\Windows\system32\Idfkednq.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2344
        
        C:\Windows\SysWOW64\Iokocmnf.exe
        
        C:\Windows\system32\Iokocmnf.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4872
        
        C:\Windows\SysWOW64\Idhgkcln.exe
        
        C:\Windows\system32\Idhgkcln.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3116
        
        C:\Windows\SysWOW64\Ikbphn32.exe
        
        C:\Windows\system32\Ikbphn32.exe
        59⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3552
        
        C:\Windows\SysWOW64\Ifipmo32.exe
        
        C:\Windows\system32\Ifipmo32.exe
        60⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4352
        
        C:\Windows\SysWOW64\Iandjg32.exe
        
        C:\Windows\system32\Iandjg32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5112
        
        C:\Windows\SysWOW64\Idonlbff.exe
        
        C:\Windows\system32\Idonlbff.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2592
        
        C:\Windows\SysWOW64\Iodaikfl.exe
        
        C:\Windows\system32\Iodaikfl.exe
        63⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4152
        
        C:\Windows\SysWOW64\Jpfnqc32.exe
        
        C:\Windows\system32\Jpfnqc32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2032
        
        C:\Windows\SysWOW64\Jphkfc32.exe
        
        C:\Windows\system32\Jphkfc32.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4760
        
        C:\Windows\SysWOW64\Jknocljn.exe
        
        C:\Windows\system32\Jknocljn.exe
        66⤵
        System Location Discovery: System Language Discovery
        
        PID:4912
        
        C:\Windows\SysWOW64\Jkplilgk.exe
        
        C:\Windows\system32\Jkplilgk.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:420
        
        C:\Windows\SysWOW64\Jpmdabfb.exe
        
        C:\Windows\system32\Jpmdabfb.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2696
        
        C:\Windows\SysWOW64\Jondojna.exe
        
        C:\Windows\system32\Jondojna.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2684
        
        C:\Windows\SysWOW64\Jncapf32.exe
        
        C:\Windows\system32\Jncapf32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:2920
        
        C:\Windows\SysWOW64\Kdmjmqjf.exe
        
        C:\Windows\system32\Kdmjmqjf.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4380
        
        C:\Windows\SysWOW64\Kdpfbp32.exe
        
        C:\Windows\system32\Kdpfbp32.exe
        72⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5364
        
        C:\Windows\SysWOW64\Koekpi32.exe
        
        C:\Windows\system32\Koekpi32.exe
        73⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3036
        
        C:\Windows\SysWOW64\Kdbchp32.exe
        
        C:\Windows\system32\Kdbchp32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5600
        
        C:\Windows\SysWOW64\Kklkej32.exe
        
        C:\Windows\system32\Kklkej32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:688
        
        C:\Windows\SysWOW64\Khplnn32.exe
        
        C:\Windows\system32\Khplnn32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5368
        
        C:\Windows\SysWOW64\Knldfe32.exe
        
        C:\Windows\system32\Knldfe32.exe
        77⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5764
        
        C:\Windows\SysWOW64\Kdfmcobk.exe
        
        C:\Windows\system32\Kdfmcobk.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:3940
        
        C:\Windows\SysWOW64\Ldiiio32.exe
        
        C:\Windows\system32\Ldiiio32.exe
        79⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2392
        
        C:\Windows\SysWOW64\Lamjbc32.exe
        
        C:\Windows\system32\Lamjbc32.exe
        80⤵
        System Location Discovery: System Language Discovery
        
        PID:4640
        
        C:\Windows\SysWOW64\Lgibjj32.exe
        
        C:\Windows\system32\Lgibjj32.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3676
        
        C:\Windows\SysWOW64\Lkgkqh32.exe
        
        C:\Windows\system32\Lkgkqh32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2008
        
        C:\Windows\SysWOW64\Lqdcio32.exe
        
        C:\Windows\system32\Lqdcio32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4608
        
        C:\Windows\SysWOW64\Lgnleiid.exe
        
        C:\Windows\system32\Lgnleiid.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3828
        
        C:\Windows\SysWOW64\Ladpcb32.exe
        
        C:\Windows\system32\Ladpcb32.exe
        85⤵
        System Location Discovery: System Language Discovery
        
        PID:2900
        
        C:\Windows\SysWOW64\Mkoaagmh.exe
        
        C:\Windows\system32\Mkoaagmh.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4812
        
        C:\Windows\SysWOW64\Mbhina32.exe
        
        C:\Windows\system32\Mbhina32.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4888
        
        C:\Windows\SysWOW64\Mbkfcabb.exe
        
        C:\Windows\system32\Mbkfcabb.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1276
        
        C:\Windows\SysWOW64\Mdloelpc.exe
        
        C:\Windows\system32\Mdloelpc.exe
        89⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2632
        
        C:\Windows\SysWOW64\Mndcnafd.exe
        
        C:\Windows\system32\Mndcnafd.exe
        90⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5304
        
        C:\Windows\SysWOW64\Mdnlkl32.exe
        
        C:\Windows\system32\Mdnlkl32.exe
        91⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5532
        
        C:\Windows\SysWOW64\Nocphd32.exe
        
        C:\Windows\system32\Nocphd32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5588
        
        C:\Windows\SysWOW64\Ndphpk32.exe
        
        C:\Windows\system32\Ndphpk32.exe
        93⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1188
        
        C:\Windows\SysWOW64\Nnimia32.exe
        
        C:\Windows\system32\Nnimia32.exe
        94⤵
        System Location Discovery: System Language Discovery
        
        PID:808
        
        C:\Windows\SysWOW64\Ndbefkjk.exe
        
        C:\Windows\system32\Ndbefkjk.exe
        95⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2724
        
        C:\Windows\SysWOW64\Nnkioq32.exe
        
        C:\Windows\system32\Nnkioq32.exe
        96⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3756
        
        C:\Windows\SysWOW64\Niqnli32.exe
        
        C:\Windows\system32\Niqnli32.exe
        97⤵
        System Location Discovery: System Language Discovery
        
        PID:952
        
        C:\Windows\SysWOW64\Nnmfdpni.exe
        
        C:\Windows\system32\Nnmfdpni.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1680
        
        C:\Windows\SysWOW64\Negoaj32.exe
        
        C:\Windows\system32\Negoaj32.exe
        99⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3840
        
        C:\Windows\SysWOW64\Nombnc32.exe
        
        C:\Windows\system32\Nombnc32.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3748
        
        C:\Windows\SysWOW64\Nejkfj32.exe
        
        C:\Windows\system32\Nejkfj32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4316
        
        C:\Windows\SysWOW64\Oooodcci.exe
        
        C:\Windows\system32\Oooodcci.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6024
        
        C:\Windows\SysWOW64\Oelhljaq.exe
        
        C:\Windows\system32\Oelhljaq.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5776
        
        C:\Windows\SysWOW64\Okfpid32.exe
        
        C:\Windows\system32\Okfpid32.exe
        104⤵
        System Location Discovery: System Language Discovery
        
        PID:1084
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1084 -s 448
        105⤵
        Program crash
        
        PID:1164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1084 -ip 1084
1⤵
PID:4704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Amibqhed.exe

Path C:\Windows\SysWOW64\Amibqhed.exe
Size 320KB
SHA256 83f5ece0161bebcd2fe6512c09f300c6847fedbe80d202ef930d4258d1333d83
MD5 74f2badb27917c6692778e39ba8ab873
SHA1 80be1e8e549e8c7355ecfddcfd589dd39dc16cca
SHA512 a91ae0550cb52915fa43c24e9f277fc5acfea404c2cba0f4ff2d41d7961475d771fb9f38f72260871168dd7b618b0977f83c1ea75501c24db41d1a04ee8f9fc5
SSDEEP 3072:y5Q5rfQcU0ZV37TLA3owS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:yirYcVR7Tk3oV/Ah1G/AcQ///NR5fn
TLSH
T125642119263449EACDED1BB6AC124AD85142E5F018F1E13E6127DFDCC8E4DBBD829F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bgafin32.exe

Path C:\Windows\SysWOW64\Bgafin32.exe
Size 320KB
SHA256 1ec1180d2ff299c06b039e62111191c345a25e3c5e5c8fab1d62606ca8fb2dd3
MD5 04dda78370fb8f67fc3f5573824c1394
SHA1 4a00d9522e6299c6da9959bb659c573ac79ef773
SHA512 7c447f743c2a65b0925dded1d9f60bbda44439b3e3b9d0df66ba6d090f49e698fe212b961290b22d6ad4b8440eb9b68207a523a521b57173246a08629194d488
SSDEEP 3072:FUZcavjVl+3ELxuBPQJ1pwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:e1jVl+3EzpV/Ah1G/AcQ///NR5fn
TLSH
T19664ED192A3409EADDFD1BB6AC024DE85141E9F028F1E23E5163DFDCD8E4DA6D816F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bmlofhca.exe

Path C:\Windows\SysWOW64\Bmlofhca.exe
Size 320KB
SHA256 adf6a29c211850f9b6307ec3b14c207f374d9407d0718477935ccdb9b7dbb477
MD5 098108058d0f434e7fa85c94d1341936
SHA1 a025ba9a261e56a559201141f055ff5bd1ba92b2
SHA512 c4b73277482e06fb19e4f03bb43118d888598c08681326eee99a31fc2e8d8aa86a348c089dde585e0c4e5fcbd23fc41c8c2d1f8571cbf3c695470fc886978f4d
SSDEEP 3072:R3RwY845hlRwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:PLJRV/Ah1G/AcQ///NR5fn
TLSH
T189642F192A3009EBDEED1BB9AC4249D89141E8F054F1E53E6123DFECDCE4DA6D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bpaacblm.exe

Path C:\Windows\SysWOW64\Bpaacblm.exe
Size 320KB
SHA256 888422fed4522179c976733595a913f5b57bc9f39112ee68554a77839228e1a9
MD5 4a1770457bf79d5a0707bc8695d8e8db
SHA1 706f65194fd513c76bc531d4d7ac6d15ba783e3c
SHA512 0820bd74e66e33bdf262c7374fcfb4b9294c0130a7d5f92abcdcd65adfb17859155f36ec9f6bf52c30a6a3981e5dc3a68a434662175a6b97b548ffc2e23d948f
SSDEEP 6144:pI75HrJySH1AOFWIyV/Ah1G/AcQ///NR5fn:45vArk/Nv
TLSH
T1B36432191A3449EECEEE1FB6AC0249D85251E9F014F1E17E6523DFDCD8E4DA2D818F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cfeplh32.exe

Path C:\Windows\SysWOW64\Cfeplh32.exe
Size 320KB
SHA256 bfeb344c15b7e1ffeea90a76ef6b7e73b65a5da06725302736fc5a43340149fc
MD5 d080d2c1728a432329ad869650cd031d
SHA1 2e454ba462fd6e9bf4e5e7d58dc80a26a65ac6d1
SHA512 b7770234e2e7ecac379475671fc317cc69c0c8f77f03bb32917f65164bca5f8592f3bf1d6608af7140f1ff71c8ac93ba3a9a5c3cceb372d6b5fc95276814dc30
SSDEEP 3072:XlutpKo9NvXEakr6wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:XluPKoPEFr6V/Ah1G/AcQ///NR5fn
TLSH
T17A643E1926300AEACEED5BB6AC024DDA9141E9F154F1E13EA563DFDCD8E4DA6CC04F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cfiiggpg.exe

Path C:\Windows\SysWOW64\Cfiiggpg.exe
Size 320KB
SHA256 abacec25ab9f91635034cf229e91ad47572647f440592d871ae8dcd2fcd69c5b
MD5 add0d35fad67e372849c70ea524a2d9d
SHA1 833029ed784a241210c5360cf864c809f1bca5d7
SHA512 512c740753d4fd9ee0c97d8924b34e6a37b99f709c1e925fd2105260b18e2d05589f5038a1ce336cb6797344ef26756930fd3d382ef5fec354836e212b3a4e89
SSDEEP 3072:eYs7vouyLYKvoF/v5CmMlJhTd8wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:eYs01LmlMlJH8V/Ah1G/AcQ///NR5fn
TLSH
T1C864D9291A3509FACEED1FB5AD024DD85141E8B164F1E13E6923DFDCD8E4DA6C809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cphgca32.exe

Path C:\Windows\SysWOW64\Cphgca32.exe
Size 320KB
SHA256 37b5ee7136feb4685e02c3184ae258b299f514d1688c7423421bc95452bdfa8e
MD5 dafc0ae937e5696ba8e23aff7c0b50b9
SHA1 5d138256bcc3d166d2a9039e1cd43d44981fe788
SHA512 2fc0e6416dcb17c5b0b244207be362cf5542c6ea9016064e9299f9deba530b97bcc64a675307246b248835980e6e5bb63908ddae8d08413b38f7e08224122522
SSDEEP 3072:gEwTerTx0p4wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:gyW4V/Ah1G/AcQ///NR5fn
TLSH
T13364411A2A3109EACDED1FB5BC0249D89145E9F014F6E13E6123DFDDC8E4DAAD918F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cpmqoqbp.exe

Path C:\Windows\SysWOW64\Cpmqoqbp.exe
Size 320KB
SHA256 b804fdd115bd4f8ff365f953686a0772d63c249efc84587bf3e9f6301ea2607d
MD5 927a82cb6f53515f6343cb8962c4d38e
SHA1 dd7fc0f839e227f8501235ba8fe5886deafdfc63
SHA512 845c98ac9fa31e6b04f7d27592c132eb3bfa504468bb9c2be33602a0acc12af71ecc995ef59c63285a48d55e7db622209a8b27460e57dcfc1ea477573a0edeb1
SSDEEP 3072:iq8t1M/vz54wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:qfMF4V/Ah1G/AcQ///NR5fn
TLSH
T1ED64FC19263409EACDED1BB5BC5259DC5181E8F028F6E13E6123DFDCD8E4DA6D809F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dcpffk32.exe

Path C:\Windows\SysWOW64\Dcpffk32.exe
Size 320KB
SHA256 3457a53bcef7605f6f54af96257e897d777baf474738e9ddcfb2140621a6bf4d
MD5 3169f758e40d768674bfab971e40268d
SHA1 5e3f26e1eb0f54e127869fccba6497960c6322ad
SHA512 da390d4cdeae485f97e16d063dd094377e60a27d3e3335aceb79110c86f88bae1da0586a7f6eef2c912e308450dcc3e3d7ba2c9fa036d729a82f771f8dce4a85
SSDEEP 3072:w+zM6JXCnTXqQ3RBIiQH+RwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:w6XCTXq4OeRV/Ah1G/AcQ///NR5fn
TLSH
T1AB6420292A3409EACDED1FB9AC1259D89142E9F014F1E13E6533DFDCD8E8DA2C805F95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dfqogfjo.exe

Path C:\Windows\SysWOW64\Dfqogfjo.exe
Size 320KB
SHA256 ff7d7c742a5cfbce1c7af486b597b39b672023ea7eac52ee1674f4fcafb09321
MD5 7d440f76ee6c1737d0915b33a98a634c
SHA1 ad979f013f6e59a3e1b5e6594f118b6784992e63
SHA512 8ef0c0e03756ec89e125b95629f5919331ae74923d9e9eda74f4ef545e504f739b4a538d58704123f2f46fed1066444db21fea80880573c7fcaba763767cc8fe
SSDEEP 3072:bvlFNfQXAuB8KL7wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:bvyz8KL7V/Ah1G/AcQ///NR5fn
TLSH
T167641E292A3409EACDED1BB6AC0249DC9181F9F014F5E13E6523DFDCD8E5DA2C918F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dokqfl32.exe

Path C:\Windows\SysWOW64\Dokqfl32.exe
Size 320KB
SHA256 2f58db470f61f37335308be42098cf29be70894e48580548d25f2b5fe4bdff1c
MD5 6e3a5d0a0c47ad981a304cf5f9c45165
SHA1 51790e857b48def9323ce882e2cd3f680c49f382
SHA512 40806e83b4d5cbd8efd89bf6a14a7f8b3247fe4894ddbc88fe89db5f49e8a510b4f69c7ca25628d20401438688d91f9629bd751f59f47bd5c430e013a37a4271
SSDEEP 3072:awX46W4wNM+n5HwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:f/dwr5HV/Ah1G/AcQ///NR5fn
TLSH
T18F64EB192A344DEACEED1BB6BC1249D85141E9F114F1E13EA123DFDCD8E8DA2D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dqdgop32.exe

Path C:\Windows\SysWOW64\Dqdgop32.exe
Size 320KB
SHA256 05abc36d5f61a9679e7d4bc5cb76b15da5848b4d4c2dfd55e246f1aaaf203bcc
MD5 3cc6c8040758f146a01fa87eb2c9f525
SHA1 09890f2ffacd9289aef259f0e9e013239ed24c4d
SHA512 dd9955bc79a68bac5d6695eb92c1db2283db92e0a2ca6bc04b91f357e5bc9ff8774da3fecf472b5268fe9bf7597f6c6e3eb4a791497b4cf9b9b93ba8ed8e947a
SSDEEP 3072:PP8/09WCGV4Nb5eRdi8dwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:PP8WNtudV/Ah1G/AcQ///NR5fn
TLSH
T16D641019263409EACDED1FB5AC2249D89281E9F114F1E17E6123FFDCD8E4DA2D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ecblbi32.exe

Path C:\Windows\SysWOW64\Ecblbi32.exe
Size 320KB
SHA256 1b543af583d747575b2aba856525233d88210f0283937993c1a7c28f03d730f7
MD5 3b132778fe1dd7600e312a1713a484ff
SHA1 3e27fe5966824e61ddb09125635ba71c899c749d
SHA512 d972af1fead12c095250608ea096b77406e85c9ba8fc401623155faf0a348232bb13950d4f64c1f1ce1fb620c633d4904a46aedb91cd308bf747fe0f13c0fac2
SSDEEP 3072:mCqxpMBGputf6xLDHwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:mRMBeuN6ZDHV/Ah1G/AcQ///NR5fn
TLSH
T1F7643F192A7009EACEED1BF5AC1249E89181E9F014F1E23E6163DFDCDCE4DA6D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Egiohh32.exe

Path C:\Windows\SysWOW64\Egiohh32.exe
Size 320KB
SHA256 2bcb91f7c5d8f5eaf7871fe7dc3979184717fdf3249a06428bef1f0b4907dff8
MD5 3c725eae912e3e42cbdd04f2137b94be
SHA1 bd66336ed52dd38da32c7a3bbae0b5cfa97fb243
SHA512 5cf62326cc55af83c802496214c6542fa9e32b1b52c38f173e9608d75588104c3d2499518fec53a8dcd56d4ccc43e175e31568bd4269869ae72650823b51804c
SSDEEP 3072:8/J0MdZoSKMaPDWgNCuHwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:unoLMa7WgNCuHV/Ah1G/AcQ///NR5fn
TLSH
T187641F292A3409EACEED1BB5EC0249D89181E9F114F1E13E6523DFDCECE4DA6D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eglkmh32.exe

Path C:\Windows\SysWOW64\Eglkmh32.exe
Size 320KB
SHA256 58670d4f3a168b0484ee9153ed0a87df63ea1d1fe95eda41965766839b17b38a
MD5 910793c8170012992f84173336cd601a
SHA1 a39390b346b4cac4be935a941b95906239c09f1b
SHA512 99d336c8a5820b4d89b271285183ba536287ad7fae403efe56160361483d0885a36b61a6eca08f0048719b940dea68ed39f576f073224ec11f4640860d415f73
SSDEEP 3072:iC05NHCqgSiwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:m5NHfgSiV/Ah1G/AcQ///NR5fn
TLSH
T1EF6431192A340AEADDED2FB5AC1249D89541E5F014F1E13EA123DFDCD8E4DA2DC29F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ejaecdnc.exe

Path C:\Windows\SysWOW64\Ejaecdnc.exe
Size 320KB
SHA256 435cad623fab230986896984755ada4cb593e86dc310a7c37539e33143de41e0
MD5 fdf7053ce78c3f37b93e4beb69e0d378
SHA1 2ef2ed28dc6582814da8096373e25995308f5fc7
SHA512 b7de1d534bb9a0c05fdd4e0f3bc6429ee2b3ceb496ea65d4582a00ce7eb2db6d2e38f9550c09739d88d8d348f1fea8dd081411f2eaba17336258136e079f2f69
SSDEEP 3072:KLB6YeT5VmyK54JWQwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:KLB6zXm/5+WQV/Ah1G/AcQ///NR5fn
TLSH
T18264D919263409EACEED1BB5AC128DDC9181E8F014F1E17E66339FECD9E4DA2D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ejennd32.exe

Path C:\Windows\SysWOW64\Ejennd32.exe
Size 320KB
SHA256 dee876d068744506a7c2f64dd4e4b1629721d0e65f29ba0bd71e8e419f03124c
MD5 b8d70ee57172e8566052525a8a5f0922
SHA1 825045e9140becfa2a4de1623b820a0549925ebc
SHA512 e6e957e8d3d7dc7aa7d7f0c9985bb6ffbf13f8f953f36c4bb0a29aa6de0f457da5ff309e669fc77dab63903c1780ee0ed2ecd22951313dc96b5b91116593a6b4
SSDEEP 3072:qYlVH0P8lvrjYke71h9pFxVBdJlRKkwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5fn:qAH0P8lTwmkV/Ah1G/AcQ///NR5fn
TLSH
T1836441192A340AEACDED5FB5AC5249D88141F9F114F2E13E6923EFDDD8E4DA2C844F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Encgdbqd.exe

Path C:\Windows\SysWOW64\Encgdbqd.exe
Size 320KB
SHA256 42b5f773b78d3b5bc9abfb1d0f215a59be41dd7215966782d116ae543050a03a
MD5 8abd06194ff5b46e74499320373437d8
SHA1 d44b6cc80468d4eb7826de1b10c60cbc5591f56e
SHA512 a11c8d4af03d35ac57766e5f93499d32e4946fd13cfb7fda693ea1d866c9bbe5842421433bb9d4e7d09ad7bcf366da0f8ac41ffe548100989abe1d85312e25a0
SSDEEP 3072:D8qEzjeVIJlkIwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:DixlkIV/Ah1G/AcQ///NR5fn
TLSH
T1866440192A3409EADEED1FB5AC124DD99141E9F014F1E23E6123DFDCD9E4DA2D809F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Enfcjb32.exe

Path C:\Windows\SysWOW64\Enfcjb32.exe
Size 320KB
SHA256 bf0bb9ff61c839f13bc0d426044617cd583ac10d8737d0eceab34cd3d922b761
MD5 612eb775fa711ae7132a5a1081b3b8e3
SHA1 f855a66bad3adf3165899d203fae0bcb46b07841
SHA512 8e092218151335db8633bdc66622cdd93b01824e3e67aa64fb088c062ae953790216f4c0d88ec9fb9c05f29372a0ce998c9539b3a197e7df1f101eb651df4ca8
SSDEEP 3072:dwDDc/58fYTEPQwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:dwS5JAPQV/Ah1G/AcQ///NR5fn
TLSH
T1BF6440191A3809EACEED1FB6EC1289D85181E9F014F5E13E6123DFDCC9E4DA2D859F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eopjakkg.exe

Path C:\Windows\SysWOW64\Eopjakkg.exe
Size 320KB
SHA256 23e2e1ebe65d972bf624f0bb8b4476e9ed0b2f7a122499c2917dfc04a380068a
MD5 4866f1cbcbbbb69b42af90e7c806b6ab
SHA1 ab4705707348ed0a84f36995c69fd0e089b888cd
SHA512 f2c6688625d0f895babebafae9d1f8e9ed39dd3ef53234fd002513d947f461947ffc7b9f5215ffccdf830c066618cad63bc1051c56ab806727e925fcd03dfef8
SSDEEP 6144:JSAEVl3bKWhj+hXWeAV/Ah1G/AcQ///NR5fn:J9EVl3bxA/Nv
TLSH
T1DF64DA1A2A3409EACEED1BB6AC124DD95141F9F014F1E13E6923DFDCD9E4DA6D808F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eqpfknbj.exe

Path C:\Windows\SysWOW64\Eqpfknbj.exe
Size 320KB
SHA256 d2cffba976c0dd7056c38f22649a596c0b0b884e956e773cfd19b3c5466181a0
MD5 64c4ecd31ae571ac87b6e5ede778c9e9
SHA1 ac12911d2dcd9ddcd77ded0a4864e00302684c27
SHA512 f676f660514bdc762b69d660423f2e03073678e2f7df1c5e4ec4f56afac1d9480bbc524568cce8a0c9180c88d8365bab81720897e306f8f64ae0f09f50133c62
SSDEEP 3072:JQcyBmFxjkY3UHHwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:fVeHV/Ah1G/AcQ///NR5fn
TLSH
T1A9642019663409FACDED1FB5AC1249D89182E9F014F1E13E6123DFDCC8E4DAAD819F92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fanbll32.exe

Path C:\Windows\SysWOW64\Fanbll32.exe
Size 320KB
SHA256 a18e8d1df2d8ef5d57257eb05dca0d915cdf576f328c3194c333c2ffd39ae1f4
MD5 a2c26fb4afe1e1a590ae3a9d0d094c74
SHA1 fe754152b0f451389f6cd96a3293f9510f2ae261
SHA512 2f59edf1857dfa52f6fdb43aaaddfe278ba918162760f241f1fa7659f41dd95887b49c30286e06e642907498c92704386e7d932ef6e53dd909d7444458993bf8
SSDEEP 3072:41HJ0g4Abj9dSwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:48g4AddSV/Ah1G/AcQ///NR5fn
TLSH
T13E643219663409FACDED1FB5AC0299D85141E9F018F1E23E6623DFDCE8E4EA2C815F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fceihh32.exe

Path C:\Windows\SysWOW64\Fceihh32.exe
Size 320KB
SHA256 f4dd7a79e73f15e2fab3be20beadd76926c105dfde736a99c18d482b4fd9e82a
MD5 ed11b369f24df789905c8a6b1e2b528e
SHA1 5171c6ac0b2ceefa77485695296123f83e3959dc
SHA512 4a3953a3eae54bfa177c2a2547d42d0c25ab038cd6c76ffc11a729d947505c54c3160b8e7556ce6627472a917cc0765a2290fd9975d68fc85800b6c48ffe98f0
SSDEEP 3072:x+nW+tgWCqzEoRDA0wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:s3g04F0V/Ah1G/AcQ///NR5fn
TLSH
T1296450296A3459EACEED5FB6AC0259D85181E8F118F1E17E6123DFDCCCE4DA2C805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fcnlng32.exe

Path C:\Windows\SysWOW64\Fcnlng32.exe
Size 320KB
SHA256 bbff3ee6be2c4ee956dfccd457a5fc280fe0dbe0c2885bdd9557cd8ea3d00ddf
MD5 b9169e754f133c424fe0d92f4e5cb401
SHA1 c1d9d8a1e476bc23639eaed0765f82edabc239cd
SHA512 2062af6fda3cfc62566a334007b754b1570a97b4b8b96e4a4cf3f340e9c64f043a9bc1fc0cb1fbf4fe71289b5dd08cc8a1e5b9942878aa2de636e9cc94329717
SSDEEP 3072:KRdr/PdIbVoQlEwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:oFqXlEV/Ah1G/AcQ///NR5fn
TLSH
T165640C192A3409EACEED1BB5AC0689D89141F9F114F1E23E6133DFDCC9E4DA6D849F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ffhnocfd.exe

Path C:\Windows\SysWOW64\Ffhnocfd.exe
Size 320KB
SHA256 06bd870d24e4cf1328cf428a45034138d789fbb3c71b491a8628c21bdbb20cdf
MD5 69994bddbd4030828303e7e657b4da28
SHA1 29a21fbd24a1606774f0a3f908bcedeb1a530025
SHA512 ee26d22105f0cdb59cbec3f931cdf1cd047dc3f6db380c2608e4469f6364bd0a89b3983c8dcbb87e43e41d86f5b9820fea925f1368a5002bc7ce0c0690e15b9a
SSDEEP 3072:ZSZuQfFWFYfr5btQSwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:AvfFWFy5xQSV/Ah1G/AcQ///NR5fn
TLSH
T1A464311A1A3419EBCEEE1FB5AC1259D89141E9F014F1E13E6163DFDCD9E4DA2C806F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fggkifmg.exe

Path C:\Windows\SysWOW64\Fggkifmg.exe
Size 320KB
SHA256 e384a127bff735da9a0558dcdd9ca4a56e38caf7c8e9e72bdfceb4cb7e288366
MD5 fdc6619922a6ce6426b41d22e14db995
SHA1 69d7f19de5d290ba43c8bc1da8dfa5f9733357c3
SHA512 c413348a8e027517bd39b1a81337bf2b1f0635bb17c7ce5e58e19f09efdc50ff64e9b3bfdbc39e194247a079f428069a0d320f7a7a2a5e065c0ec0f849fcb18c
SSDEEP 3072:eQXCgoWXDVXh1PPLRpwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:HX3DVXh1VpV/Ah1G/AcQ///NR5fn
TLSH
T133642F192A7009EACEED1FB6AC125DD89241E9F014F1E13E6123DFDDD8E4DA6D809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fjanjb32.exe

Path C:\Windows\SysWOW64\Fjanjb32.exe
Size 320KB
SHA256 96f66e20156284964fedf3d3e9da8468edb19719bf17ddca403fdc7917fbb3c6
MD5 ccc1c8806c9eb9347bcfcb2ff84f7537
SHA1 6ff6d1d7e9d16b27ca13a96702f6a8ba8171a489
SHA512 2072acae0e65ab21284127ae33cf039904974b28bfce11b4f84c1a9ceec169a18f6731e10d294bbf1ad2fdd6888750e37304afbdba9ea7852271d2f2bec4cdd3
SSDEEP 3072:nIjcpWpAu7IflmszSwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:nIjm0Au70zSV/Ah1G/AcQ///NR5fn
TLSH
T170642E29263009EADEFD1BB5AC1249D85155E8F114F5E13E2323DFDCD8E4DAAE844F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fjldocde.exe

Path C:\Windows\SysWOW64\Fjldocde.exe
Size 320KB
SHA256 22ae3118680f258939f6e93eaa6618b6a0715fa929582966c4ad542d55d0103c
MD5 d537089a1e4716390d8b65b8678a95b9
SHA1 c0749bf0cebaa6e2a0bce052000c3e2f87039744
SHA512 6e045a9329d102b3fc948d491c60340845e9716808d94713594aa20cdd2b67013ad6dbb3158057f9c2cb2f941b471849064729fc49c0c0544f9b73c7c7ef5629
SSDEEP 3072:FutPl6rDqGPQiY5sS1wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Utt+YiYl1V/Ah1G/AcQ///NR5fn
TLSH
T1C4640C192A3009EACDED1FB5AD125DD85185EAF014F1E13E6123DFDCD8E4DA2E84AF81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fmdcamko.exe

Path C:\Windows\SysWOW64\Fmdcamko.exe
Size 320KB
SHA256 5794b3114473909d0d4c8d4841b24ac613f1ad8acc834aee388e822da5a5bbc1
MD5 8273951f9f0ebb9c78765326403404e0
SHA1 54ace81750849666d1c0816f90c49183b4aa25ec
SHA512 5dabc9580c17fa8fd639245ca28070c6f939cf5654d73c14e409e824197739f3440a2cfc5edfa41df67d7a6502fb92e8f6b3d902b381027bf3ad81506fa48b0f
SSDEEP 6144:fMlBWCWv5RAb+S+AOV/Ah1G/AcQ///NR5fn:fMlBWIZ+Q/Nv
TLSH
T1796441291A3009EACDED9BBDAC0249D85141E9F216F1E13E2133DFDDD8E4DAAD805F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fnjmea32.exe

Path C:\Windows\SysWOW64\Fnjmea32.exe
Size 320KB
SHA256 4e63d9d0b9dc864f4e92e0e665be586d77524454193d4b667b13dbe531b2ec33
MD5 6e4f178e0482c8b5a5945cfa3e83bccd
SHA1 f12a419ad67df1e41e6ac187d528ae3c149c657e
SHA512 7a413b97500861130ceb84c71918a98d941848541469020fd533de98b197214ad6aa5d9a08079ce536d2d473869518b5ead33399198e7bb35ee35f67854e5ba5
SSDEEP 3072:FQBmEcHM7iLmyP32kaBSkwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:scHM7iv3d0SkV/Ah1G/AcQ///NR5fn
TLSH
T19B6420592A3409EACDED1FB6AC164AD89142E8F014F5E13EA137DFDCD8E4DA2D805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fplimi32.exe

Path C:\Windows\SysWOW64\Fplimi32.exe
Size 320KB
SHA256 4d87bff252d5c5ddd677745838fc54ed7cf73e020dc84285ec0ecf261de97f82
MD5 b54f900bafcbfbb82783734535de6cf3
SHA1 26daccd19297c90d5441f4b2421c9da1d33f936d
SHA512 a3ba69055a692dc951d38fe5d2067073ae187be5937a33ed9fa754ff88276e8cd25cb2286bac40534393494d5b73a9574b0800f339c57bedc070227d1a6da4ae
SSDEEP 3072:1IdY6xmL9TJvCYtWwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:KFxmBTJntWV/Ah1G/AcQ///NR5fn
TLSH
T1DC640D192A3009FACDED1BF6AC4249D89241E9F114F1E13E6527EFDDD9E4DA2C809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fpnfbi32.exe

Path C:\Windows\SysWOW64\Fpnfbi32.exe
Size 320KB
SHA256 cfb4ea1d80065b22a608a67a2018999c47359aba09bf52418aff5cd1e24ebbbc
MD5 9d0e8853d3582ac2edad6308f91ad346
SHA1 e26b7dec90bb0b0df8eb54ef4492fcf6e18a1b51
SHA512 3bec4ed8a279f7ace1d47e144ed0cc8ee9386418a94b44bcc7f02b4909f4c9db64bbef04b8b751009dba9de7535b4874b178e12ec070867dde7137922785c410
SSDEEP 3072:UH/CZU+XZJIVSwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:UfoZJJIVSV/Ah1G/AcQ///NR5fn
TLSH
T13D641F191A3409EACEED6BB5BC1249D89141E9F164F1E13E6533DFDCC8E4DA2C819F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/304-112-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/420-395-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/688-435-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/996-250-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1580-235-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1644-290-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1688-245-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1724-305-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1756-330-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1836-4-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/1836-460-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1836-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1912-260-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2008-472-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2028-203-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2032-380-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2096-295-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2144-119-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2172-133-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2216-154-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2344-340-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2392-455-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2464-230-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2504-70-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2572-140-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2592-370-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2684-405-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2696-400-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2748-270-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2776-495-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2776-36-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2860-285-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2900-490-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2920-410-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2948-28-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2948-489-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3036-425-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3040-84-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3116-350-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3492-56-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3552-355-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3616-217-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3676-466-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3680-126-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3828-484-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3928-320-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3940-450-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3996-105-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4152-375-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4180-210-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4288-161-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4304-280-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4352-360-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4368-265-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4380-415-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4448-77-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4492-168-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4608-478-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4640-461-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4752-175-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4760-385-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4780-255-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4804-42-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4804-501-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4812-496-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4820-63-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4872-345-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4888-502-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4912-390-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4992-21-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4992-483-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5112-365-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5208-147-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5268-275-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5336-335-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5364-420-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5368-440-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5440-196-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5448-182-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5476-300-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5524-50-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5524-507-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5528-325-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5548-315-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5552-240-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5600-430-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5712-310-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5764-445-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5828-224-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5948-471-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5948-7-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6028-91-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6084-14-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6084-477-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6112-189-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6136-99-0x0000000000400000-0x000000000046D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads