berbew | 0bc79e00eeb04206c2bfbfa2a0080f6cc6e3a181beba1bd187524bf6d6879062

Analysis

max time kernel
150s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 16:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-14_9547619058d33eed636446e6570413c5_elex_wannacry.exe
Size 429KB
Sample261014-tzee3se15k
SHA256 0bc79e00eeb04206c2bfbfa2a0080f6cc6e3a181beba1bd187524bf6d6879062
MD5 9547619058d33eed636446e6570413c5
SHA1 29a84f342cec877bb1b7fc388fd306bc8ece46e3
SHA512 6700aa682b84cd4819ad70bb167229ea7aba27991b62efe100ce8008f2f618521a1f6632363dee5493c94862bc82e96795f2ad6e84994f988febcd2cd88a9fd8
SSDEEP 6144:OAcWmH2pV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:OAcWmB/NcZ7/N
TLSH
T1AB9473656A3019E5DDEE6BB5AC5249D84181E5B204F1F13F6633EFECC8E4E61CC0AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgphje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Okcccdkp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhppap32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chlomnfl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dcdifdem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fcdbmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Foplnb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbenjm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njljnl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jphkfc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmfilfep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpmodg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jkkbnl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onifpodl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Elagjihh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gpioca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lamjbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lnhdbc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Blnhgn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Foplnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgebfhcl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aemjjeek.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dcjfpfnh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgphje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kipalpoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Liekgo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lajmmc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnojcb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bojhnjgf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ijfbhflj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mbfmha32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oajoaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eckogc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eqopqh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hclaeocp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkegbfgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngekmf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qbekgknb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bpnncl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Didnmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hidpbf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hcpjpn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kaajfe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkenkhec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbfeoohe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ppbepp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Djnaco32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fcfocb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmhfbf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibmmbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jkkbnl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lkcaeige.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Elepei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fmmffhnk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Icedkn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kanffogf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcdepd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjalpida.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hfajlp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Appaangd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Algbfo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fcdbmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fifdqhal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gbcaemdg.exe

Executes dropped EXE 64 IoCs

pid	Process
5616	Hnfehm32.exe
4124	Hfajlp32.exe
2220	Ihhmgaqb.exe
3432	Igmjhnej.exe
3732	Jkkbnl32.exe
1212	Jphkfc32.exe
1340	Jgdphm32.exe
2620	Jmnheggo.exe
5104	Jdhpba32.exe
1880	Kdmjmqjf.exe
4580	Kkgbjkac.exe
4264	Kaajfe32.exe
1700	Koggehff.exe
1204	Kphdma32.exe
2580	Khplnn32.exe
360	Knldfe32.exe
6004	Khbhdn32.exe
1484	Kolaqh32.exe
3284	Lajmmc32.exe
5468	Lhdeinhb.exe
2436	Lkcaeige.exe
4244	Lamjbc32.exe
5384	Lhgbomfo.exe
2172	Lkenkhec.exe
4168	Lqbgcp32.exe
3660	Lglopjkg.exe
4372	Lnfgmc32.exe
708	Lqdcio32.exe
3224	Lgnleiid.exe
4504	Lnhdbc32.exe
2576	Ldblon32.exe
3304	Lkldlgok.exe
2764	Mbfmha32.exe
2924	Mhpeelnd.exe
1000	Mojmbf32.exe
1344	Mqkijnkp.exe
3552	Mgebfhcl.exe
2980	Mnojcb32.exe
3428	Mdibplaf.exe
1760	Mggolhaj.exe
3356	Mnaghb32.exe
4428	Mdloelpc.exe
4152	Mkegbfgp.exe
6092	Mndcnafd.exe
3548	Mdnlkl32.exe
5480	Nkhdgfen.exe
2256	Nnfpcada.exe
5992	Ndphpk32.exe
5968	Nkjqme32.exe
3632	Nbdijpjh.exe
2148	Ninafj32.exe
4276	Nohicdia.exe
5020	Nbfeoohe.exe
5792	Niqnli32.exe
3348	Nojfic32.exe
4164	Nqlbqlmm.exe
3932	Ngekmf32.exe
5672	Nnpcjplf.exe
3500	Nqnofkkj.exe
3060	Okcccdkp.exe
5176	Obnlpnbm.exe
2236	Oigdmh32.exe
3140	Ooalibaf.exe
5932	Oabiak32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Llmghjen.dll	Aacjofkp.exe
File created	C:\Windows\SysWOW64\Kikjjfkp.dll	Bojhnjgf.exe
File created	C:\Windows\SysWOW64\Hdcbbbbi.dll	Bhdilold.exe
File created	C:\Windows\SysWOW64\Maicgdbl.dll	Fhonpi32.exe
File created	C:\Windows\SysWOW64\Gfcgpkhk.exe	Gpioca32.exe
File created	C:\Windows\SysWOW64\Iapjeq32.exe	Ijfbhflj.exe
File opened for modification	C:\Windows\SysWOW64\Lqdcio32.exe	Lnfgmc32.exe
File created	C:\Windows\SysWOW64\Gcahbiba.dll	Lnhdbc32.exe
File created	C:\Windows\SysWOW64\Mnojcb32.exe	Mgebfhcl.exe
File opened for modification	C:\Windows\SysWOW64\Booaii32.exe	Bhdilold.exe
File created	C:\Windows\SysWOW64\Hbdjbn32.dll	Cakjfcfe.exe
File created	C:\Windows\SysWOW64\Jplmglbf.exe	Jibejb32.exe
File opened for modification	C:\Windows\SysWOW64\Mpkbohhd.exe	Mgbnfb32.exe
File created	C:\Windows\SysWOW64\Efeggaqg.dll	Mkpglqgj.exe
File created	C:\Windows\SysWOW64\Jlcdjfpl.dll	Jgdphm32.exe
File created	C:\Windows\SysWOW64\Ficaeg32.dll	Jaljaoii.exe
File created	C:\Windows\SysWOW64\Abnemc32.dll	Mgbnfb32.exe
File opened for modification	C:\Windows\SysWOW64\Ojfmdk32.exe	Odidld32.exe
File opened for modification	C:\Windows\SysWOW64\Hfajlp32.exe	Hnfehm32.exe
File created	C:\Windows\SysWOW64\Nohicdia.exe	Ninafj32.exe
File created	C:\Windows\SysWOW64\Abcgii32.exe	Alioloje.exe
File created	C:\Windows\SysWOW64\Bhppap32.exe	Abcgii32.exe
File created	C:\Windows\SysWOW64\Ahmpgegh.dll	Fqcilgji.exe
File opened for modification	C:\Windows\SysWOW64\Gqohge32.exe	Fjepkk32.exe
File created	C:\Windows\SysWOW64\Phbdoakj.dll	Kipalpoj.exe
File created	C:\Windows\SysWOW64\Mcdepd32.exe	Lacihleo.exe
File opened for modification	C:\Windows\SysWOW64\Jkkbnl32.exe	Igmjhnej.exe
File opened for modification	C:\Windows\SysWOW64\Nojfic32.exe	Niqnli32.exe
File created	C:\Windows\SysWOW64\Pngbam32.exe	Phmjdbpo.exe
File created	C:\Windows\SysWOW64\Ccfmef32.exe	Chphhn32.exe
File created	C:\Windows\SysWOW64\Mkpglqgj.exe	Mpkbohhd.exe
File opened for modification	C:\Windows\SysWOW64\Oiojmgcb.exe	Onifpodl.exe
File opened for modification	C:\Windows\SysWOW64\Qhbcpb32.exe	Qbekgknb.exe
File created	C:\Windows\SysWOW64\Bkomoj32.dll	Lqbgcp32.exe
File opened for modification	C:\Windows\SysWOW64\Mnojcb32.exe	Mgebfhcl.exe
File opened for modification	C:\Windows\SysWOW64\Mdibplaf.exe	Mnojcb32.exe
File created	C:\Windows\SysWOW64\Cakjfcfe.exe	Cpjmok32.exe
File created	C:\Windows\SysWOW64\Jdhpba32.exe	Jmnheggo.exe
File created	C:\Windows\SysWOW64\Kolaqh32.exe	Khbhdn32.exe
File created	C:\Windows\SysWOW64\Bdelid32.dll	Nbfeoohe.exe
File opened for modification	C:\Windows\SysWOW64\Plapdb32.exe	Pehghhgc.exe
File created	C:\Windows\SysWOW64\Chebcmna.exe	Cakjfcfe.exe
File created	C:\Windows\SysWOW64\Dpnfjjla.exe	Didnmp32.exe
File created	C:\Windows\SysWOW64\Afcafo32.dll	Fbeeco32.exe
File created	C:\Windows\SysWOW64\Hakhcd32.exe	Hidpbf32.exe
File opened for modification	C:\Windows\SysWOW64\Lajmmc32.exe	Kolaqh32.exe
File created	C:\Windows\SysWOW64\Bidefbcg.exe	Booaii32.exe
File created	C:\Windows\SysWOW64\Dcjfpfnh.exe	Chebcmna.exe
File opened for modification	C:\Windows\SysWOW64\Jabgkpad.exe	Ibagmiie.exe
File created	C:\Windows\SysWOW64\Kapclned.exe	Kgkooeen.exe
File opened for modification	C:\Windows\SysWOW64\Ndpafe32.exe	Nglala32.exe
File created	C:\Windows\SysWOW64\Gipgea32.dll	Occkhp32.exe
File opened for modification	C:\Windows\SysWOW64\Hnfehm32.exe	2026-10-14_9547619058d33eed636446e6570413c5_elex_wannacry.exe
File created	C:\Windows\SysWOW64\Jobomo32.dll	Dekobaki.exe
File created	C:\Windows\SysWOW64\Gmhfbf32.exe	Gbcaemdg.exe
File opened for modification	C:\Windows\SysWOW64\Nkjqme32.exe	Ndphpk32.exe
File created	C:\Windows\SysWOW64\Ifadqd32.dll	Cbofdg32.exe
File opened for modification	C:\Windows\SysWOW64\Fcfocb32.exe	Fmmffhnk.exe
File opened for modification	C:\Windows\SysWOW64\Ijfbhflj.exe	Ipqnknld.exe
File created	C:\Windows\SysWOW64\Kgkooeen.exe	Kanffogf.exe
File created	C:\Windows\SysWOW64\Mpmodg32.exe	Mkpglqgj.exe
File opened for modification	C:\Windows\SysWOW64\Lamjbc32.exe	Lkcaeige.exe
File created	C:\Windows\SysWOW64\Obnlpnbm.exe	Okcccdkp.exe
File opened for modification	C:\Windows\SysWOW64\Bidefbcg.exe	Booaii32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7644	7384	WerFault.exe	337

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lgkhec32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hfajlp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldblon32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qhbcpb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Coegih32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iippne32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ehlakjig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gfcgpkhk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfalhgni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nqlbqlmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhppap32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iidiidgj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iiffoc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onceji32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eqopqh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hclaeocp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nkhdgfen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Obnlpnbm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Appaangd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jdqcglqh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpnfjjla.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kapclned.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lkldlgok.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Didnmp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mncmck32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdibplaf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnbifmla.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ccfmef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ficgkico.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpcmoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onfbpi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mggolhaj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ehhgpj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fmmffhnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fifdqhal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hakhcd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kabpan32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bojhnjgf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bedpjdoc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mkegbfgp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pblhalfm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Elepei32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fqcilgji.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hihimfag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abcgii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nqnofkkj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dlegokbe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfffcf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgebfhcl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngekmf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qlkbka32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbofdg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hifmhf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mphfjhjf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbeeco32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Icedkn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jaljaoii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojopki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kolaqh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oabiak32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnnokn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apkhfo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fcfocb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kfhbifgq.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nkjqme32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Okcccdkp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Giilml32.dll"	Pnnokn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnhemllq.dll"	Hclaeocp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efeggaqg.dll"	Mkpglqgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lnfgmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pngbam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jobomo32.dll"	Dekobaki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gmfilfep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hcpjpn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jjklcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jplmglbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aqldhh32.dll"	Nqklfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmgjbc32.dll"	Kdmjmqjf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qhbcpb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aified32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cbokheno.dll"	Ipqnknld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekdpdkkf.dll"	Hnfehm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hfajlp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kdmjmqjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnfpcada.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oiojmgcb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bedpjdoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpfmgq32.dll"	Gbcaemdg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfeodebg.dll"	Nnpcjplf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ppbepp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Peajngoi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ficgkico.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkmghc32.dll"	Hbanfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogmkmjhc.dll"	Pcgdcome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anonhl32.dll"	Mnaghb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qhkdob32.dll"	Dcdifdem.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hihimfag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hbegakcb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eipmlo32.dll"	Nqioqf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kolaqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcahbiba.dll"	Lnhdbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Okhmnc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bedpjdoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Djnaco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efllohoa.dll"	Elagjihh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gfcgpkhk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eojplbhc.dll"	Hifmhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfbqdb32.dll"	Lhgbomfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lkldlgok.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dadlmanj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fifdqhal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jfalhgni.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kgphje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Odidld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Onceji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Algbfo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ccfmef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gqhknd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hifmhf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iiblcdil.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lkenkhec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lnhdbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nqlbqlmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nqnofkkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkjmodoi.dll"	Bpnncl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chphhn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eokjke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Poohcg32.dll"	Fmmffhnk.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 5616	2108	2026-10-14_9547619058d33eed636446e6570413c5_elex_wannacry.exe	89
PID 5616 wrote to memory of 4124	5616	Hnfehm32.exe	90
PID 4124 wrote to memory of 2220	4124	Hfajlp32.exe	91
PID 2220 wrote to memory of 3432	2220	Ihhmgaqb.exe	92
PID 3432 wrote to memory of 3732	3432	Igmjhnej.exe	93
PID 3732 wrote to memory of 1212	3732	Jkkbnl32.exe	94
PID 1212 wrote to memory of 1340	1212	Jphkfc32.exe	95
PID 1340 wrote to memory of 2620	1340	Jgdphm32.exe	96
PID 2620 wrote to memory of 5104	2620	Jmnheggo.exe	97
PID 5104 wrote to memory of 1880	5104	Jdhpba32.exe	98
PID 1880 wrote to memory of 4580	1880	Kdmjmqjf.exe	99
PID 4580 wrote to memory of 4264	4580	Kkgbjkac.exe	100
PID 4264 wrote to memory of 1700	4264	Kaajfe32.exe	101
PID 1700 wrote to memory of 1204	1700	Koggehff.exe	102
PID 1204 wrote to memory of 2580	1204	Kphdma32.exe	103
PID 2580 wrote to memory of 360	2580	Khplnn32.exe	104
PID 360 wrote to memory of 6004	360	Knldfe32.exe	105
PID 6004 wrote to memory of 1484	6004	Khbhdn32.exe	106
PID 1484 wrote to memory of 3284	1484	Kolaqh32.exe	107
PID 3284 wrote to memory of 5468	3284	Lajmmc32.exe	108
PID 5468 wrote to memory of 2436	5468	Lhdeinhb.exe	109
PID 2436 wrote to memory of 4244	2436	Lkcaeige.exe	110
PID 4244 wrote to memory of 5384	4244	Lamjbc32.exe	111
PID 5384 wrote to memory of 2172	5384	Lhgbomfo.exe	112
PID 2172 wrote to memory of 4168	2172	Lkenkhec.exe	113
PID 4168 wrote to memory of 3660	4168	Lqbgcp32.exe	114
PID 3660 wrote to memory of 4372	3660	Lglopjkg.exe	115
PID 4372 wrote to memory of 708	4372	Lnfgmc32.exe	116
PID 708 wrote to memory of 3224	708	Lqdcio32.exe	117
PID 3224 wrote to memory of 4504	3224	Lgnleiid.exe	118
PID 4504 wrote to memory of 2576	4504	Lnhdbc32.exe	119
PID 2576 wrote to memory of 3304	2576	Ldblon32.exe	120
PID 3304 wrote to memory of 2764	3304	Lkldlgok.exe	121
PID 2764 wrote to memory of 2924	2764	Mbfmha32.exe	122
PID 2924 wrote to memory of 1000	2924	Mhpeelnd.exe	123
PID 1000 wrote to memory of 1344	1000	Mojmbf32.exe	124
PID 1344 wrote to memory of 3552	1344	Mqkijnkp.exe	125
PID 3552 wrote to memory of 2980	3552	Mgebfhcl.exe	126
PID 2980 wrote to memory of 3428	2980	Mnojcb32.exe	127
PID 3428 wrote to memory of 1760	3428	Mdibplaf.exe	128
PID 1760 wrote to memory of 3356	1760	Mggolhaj.exe	129
PID 3356 wrote to memory of 4428	3356	Mnaghb32.exe	130
PID 4428 wrote to memory of 4152	4428	Mdloelpc.exe	131
PID 4152 wrote to memory of 6092	4152	Mkegbfgp.exe	132
PID 6092 wrote to memory of 3548	6092	Mndcnafd.exe	133
PID 3548 wrote to memory of 5480	3548	Mdnlkl32.exe	134
PID 5480 wrote to memory of 2256	5480	Nkhdgfen.exe	135
PID 2256 wrote to memory of 5992	2256	Nnfpcada.exe	136
PID 5992 wrote to memory of 5968	5992	Ndphpk32.exe	137
PID 5968 wrote to memory of 3632	5968	Nkjqme32.exe	138
PID 3632 wrote to memory of 2148	3632	Nbdijpjh.exe	139
PID 2148 wrote to memory of 4276	2148	Ninafj32.exe	140
PID 4276 wrote to memory of 5020	4276	Nohicdia.exe	141
PID 5020 wrote to memory of 5792	5020	Nbfeoohe.exe	142
PID 5792 wrote to memory of 3348	5792	Niqnli32.exe	143
PID 3348 wrote to memory of 4164	3348	Nojfic32.exe	144
PID 4164 wrote to memory of 3932	4164	Nqlbqlmm.exe	145
PID 3932 wrote to memory of 5672	3932	Ngekmf32.exe	146
PID 5672 wrote to memory of 3500	5672	Nnpcjplf.exe	147
PID 3500 wrote to memory of 3060	3500	Nqnofkkj.exe	148
PID 3060 wrote to memory of 5176	3060	Okcccdkp.exe	149
PID 5176 wrote to memory of 2236	5176	Obnlpnbm.exe	150
PID 2236 wrote to memory of 3140	2236	Oigdmh32.exe	151
PID 3140 wrote to memory of 5932	3140	Ooalibaf.exe	152

C:\Users\Admin\AppData\Local\Temp\2026-10-14_9547619058d33eed636446e6570413c5_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-14_9547619058d33eed636446e6570413c5_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\SysWOW64\Hnfehm32.exe
  C:\Windows\system32\Hnfehm32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5616
- - C:\Windows\SysWOW64\Hfajlp32.exe
    C:\Windows\system32\Hfajlp32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4124
  - - C:\Windows\SysWOW64\Ihhmgaqb.exe
      C:\Windows\system32\Ihhmgaqb.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2220
    - - C:\Windows\SysWOW64\Igmjhnej.exe
        
        C:\Windows\system32\Igmjhnej.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3432
      - C:\Windows\SysWOW64\Jkkbnl32.exe
        
        C:\Windows\system32\Jkkbnl32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3732
        
        C:\Windows\SysWOW64\Jphkfc32.exe
        
        C:\Windows\system32\Jphkfc32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1212
        
        C:\Windows\SysWOW64\Jgdphm32.exe
        
        C:\Windows\system32\Jgdphm32.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1340
        
        C:\Windows\SysWOW64\Jmnheggo.exe
        
        C:\Windows\system32\Jmnheggo.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2620
        
        C:\Windows\SysWOW64\Jdhpba32.exe
        
        C:\Windows\system32\Jdhpba32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5104
        
        C:\Windows\SysWOW64\Kdmjmqjf.exe
        
        C:\Windows\system32\Kdmjmqjf.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1880
        
        C:\Windows\SysWOW64\Kkgbjkac.exe
        
        C:\Windows\system32\Kkgbjkac.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4580
        
        C:\Windows\SysWOW64\Kaajfe32.exe
        
        C:\Windows\system32\Kaajfe32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4264
        
        C:\Windows\SysWOW64\Koggehff.exe
        
        C:\Windows\system32\Koggehff.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1700
        
        C:\Windows\SysWOW64\Kphdma32.exe
        
        C:\Windows\system32\Kphdma32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1204
        
        C:\Windows\SysWOW64\Khplnn32.exe
        
        C:\Windows\system32\Khplnn32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2580
        
        C:\Windows\SysWOW64\Knldfe32.exe
        
        C:\Windows\system32\Knldfe32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:360
        
        C:\Windows\SysWOW64\Khbhdn32.exe
        
        C:\Windows\system32\Khbhdn32.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:6004
        
        C:\Windows\SysWOW64\Kolaqh32.exe
        
        C:\Windows\system32\Kolaqh32.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1484
        
        C:\Windows\SysWOW64\Lajmmc32.exe
        
        C:\Windows\system32\Lajmmc32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3284
        
        C:\Windows\SysWOW64\Lhdeinhb.exe
        
        C:\Windows\system32\Lhdeinhb.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5468
        
        C:\Windows\SysWOW64\Lkcaeige.exe
        
        C:\Windows\system32\Lkcaeige.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2436
        
        C:\Windows\SysWOW64\Lamjbc32.exe
        
        C:\Windows\system32\Lamjbc32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4244
        
        C:\Windows\SysWOW64\Lhgbomfo.exe
        
        C:\Windows\system32\Lhgbomfo.exe
        24⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5384
        
        C:\Windows\SysWOW64\Lkenkhec.exe
        
        C:\Windows\system32\Lkenkhec.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2172
        
        C:\Windows\SysWOW64\Lqbgcp32.exe
        
        C:\Windows\system32\Lqbgcp32.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4168
        
        C:\Windows\SysWOW64\Lglopjkg.exe
        
        C:\Windows\system32\Lglopjkg.exe
        27⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3660
        
        C:\Windows\SysWOW64\Lnfgmc32.exe
        
        C:\Windows\system32\Lnfgmc32.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4372
        
        C:\Windows\SysWOW64\Lqdcio32.exe
        
        C:\Windows\system32\Lqdcio32.exe
        29⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:708
        
        C:\Windows\SysWOW64\Lgnleiid.exe
        
        C:\Windows\system32\Lgnleiid.exe
        30⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3224
        
        C:\Windows\SysWOW64\Lnhdbc32.exe
        
        C:\Windows\system32\Lnhdbc32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4504
        
        C:\Windows\SysWOW64\Ldblon32.exe
        
        C:\Windows\system32\Ldblon32.exe
        32⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2576
        
        C:\Windows\SysWOW64\Lkldlgok.exe
        
        C:\Windows\system32\Lkldlgok.exe
        33⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3304
        
        C:\Windows\SysWOW64\Mbfmha32.exe
        
        C:\Windows\system32\Mbfmha32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2764
        
        C:\Windows\SysWOW64\Mhpeelnd.exe
        
        C:\Windows\system32\Mhpeelnd.exe
        35⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2924
        
        C:\Windows\SysWOW64\Mojmbf32.exe
        
        C:\Windows\system32\Mojmbf32.exe
        36⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1000
        
        C:\Windows\SysWOW64\Mqkijnkp.exe
        
        C:\Windows\system32\Mqkijnkp.exe
        37⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1344
        
        C:\Windows\SysWOW64\Mgebfhcl.exe
        
        C:\Windows\system32\Mgebfhcl.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3552
        
        C:\Windows\SysWOW64\Mnojcb32.exe
        
        C:\Windows\system32\Mnojcb32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2980
        
        C:\Windows\SysWOW64\Mdibplaf.exe
        
        C:\Windows\system32\Mdibplaf.exe
        40⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3428
        
        C:\Windows\SysWOW64\Mggolhaj.exe
        
        C:\Windows\system32\Mggolhaj.exe
        41⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1760
        
        C:\Windows\SysWOW64\Mnaghb32.exe
        
        C:\Windows\system32\Mnaghb32.exe
        42⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3356
        
        C:\Windows\SysWOW64\Mdloelpc.exe
        
        C:\Windows\system32\Mdloelpc.exe
        43⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4428
        
        C:\Windows\SysWOW64\Mkegbfgp.exe
        
        C:\Windows\system32\Mkegbfgp.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4152
        
        C:\Windows\SysWOW64\Mndcnafd.exe
        
        C:\Windows\system32\Mndcnafd.exe
        45⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6092
        
        C:\Windows\SysWOW64\Mdnlkl32.exe
        
        C:\Windows\system32\Mdnlkl32.exe
        46⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3548
        
        C:\Windows\SysWOW64\Nkhdgfen.exe
        
        C:\Windows\system32\Nkhdgfen.exe
        47⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5480
        
        C:\Windows\SysWOW64\Nnfpcada.exe
        
        C:\Windows\system32\Nnfpcada.exe
        48⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2256
        
        C:\Windows\SysWOW64\Ndphpk32.exe
        
        C:\Windows\system32\Ndphpk32.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5992
        
        C:\Windows\SysWOW64\Nkjqme32.exe
        
        C:\Windows\system32\Nkjqme32.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5968
        
        C:\Windows\SysWOW64\Nbdijpjh.exe
        
        C:\Windows\system32\Nbdijpjh.exe
        51⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3632
        
        C:\Windows\SysWOW64\Ninafj32.exe
        
        C:\Windows\system32\Ninafj32.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2148
        
        C:\Windows\SysWOW64\Nohicdia.exe
        
        C:\Windows\system32\Nohicdia.exe
        53⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4276
        
        C:\Windows\SysWOW64\Nbfeoohe.exe
        
        C:\Windows\system32\Nbfeoohe.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5020
        
        C:\Windows\SysWOW64\Niqnli32.exe
        
        C:\Windows\system32\Niqnli32.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5792
        
        C:\Windows\SysWOW64\Nojfic32.exe
        
        C:\Windows\system32\Nojfic32.exe
        56⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3348
        
        C:\Windows\SysWOW64\Nqlbqlmm.exe
        
        C:\Windows\system32\Nqlbqlmm.exe
        57⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4164
        
        C:\Windows\SysWOW64\Ngekmf32.exe
        
        C:\Windows\system32\Ngekmf32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3932
        
        C:\Windows\SysWOW64\Nnpcjplf.exe
        
        C:\Windows\system32\Nnpcjplf.exe
        59⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5672
        
        C:\Windows\SysWOW64\Nqnofkkj.exe
        
        C:\Windows\system32\Nqnofkkj.exe
        60⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3500
        
        C:\Windows\SysWOW64\Okcccdkp.exe
        
        C:\Windows\system32\Okcccdkp.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3060
        
        C:\Windows\SysWOW64\Obnlpnbm.exe
        
        C:\Windows\system32\Obnlpnbm.exe
        62⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5176
        
        C:\Windows\SysWOW64\Oigdmh32.exe
        
        C:\Windows\system32\Oigdmh32.exe
        63⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2236
        
        C:\Windows\SysWOW64\Ooalibaf.exe
        
        C:\Windows\system32\Ooalibaf.exe
        64⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3140
        
        C:\Windows\SysWOW64\Oabiak32.exe
        
        C:\Windows\system32\Oabiak32.exe
        65⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5932
        
        C:\Windows\SysWOW64\Okhmnc32.exe
        
        C:\Windows\system32\Okhmnc32.exe
        66⤵
        Modifies registry class
        
        PID:4180
        
        C:\Windows\SysWOW64\Obbekn32.exe
        
        C:\Windows\system32\Obbekn32.exe
        67⤵
        
        PID:2140
        
        C:\Windows\SysWOW64\Oilmhhfd.exe
        
        C:\Windows\system32\Oilmhhfd.exe
        68⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Onifpodl.exe
        
        C:\Windows\system32\Onifpodl.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5788
        
        C:\Windows\SysWOW64\Oiojmgcb.exe
        
        C:\Windows\system32\Oiojmgcb.exe
        70⤵
        Modifies registry class
        
        PID:4676
        
        C:\Windows\SysWOW64\Ophbja32.exe
        
        C:\Windows\system32\Ophbja32.exe
        71⤵
        
        PID:3480
        
        C:\Windows\SysWOW64\Oajoaj32.exe
        
        C:\Windows\system32\Oajoaj32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3476
        
        C:\Windows\SysWOW64\Pgdgodhj.exe
        
        C:\Windows\system32\Pgdgodhj.exe
        73⤵
        
        PID:2812
        
        C:\Windows\SysWOW64\Pnnokn32.exe
        
        C:\Windows\system32\Pnnokn32.exe
        74⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3148
        
        C:\Windows\SysWOW64\Pehghhgc.exe
        
        C:\Windows\system32\Pehghhgc.exe
        75⤵
        Drops file in System32 directory
        
        PID:3324
        
        C:\Windows\SysWOW64\Plapdb32.exe
        
        C:\Windows\system32\Plapdb32.exe
        76⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Pblhalfm.exe
        
        C:\Windows\system32\Pblhalfm.exe
        77⤵
        System Location Discovery: System Language Discovery
        
        PID:1092
        
        C:\Windows\SysWOW64\Piepnfnj.exe
        
        C:\Windows\system32\Piepnfnj.exe
        78⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Pnbifmla.exe
        
        C:\Windows\system32\Pnbifmla.exe
        79⤵
        System Location Discovery: System Language Discovery
        
        PID:1048
        
        C:\Windows\SysWOW64\Pelacg32.exe
        
        C:\Windows\system32\Pelacg32.exe
        80⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Ppbepp32.exe
        
        C:\Windows\system32\Ppbepp32.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5620
        
        C:\Windows\SysWOW64\Pacahhib.exe
        
        C:\Windows\system32\Pacahhib.exe
        82⤵
        
        PID:4496
        
        C:\Windows\SysWOW64\Phmjdbpo.exe
        
        C:\Windows\system32\Phmjdbpo.exe
        83⤵
        Drops file in System32 directory
        
        PID:3120
        
        C:\Windows\SysWOW64\Pngbam32.exe
        
        C:\Windows\system32\Pngbam32.exe
        84⤵
        Modifies registry class
        
        PID:3812
        
        C:\Windows\SysWOW64\Peajngoi.exe
        
        C:\Windows\system32\Peajngoi.exe
        85⤵
        Modifies registry class
        
        PID:2384
        
        C:\Windows\SysWOW64\Qlkbka32.exe
        
        C:\Windows\system32\Qlkbka32.exe
        86⤵
        System Location Discovery: System Language Discovery
        
        PID:5748
        
        C:\Windows\SysWOW64\Qbekgknb.exe
        
        C:\Windows\system32\Qbekgknb.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3376
        
        C:\Windows\SysWOW64\Qhbcpb32.exe
        
        C:\Windows\system32\Qhbcpb32.exe
        88⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:800
        
        C:\Windows\SysWOW64\Qnlkllcf.exe
        
        C:\Windows\system32\Qnlkllcf.exe
        89⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\Aiapjecl.exe
        
        C:\Windows\system32\Aiapjecl.exe
        90⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\Apkhfo32.exe
        
        C:\Windows\system32\Apkhfo32.exe
        91⤵
        System Location Discovery: System Language Discovery
        
        PID:5752
        
        C:\Windows\SysWOW64\Aaldngqg.exe
        
        C:\Windows\system32\Aaldngqg.exe
        92⤵
        
        PID:248
        
        C:\Windows\SysWOW64\Ahfmka32.exe
        
        C:\Windows\system32\Ahfmka32.exe
        93⤵
        
        PID:1640
        
        C:\Windows\SysWOW64\Aoqegk32.exe
        
        C:\Windows\system32\Aoqegk32.exe
        94⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Aified32.exe
        
        C:\Windows\system32\Aified32.exe
        95⤵
        Modifies registry class
        
        PID:5180
        
        C:\Windows\SysWOW64\Appaangd.exe
        
        C:\Windows\system32\Appaangd.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5340
        
        C:\Windows\SysWOW64\Aemjjeek.exe
        
        C:\Windows\system32\Aemjjeek.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1124
        
        C:\Windows\SysWOW64\Algbfo32.exe
        
        C:\Windows\system32\Algbfo32.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1488
        
        C:\Windows\SysWOW64\Aacjofkp.exe
        
        C:\Windows\system32\Aacjofkp.exe
        99⤵
        Drops file in System32 directory
        
        PID:3000
        
        C:\Windows\SysWOW64\Alioloje.exe
        
        C:\Windows\system32\Alioloje.exe
        100⤵
        Drops file in System32 directory
        
        PID:1100
        
        C:\Windows\SysWOW64\Abcgii32.exe
        
        C:\Windows\system32\Abcgii32.exe
        101⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5544
        
        C:\Windows\SysWOW64\Bhppap32.exe
        
        C:\Windows\system32\Bhppap32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4664
        
        C:\Windows\SysWOW64\Bojhnjgf.exe
        
        C:\Windows\system32\Bojhnjgf.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2312
        
        C:\Windows\SysWOW64\Bedpjdoc.exe
        
        C:\Windows\system32\Bedpjdoc.exe
        104⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5140
        
        C:\Windows\SysWOW64\Blnhgn32.exe
        
        C:\Windows\system32\Blnhgn32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4444
        
        C:\Windows\SysWOW64\Bbhqdhnm.exe
        
        C:\Windows\system32\Bbhqdhnm.exe
        106⤵
        
        PID:3712
        
        C:\Windows\SysWOW64\Bhdilold.exe
        
        C:\Windows\system32\Bhdilold.exe
        107⤵
        Drops file in System32 directory
        
        PID:2420
        
        C:\Windows\SysWOW64\Booaii32.exe
        
        C:\Windows\system32\Booaii32.exe
        108⤵
        Drops file in System32 directory
        
        PID:3608
        
        C:\Windows\SysWOW64\Bidefbcg.exe
        
        C:\Windows\system32\Bidefbcg.exe
        109⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\Bpnncl32.exe
        
        C:\Windows\system32\Bpnncl32.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3040
        
        C:\Windows\SysWOW64\Baojkdqb.exe
        
        C:\Windows\system32\Baojkdqb.exe
        111⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\Blenhmph.exe
        
        C:\Windows\system32\Blenhmph.exe
        112⤵
        
        PID:840
        
        C:\Windows\SysWOW64\Cbofdg32.exe
        
        C:\Windows\system32\Cbofdg32.exe
        113⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4840
        
        C:\Windows\SysWOW64\Chlomnfl.exe
        
        C:\Windows\system32\Chlomnfl.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2092
        
        C:\Windows\SysWOW64\Coegih32.exe
        
        C:\Windows\system32\Coegih32.exe
        115⤵
        System Location Discovery: System Language Discovery
        
        PID:2376
        
        C:\Windows\SysWOW64\Cikkga32.exe
        
        C:\Windows\system32\Cikkga32.exe
        116⤵
        
        PID:3056
        
        C:\Windows\SysWOW64\Cafpkc32.exe
        
        C:\Windows\system32\Cafpkc32.exe
        117⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\Chphhn32.exe
        
        C:\Windows\system32\Chphhn32.exe
        118⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1404
        
        C:\Windows\SysWOW64\Ccfmef32.exe
        
        C:\Windows\system32\Ccfmef32.exe
        119⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1956
        
        C:\Windows\SysWOW64\Cipebqij.exe
        
        C:\Windows\system32\Cipebqij.exe
        120⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Cpjmok32.exe
        
        C:\Windows\system32\Cpjmok32.exe
        121⤵
        Drops file in System32 directory
        
        PID:6160
        
        C:\Windows\SysWOW64\Cakjfcfe.exe
        
        C:\Windows\system32\Cakjfcfe.exe
        122⤵
        Drops file in System32 directory
        
        PID:6200
        
        C:\Windows\SysWOW64\Chebcmna.exe
        
        C:\Windows\system32\Chebcmna.exe
        123⤵
        Drops file in System32 directory
        
        PID:6240
        
        C:\Windows\SysWOW64\Dcjfpfnh.exe
        
        C:\Windows\system32\Dcjfpfnh.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6280
        
        C:\Windows\SysWOW64\Didnmp32.exe
        
        C:\Windows\system32\Didnmp32.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6320
        
        C:\Windows\SysWOW64\Dpnfjjla.exe
        
        C:\Windows\system32\Dpnfjjla.exe
        126⤵
        System Location Discovery: System Language Discovery
        
        PID:6360
        
        C:\Windows\SysWOW64\Dekobaki.exe
        
        C:\Windows\system32\Dekobaki.exe
        127⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6400
        
        C:\Windows\SysWOW64\Dlegokbe.exe
        
        C:\Windows\system32\Dlegokbe.exe
        128⤵
        System Location Discovery: System Language Discovery
        
        PID:6440
        
        C:\Windows\SysWOW64\Denlgq32.exe
        
        C:\Windows\system32\Denlgq32.exe
        129⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Dadlmanj.exe
        
        C:\Windows\system32\Dadlmanj.exe
        130⤵
        Modifies registry class
        
        PID:6524
        
        C:\Windows\SysWOW64\Dcdifdem.exe
        
        C:\Windows\system32\Dcdifdem.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6564
        
        C:\Windows\SysWOW64\Djnaco32.exe
        
        C:\Windows\system32\Djnaco32.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6604
        
        C:\Windows\SysWOW64\Eokjke32.exe
        
        C:\Windows\system32\Eokjke32.exe
        133⤵
        Modifies registry class
        
        PID:6644
        
        C:\Windows\SysWOW64\Efdbhpbn.exe
        
        C:\Windows\system32\Efdbhpbn.exe
        134⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Epjfehbd.exe
        
        C:\Windows\system32\Epjfehbd.exe
        135⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Ebkbmqhb.exe
        
        C:\Windows\system32\Ebkbmqhb.exe
        136⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Elagjihh.exe
        
        C:\Windows\system32\Elagjihh.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6804
        
        C:\Windows\SysWOW64\Eckogc32.exe
        
        C:\Windows\system32\Eckogc32.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6844
        
        C:\Windows\SysWOW64\Ehhgpj32.exe
        
        C:\Windows\system32\Ehhgpj32.exe
        139⤵
        System Location Discovery: System Language Discovery
        
        PID:6888
        
        C:\Windows\SysWOW64\Eqopqh32.exe
        
        C:\Windows\system32\Eqopqh32.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6928
        
        C:\Windows\SysWOW64\Eflhiolf.exe
        
        C:\Windows\system32\Eflhiolf.exe
        141⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Elepei32.exe
        
        C:\Windows\system32\Elepei32.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7008
        
        C:\Windows\SysWOW64\Ebbinp32.exe
        
        C:\Windows\system32\Ebbinp32.exe
        143⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Ehlakjig.exe
        
        C:\Windows\system32\Ehlakjig.exe
        144⤵
        System Location Discovery: System Language Discovery
        
        PID:7088
        
        C:\Windows\SysWOW64\Fqcilgji.exe
        
        C:\Windows\system32\Fqcilgji.exe
        145⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7128
        
        C:\Windows\SysWOW64\Fbeeco32.exe
        
        C:\Windows\system32\Fbeeco32.exe
        146⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5704
        
        C:\Windows\SysWOW64\Fhonpi32.exe
        
        C:\Windows\system32\Fhonpi32.exe
        147⤵
        Drops file in System32 directory
        
        PID:4656
        
        C:\Windows\SysWOW64\Fcdbmb32.exe
        
        C:\Windows\system32\Fcdbmb32.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5172
        
        C:\Windows\SysWOW64\Fmmffhnk.exe
        
        C:\Windows\system32\Fmmffhnk.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5372
        
        C:\Windows\SysWOW64\Fcfocb32.exe
        
        C:\Windows\system32\Fcfocb32.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1316
        
        C:\Windows\SysWOW64\Ficgkico.exe
        
        C:\Windows\system32\Ficgkico.exe
        151⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3696
        
        C:\Windows\SysWOW64\Fblldn32.exe
        
        C:\Windows\system32\Fblldn32.exe
        152⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Fifdqhal.exe
        
        C:\Windows\system32\Fifdqhal.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6216
        
        C:\Windows\SysWOW64\Foplnb32.exe
        
        C:\Windows\system32\Foplnb32.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4560
        
        C:\Windows\SysWOW64\Fjepkk32.exe
        
        C:\Windows\system32\Fjepkk32.exe
        155⤵
        Drops file in System32 directory
        
        PID:6312
        
        C:\Windows\SysWOW64\Gqohge32.exe
        
        C:\Windows\system32\Gqohge32.exe
        156⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Gflapl32.exe
        
        C:\Windows\system32\Gflapl32.exe
        157⤵
        
        PID:4324
        
        C:\Windows\SysWOW64\Gmfilfep.exe
        
        C:\Windows\system32\Gmfilfep.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3992
        
        C:\Windows\SysWOW64\Gbcaemdg.exe
        
        C:\Windows\system32\Gbcaemdg.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6476
        
        C:\Windows\SysWOW64\Gmhfbf32.exe
        
        C:\Windows\system32\Gmhfbf32.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6532
        
        C:\Windows\SysWOW64\Gbenjm32.exe
        
        C:\Windows\system32\Gbenjm32.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6592
        
        C:\Windows\SysWOW64\Giofggia.exe
        
        C:\Windows\system32\Giofggia.exe
        162⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Gpioca32.exe
        
        C:\Windows\system32\Gpioca32.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6712
        
        C:\Windows\SysWOW64\Gfcgpkhk.exe
        
        C:\Windows\system32\Gfcgpkhk.exe
        164⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6776
        
        C:\Windows\SysWOW64\Gqhknd32.exe
        
        C:\Windows\system32\Gqhknd32.exe
        165⤵
        Modifies registry class
        
        PID:6836
        
        C:\Windows\SysWOW64\Gcggjp32.exe
        
        C:\Windows\system32\Gcggjp32.exe
        166⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Hidpbf32.exe
        
        C:\Windows\system32\Hidpbf32.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6956
        
        C:\Windows\SysWOW64\Hakhcd32.exe
        
        C:\Windows\system32\Hakhcd32.exe
        168⤵
        System Location Discovery: System Language Discovery
        
        PID:7020
        
        C:\Windows\SysWOW64\Hifmhf32.exe
        
        C:\Windows\system32\Hifmhf32.exe
        169⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7072
        
        C:\Windows\SysWOW64\Hclaeocp.exe
        
        C:\Windows\system32\Hclaeocp.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7140
        
        C:\Windows\SysWOW64\Hihimfag.exe
        
        C:\Windows\system32\Hihimfag.exe
        171⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2852
        
        C:\Windows\SysWOW64\Hbanfk32.exe
        
        C:\Windows\system32\Hbanfk32.exe
        172⤵
        Modifies registry class
        
        PID:2628
        
        C:\Windows\SysWOW64\Hikfbeod.exe
        
        C:\Windows\system32\Hikfbeod.exe
        173⤵
        
        PID:3700
        
        C:\Windows\SysWOW64\Hcpjpn32.exe
        
        C:\Windows\system32\Hcpjpn32.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6152
        
        C:\Windows\SysWOW64\Hmioicek.exe
        
        C:\Windows\system32\Hmioicek.exe
        175⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Hbegakcb.exe
        
        C:\Windows\system32\Hbegakcb.exe
        176⤵
        Modifies registry class
        
        PID:5784
        
        C:\Windows\SysWOW64\Iippne32.exe
        
        C:\Windows\system32\Iippne32.exe
        177⤵
        System Location Discovery: System Language Discovery
        
        PID:6428
        
        C:\Windows\SysWOW64\Icedkn32.exe
        
        C:\Windows\system32\Icedkn32.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5376
        
        C:\Windows\SysWOW64\Iiblcdil.exe
        
        C:\Windows\system32\Iiblcdil.exe
        179⤵
        Modifies registry class
        
        PID:6516
        
        C:\Windows\SysWOW64\Icgqqmib.exe
        
        C:\Windows\system32\Icgqqmib.exe
        180⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Iidiidgj.exe
        
        C:\Windows\system32\Iidiidgj.exe
        181⤵
        System Location Discovery: System Language Discovery
        
        PID:6760
        
        C:\Windows\SysWOW64\Ibmmbj32.exe
        
        C:\Windows\system32\Ibmmbj32.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6880
        
        C:\Windows\SysWOW64\Iiffoc32.exe
        
        C:\Windows\system32\Iiffoc32.exe
        183⤵
        System Location Discovery: System Language Discovery
        
        PID:7004
        
        C:\Windows\SysWOW64\Ipqnknld.exe
        
        C:\Windows\system32\Ipqnknld.exe
        184⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7124
        
        C:\Windows\SysWOW64\Ijfbhflj.exe
        
        C:\Windows\system32\Ijfbhflj.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1240
        
        C:\Windows\SysWOW64\Iapjeq32.exe
        
        C:\Windows\system32\Iapjeq32.exe
        186⤵
        
        PID:3508
        
        C:\Windows\SysWOW64\Ibagmiie.exe
        
        C:\Windows\system32\Ibagmiie.exe
        187⤵
        Drops file in System32 directory
        
        PID:1696
        
        C:\Windows\SysWOW64\Jabgkpad.exe
        
        C:\Windows\system32\Jabgkpad.exe
        188⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Jdqcglqh.exe
        
        C:\Windows\system32\Jdqcglqh.exe
        189⤵
        System Location Discovery: System Language Discovery
        
        PID:4176
        
        C:\Windows\SysWOW64\Jjklcf32.exe
        
        C:\Windows\system32\Jjklcf32.exe
        190⤵
        Modifies registry class
        
        PID:6572
        
        C:\Windows\SysWOW64\Jpgdlm32.exe
        
        C:\Windows\system32\Jpgdlm32.exe
        191⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Jfalhgni.exe
        
        C:\Windows\system32\Jfalhgni.exe
        192⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6976
        
        C:\Windows\SysWOW64\Jmkdeaee.exe
        
        C:\Windows\system32\Jmkdeaee.exe
        193⤵
        
        PID:4976
        
        C:\Windows\SysWOW64\Jdembk32.exe
        
        C:\Windows\system32\Jdembk32.exe
        194⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\Jibejb32.exe
        
        C:\Windows\system32\Jibejb32.exe
        195⤵
        Drops file in System32 directory
        
        PID:6348
        
        C:\Windows\SysWOW64\Jplmglbf.exe
        
        C:\Windows\system32\Jplmglbf.exe
        196⤵
        Modifies registry class
        
        PID:6680
        
        C:\Windows\SysWOW64\Jfffcf32.exe
        
        C:\Windows\system32\Jfffcf32.exe
        197⤵
        System Location Discovery: System Language Discovery
        
        PID:7016
        
        C:\Windows\SysWOW64\Jaljaoii.exe
        
        C:\Windows\system32\Jaljaoii.exe
        198⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4376
        
        C:\Windows\SysWOW64\Kfhbifgq.exe
        
        C:\Windows\system32\Kfhbifgq.exe
        199⤵
        System Location Discovery: System Language Discovery
        
        PID:6352
        
        C:\Windows\SysWOW64\Kanffogf.exe
        
        C:\Windows\system32\Kanffogf.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6740
        
        C:\Windows\SysWOW64\Kgkooeen.exe
        
        C:\Windows\system32\Kgkooeen.exe
        201⤵
        Drops file in System32 directory
        
        PID:5680
        
        C:\Windows\SysWOW64\Kapclned.exe
        
        C:\Windows\system32\Kapclned.exe
        202⤵
        System Location Discovery: System Language Discovery
        
        PID:6616
        
        C:\Windows\SysWOW64\Kgmlde32.exe
        
        C:\Windows\system32\Kgmlde32.exe
        203⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Kabpan32.exe
        
        C:\Windows\system32\Kabpan32.exe
        204⤵
        System Location Discovery: System Language Discovery
        
        PID:6512
        
        C:\Windows\SysWOW64\Kgphje32.exe
        
        C:\Windows\system32\Kgphje32.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7192
        
        C:\Windows\SysWOW64\Kaemgn32.exe
        
        C:\Windows\system32\Kaemgn32.exe
        206⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\Kcfiof32.exe
        
        C:\Windows\system32\Kcfiof32.exe
        207⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Kipalpoj.exe
        
        C:\Windows\system32\Kipalpoj.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7324
        
        C:\Windows\SysWOW64\Kdffiinp.exe
        
        C:\Windows\system32\Kdffiinp.exe
        209⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Libnapmg.exe
        
        C:\Windows\system32\Libnapmg.exe
        210⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Ldhbnhlm.exe
        
        C:\Windows\system32\Ldhbnhlm.exe
        211⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Liekgo32.exe
        
        C:\Windows\system32\Liekgo32.exe
        212⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7504
        
        C:\Windows\SysWOW64\Lpocciba.exe
        
        C:\Windows\system32\Lpocciba.exe
        213⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Lkdgqbag.exe
        
        C:\Windows\system32\Lkdgqbag.exe
        214⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Lanpml32.exe
        
        C:\Windows\system32\Lanpml32.exe
        215⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Lgkhec32.exe
        
        C:\Windows\system32\Lgkhec32.exe
        216⤵
        System Location Discovery: System Language Discovery
        
        PID:7676
        
        C:\Windows\SysWOW64\Lpcmoi32.exe
        
        C:\Windows\system32\Lpcmoi32.exe
        217⤵
        System Location Discovery: System Language Discovery
        
        PID:7716
        
        C:\Windows\SysWOW64\Lkiqla32.exe
        
        C:\Windows\system32\Lkiqla32.exe
        218⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Lacihleo.exe
        
        C:\Windows\system32\Lacihleo.exe
        219⤵
        Drops file in System32 directory
        
        PID:7800
        
        C:\Windows\SysWOW64\Mcdepd32.exe
        
        C:\Windows\system32\Mcdepd32.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7836
        
        C:\Windows\SysWOW64\Mphfjhjf.exe
        
        C:\Windows\system32\Mphfjhjf.exe
        221⤵
        System Location Discovery: System Language Discovery
        
        PID:7876
        
        C:\Windows\SysWOW64\Mgbnfb32.exe
        
        C:\Windows\system32\Mgbnfb32.exe
        222⤵
        Drops file in System32 directory
        
        PID:7912
        
        C:\Windows\SysWOW64\Mpkbohhd.exe
        
        C:\Windows\system32\Mpkbohhd.exe
        223⤵
        Drops file in System32 directory
        
        PID:7948
        
        C:\Windows\SysWOW64\Mkpglqgj.exe
        
        C:\Windows\system32\Mkpglqgj.exe
        224⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7984
        
        C:\Windows\SysWOW64\Mpmodg32.exe
        
        C:\Windows\system32\Mpmodg32.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8020
        
        C:\Windows\SysWOW64\Mnapnl32.exe
        
        C:\Windows\system32\Mnapnl32.exe
        226⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Mcnhfb32.exe
        
        C:\Windows\system32\Mcnhfb32.exe
        227⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Mncmck32.exe
        
        C:\Windows\system32\Mncmck32.exe
        228⤵
        System Location Discovery: System Language Discovery
        
        PID:8132
        
        C:\Windows\SysWOW64\Nglala32.exe
        
        C:\Windows\system32\Nglala32.exe
        229⤵
        Drops file in System32 directory
        
        PID:8172
        
        C:\Windows\SysWOW64\Ndpafe32.exe
        
        C:\Windows\system32\Ndpafe32.exe
        230⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Njljnl32.exe
        
        C:\Windows\system32\Njljnl32.exe
        231⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7248
        
        C:\Windows\SysWOW64\Ndbnkefp.exe
        
        C:\Windows\system32\Ndbnkefp.exe
        232⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Nqioqf32.exe
        
        C:\Windows\system32\Nqioqf32.exe
        233⤵
        Modifies registry class
        
        PID:7364
        
        C:\Windows\SysWOW64\Nkncno32.exe
        
        C:\Windows\system32\Nkncno32.exe
        234⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Nqklfe32.exe
        
        C:\Windows\system32\Nqklfe32.exe
        235⤵
        Modifies registry class
        
        PID:7496
        
        C:\Windows\SysWOW64\Nkqpcnig.exe
        
        C:\Windows\system32\Nkqpcnig.exe
        236⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\Odidld32.exe
        
        C:\Windows\system32\Odidld32.exe
        237⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7604
        
        C:\Windows\SysWOW64\Ojfmdk32.exe
        
        C:\Windows\system32\Ojfmdk32.exe
        238⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Oqpeaeel.exe
        
        C:\Windows\system32\Oqpeaeel.exe
        239⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Ogjmnomi.exe
        
        C:\Windows\system32\Ogjmnomi.exe
        240⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Onceji32.exe
        
        C:\Windows\system32\Onceji32.exe
        241⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7832
        
        C:\Windows\SysWOW64\Ocqncp32.exe
        
        C:\Windows\system32\Ocqncp32.exe
        242⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Onfbpi32.exe
        
        C:\Windows\system32\Onfbpi32.exe
        243⤵
        System Location Discovery: System Language Discovery
        
        PID:7944
        
        C:\Windows\SysWOW64\Occkhp32.exe
        
        C:\Windows\system32\Occkhp32.exe
        244⤵
        Drops file in System32 directory
        
        PID:7992
        
        C:\Windows\SysWOW64\Ojmcej32.exe
        
        C:\Windows\system32\Ojmcej32.exe
        245⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Ocegnoog.exe
        
        C:\Windows\system32\Ocegnoog.exe
        246⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Ojopki32.exe
        
        C:\Windows\system32\Ojopki32.exe
        247⤵
        System Location Discovery: System Language Discovery
        
        PID:8164
        
        C:\Windows\SysWOW64\Pcgdcome.exe
        
        C:\Windows\system32\Pcgdcome.exe
        248⤵
        Modifies registry class
        
        PID:7204
        
        C:\Windows\SysWOW64\Pjalpida.exe
        
        C:\Windows\system32\Pjalpida.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7292
        
        C:\Windows\SysWOW64\Pqkdmc32.exe
        
        C:\Windows\system32\Pqkdmc32.exe
        250⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7384 -s 448
        251⤵
        Program crash
        
        PID:7644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 7384 -ip 7384
1⤵
PID:7560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Hfajlp32.exe

Path C:\Windows\SysWOW64\Hfajlp32.exe
Size 429KB
SHA256 1e5d6186cd34672346c28fcdf466d6108bd2994fd3241da05b59e9c3a68ff832
MD5 715acd5dfb639e438958a024f7d0c74f
SHA1 55289c74afb1f8d96ab2bc755c916879c1855f70
SHA512 8f4fc8813d19d4c67fe103a3db49fea62d467cda251f22c7f257cb4013a7c67be7845150787dab5739e40f28d2cc71fa514d2431303cad20bce09e71239f02ea
SSDEEP 6144:8G8tmyBOIvCdSr7V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:8GXy5vCdS+/NcZ7/N
TLSH
T124944D256A701EE6EDEE6BB5AC1249D8C081E5F104F1E53E6A77DFDCD8E4DA1C804B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hnfehm32.exe

Path C:\Windows\SysWOW64\Hnfehm32.exe
Size 429KB
SHA256 06170627f77eef5ca130c96b4da52d253e06108dc9cb1b0b24386867ea6911af
MD5 5f4ab3889ef5abc57653067da1c9512a
SHA1 1e28d1ee64beca1331ec5b31c35e2c7d00f1f5fc
SHA512 a2a249159b7886d439cc359d3fe3328ce526b87b030beb0dbc563a31adc0453e52fdd0b4b5ff8689b89f33d21f536c4eab9ec370f17bb9426d5c98768f2bfa15
SSDEEP 6144:7xKktQV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:7L/NcZ7/N
TLSH
T1B5946166663019E6DDEE6BB5AC1249E89182E9B114F1F13F6633DFDCC8E4DA1CC04B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Igmjhnej.exe

Path C:\Windows\SysWOW64\Igmjhnej.exe
Size 429KB
SHA256 3885dd078a4324c44db1648e059baad5d987b009bb3b47d7a0463d43b9dec05d
MD5 21b56082e96dbfc1e74ad0023281d340
SHA1 2c175418619411062c93555ba8a7a4dde6f27b43
SHA512 c6902f9833de9d516f9a02ad17d24ae40a05360d54b660795e7e782e8f9a51149041c0f6ded33a0d65c4f0db97e7d50b3baf932be11889af444a98a5e56c3605
SSDEEP 6144:hLKPupChHvqimffffffELDx8fV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:NKPupChHvqiRDb/NcZ7/N
TLSH
T1D5945F656A302DE6DDEE6BF5AC1249E88181E8B514F1F13E6A33DFDCC8E4D61C844B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ihhmgaqb.exe

Path C:\Windows\SysWOW64\Ihhmgaqb.exe
Size 429KB
SHA256 4afd5f8f7babd7d82868fdbc89afe9f880d7b496a6c5b63b804b3cec342fd858
MD5 fa547d45317aeb22edbd6ccee74ccca8
SHA1 15dac7f5329554bb65ce9cf99bba5bfa56090cd2
SHA512 a6df00d0d0bbdf3b481b9289725777c992c7804d31310f734eb77262fa0806240c61bc57e40af5c12d941cbdd8e0f385915ea668c8e2209872eeb3fec2650b37
SSDEEP 6144:l0vmDamr0V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:l0vmDau/NcZ7/N
TLSH
T1D89481656A3429EADDEE6BB5AD2249D88181E4B104F1F13E6633DFDCC8E4DA1CC05F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jdhpba32.exe

Path C:\Windows\SysWOW64\Jdhpba32.exe
Size 429KB
SHA256 c45cd7f66362e6b31cc49a91ace48bfab0ed45c1568a1e6a5c6e77609008c984
MD5 5f78916c7e166b34db4b146e88e67e0b
SHA1 4dfebaa16ee9ffbda1c03288deffb9de57b5fbe6
SHA512 90795d25f92dc8fc9437177c732d7bb589eed5a99d5b5306aaf80cb256ed3138d342d989321f7c93a38b9a484fcc5b644844cdf716f921edc90c2c92683b524f
SSDEEP 6144:+VX/Sp90yV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:jLc/NcZ7/N
TLSH
T1039471292A3019E5DDEE6BB6AC1249D88581E8B514F1F13E6A33DFDCC8F8D61CD44B84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jgdphm32.exe

Path C:\Windows\SysWOW64\Jgdphm32.exe
Size 429KB
SHA256 58e0d790b5b42db4f3199061963e5a7aeb2f7bd616cc44484e173419dfc0bf30
MD5 d159b01e9e17e4d1c9bdec47c1087da2
SHA1 34cf02ae54763b848a363735db8cbeab8f1a5d3a
SHA512 fbe1c0aca28aa32b636957a627e141bf37d1c359b863d20d14eba974d51ad7defff49abf1f6f40160f0514ffa3103bcf8e434f92aeeab2a5f14ae6a2c0b8f39c
SSDEEP 6144:kthcEpuxV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:2hcEpR/NcZ7/N
TLSH
T1E89470652A3019E6DDEE6BB5AC1289E88185E9B114F1F13E6633DFDCC9E4DA1CC04F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jkkbnl32.exe

Path C:\Windows\SysWOW64\Jkkbnl32.exe
Size 429KB
SHA256 30e1a5ca1fc61eca5a55e1c9a7a75b52ef59a0e520ae6ba9afca1ed0d2ca84ed
MD5 33ffff9df2addf44f11e60286d441b43
SHA1 4a6396c1749ccb0a626e0f384f752f5397e7f41d
SHA512 8e436dd95969079124b40dcbbdd6e165fbce33ed3f91aef4834903106ff8bac9519cc345217d00a3cd37f030183bf889f2f9ea0cd3f088ecfceb310b37503988
SSDEEP 6144:+sFKkfz25zV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:+sFKq28/NcZ7/N
TLSH
T18F9460266A301DE5DDEE6BB5AC1249E88181E5B148F1F13E6623DFDDC8E4D62CC06F90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jmnheggo.exe

Path C:\Windows\SysWOW64\Jmnheggo.exe
Size 429KB
SHA256 21a68e94d4f49b308925f23f6c616e11ce7beaa8426cc4757d994d6f94f25a74
MD5 3432c79a6a42f808a3717cf32fd1fa64
SHA1 9ba6a11d2d445269dc629552cbeda7175526b9af
SHA512 dcee9720e91999d044186560798ec5c44dc5c5fab0450b22f6f86d53dbc2910329c951cd81cee9a4f4ef88f2129a4b4c61e041aca48412a1c462dad3933ccfb8
SSDEEP 6144:rTjxNS58V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:d8/NcZ7/N
TLSH
T1CE9460256A3019E6DDEE6BB5AE1249D88181E5F204F1F13EA633DFDCD9E4DA1DC04B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jphkfc32.exe

Path C:\Windows\SysWOW64\Jphkfc32.exe
Size 429KB
SHA256 05ebaf4ad211aae57c1b72798cd58a820d1e27e374a47e861f5edbc36e9fb9d0
MD5 1bae1fc0cd9a095222be2d170c6ad08f
SHA1 c885813671500eca6c2df33ab4ad3c67d7fa1c7d
SHA512 845067eef9f03f3be25d4c3e11b10b4e461b93248db3e6da02afbb7bc8939f6492707a8dbf632319dfedddf0071676c7f5672cfcfff31502b4c2313a86b7935a
SSDEEP 6144:5NXADE+8lV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:5NQAe/NcZ7/N
TLSH
T1289471652A3029EADDEE6BB1BD1249E88581E4B114F1F13E6633DFDCC8E4DA1DC05B84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kaajfe32.exe

Path C:\Windows\SysWOW64\Kaajfe32.exe
Size 429KB
SHA256 4d28634a17cae61b45dac73ac51c703df9271aebf35385e72522811af737fa39
MD5 77cd814e754468a2e8d5db350d9aa6cf
SHA1 afa9af10b59ee5300249f5f4408cc47c30a00097
SHA512 0517bc7a1215c9a1f150622e3b33d9069dd1aec2d99d8adb00053953e62f1145a4ce04bcf5cf1c80cc62eb77d2856358c16dafa7d41dc46e93a3f20a60adb4ef
SSDEEP 6144:3qVArBjNV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:aerC/NcZ7/N
TLSH
T1D4946F652A3019EADDEE6BB5AC1249E88182E5B114F1F13F6633DFDDC8E4DA5CC44B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kdmjmqjf.exe

Path C:\Windows\SysWOW64\Kdmjmqjf.exe
Size 429KB
SHA256 3aed267670aa3fba27ecfe914b51cabb25f721f7401fc0afe351d80674d36435
MD5 13959855b5f35e947c5ec66012662d8a
SHA1 f67907c3f01e1e68e449419e45b98359b66d0e8a
SHA512 dfda052ee6d6112c6a30d1328d7923f85feb7ab09af5bbab30978e4951f331732b007b84ccbcf40501302ce5233c697cf7e3e43fb707007653191aa6d323a32e
SSDEEP 6144:fDHqV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:fD//NcZ7/N
TLSH
T1BF946E692B3019E6DDEE6BB5AC1249D88181E9F114F1F53E6633DFDCC9E5DA2C804B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Khbhdn32.exe

Path C:\Windows\SysWOW64\Khbhdn32.exe
Size 429KB
SHA256 e51243c933ce1d54c29ac29f7b476470a580f943aed20e3b10c109219519332d
MD5 a239496d931715624aecb57d06f19535
SHA1 fc199bc80323f49ed7fb798b10266d17442d088b
SHA512 acba26c0aece5a0747147939fb1d994e22881e3afbc3e08a2bf2ac935dc76cd91aa4e4ee9cbb8388790c72dd692b10ff90fea3d7f393f32f1820121f17e6985f
SSDEEP 6144:3MFyf8jMcTaf4Beoz9V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:30yfiMcTaf4B5E/NcZ7/N
TLSH
T166947265663419E9DDEE6FB6AC1289D88181E9B114F1F13E6633EFDCC8E4DA1CC05B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Khplnn32.exe

Path C:\Windows\SysWOW64\Khplnn32.exe
Size 429KB
SHA256 fa23c9223c9d8778d1e8f68c5f0dca6e6587a599ab0573b834bc954e452dd4ca
MD5 2f520b993476d443b3b028af334c706d
SHA1 11d4f77a99637fe579bdf82a92cd73543490e850
SHA512 8af86ac792bf371cfded04afee63fff437cd0bab75921ef4b256e847ff66d677e83848a81509c525f883c7ace0cde6256f9f5e46546e4c9edef6e44118c1fde2
SSDEEP 6144:J1Oc8gUsJV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:TogUX/NcZ7/N
TLSH
T126946F652A7059E6DDEEABB1AC5249E890C1E8B104F1F13E6637DFDDC8E4DA1C814F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kkgbjkac.exe

Path C:\Windows\SysWOW64\Kkgbjkac.exe
Size 429KB
SHA256 70d6791a99afac432620c967e14620ed97c7fafac578eb28a7dfcd1466bb1cc4
MD5 e73dc0699c301bb276262f7166dd4908
SHA1 c3c5956753797c7686f2e42edbda3db18eb39f79
SHA512 2d7c8f67833e3ced13f2bdb84bad72fee63bdf49efacad1924cb218c4dba9c26059b3b5ab587313a61d82f779b8ecc356eb1b53639b9649794195a65549f8f31
SSDEEP 6144:xjT1vYlzyJJy/V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:NxwzsF/NcZ7/N
TLSH
T1DE9473696A3019E5DDEEAFB5AC124AD88181E5B118F1F13E6633DFDCC8E4DA1CC04B85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Knldfe32.exe

Path C:\Windows\SysWOW64\Knldfe32.exe
Size 429KB
SHA256 074f3063e5d1f6b1fd5d7a9d5f288d08bf81d092cf224f6877f334b97340f686
MD5 168e8afdbca2ecdcbc7b0fb75de7be7d
SHA1 b21b10115c733542c3fba1b245b0c73018710d9f
SHA512 4e9f32f66c2cb37101119d303ba29576bff3ac307f07a7070dd93a804e6f6dee8ac759c7289ead3c62af3feb01ecefb5e0841c2e0f1d5825711f6d152d2594d4
SSDEEP 6144:jGKdM/ur9WV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:ZdD/NcZ7/N
TLSH
T17E945F252A7059E5DDFE6BB5AC1249D88281E4B204F1F13E6637DFEDC8E5EA1CC04B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Koggehff.exe

Path C:\Windows\SysWOW64\Koggehff.exe
Size 429KB
SHA256 ce3bd58e4a30518e9fda657f6657c17884f59044dbb0bffae7ee86b5a6a727d5
MD5 6f5222d1776f0ef0d646305b4f83d156
SHA1 cde15999a24f1456a3401033dd4ee965897eeb55
SHA512 d64f60a55d72b84f6da4c14b0d516cc24781c6bb20a65742155849df433b0aafce09fbc8b870f52e966845e99b96cfd8a899469b546c78d1ba6761759b1b4b09
SSDEEP 6144:q05B4GY+exhV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:fB4EeW/NcZ7/N
TLSH
T193944F65663019E5EDEE6BB5AC125DDC8181E5B118F1F13E6623DFECC9E8DA2CC04B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kolaqh32.exe

Path C:\Windows\SysWOW64\Kolaqh32.exe
Size 429KB
SHA256 1cd2d40780dac47bb45a96656939c45861a735c25822181b5d490826754020f3
MD5 a7bf05d4b706ce09f1aa35182d018090
SHA1 5ddfa82716f2e84dfa0bcdd9d951f95d8fff04f5
SHA512 ebb8150ca30b91e4cfd6399e94f6655e1f1e5fc4b09f407a8443909448c0628cc3b071d82c2a3719ab752f7e16d764b8e72dba9574d841c223e27a1684c17ee0
SSDEEP 6144:ZQkNQV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:Z/z/NcZ7/N
TLSH
T1169483256A3419E9DEEE6BB5AC2249E88181E9B114F1F13E6633DFDCC8E4D61CC04F84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kphdma32.exe

Path C:\Windows\SysWOW64\Kphdma32.exe
Size 429KB
SHA256 d3184ffbd286bb83e9375de0193d3088777552ae8b51a360ea5003a80705f1d7
MD5 1fb8ea5dc1d66f5d28c6879afc1acd15
SHA1 d2f8f1f3b6948e44e2b83bf4c9d54ed7396035b9
SHA512 704c66ceb6e63311977799275f190271e98db36de56c119aa983c94fa4630fa07adf14b1702c25b3d1c3065cf9f6940b13ecdd42f87ff1c3ae9c060041bfe26b
SSDEEP 6144:1oiG2V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:2ie/NcZ7/N
TLSH
T18F944F656A3019E5EDEE6BB5AC1249D88181E5F214F2F13E6633DFDDC8E4DA2CC04B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lajmmc32.exe

Path C:\Windows\SysWOW64\Lajmmc32.exe
Size 429KB
SHA256 60c23db2d5536ea033642ffeaa4b06c9ac60e65e7c3ba046c37a7e7f00eac297
MD5 e9c180326407a3db4f20271e93acd303
SHA1 c53755bb1c01952e3f300bfd270b26b1bd57f88b
SHA512 de054d254a385ca9346364824d26bf1bc4b621b18f45f63c02b68eb0cffab5aa3d2ea456da696c07ed9ef13e492e533332803514104f75aab8ec28765ee35d30
SSDEEP 6144:S7cqLT3gt8lV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:SYL9/NcZ7/N
TLSH
T178945E252B3019E6DDEE6BB1AC1249D88181E4B114F1F23F663BDFDCD8E4D62D845B82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lamjbc32.exe

Path C:\Windows\SysWOW64\Lamjbc32.exe
Size 429KB
SHA256 16eb228b4242eb4d6e05a5cab44200f2b5166bf6c7d51c06ffb5e55feb8d9751
MD5 3092db9b519f4ed93c9b39b2453d02f3
SHA1 d8194fe843bac920d7e55cb5b6a95525b45108d4
SHA512 55f9aa934ef714e0a2a1db133cb34646ab2a02227a3a75eb6ab7f700cd5d1ac261775dbf9de10c6890391e7fd60377130f06b58e136b23d3aac460bd5d585473
SSDEEP 6144:5rCKgJv9V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:NCP4/NcZ7/N
TLSH
T1CC9471256A341AEADDEE6BB5AC1249D88181E5F114F5F23E6633DFDCC8E4DA1CC04B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ldblon32.exe

Path C:\Windows\SysWOW64\Ldblon32.exe
Size 429KB
SHA256 0c072f1c964a39b997ffd3d4d889027bf88d418fd1be6c0552b5587806f387cf
MD5 6fa99a967deb52fc50cad15a7107f1b6
SHA1 87ac79f93ec176903cf85ad425f686cb60f034dd
SHA512 f0d744ccfd05db956eb9cbf0e9186d422f25dbe8c4c126de69924781d740f71c069c4918ac85c327d30bcd7a4ef7dabc7800aaea9820a242cf128d6168bb4b86
SSDEEP 6144:1xsvaah3V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:0vaB/NcZ7/N
TLSH
T1CE9492652A3019E9DDEE6BB1AC2249E88281E4B115F1F57E6633DFDCC8E4D62CC15F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lglopjkg.exe

Path C:\Windows\SysWOW64\Lglopjkg.exe
Size 429KB
SHA256 4d5e570654c05d584221bade189da1b13516b8226bc1d45b0ef956573d59a666
MD5 56399c087d1d2e7fd2e0d83ab4fc52b4
SHA1 397bc34e3f04529039a058236c2d0b90fc44059e
SHA512 51dbd57782f3b8b9587eac6d1f7f151681cdf8b5a422e814ba7a27cf70ab10fd4c212d0ddb8f309abb1da921d367fbfd72fa36a5d4a8bc9cee83a7994f1da643
SSDEEP 6144:uXW+mW/EV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:iv/NcZ7/N
TLSH
T11B9480652A701DE5DDEE6BB1AC1249D881A1E4B114F1F17E6A33DFDCE9E4E62CC04B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lgnleiid.exe

Path C:\Windows\SysWOW64\Lgnleiid.exe
Size 429KB
SHA256 e7ee5b3d5bd9c6c6633efef0575900d0de1fe55c63bf99eb4e30f0c700a30a0d
MD5 50beef83df5ef3fb0241a0d463f1c50d
SHA1 4f65f6c3bde72794f7903b49cb8ad07bc184556f
SHA512 f29ce9bf27f588cf5331f7a271d77bad3edd589053b593c885a3bae7f97776035d4f3f4e88686d251f5c36d473e28b0cfa635d00395274aa9a31b6dfbf35b744
SSDEEP 6144:6yijuILV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:SjuB/NcZ7/N
TLSH
T1499461252A3019E6DEEE6BB5AC9299D88181E4B114F1F13E6673DFDCC8E5DA1CC04BC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lhdeinhb.exe

Path C:\Windows\SysWOW64\Lhdeinhb.exe
Size 429KB
SHA256 8a4db3152dc901b291f00c80709aa191574ffeb26f267abeb6d6bd51459bffbe
MD5 fa648f1ac1f237f74de671091fed592f
SHA1 afd6239d1b85b8a2f55d42fc229a6ab3715b2561
SHA512 59f71d94597388fdfdf2b4096e825ff7bebeea707d1f7c2b21336eee99408cd9c35426e7025357a87b6e971502e760af6980e7dfa2538f4dac704c59c6cfe515
SSDEEP 6144:IetEqWbi+V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:ZtQy/NcZ7/N
TLSH
T1F2946029AA7019E6DDEE6BB9AC1249E88181E5B115F1F13E6633DFDCC8E5D61CC04F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lhgbomfo.exe

Path C:\Windows\SysWOW64\Lhgbomfo.exe
Size 429KB
SHA256 e3eddc6b1b9ed0f499bf3f9768fb63fd2def0dbc9e68c4b980feea60f8fb2781
MD5 67548ff29b63c6ac445a9bd6bc90ccf2
SHA1 e34429dd18437b461c4bf942a9ed94b8618a876e
SHA512 fb77b5fa4f444714d074ee1c7babc24c56a1c0791446cec80c1da8dd1d219b491e5c2c1fa41ee5b3737344f8256908c95b0d2b21912e1fd838b94982762d9c37
SSDEEP 6144:ZrEHIGRzIMipxB/V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:ZrEHI4/NcZ7/N
TLSH
T17D94822526301AEADDEE6BB5AD1249D98181E5B114F1F13EA673DFDCC8F8D62CC14B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lkcaeige.exe

Path C:\Windows\SysWOW64\Lkcaeige.exe
Size 429KB
SHA256 1fc92cbb7010ffb3ee18415b8990bb55d5ffb146be302aa38e93f6e08ef197ec
MD5 d8fa61ebae15bca6346a36673b2e3a93
SHA1 a668e8ab7826364cdcd2e3501d373f88fb90ac04
SHA512 fac7e9db3420b3bd7a2c356d63da526d66258851d8814fc62bad992ee5829d218b49a3510f195c90db1e367de3ee933c2fc7032b703a57ed0cd4dae75c293532
SSDEEP 6144:e5UC8LV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:+Uy/NcZ7/N
TLSH
T1249471256A7019E6DDEE6BB5AC1249E881C2E4B114F9F13E6633DFDCC8E4DA5CC44B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lkenkhec.exe

Path C:\Windows\SysWOW64\Lkenkhec.exe
Size 429KB
SHA256 8ecddfa23eed521ca5f51cc177c9c8f3eb22838efea9019dd0ca1439a1f8dde2
MD5 9ac89cf95570b455156fff139a15fbce
SHA1 538fc49b46de5496e6b11190e400ccb59b969556
SHA512 0cc71a4e125e213ca0cb3cc5861053d83263c6121ef43d6fd90f7e469d23332a3173ad26c3dc603ac93d7745796d42a78b0fef84c3a8a4410322b349fa1670ff
SSDEEP 6144:d06iLoV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:dBid/NcZ7/N
TLSH
T1E69482656A7019EADDEE6BB5AC1249D88181E8B614F1F13F6673DFDCC8E4D62CC04B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lkldlgok.exe

Path C:\Windows\SysWOW64\Lkldlgok.exe
Size 429KB
SHA256 6993c3baaeec5d75fc6b675a3153d1ffcf059d67096c2a3d67d6e02f2e00cba5
MD5 08bf38dd36e9200541a18a1ea21bf0ae
SHA1 8629370bdde0ba1fe8a9f35118ed8a04f9204743
SHA512 aaeeb82ce61c64ab4f999e83563565fbb474a2a3d866734a46721fb7e42a3024fb6d9ae3e985f7d02a3e01aab9f83a4d4c4a1e1411cd32a7ae7ee0dc62097df5
SSDEEP 6144:wI5nSnSQTyGK+CWSmqei2fT3E5uqV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:f5S9TyGK+CWSmqei2fT3E5+/NcZ7/N
TLSH
T130946F656A3019E5DDEE6BF5AC1249D88182E9B114F2F13E6623DFDCD8E8DA1CC04F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lnfgmc32.exe

Path C:\Windows\SysWOW64\Lnfgmc32.exe
Size 429KB
SHA256 42c9173f37404757648da655057b83b411e97524dbf20040fc752f28e1c77dda
MD5 16fdbf9ef3fb8283877340fa0584e68f
SHA1 0c1528e456c46eee519ff72a3ea0393a6e7d9cf4
SHA512 0abf03abb40b370fd29399b83af16f7cf40f051e60875539565fd3f88689a99bdd4de7013c06412f0e6968adbbe0c412fd5a6beb6bcbb964fba747416853b11a
SSDEEP 6144:lZNaAuCSV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:nN/NcZ7/N
TLSH
T17D9470652B3019E6DDEE6BB5AC1249E98181E5B104F1F13E6633DFDCE8E4DA5CC04B82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lnhdbc32.exe

Path C:\Windows\SysWOW64\Lnhdbc32.exe
Size 429KB
SHA256 f4b178ddee2b95e485e3cb4aacf10149a855d598945a1448eb9bc3c94f49a126
MD5 0c8bdd90ded8b534cf80c8f155a2e7dc
SHA1 ee13b824841fbb63f4f5226270943f93ed70cdb6
SHA512 2523beaea0dc31237f3860e6bcfa1077dc5f350b8d5cc9122abbd43a63f7272a58bfe7781f4aa88816219fa5d21840baa3fbeaab0f15d44cec63a2c34e5b8553
SSDEEP 6144:aiucxxV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:9a/NcZ7/N
TLSH
T1749482653A3059E6DDEE6BB6AC1269E88181E4B514F1F13E6633DFDCC8E4DA1CC44B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lqbgcp32.exe

Path C:\Windows\SysWOW64\Lqbgcp32.exe
Size 429KB
SHA256 8ecddc3c15beb740ac178928999f63f461b24cf529c4c17fd2116e448accdeed
MD5 732902e872e733d45aec52b480b2eea9
SHA1 3aace9f26df5080d926380afa44156fa0dd842e0
SHA512 a230e4506e5198928bcbfddfcfb17e6b6bb886a3e0f964491c1ecffb2bc748b843d234cdaa7682a3e5098f901c7dff877127253f3ecffcdb7047873ac6a4419c
SSDEEP 6144:NRnNsyV/EXmV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:9syV/E7/NcZ7/N
TLSH
T18F9482656A7019E9DDEE6BB5AC1249D880C1E6B244F1F13E6A33DFDCC8E5D62CC14B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lqdcio32.exe

Path C:\Windows\SysWOW64\Lqdcio32.exe
Size 429KB
SHA256 1ad827dbd2a876fe3107420e156ccc734ae9eee34d765cb14c12a104bee16a94
MD5 d68bf1ad9c311fd04f1aa58657aad4f6
SHA1 bca19f06aeba781f1ae9d6a102ca089bf9ff0583
SHA512 f6bf4f803557b1427b10429a45235f559cb57b531ca15a8c21c57e7e3bce4839f3b746d7094568ec303679a76efdd51cdc50681d6ebda8053c7a31e3d5308c6a
SSDEEP 6144:ZnTAQjyatTV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:KQjyV/NcZ7/N
TLSH
T1689472652A3019E6DDEE6BB5AC128AD891C1E4B118F1F13E6633DFDCC8E4DA1DC05B84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/360-112-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/708-196-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1000-240-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1048-455-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1092-445-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1204-98-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1212-497-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1212-42-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1340-50-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1340-503-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1344-245-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1484-126-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1700-91-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1760-265-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1880-70-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2108-460-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2108-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2108-1-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/2140-395-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2148-320-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2172-168-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2220-483-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2220-21-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2236-375-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2256-300-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2384-490-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2436-147-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2576-217-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2580-105-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2620-56-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2764-230-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2812-425-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2924-235-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2980-255-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3060-365-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3120-478-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3140-380-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3148-430-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3224-203-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3284-133-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3304-224-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3324-435-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3348-340-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3356-270-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3376-498-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3428-260-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3432-28-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3432-489-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3476-420-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3480-415-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3500-360-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3548-290-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3552-250-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3632-315-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3660-182-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3732-35-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3732-491-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3812-484-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3932-350-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4124-14-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4124-477-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4152-280-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4164-345-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4168-175-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4180-390-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4244-154-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4264-84-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4276-325-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4372-189-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4428-275-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4496-472-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4504-210-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4580-77-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4676-410-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5020-330-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5104-63-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5176-370-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5384-161-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5468-140-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5480-295-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5616-7-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5616-471-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5620-466-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5672-355-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5748-492-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5788-405-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5792-335-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5804-461-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5908-400-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5932-385-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5968-310-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5992-305-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6004-119-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6076-450-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6092-285-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6116-440-0x0000000000400000-0x000000000046D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads