berbew | d5776aa265860b9d462df0a20c12f47abf2b3e32a13ea1abefdd03a64b28934d

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 19:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-21_80cdf091acd6638b06762d77d778a6de_elex_wannacry.exe
Size 429KB
Sample261022-yc764axt6m
SHA256 d5776aa265860b9d462df0a20c12f47abf2b3e32a13ea1abefdd03a64b28934d
MD5 80cdf091acd6638b06762d77d778a6de
SHA1 df34f8a719d87632fed59b66961e0191df5f77d4
SHA512 b5f8f809540ba6da0da213824e92faace9f861cb5908dd14f333572ba5b55fd46c0bb346c22ea3038736d24c137c9d492c325c48249ade72e26a8ce2f0f37831
SSDEEP 6144:Ig3T3iRitV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:Ig37iRN/NcZ7/N
TLSH
T14C946F296A3019E6DDEE6BB5AC1249D89182E4B114F1F13E6663DFDCC8F4EA5CC04F81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ognpoheh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocdqcikl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Naaejj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qagdia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pgefogop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cacmkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Okloomoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Odkaac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bniacddk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Doeifpkk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hicihp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmgfmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nngoddkg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hicihp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpeibdfp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oggjni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cogmdb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hiefmp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibgmldnd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lffhpnhe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njnpie32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkbcbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eaoenjqa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffdddg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oncopcqj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Obanqgkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ahhbfkbf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddklnh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eojcao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pckfdh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Obanqgkl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anbkbe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Balfko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mllcocna.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edkddeag.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jecejm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqdgan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fomhnmgp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdiobd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lefkfk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjeoablq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dlijodjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kppphe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lefkfk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llemnd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Docmqp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fohobmke.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lemagjjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mipchg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocmjcjad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cbefkp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehpjdepi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecjhmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hkhkdjkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Llbphdfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpjleadh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njnpie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngpjgpec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdfbbhdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Npjelo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdkcnklf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abpcicpi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Flgfqb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fohobmke.exe

Executes dropped EXE 64 IoCs

pid	Process
4352	Mkbcbp32.exe
1100	Mdkhkflh.exe
2992	Naaejj32.exe
3632	Nacboi32.exe
4644	Ngpjgpec.exe
2072	Nnolojhk.exe
2216	Odkaac32.exe
3592	Ojhijjll.exe
4556	Obanqgkl.exe
820	Occkhp32.exe
1116	Odbgbb32.exe
2888	Okloomoj.exe
2468	Pbfglg32.exe
692	Pengna32.exe
2220	Qagdia32.exe
5824	Qgalelin.exe
3892	Agcikk32.exe
1532	Ahhbfkbf.exe
4444	Anbkbe32.exe
3784	Abpcicpi.exe
5812	Bniacddk.exe
5020	Bajjeo32.exe
5184	Blonbh32.exe
4172	Balfko32.exe
3476	Bdmpljlj.exe
2512	Cacmkn32.exe
4852	Chmehhpn.exe
5752	Cogmdb32.exe
2276	Ceaealoh.exe
4708	Clknnf32.exe
2572	Cbefkp32.exe
2168	Cdfbbhdp.exe
3464	Ckpjob32.exe
4616	Cajblmci.exe
5700	Cdiohhbm.exe
3012	Dbjofp32.exe
4304	Ddklnh32.exe
988	Dkedjbgg.exe
1072	Daolgl32.exe
4532	Dhidcffq.exe
5944	Docmqp32.exe
1612	Daaiml32.exe
1156	Dhkaif32.exe
4740	Doeifpkk.exe
2480	Deoabj32.exe
5444	Dlijodjd.exe
1712	Dafbhkhl.exe
1764	Ehpjdepi.exe
5292	Eojcao32.exe
3440	Eefhcimp.exe
2708	Ecjhmm32.exe
3760	Edkddeag.exe
2580	Eaoenjqa.exe
4580	Ekhjgoga.exe
2020	Flgfqb32.exe
6088	Fadoii32.exe
5652	Fohobmke.exe
4252	Fllplajo.exe
256	Ffdddg32.exe
4696	Fomhnmgp.exe
4804	Flqigq32.exe
4488	Gbmaog32.exe
3844	Gkffhmka.exe
5948	Gdnjabab.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Abpcicpi.exe	Anbkbe32.exe
File opened for modification	C:\Windows\SysWOW64\Ceaealoh.exe	Cogmdb32.exe
File created	C:\Windows\SysWOW64\Dhkaif32.exe	Daaiml32.exe
File created	C:\Windows\SysWOW64\Ehpjdepi.exe	Dafbhkhl.exe
File created	C:\Windows\SysWOW64\Dendcmjg.dll	Dbjofp32.exe
File opened for modification	C:\Windows\SysWOW64\Gbmaog32.exe	Flqigq32.exe
File opened for modification	C:\Windows\SysWOW64\Hihbco32.exe	Hoonjjgk.exe
File opened for modification	C:\Windows\SysWOW64\Edkddeag.exe	Ecjhmm32.exe
File opened for modification	C:\Windows\SysWOW64\Gdnjabab.exe	Gkffhmka.exe
File created	C:\Windows\SysWOW64\Hemgeg32.dll	Kfoapo32.exe
File created	C:\Windows\SysWOW64\Bebmpc32.dll	Ocdqcikl.exe
File created	C:\Windows\SysWOW64\Cajblmci.exe	Ckpjob32.exe
File created	C:\Windows\SysWOW64\Pckfdh32.exe	Pmangnmg.exe
File created	C:\Windows\SysWOW64\Gicogo32.dll	Gkmlilej.exe
File opened for modification	C:\Windows\SysWOW64\Obanqgkl.exe	Ojhijjll.exe
File opened for modification	C:\Windows\SysWOW64\Flgfqb32.exe	Ekhjgoga.exe
File created	C:\Windows\SysWOW64\Bgnhmn32.dll	Ekhjgoga.exe
File opened for modification	C:\Windows\SysWOW64\Flqigq32.exe	Fomhnmgp.exe
File created	C:\Windows\SysWOW64\Bkbakm32.dll	Ilbnkiba.exe
File created	C:\Windows\SysWOW64\Ognpoheh.exe	Oqdgan32.exe
File opened for modification	C:\Windows\SysWOW64\Dafbhkhl.exe	Dlijodjd.exe
File opened for modification	C:\Windows\SysWOW64\Njnpie32.exe	Ncdgmkio.exe
File opened for modification	C:\Windows\SysWOW64\Pgiojf32.exe	Pdkcnklf.exe
File opened for modification	C:\Windows\SysWOW64\Odbgbb32.exe	Occkhp32.exe
File created	C:\Windows\SysWOW64\Eaoenjqa.exe	Edkddeag.exe
File opened for modification	C:\Windows\SysWOW64\Mpjleadh.exe	Mipchg32.exe
File opened for modification	C:\Windows\SysWOW64\Dhidcffq.exe	Daolgl32.exe
File created	C:\Windows\SysWOW64\Fadoii32.exe	Flgfqb32.exe
File created	C:\Windows\SysWOW64\Fomhnmgp.exe	Ffdddg32.exe
File created	C:\Windows\SysWOW64\Ilfhfh32.exe	Ildkpiqo.exe
File created	C:\Windows\SysWOW64\Plkoeeae.dll	Mmgfmg32.exe
File created	C:\Windows\SysWOW64\Ocmjcjad.exe	Onqbjccl.exe
File opened for modification	C:\Windows\SysWOW64\Oqdgan32.exe	Ojjoedfn.exe
File created	C:\Windows\SysWOW64\Ojhijjll.exe	Odkaac32.exe
File created	C:\Windows\SysWOW64\Deoabj32.exe	Doeifpkk.exe
File created	C:\Windows\SysWOW64\Ejkmkh32.dll	Gbbkjgpl.exe
File created	C:\Windows\SysWOW64\Algaplmg.dll	Pjnipc32.exe
File created	C:\Windows\SysWOW64\Jmjjdo32.dll	Mdanjaqf.exe
File opened for modification	C:\Windows\SysWOW64\Npabeq32.exe	Mgimmkgp.exe
File created	C:\Windows\SysWOW64\Oqdgan32.exe	Ojjoedfn.exe
File created	C:\Windows\SysWOW64\Daolgl32.exe	Dkedjbgg.exe
File opened for modification	C:\Windows\SysWOW64\Jpgmaf32.exe	Jfllca32.exe
File created	C:\Windows\SysWOW64\Hacacl32.dll	Mebkbi32.exe
File created	C:\Windows\SysWOW64\Kfbjhd32.dll	Pdkcnklf.exe
File created	C:\Windows\SysWOW64\Oeaadmkh.dll	Fomhnmgp.exe
File created	C:\Windows\SysWOW64\Jfllca32.exe	Ilfhfh32.exe
File created	C:\Windows\SysWOW64\Lplpcc32.exe	Lefkfk32.exe
File created	C:\Windows\SysWOW64\Hiefmp32.exe	Hbknqeha.exe
File created	C:\Windows\SysWOW64\Mlqljb32.exe	Megdmhbp.exe
File created	C:\Windows\SysWOW64\Khaahimc.dll	Ocmjcjad.exe
File created	C:\Windows\SysWOW64\Lbfglg32.dll	Qagdia32.exe
File created	C:\Windows\SysWOW64\Bdmpljlj.exe	Balfko32.exe
File opened for modification	C:\Windows\SysWOW64\Fomhnmgp.exe	Ffdddg32.exe
File opened for modification	C:\Windows\SysWOW64\Gkffhmka.exe	Gbmaog32.exe
File opened for modification	C:\Windows\SysWOW64\Qfolkcpb.exe	Pmfhbm32.exe
File created	C:\Windows\SysWOW64\Cmglog32.dll	Bajjeo32.exe
File opened for modification	C:\Windows\SysWOW64\Gkmlilej.exe	Gdcdlb32.exe
File created	C:\Windows\SysWOW64\Mpjleadh.exe	Mipchg32.exe
File created	C:\Windows\SysWOW64\Ddklnh32.exe	Dbjofp32.exe
File created	C:\Windows\SysWOW64\Jjnccd32.dll	Eaoenjqa.exe
File created	C:\Windows\SysWOW64\Fllplajo.exe	Fohobmke.exe
File created	C:\Windows\SysWOW64\Dhbdkgfd.dll	Immaimnj.exe
File opened for modification	C:\Windows\SysWOW64\Mmgfmg32.exe	Lgmnqmam.exe
File created	C:\Windows\SysWOW64\Pbhkqe32.dll	Abpcicpi.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6952	6860	WerFault.exe	241

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-21_80cdf091acd6638b06762d77d778a6de_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kppphe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpeibdfp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldeonbkd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmgfmg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nngoddkg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngpjgpec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbefkp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gkffhmka.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibgmldnd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jecejm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qfolkcpb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odbgbb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhidcffq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fohobmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hiefmp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgimmkgp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cogmdb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdiohhbm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbmaog32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qgalelin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deoabj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llgjcd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njnpie32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gfbpfedp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdiobd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mebkbi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ndcdfnpa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oncopcqj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgiojf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nacboi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Clknnf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckpjob32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hbiakf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olaeqp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojhijjll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lfhdem32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlqljb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngmggj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdkcnklf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ffdddg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lplpcc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mipchg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pengna32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdnincal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mllcocna.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onqbjccl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkhkdjkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Heapmp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfllca32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klljhe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eaoenjqa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Obanqgkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bniacddk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Doeifpkk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhkaif32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Edkddeag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hoonjjgk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flqigq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Meiabh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nenjng32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odmgmmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojjoedfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Occkhp32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Anbkbe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnhmoi32.dll"	Balfko32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cogmdb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okjnpija.dll"	Eojcao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gdnjabab.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ceaealoh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Deoabj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlnbhlof.dll"	Heapmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjldieop.dll"	Kppphe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkilik32.dll"	2026-10-21_80cdf091acd6638b06762d77d778a6de_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eaoenjqa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Npjelo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pengna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hiefmp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kifhkkci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbifbcdo.dll"	Kifhkkci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kncfkjpc.dll"	Mlciobhj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Okloomoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjnijb32.dll"	Deoabj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fomhnmgp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ildkpiqo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	2026-10-21_80cdf091acd6638b06762d77d778a6de_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmjnjo32.dll"	Pbfglg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qagdia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jecejm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kifhkkci.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhidcffq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Daaiml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kallmekb.dll"	Llbphdfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ilfhfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jidkek32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mlciobhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dooglp32.dll"	Dhidcffq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjeoablq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cogmdb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ddklnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ghlcga32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lefkfk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pbfglg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ehpjdepi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lplpcc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Occkhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qcnhngkp.dll"	Hoonjjgk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hicihp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iiofhm32.dll"	Hbknqeha.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmfhbm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qagdia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Daaiml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Heochp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mipchg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clomaf32.dll"	Ognpoheh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bebmpc32.dll"	Ocdqcikl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdkhkflh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dkedjbgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfcppgoj.dll"	Ibgmldnd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lehhhj32.dll"	Lefkfk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	2026-10-21_80cdf091acd6638b06762d77d778a6de_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pbfglg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ekhjgoga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gbbkjgpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hacacl32.dll"	Mebkbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nenjng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncdgmkio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ognpoheh.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 4352	4112	2026-10-21_80cdf091acd6638b06762d77d778a6de_elex_wannacry.exe	90
PID 4352 wrote to memory of 1100	4352	Mkbcbp32.exe	91
PID 1100 wrote to memory of 2992	1100	Mdkhkflh.exe	92
PID 2992 wrote to memory of 3632	2992	Naaejj32.exe	93
PID 3632 wrote to memory of 4644	3632	Nacboi32.exe	94
PID 4644 wrote to memory of 2072	4644	Ngpjgpec.exe	95
PID 2072 wrote to memory of 2216	2072	Nnolojhk.exe	96
PID 2216 wrote to memory of 3592	2216	Odkaac32.exe	97
PID 3592 wrote to memory of 4556	3592	Ojhijjll.exe	98
PID 4556 wrote to memory of 820	4556	Obanqgkl.exe	99
PID 820 wrote to memory of 1116	820	Occkhp32.exe	100
PID 1116 wrote to memory of 2888	1116	Odbgbb32.exe	101
PID 2888 wrote to memory of 2468	2888	Okloomoj.exe	102
PID 2468 wrote to memory of 692	2468	Pbfglg32.exe	103
PID 692 wrote to memory of 2220	692	Pengna32.exe	104
PID 2220 wrote to memory of 5824	2220	Qagdia32.exe	105
PID 5824 wrote to memory of 3892	5824	Qgalelin.exe	106
PID 3892 wrote to memory of 1532	3892	Agcikk32.exe	107
PID 1532 wrote to memory of 4444	1532	Ahhbfkbf.exe	108
PID 4444 wrote to memory of 3784	4444	Anbkbe32.exe	109
PID 3784 wrote to memory of 5812	3784	Abpcicpi.exe	110
PID 5812 wrote to memory of 5020	5812	Bniacddk.exe	111
PID 5020 wrote to memory of 5184	5020	Bajjeo32.exe	112
PID 5184 wrote to memory of 4172	5184	Blonbh32.exe	113
PID 4172 wrote to memory of 3476	4172	Balfko32.exe	114
PID 3476 wrote to memory of 2512	3476	Bdmpljlj.exe	115
PID 2512 wrote to memory of 4852	2512	Cacmkn32.exe	116
PID 4852 wrote to memory of 5752	4852	Chmehhpn.exe	117
PID 5752 wrote to memory of 2276	5752	Cogmdb32.exe	118
PID 2276 wrote to memory of 4708	2276	Ceaealoh.exe	119
PID 4708 wrote to memory of 2572	4708	Clknnf32.exe	120
PID 2572 wrote to memory of 2168	2572	Cbefkp32.exe	121
PID 2168 wrote to memory of 3464	2168	Cdfbbhdp.exe	122
PID 3464 wrote to memory of 4616	3464	Ckpjob32.exe	123
PID 4616 wrote to memory of 5700	4616	Cajblmci.exe	124
PID 5700 wrote to memory of 3012	5700	Cdiohhbm.exe	125
PID 3012 wrote to memory of 4304	3012	Dbjofp32.exe	126
PID 4304 wrote to memory of 988	4304	Ddklnh32.exe	127
PID 988 wrote to memory of 1072	988	Dkedjbgg.exe	128
PID 1072 wrote to memory of 4532	1072	Daolgl32.exe	129
PID 4532 wrote to memory of 5944	4532	Dhidcffq.exe	130
PID 5944 wrote to memory of 1612	5944	Docmqp32.exe	131
PID 1612 wrote to memory of 1156	1612	Daaiml32.exe	132
PID 1156 wrote to memory of 4740	1156	Dhkaif32.exe	133
PID 4740 wrote to memory of 2480	4740	Doeifpkk.exe	134
PID 2480 wrote to memory of 5444	2480	Deoabj32.exe	135
PID 5444 wrote to memory of 1712	5444	Dlijodjd.exe	136
PID 1712 wrote to memory of 1764	1712	Dafbhkhl.exe	137
PID 1764 wrote to memory of 5292	1764	Ehpjdepi.exe	138
PID 5292 wrote to memory of 3440	5292	Eojcao32.exe	139
PID 3440 wrote to memory of 2708	3440	Eefhcimp.exe	140
PID 2708 wrote to memory of 3760	2708	Ecjhmm32.exe	141
PID 3760 wrote to memory of 2580	3760	Edkddeag.exe	142
PID 2580 wrote to memory of 4580	2580	Eaoenjqa.exe	143
PID 4580 wrote to memory of 2020	4580	Ekhjgoga.exe	144
PID 2020 wrote to memory of 6088	2020	Flgfqb32.exe	145
PID 6088 wrote to memory of 5652	6088	Fadoii32.exe	146
PID 5652 wrote to memory of 4252	5652	Fohobmke.exe	147
PID 4252 wrote to memory of 256	4252	Fllplajo.exe	148
PID 256 wrote to memory of 4696	256	Ffdddg32.exe	149
PID 4696 wrote to memory of 4804	4696	Fomhnmgp.exe	150
PID 4804 wrote to memory of 4488	4804	Flqigq32.exe	151
PID 4488 wrote to memory of 3844	4488	Gbmaog32.exe	152
PID 3844 wrote to memory of 5948	3844	Gkffhmka.exe	153

C:\Users\Admin\AppData\Local\Temp\2026-10-21_80cdf091acd6638b06762d77d778a6de_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-21_80cdf091acd6638b06762d77d778a6de_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Windows\SysWOW64\Mkbcbp32.exe
  C:\Windows\system32\Mkbcbp32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4352
- - C:\Windows\SysWOW64\Mdkhkflh.exe
    C:\Windows\system32\Mdkhkflh.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1100
  - - C:\Windows\SysWOW64\Naaejj32.exe
      C:\Windows\system32\Naaejj32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2992
    - - C:\Windows\SysWOW64\Nacboi32.exe
        
        C:\Windows\system32\Nacboi32.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3632
      - C:\Windows\SysWOW64\Ngpjgpec.exe
        
        C:\Windows\system32\Ngpjgpec.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4644
        
        C:\Windows\SysWOW64\Nnolojhk.exe
        
        C:\Windows\system32\Nnolojhk.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2072
        
        C:\Windows\SysWOW64\Odkaac32.exe
        
        C:\Windows\system32\Odkaac32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2216
        
        C:\Windows\SysWOW64\Ojhijjll.exe
        
        C:\Windows\system32\Ojhijjll.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3592
        
        C:\Windows\SysWOW64\Obanqgkl.exe
        
        C:\Windows\system32\Obanqgkl.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4556
        
        C:\Windows\SysWOW64\Occkhp32.exe
        
        C:\Windows\system32\Occkhp32.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:820
        
        C:\Windows\SysWOW64\Odbgbb32.exe
        
        C:\Windows\system32\Odbgbb32.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1116
        
        C:\Windows\SysWOW64\Okloomoj.exe
        
        C:\Windows\system32\Okloomoj.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2888
        
        C:\Windows\SysWOW64\Pbfglg32.exe
        
        C:\Windows\system32\Pbfglg32.exe
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2468
        
        C:\Windows\SysWOW64\Pengna32.exe
        
        C:\Windows\system32\Pengna32.exe
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:692
        
        C:\Windows\SysWOW64\Qagdia32.exe
        
        C:\Windows\system32\Qagdia32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2220
        
        C:\Windows\SysWOW64\Qgalelin.exe
        
        C:\Windows\system32\Qgalelin.exe
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5824
        
        C:\Windows\SysWOW64\Agcikk32.exe
        
        C:\Windows\system32\Agcikk32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3892
        
        C:\Windows\SysWOW64\Ahhbfkbf.exe
        
        C:\Windows\system32\Ahhbfkbf.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1532
        
        C:\Windows\SysWOW64\Anbkbe32.exe
        
        C:\Windows\system32\Anbkbe32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4444
        
        C:\Windows\SysWOW64\Abpcicpi.exe
        
        C:\Windows\system32\Abpcicpi.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3784
        
        C:\Windows\SysWOW64\Bniacddk.exe
        
        C:\Windows\system32\Bniacddk.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5812
        
        C:\Windows\SysWOW64\Bajjeo32.exe
        
        C:\Windows\system32\Bajjeo32.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5020
        
        C:\Windows\SysWOW64\Blonbh32.exe
        
        C:\Windows\system32\Blonbh32.exe
        24⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5184
        
        C:\Windows\SysWOW64\Balfko32.exe
        
        C:\Windows\system32\Balfko32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4172
        
        C:\Windows\SysWOW64\Bdmpljlj.exe
        
        C:\Windows\system32\Bdmpljlj.exe
        26⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3476
        
        C:\Windows\SysWOW64\Cacmkn32.exe
        
        C:\Windows\system32\Cacmkn32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2512
        
        C:\Windows\SysWOW64\Chmehhpn.exe
        
        C:\Windows\system32\Chmehhpn.exe
        28⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4852
        
        C:\Windows\SysWOW64\Cogmdb32.exe
        
        C:\Windows\system32\Cogmdb32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5752
        
        C:\Windows\SysWOW64\Ceaealoh.exe
        
        C:\Windows\system32\Ceaealoh.exe
        30⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2276
        
        C:\Windows\SysWOW64\Clknnf32.exe
        
        C:\Windows\system32\Clknnf32.exe
        31⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4708
        
        C:\Windows\SysWOW64\Cbefkp32.exe
        
        C:\Windows\system32\Cbefkp32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2572
        
        C:\Windows\SysWOW64\Cdfbbhdp.exe
        
        C:\Windows\system32\Cdfbbhdp.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2168
        
        C:\Windows\SysWOW64\Ckpjob32.exe
        
        C:\Windows\system32\Ckpjob32.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3464
        
        C:\Windows\SysWOW64\Cajblmci.exe
        
        C:\Windows\system32\Cajblmci.exe
        35⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4616
        
        C:\Windows\SysWOW64\Cdiohhbm.exe
        
        C:\Windows\system32\Cdiohhbm.exe
        36⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5700
        
        C:\Windows\SysWOW64\Dbjofp32.exe
        
        C:\Windows\system32\Dbjofp32.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3012
        
        C:\Windows\SysWOW64\Ddklnh32.exe
        
        C:\Windows\system32\Ddklnh32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4304
        
        C:\Windows\SysWOW64\Dkedjbgg.exe
        
        C:\Windows\system32\Dkedjbgg.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:988
        
        C:\Windows\SysWOW64\Daolgl32.exe
        
        C:\Windows\system32\Daolgl32.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1072
        
        C:\Windows\SysWOW64\Dhidcffq.exe
        
        C:\Windows\system32\Dhidcffq.exe
        41⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4532
        
        C:\Windows\SysWOW64\Docmqp32.exe
        
        C:\Windows\system32\Docmqp32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5944
        
        C:\Windows\SysWOW64\Daaiml32.exe
        
        C:\Windows\system32\Daaiml32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1612
        
        C:\Windows\SysWOW64\Dhkaif32.exe
        
        C:\Windows\system32\Dhkaif32.exe
        44⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1156
        
        C:\Windows\SysWOW64\Doeifpkk.exe
        
        C:\Windows\system32\Doeifpkk.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4740
        
        C:\Windows\SysWOW64\Deoabj32.exe
        
        C:\Windows\system32\Deoabj32.exe
        46⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2480
        
        C:\Windows\SysWOW64\Dlijodjd.exe
        
        C:\Windows\system32\Dlijodjd.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5444
        
        C:\Windows\SysWOW64\Dafbhkhl.exe
        
        C:\Windows\system32\Dafbhkhl.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1712
        
        C:\Windows\SysWOW64\Ehpjdepi.exe
        
        C:\Windows\system32\Ehpjdepi.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1764
        
        C:\Windows\SysWOW64\Eojcao32.exe
        
        C:\Windows\system32\Eojcao32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5292
        
        C:\Windows\SysWOW64\Eefhcimp.exe
        
        C:\Windows\system32\Eefhcimp.exe
        51⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3440
        
        C:\Windows\SysWOW64\Ecjhmm32.exe
        
        C:\Windows\system32\Ecjhmm32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2708
        
        C:\Windows\SysWOW64\Edkddeag.exe
        
        C:\Windows\system32\Edkddeag.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3760
        
        C:\Windows\SysWOW64\Eaoenjqa.exe
        
        C:\Windows\system32\Eaoenjqa.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2580
        
        C:\Windows\SysWOW64\Ekhjgoga.exe
        
        C:\Windows\system32\Ekhjgoga.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4580
        
        C:\Windows\SysWOW64\Flgfqb32.exe
        
        C:\Windows\system32\Flgfqb32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2020
        
        C:\Windows\SysWOW64\Fadoii32.exe
        
        C:\Windows\system32\Fadoii32.exe
        57⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6088
        
        C:\Windows\SysWOW64\Fohobmke.exe
        
        C:\Windows\system32\Fohobmke.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5652
        
        C:\Windows\SysWOW64\Fllplajo.exe
        
        C:\Windows\system32\Fllplajo.exe
        59⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4252
        
        C:\Windows\SysWOW64\Ffdddg32.exe
        
        C:\Windows\system32\Ffdddg32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:256
        
        C:\Windows\SysWOW64\Fomhnmgp.exe
        
        C:\Windows\system32\Fomhnmgp.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4696
        
        C:\Windows\SysWOW64\Flqigq32.exe
        
        C:\Windows\system32\Flqigq32.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4804
        
        C:\Windows\SysWOW64\Gbmaog32.exe
        
        C:\Windows\system32\Gbmaog32.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4488
        
        C:\Windows\SysWOW64\Gkffhmka.exe
        
        C:\Windows\system32\Gkffhmka.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3844
        
        C:\Windows\SysWOW64\Gdnjabab.exe
        
        C:\Windows\system32\Gdnjabab.exe
        65⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5948
        
        C:\Windows\SysWOW64\Gbbkjgpl.exe
        
        C:\Windows\system32\Gbbkjgpl.exe
        66⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5436
        
        C:\Windows\SysWOW64\Ghlcga32.exe
        
        C:\Windows\system32\Ghlcga32.exe
        67⤵
        Modifies registry class
        
        PID:1092
        
        C:\Windows\SysWOW64\Gdcdlb32.exe
        
        C:\Windows\system32\Gdcdlb32.exe
        68⤵
        Drops file in System32 directory
        
        PID:3400
        
        C:\Windows\SysWOW64\Gkmlilej.exe
        
        C:\Windows\system32\Gkmlilej.exe
        69⤵
        Drops file in System32 directory
        
        PID:1868
        
        C:\Windows\SysWOW64\Gfbpfedp.exe
        
        C:\Windows\system32\Gfbpfedp.exe
        70⤵
        System Location Discovery: System Language Discovery
        
        PID:1332
        
        C:\Windows\SysWOW64\Hbiakf32.exe
        
        C:\Windows\system32\Hbiakf32.exe
        71⤵
        System Location Discovery: System Language Discovery
        
        PID:1684
        
        C:\Windows\SysWOW64\Hicihp32.exe
        
        C:\Windows\system32\Hicihp32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2672
        
        C:\Windows\SysWOW64\Hbknqeha.exe
        
        C:\Windows\system32\Hbknqeha.exe
        73⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1688
        
        C:\Windows\SysWOW64\Hiefmp32.exe
        
        C:\Windows\system32\Hiefmp32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4132
        
        C:\Windows\SysWOW64\Hoonjjgk.exe
        
        C:\Windows\system32\Hoonjjgk.exe
        75⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4980
        
        C:\Windows\SysWOW64\Hihbco32.exe
        
        C:\Windows\system32\Hihbco32.exe
        76⤵
        
        PID:2604
        
        C:\Windows\SysWOW64\Heochp32.exe
        
        C:\Windows\system32\Heochp32.exe
        77⤵
        Modifies registry class
        
        PID:4716
        
        C:\Windows\SysWOW64\Hkhkdjkl.exe
        
        C:\Windows\system32\Hkhkdjkl.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2772
        
        C:\Windows\SysWOW64\Heapmp32.exe
        
        C:\Windows\system32\Heapmp32.exe
        79⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5096
        
        C:\Windows\SysWOW64\Hkkhjj32.exe
        
        C:\Windows\system32\Hkkhjj32.exe
        80⤵
        
        PID:3396
        
        C:\Windows\SysWOW64\Ibgmldnd.exe
        
        C:\Windows\system32\Ibgmldnd.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3820
        
        C:\Windows\SysWOW64\Immaimnj.exe
        
        C:\Windows\system32\Immaimnj.exe
        82⤵
        Drops file in System32 directory
        
        PID:3788
        
        C:\Windows\SysWOW64\Ilbnkiba.exe
        
        C:\Windows\system32\Ilbnkiba.exe
        83⤵
        Drops file in System32 directory
        
        PID:3992
        
        C:\Windows\SysWOW64\Ildkpiqo.exe
        
        C:\Windows\system32\Ildkpiqo.exe
        84⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2100
        
        C:\Windows\SysWOW64\Ilfhfh32.exe
        
        C:\Windows\system32\Ilfhfh32.exe
        85⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2520
        
        C:\Windows\SysWOW64\Jfllca32.exe
        
        C:\Windows\system32\Jfllca32.exe
        86⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1280
        
        C:\Windows\SysWOW64\Jpgmaf32.exe
        
        C:\Windows\system32\Jpgmaf32.exe
        87⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Jecejm32.exe
        
        C:\Windows\system32\Jecejm32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1908
        
        C:\Windows\SysWOW64\Jcgbmd32.exe
        
        C:\Windows\system32\Jcgbmd32.exe
        89⤵
        
        PID:1244
        
        C:\Windows\SysWOW64\Jidkek32.exe
        
        C:\Windows\system32\Jidkek32.exe
        90⤵
        Modifies registry class
        
        PID:2564
        
        C:\Windows\SysWOW64\Kdiobd32.exe
        
        C:\Windows\system32\Kdiobd32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4280
        
        C:\Windows\SysWOW64\Kifhkkci.exe
        
        C:\Windows\system32\Kifhkkci.exe
        92⤵
        Modifies registry class
        
        PID:260
        
        C:\Windows\SysWOW64\Kppphe32.exe
        
        C:\Windows\system32\Kppphe32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5608
        
        C:\Windows\SysWOW64\Kmdqai32.exe
        
        C:\Windows\system32\Kmdqai32.exe
        94⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Kdnincal.exe
        
        C:\Windows\system32\Kdnincal.exe
        95⤵
        System Location Discovery: System Language Discovery
        
        PID:3040
        
        C:\Windows\SysWOW64\Kikafjoc.exe
        
        C:\Windows\system32\Kikafjoc.exe
        96⤵
        
        PID:3516
        
        C:\Windows\SysWOW64\Kpeibdfp.exe
        
        C:\Windows\system32\Kpeibdfp.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2388
        
        C:\Windows\SysWOW64\Kfoapo32.exe
        
        C:\Windows\system32\Kfoapo32.exe
        98⤵
        Drops file in System32 directory
        
        PID:2496
        
        C:\Windows\SysWOW64\Klljhe32.exe
        
        C:\Windows\system32\Klljhe32.exe
        99⤵
        System Location Discovery: System Language Discovery
        
        PID:4100
        
        C:\Windows\SysWOW64\Kipkaj32.exe
        
        C:\Windows\system32\Kipkaj32.exe
        100⤵
        
        PID:2732
        
        C:\Windows\SysWOW64\Ldeonbkd.exe
        
        C:\Windows\system32\Ldeonbkd.exe
        101⤵
        System Location Discovery: System Language Discovery
        
        PID:4476
        
        C:\Windows\SysWOW64\Lefkfk32.exe
        
        C:\Windows\system32\Lefkfk32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5496
        
        C:\Windows\SysWOW64\Lplpcc32.exe
        
        C:\Windows\system32\Lplpcc32.exe
        103⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5960
        
        C:\Windows\SysWOW64\Lffhpnhe.exe
        
        C:\Windows\system32\Lffhpnhe.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1680
        
        C:\Windows\SysWOW64\Llbphdfl.exe
        
        C:\Windows\system32\Llbphdfl.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4944
        
        C:\Windows\SysWOW64\Lfhdem32.exe
        
        C:\Windows\system32\Lfhdem32.exe
        106⤵
        System Location Discovery: System Language Discovery
        
        PID:5412
        
        C:\Windows\SysWOW64\Llemnd32.exe
        
        C:\Windows\system32\Llemnd32.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5196
        
        C:\Windows\SysWOW64\Lemagjjj.exe
        
        C:\Windows\system32\Lemagjjj.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2124
        
        C:\Windows\SysWOW64\Llgjcd32.exe
        
        C:\Windows\system32\Llgjcd32.exe
        109⤵
        System Location Discovery: System Language Discovery
        
        PID:1640
        
        C:\Windows\SysWOW64\Lgmnqmam.exe
        
        C:\Windows\system32\Lgmnqmam.exe
        110⤵
        Drops file in System32 directory
        
        PID:4508
        
        C:\Windows\SysWOW64\Mmgfmg32.exe
        
        C:\Windows\system32\Mmgfmg32.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1508
        
        C:\Windows\SysWOW64\Mdanjaqf.exe
        
        C:\Windows\system32\Mdanjaqf.exe
        112⤵
        Drops file in System32 directory
        
        PID:3280
        
        C:\Windows\SysWOW64\Mebkbi32.exe
        
        C:\Windows\system32\Mebkbi32.exe
        113⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1056
        
        C:\Windows\SysWOW64\Mllcocna.exe
        
        C:\Windows\system32\Mllcocna.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5032
        
        C:\Windows\SysWOW64\Mipchg32.exe
        
        C:\Windows\system32\Mipchg32.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4484
        
        C:\Windows\SysWOW64\Mpjleadh.exe
        
        C:\Windows\system32\Mpjleadh.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5676
        
        C:\Windows\SysWOW64\Megdmhbp.exe
        
        C:\Windows\system32\Megdmhbp.exe
        117⤵
        Drops file in System32 directory
        
        PID:4752
        
        C:\Windows\SysWOW64\Mlqljb32.exe
        
        C:\Windows\system32\Mlqljb32.exe
        118⤵
        System Location Discovery: System Language Discovery
        
        PID:5476
        
        C:\Windows\SysWOW64\Meiabh32.exe
        
        C:\Windows\system32\Meiabh32.exe
        119⤵
        System Location Discovery: System Language Discovery
        
        PID:5648
        
        C:\Windows\SysWOW64\Mlciobhj.exe
        
        C:\Windows\system32\Mlciobhj.exe
        120⤵
        Modifies registry class
        
        PID:4676
        
        C:\Windows\SysWOW64\Mgimmkgp.exe
        
        C:\Windows\system32\Mgimmkgp.exe
        121⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5892
        
        C:\Windows\SysWOW64\Npabeq32.exe
        
        C:\Windows\system32\Npabeq32.exe
        122⤵
        
        PID:2656
        
        C:\Windows\SysWOW64\Nenjng32.exe
        
        C:\Windows\system32\Nenjng32.exe
        123⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:808
        
        C:\Windows\SysWOW64\Ngmggj32.exe
        
        C:\Windows\system32\Ngmggj32.exe
        124⤵
        System Location Discovery: System Language Discovery
        
        PID:2760
        
        C:\Windows\SysWOW64\Nngoddkg.exe
        
        C:\Windows\system32\Nngoddkg.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3768
        
        C:\Windows\SysWOW64\Ncdgmkio.exe
        
        C:\Windows\system32\Ncdgmkio.exe
        126⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1424
        
        C:\Windows\SysWOW64\Njnpie32.exe
        
        C:\Windows\system32\Njnpie32.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2372
        
        C:\Windows\SysWOW64\Ndcdfnpa.exe
        
        C:\Windows\system32\Ndcdfnpa.exe
        128⤵
        System Location Discovery: System Language Discovery
        
        PID:560
        
        C:\Windows\SysWOW64\Njploeoi.exe
        
        C:\Windows\system32\Njploeoi.exe
        129⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Npjelo32.exe
        
        C:\Windows\system32\Npjelo32.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4204
        
        C:\Windows\SysWOW64\Ofgmdf32.exe
        
        C:\Windows\system32\Ofgmdf32.exe
        131⤵
        
        PID:3236
        
        C:\Windows\SysWOW64\Olaeqp32.exe
        
        C:\Windows\system32\Olaeqp32.exe
        132⤵
        System Location Discovery: System Language Discovery
        
        PID:3692
        
        C:\Windows\SysWOW64\Oggjni32.exe
        
        C:\Windows\system32\Oggjni32.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4408
        
        C:\Windows\SysWOW64\Onqbjccl.exe
        
        C:\Windows\system32\Onqbjccl.exe
        134⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2680
        
        C:\Windows\SysWOW64\Ocmjcjad.exe
        
        C:\Windows\system32\Ocmjcjad.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2908
        
        C:\Windows\SysWOW64\Oncopcqj.exe
        
        C:\Windows\system32\Oncopcqj.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6156
        
        C:\Windows\SysWOW64\Odmgmmhf.exe
        
        C:\Windows\system32\Odmgmmhf.exe
        137⤵
        System Location Discovery: System Language Discovery
        
        PID:6200
        
        C:\Windows\SysWOW64\Ojjoedfn.exe
        
        C:\Windows\system32\Ojjoedfn.exe
        138⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6244
        
        C:\Windows\SysWOW64\Oqdgan32.exe
        
        C:\Windows\system32\Oqdgan32.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6288
        
        C:\Windows\SysWOW64\Ognpoheh.exe
        
        C:\Windows\system32\Ognpoheh.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6328
        
        C:\Windows\SysWOW64\Omjhgoco.exe
        
        C:\Windows\system32\Omjhgoco.exe
        141⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Ocdqcikl.exe
        
        C:\Windows\system32\Ocdqcikl.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6416
        
        C:\Windows\SysWOW64\Pjnipc32.exe
        
        C:\Windows\system32\Pjnipc32.exe
        143⤵
        Drops file in System32 directory
        
        PID:6456
        
        C:\Windows\SysWOW64\Pddmml32.exe
        
        C:\Windows\system32\Pddmml32.exe
        144⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Pfeiedhm.exe
        
        C:\Windows\system32\Pfeiedhm.exe
        145⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Pgefogop.exe
        
        C:\Windows\system32\Pgefogop.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6576
        
        C:\Windows\SysWOW64\Pmangnmg.exe
        
        C:\Windows\system32\Pmangnmg.exe
        147⤵
        Drops file in System32 directory
        
        PID:6616
        
        C:\Windows\SysWOW64\Pckfdh32.exe
        
        C:\Windows\system32\Pckfdh32.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6656
        
        C:\Windows\SysWOW64\Pjeoablq.exe
        
        C:\Windows\system32\Pjeoablq.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6696
        
        C:\Windows\SysWOW64\Pdkcnklf.exe
        
        C:\Windows\system32\Pdkcnklf.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6736
        
        C:\Windows\SysWOW64\Pgiojf32.exe
        
        C:\Windows\system32\Pgiojf32.exe
        151⤵
        System Location Discovery: System Language Discovery
        
        PID:6780
        
        C:\Windows\SysWOW64\Pmfhbm32.exe
        
        C:\Windows\system32\Pmfhbm32.exe
        152⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6820
        
        C:\Windows\SysWOW64\Qfolkcpb.exe
        
        C:\Windows\system32\Qfolkcpb.exe
        153⤵
        System Location Discovery: System Language Discovery
        
        PID:6860
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6860 -s 448
        154⤵
        Program crash
        
        PID:6952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 6860 -ip 6860
1⤵
PID:6928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Abpcicpi.exe

Path C:\Windows\SysWOW64\Abpcicpi.exe
Size 429KB
SHA256 33755b5e685937486b2bb3607061621528c8b13474582c934f0947b94b353ac8
MD5 0408798c7aee619d162b57411bc12f90
SHA1 c1ac648d6d1f0fbd7dff9e16f8e52a8caf1cc49c
SHA512 a30a90074866384d0c93fafd11b7f71c92475a89bdee7bf6a6ac91617e6414bc906b806cfb123421778677966589d4a8fc4c7fc109b9e941a0e8bdb91d307643
SSDEEP 6144:GLqIvzH55XAQV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:EjzZ52/NcZ7/N
TLSH
T1C79471652A301DE5DDEEABB5AC2249D88181E4B154F1F13EA6B3DFDCC8E4DA5CC04B90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Agcikk32.exe

Path C:\Windows\SysWOW64\Agcikk32.exe
Size 429KB
SHA256 6e97831495643096b9604dfe63cebbf8dcaa244d7ad8a8b4430c53f8c22498f3
MD5 7273e771937a85ec7a3cfab906871d73
SHA1 d054965b380e14314299a77cc4711aa6f4ba442e
SHA512 32fbe6f694dd0107f1a8c336e1c44bd4ea69fa64845116b99b03680d1bc74adba2bf6cda3aad3aec01591af8e38ca6c6cbd20e3ce5ec796900f78f3e66a1450c
SSDEEP 6144:D4hgTXKV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:cWTv/NcZ7/N
TLSH
T1CB9461652A301DE5DDEE6BB5AC1289E88181E8B514F1F23E6633DFDCC9E5D66CC04B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ahhbfkbf.exe

Path C:\Windows\SysWOW64\Ahhbfkbf.exe
Size 429KB
SHA256 915401f3d0187ce9d0f4844db3c9dec5baa70cbb13dc5973ae7482959d894d1d
MD5 8b8bdf2b23749ea8e23224f512074d29
SHA1 5ea3321c4b73840d0480c70ad38419e1c55fd32a
SHA512 c8d74421e79b561fbd3b3d5759cc8a802c786327e25adf272fe943244244afa1ad4b5f361ad3458c62c3ac14fcbf984a3c9ce4cd782e4bec62da25f7cb85793d
SSDEEP 6144:Uurp4V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:UMn/NcZ7/N
TLSH
T1379482652A3059E6DDEE6BB5AC1289D88181E5B128F1F23E6633DFDDC8E5D61CC04F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Anbkbe32.exe

Path C:\Windows\SysWOW64\Anbkbe32.exe
Size 429KB
SHA256 07a580cdd47f5078ad48465ff0a657e55649103862ff24cced37460cd6e2560f
MD5 9611829e968edc92a70d9ab541c6facb
SHA1 a4bbb856f5d95096429488ece08ca8a0c0dba7c3
SHA512 8d3308b81220fcd79b400a7226bd8dc1cc556fa7af45f918fb04d59abcd7aa8ab5caea392d48ae6e6489c98af32689f2cc1839a8ed22af73b6c8e25cd0211b5b
SSDEEP 6144:pxChRrjAV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:Of9/NcZ7/N
TLSH
T1479481656A3059E6DDEE6BB5AC124DD88186E9B114F1F13E6633DFDCC8E4DA2CC04B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bajjeo32.exe

Path C:\Windows\SysWOW64\Bajjeo32.exe
Size 429KB
SHA256 f91a96d0999263326ed51ab0c428dd971107d01dcc6194c2e045bf0bc4786ead
MD5 7f2586f4e1cd8449fd918f3fe762e5df
SHA1 f10c5efa5e6d789a0e454182eb39d62b63107256
SHA512 6398ef0fe86c45ffdfa2d214e4576f8a9ca42372ce7a4573677377eb8a76b876f0c296661862f8682fb932cbef7e6275f28273594d37fd1ee564342dcf1d36f0
SSDEEP 6144:CffkRJ2jjOV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:CX5jH/NcZ7/N
TLSH
T1FF9482252A301DE5DDEE6BB5AC5249E88182E5B414F2F13E5A73DFDCC8E5EA5CC04B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Balfko32.exe

Path C:\Windows\SysWOW64\Balfko32.exe
Size 429KB
SHA256 80933c4d912357601fdf4f02baaeacc5068650e3dfc101838d62558705bdbead
MD5 9814723647203f00acb5a1723cdad42b
SHA1 c5239b754a357c59a7468af5f513d7a7d41abce2
SHA512 95ffcbb9b7323995ea8ad2ea1662b5b1301d1b139194aded04b85c7847406d6785d4a911838ed8676d029832a523e5c9040d5c4dc42494e7d91e8c51347b8ed4
SSDEEP 6144:oMyzOHaorCjrWwozV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:2zOHaorCjrRB/NcZ7/N
TLSH
T1BC945E656A3019E6DDEE6BB5AC1249E98181E8F515F1F13E6623DFDCC8E4DB1CC08B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bdmpljlj.exe

Path C:\Windows\SysWOW64\Bdmpljlj.exe
Size 429KB
SHA256 c2313f77c01fc7eaed7cfbd33d191d505226fb5a4af8b25acd25f564061b8746
MD5 ce0c271704fb8216763b7ef791133aa9
SHA1 4be3f4c7f2de753231708126d368bc85bf12fe05
SHA512 4ac1ce5bf79d63aa377b010977d38b7045ddf54125f0bdba2f9acd625746efed6cb5abe6758d37140a083e818d269dc4759b5ca84e8116372f02ed4627cc23d3
SSDEEP 6144:nATGiqpq3JzsEeylEFvnV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:gkW/NcZ7/N
TLSH
T1EF9450652A3019E6DDEEABF5AC1249D88281E5B154F5F13E6633DFDCC8E4DA1CC08B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Blonbh32.exe

Path C:\Windows\SysWOW64\Blonbh32.exe
Size 429KB
SHA256 2fc0f4b6502cab43f7919340d76311df1523f8ef4db71ea79c58809743eea5e1
MD5 863092e71b9caff1a351ef4a07e810f6
SHA1 e2f0bdff739b59bb07af18f4627a03a7ee9600c1
SHA512 02c7c8dde840fb12ad70aa0811b9d965f7201fed7d580c959b23c53539ed9f8926bb435d952887350bbdb1d5bcfd2ef5b2181ed468a85aedb749e13d3d6bf6af
SSDEEP 6144:syISiMH/Qod1V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:LISiMFG/NcZ7/N
TLSH
T1D8945F65667019E6DEEE6BB5AC124AD88182E8B144F1F53F6633DFDCC8E5D62C804F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bniacddk.exe

Path C:\Windows\SysWOW64\Bniacddk.exe
Size 429KB
SHA256 77574cf905f372dad2afffb2a8cbb54def3ca7f3bb7571766240421d0f525d94
MD5 2445d70082640271de0722f744b8e7f0
SHA1 dd65722af61d88b309b49c19e21af5bbf4cfaaad
SHA512 42e4167829775ff3dbd7419292f71b37a7935f22c252f1e45620ebd60a64c7a71a6bb236b4a012c5db130dcb37555546d63a1d029b34428008a23792d541b318
SSDEEP 6144:x+d2iQdCkV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:xqcy/NcZ7/N
TLSH
T10D9460252A741AE6EDFE6BB5AC1249D88182E5B104F1F53E6633DFDCC8E5D66CC04B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cacmkn32.exe

Path C:\Windows\SysWOW64\Cacmkn32.exe
Size 429KB
SHA256 61a7d529036c228450db7f69a89b3fc485139710d66ec0f098f231b6291c9374
MD5 b1d10655aa9e3f0883646661569968b3
SHA1 e40445edbfebfb1a776014a8b301b438a843c85a
SHA512 617bfcd4ee838181a06243d3d57fd3170a1a575f720a683ed85dc2b0152dd1d1b72810e9bdfaf1f3470c7149c2f0ff06145959c3136d18e6ad35cb5be413f324
SSDEEP 6144:jYSl6ZXjV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:8Sx/NcZ7/N
TLSH
T190946F696B3019E6DEEE6BB5AC1349E88181E4B104F1F13E6663DFDCC8E6D65CC04B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cbefkp32.exe

Path C:\Windows\SysWOW64\Cbefkp32.exe
Size 429KB
SHA256 50d24d730db8f9582a700e5eaf9551d671e331212962568a06d2f6bca8aa6e25
MD5 1aabeea16e1166f2085f92d55ebff5f9
SHA1 6d543685a5e0a12ae79039cffa0de999b3af729c
SHA512 2ac8c181b306c7eaa70c45a814f6d7b942be5a4e46ea2fe34f6a7d04e686fdcf168103327d89a1820ae0ae57bb3f74b0a57f24cb0fde57cb0cc68d50d4388ae7
SSDEEP 6144:zCYHpXEcV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:zU/NcZ7/N
TLSH
T13D9482256A3029E6DDEE6BB5AC1249D88181E5F105F5F53E6A33DFECC8E4D62CC04B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cdfbbhdp.exe

Path C:\Windows\SysWOW64\Cdfbbhdp.exe
Size 429KB
SHA256 7cae6beeaba65c905f6e832c70b60bb73cb0719e068426bd3adeba65843fe21e
MD5 fd44f5303211f4052b23575bcf95be28
SHA1 3715f73e85775c2b10cb40a29be4b55510867ee5
SHA512 813ca18c7067c5570b191d71aec803aab4f27b1b67c41c8afae842fec2e7d4a33611cb49a65c2638bae9997aceb9fb79555843f36ef275f78e6b3c18d1000100
SSDEEP 6144:3HAVNc4eV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:3YmE/NcZ7/N
TLSH
T18594B3252A3019E6EDEE6BB5AC5249D88285E8B154F1F53E2633DFDDC8E4D62CC04F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ceaealoh.exe

Path C:\Windows\SysWOW64\Ceaealoh.exe
Size 429KB
SHA256 95a0306fcb7cddaa92a1f445ebe78f2cd5474df9acc96d108827e30f61d033f0
MD5 34f868f713cfb6cfe3f8fac483428e43
SHA1 f117b11611c7d10676d2d46ec8328419f30b4ab9
SHA512 9f864e7325de07ccc5c3105c1e8d1c36d989c75963e6b56f4178c234d5b4c77b8c8c3b09a317861ffeed38fd74d9e9ad216e2f2ff471700d8e9c84d571f3016d
SSDEEP 6144:Wzq3zmxKV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:Wm3zM/NcZ7/N
TLSH
T1139481292A3019E6DEEE6BF5AC1249E88191E5B114F1F13E6637DFDCC8E4DA1DC44B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Chmehhpn.exe

Path C:\Windows\SysWOW64\Chmehhpn.exe
Size 429KB
SHA256 505fa545b31bdb2960928bdaf10cd25cfe7a738fedac6436684ce285a70868d5
MD5 9d9696e7cb76d5d49d306aca9b8d6a35
SHA1 35a5012550f4afe82ef33736a97fb9aa0f44a743
SHA512 62f8d12ccbab53813ce3ad1502957976a1b7db9c325ecbcbd2f02474206307432cf04fea908f70466212038fb56a1520445e28706561591c7cb8521e04763a26
SSDEEP 6144:b0mpf7V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:Bpa/NcZ7/N
TLSH
T1EC9493252A7019E6DDEE6BB5AD2259E88181E8F114F5F23E6633DFDDC8E4D61CC04B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Clknnf32.exe

Path C:\Windows\SysWOW64\Clknnf32.exe
Size 429KB
SHA256 794a7d03938931be25a5ebd7042f68965a0c392c33136a88035d01b8d4e8807b
MD5 b2c7331c61af20a258fa5c1b24ee6cdc
SHA1 b9c07eefa9e77e9b7bef74563e6abea2dd02a1f6
SHA512 eeb4e4de465664bb61820c133bd464242d62000e3077579e4cb2649ee2523d9c4bfa5adda236becb934f6e7fbe6349c677042470f3dc90b4353e25f8fc72ea48
SSDEEP 6144:v+UM5wV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:GlL/NcZ7/N
TLSH
T1AF9471656A311DEADDEE6BB5AC1249D88181E4B214F1F13E6633EFDCC8E5D61CC04B82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cogmdb32.exe

Path C:\Windows\SysWOW64\Cogmdb32.exe
Size 429KB
SHA256 aa75059083921fdbd6c3664f85f9c2933bfbabbc58758980dd6248cc29cb43f4
MD5 db0c12e3258344f5fc750a6a7df45b1f
SHA1 25be0a94d42e42e2fed069ae0027e6a651821c49
SHA512 e8e0446c857a466831caebb36ab3249d46b421f7fcce702bf1d2e4853bb38285a9d445e0e1639f5f37b382ace93851bf593f2dc402f3b7456433d02fc97a1abc
SSDEEP 6144:B0XR2Vp/gV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:s2l/NcZ7/N
TLSH
T1E09450696A301DE9DDEE6BB9AD1249D88181E4B114F1F17F6623EFDCC8E4D62CC04B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mdkhkflh.exe

Path C:\Windows\SysWOW64\Mdkhkflh.exe
Size 429KB
SHA256 8c913ce32d5548cb498869e2147251b426dda913042397686ca3cc07b6da2079
MD5 93edbe7b165a87e761b9129a4f59a230
SHA1 1fa55cf79ae3d571a333861aff1665237705e799
SHA512 63033b702e4da7ba2a734c3376d8453621ca4997a54b05643651b5bb42eee56d3ca1e1e138d9efc1f74ca2a8d0dd144832dd25465765cbf562ba2e567fc2cc53
SSDEEP 6144:JEa/IV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:J3/NcZ7/N
TLSH
T1799470252A3029E5DDEE6BB5AD1249E88181E8F104F1F63E6633DFDCD8E4D62CC14B85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mkbcbp32.exe

Path C:\Windows\SysWOW64\Mkbcbp32.exe
Size 429KB
SHA256 78b6a4c4dbbbb98daa7974f816ed079b3ab99cb3e785787df6f2ad556270f05a
MD5 c9a0e6ea3843f1839df0c3763b61503a
SHA1 824d7f40e99343788ff2ce52c2963a8efdb15d24
SHA512 839691e632fdef78e77ccb6868b5c6049cbd962feaa875296732df452e4bcb63537f45ded59c2b50cf277a339011aa7620b4df8f3fbe7b567230479dfeda9b01
SSDEEP 6144:y62PpHp2GtV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:N6pJ29/NcZ7/N
TLSH
T16A947266263019E6DDEE6BB5AC1249D882C1E5B114F1F13E6A33EFDEC8E4D61CC05B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Naaejj32.exe

Path C:\Windows\SysWOW64\Naaejj32.exe
Size 429KB
SHA256 8c7b54c98ad046cb33fdd42584e27425c858c867ad2539e134230a0902144725
MD5 139db15a8f71299c4fa7cbccb799d277
SHA1 34dcabb5a50342aa9ec17c171215000d4c2ff0ad
SHA512 dda5f0bf55ac87c20f8539aa965863cd5baf3ef12a658afeeaa05af83d34e59ab03b387d69b3f8f360ffb4d895f79c05655015df1b08bf4389f7d3e9ca0f7492
SSDEEP 6144:rC+i4agi8rXyV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:rs4agjr3/NcZ7/N
TLSH
T196947265663019EADDEE6BB5AC1249E88181E6B104F1F13E6A33DFDCC8F4DA1CD05B90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nacboi32.exe

Path C:\Windows\SysWOW64\Nacboi32.exe
Size 429KB
SHA256 ee93c8745a4c2a5962d3f6f0402615282e0b067a0a16d2d2723782e714705057
MD5 3e3e9831ddea7cc4573d67a8e4c730d2
SHA1 e9c760a45a77110fc81a559b28e98012d401e7f8
SHA512 206a3e67e0251fc74bd672531e80c0827cd82f4c0fdf307bd6414b199a70dd610e164ebf78dffaf6d67530e4ab0fec4048473b875aa99e3ec73234d63c977c9d
SSDEEP 6144:P4YirF1hmErgV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:wYirF1hmEN/NcZ7/N
TLSH
T1429493257A3019E6DDEE6BB5AC124AE99181E4B544F1F13E6633EFDCC8E4D62DC04B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ngpjgpec.exe

Path C:\Windows\SysWOW64\Ngpjgpec.exe
Size 429KB
SHA256 3d765dbec8cfe52eda2b93babf5fbfbf41c0e609362c817688a45f7eb879d2df
MD5 bc37641f732253c7cd61e292da7dd4b5
SHA1 a587d0b28d56b992564544cdf6d30fb91ce5ed2c
SHA512 19658d04a075a6997e5dbe0af6ccea9f3582db2e7e72824b3a8ecf7e08121d53989c1cf586c0090bfa89b7044083fb0ab64a9e042407f5b51a5da8263a3bf710
SSDEEP 6144:t8dooFNP6V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:troFN3/NcZ7/N
TLSH
T199946E252B341DEADDEE6BB5AC1249D88181E8B154F1F53E66339FDDC8E4DA2CC04B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nnolojhk.exe

Path C:\Windows\SysWOW64\Nnolojhk.exe
Size 429KB
SHA256 1516bd56e28d9a8deba68f0d4fdabf9251b127ac215596176fe74f99dc498246
MD5 ff39679c02502d226d73367988ae6c2f
SHA1 89ef3ab61277c793df2f79f370562d3383d65295
SHA512 c9473f95dbde15614cb6a55f1a3eb27000abe663badd239e1854ae26218a9c6ad2ea3902f5244f11851dd2206d80416291ce6aef9942a30e42501b43d78c1fcb
SSDEEP 6144:XAsymPZu9kLksV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:XXymPfC/NcZ7/N
TLSH
T1459471256A3019E5DDEE6BB5AC224AE88182E5B518F1F13E6633DFDDC8E5D61CC04F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Obanqgkl.exe

Path C:\Windows\SysWOW64\Obanqgkl.exe
Size 429KB
SHA256 574673e91032977bad6bd3c01b64d18ff26992eebf70145ebf594f9964f279af
MD5 4766d95c5a35131dbb5ef4a298cc795e
SHA1 2ff03e4babbfaafdedd60a4f9a03ba522d1ddb03
SHA512 10adab2e582cbfa0623f822896d107a9e57bb86dcd00c0170425a57e54e0a25653608f637c9ac1f52e6f9d297b7e535773c093ad698d71d5a600efb1d323b019
SSDEEP 6144:TF7g0LxV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:TF7gZ/NcZ7/N
TLSH
T18E945F656A3019F5EDEE6BB5AC5259E98181E8B104F1F17F6623DFDCC8E4DA2CC04B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Occkhp32.exe

Path C:\Windows\SysWOW64\Occkhp32.exe
Size 429KB
SHA256 61718ec14b0ab5b32ad13a18c79e0b61af2e649051c1a5182ecb10eff6094daa
MD5 494777d351d6de7698f926c4d67ee110
SHA1 d9ecd0e973792ebfedec3d1131eb04967b8611c1
SHA512 b7782b228d14a04396850c16d01ddd73a0eea98cc930f7d83446b5805bb8be6a744f1125cff886c83f6a5c92893de1e08cb1d6ace60bb5d6a00fecc33b715f65
SSDEEP 6144:W8leQiV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:BEU/NcZ7/N
TLSH
T1C4947165263019E5DDEE6BB5AC2249ED8181E5B108F1F53E6A33EFDCC8E4DA1CC44B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Odbgbb32.exe

Path C:\Windows\SysWOW64\Odbgbb32.exe
Size 429KB
SHA256 0de78d90831ea85382e951f1f4c45387836923f83a9a7cf59a00f330253765de
MD5 8b0da2a53137bb6845aaf573701f3cf3
SHA1 d6ec40b87b56430ddf1e29d58febfe1f00e3fe94
SHA512 a9182827b0af52afb3be2035698f41bc8db863655cdf2d6984c8a2b5b64baa4a3bd21cba4b4cabcda5d08cffbac1bed179c1471055d9eff625d02b23d9405df7
SSDEEP 6144:Z0ONykHUEV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:Z0ONyCK/NcZ7/N
TLSH
T1779471696A7029E6DDEE6BB5AC1249E88181E4B114F1F13E6633DFECC8F4D61CC14B90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Odkaac32.exe

Path C:\Windows\SysWOW64\Odkaac32.exe
Size 429KB
SHA256 e0e3b4a9baa17cda254aa9e066de39cc22a68c381d617e836566ccf7c8f02d8d
MD5 f2692a8c54ac60b1acae23fbc692f7cd
SHA1 fc3044003c986331c37956238bed0fd1df410dd9
SHA512 4d6f9359b04dfd4d123fb419236233f86c9f6e5d6922b338400a6ab0d639179a4ed06780f45f7a8ad1be74c3d072c50f4b6d622faec5d338b25f9717e62e08da
SSDEEP 6144:TX+3seDWsy6f0V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:TX+3seDWsy6V/NcZ7/N
TLSH
T197945F256A7419E6DDEE6BB6AC1249D981C1E4B114F1F17E6A33DFDCC8E4D62CC08B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ojhijjll.exe

Path C:\Windows\SysWOW64\Ojhijjll.exe
Size 429KB
SHA256 427e9852bd68a2e73d790fd89fafda4b8b4079c990e382228634d4e6c925d5fa
MD5 1c30a31c6f596894f70d6bac1d8e3ac0
SHA1 acbb27e4ca85b834b7dafba26fb3b58aea34a71a
SHA512 b4f4cb29b01a81601f17b6fb39146102c933e9e51348c29f02d3621c2e792691c560f48d48358fbe7b674ac6c733ec186ed6b87f7c7a14cdf43473cef9162863
SSDEEP 6144:QNAanbnlfMV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:QFbld/NcZ7/N
TLSH
T1E8946F652B3019E5DDEE6BB5AC1349D88581E9B118F1F13EA623DFDDC8E4DA2CC44B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Okloomoj.exe

Path C:\Windows\SysWOW64\Okloomoj.exe
Size 429KB
SHA256 f1260fd6bd44bc622ddd5f8d0e8a2d3032fea7cebd27b621e3bd5164059df352
MD5 f00633f7079454c060840eddc87cc122
SHA1 bdee8f04365026a0873650d538e6e3152a8bd132
SHA512 531172eb2db469dfaf558572fc08d97a99f80c0ee803199b56db4b2e11b5254c788c88ec8ba7774ad905acb5f9cf8ed7feeda31a1a724d86542e5ec91cb084f1
SSDEEP 6144:JFdlgV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:Lp/NcZ7/N
TLSH
T1499492666A301EE6DDEE6BB5AC1249E88081E8B554F5F13E6633DFDCC8E4D61CC04B84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pbfglg32.exe

Path C:\Windows\SysWOW64\Pbfglg32.exe
Size 429KB
SHA256 b143db5ddce052027d7ae21739efe36c03b55e81ff5d646deb46c31045c47f6f
MD5 0d1cbdbec3269d550e37c4e234ca2ba9
SHA1 a8534e570b2ba63df33c55946ccb5ad5b8ff52ae
SHA512 fec86159c7e2609de05dc40aa200fa5c26895dc9192960feccbed50855fecc4fb2b6e240bec0f966dad2baa89a67b040a25a9970db90295d832cc4a24254a493
SSDEEP 6144:Mbm+mc/6dTV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:x+mc/6o/NcZ7/N
TLSH
T12F9481256A311AE6DDEE6BB5AC1249D88181EAB114F1F13E6673DFDCC8F4DA1CC05B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pengna32.exe

Path C:\Windows\SysWOW64\Pengna32.exe
Size 429KB
SHA256 04fd04c65fd4a07e1fd01eff4aa6bbc7e1942f94d528a235bdd8736ee6a9c542
MD5 49c08a9f3edfd717dff880a07eadee6a
SHA1 c8f1cb2eeafced43349556869f14c5556249edd8
SHA512 241263e2d3d389a182e7952fc1ac2764d84f28f40ee04a3e14affdafb8e679b46b78fee5ad7f3bc95d62abe5c3dbd0dbef6a87455f43be4ad83acfaa11090a16
SSDEEP 6144:2UrdgH2OV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:5dgHW/NcZ7/N
TLSH
T1939461A56A3019E6DDEE6BB5AC2249D98181E9B114F1F13F6633EFDCC8E4D61CC04B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qagdia32.exe

Path C:\Windows\SysWOW64\Qagdia32.exe
Size 429KB
SHA256 d8efabc62259103076edf21563f157e8f82044495b1660bfb1573e11bb5453f7
MD5 de872e8901fec390c445b3b7c4d04805
SHA1 f7a0fade66ddf53b0a7f9f487a828e03b0d20c7d
SHA512 ffd04ee13aa58427f0489671adb521ca0c27129474bb8fb4767f8887433f7e9bc40fcf1c06afacbe20b74725ce0aee6c6f71dd10d2a143efa2b454a31e954ee5
SSDEEP 6144:MWz+QURXRV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:9yQUK/NcZ7/N
TLSH
T1CD9490252A3159E6DDEE6FB5AC1259E88085E8B104F1F53E6633DFDCC9E4DA1CC08B90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qgalelin.exe

Path C:\Windows\SysWOW64\Qgalelin.exe
Size 429KB
SHA256 60468d426863552bcd2d1166cc78df35531cdc9fc6ac0cb0d0ea6436facf53f3
MD5 cf323cd40212455092869c17d8c5ec27
SHA1 56e8b82a87fa9c730bec83f595b9ffc0c44f1d12
SHA512 cfd34548f1d39c218100fc3bf3843a067cc7f0c7930e26b74a236f15e1304c2002ee78571e3b4294278effbef95c65d173143835147651742d786984c1030655
SSDEEP 6144:vgqCJV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:oqV/NcZ7/N
TLSH
T1F79472652B305DE5EDEE6BB5AC1289E88185E9B004F1F13E6633DFDDC8E9E51C804B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/256-360-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/692-98-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/820-70-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/988-255-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1072-260-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1092-395-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1100-476-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1100-14-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1116-77-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1156-280-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1280-495-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1332-410-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1532-126-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1612-275-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1684-415-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1688-425-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1712-300-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1764-305-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1868-405-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1908-507-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2020-340-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2072-42-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2072-500-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2100-483-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2168-224-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2216-49-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2216-506-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2220-105-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2276-203-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2468-91-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2480-290-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2512-182-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2520-489-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2572-217-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2580-330-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2604-440-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2672-420-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2708-320-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2772-450-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2888-84-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2992-21-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2992-482-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3012-245-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3396-461-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3400-400-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3440-315-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3464-230-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3476-175-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3592-56-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3632-28-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3632-488-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3760-325-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3784-140-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3788-471-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3844-380-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3892-119-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3992-477-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4112-460-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4112-1-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/4112-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4132-430-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4172-168-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4252-355-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4304-250-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4352-7-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4352-470-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4444-133-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4488-375-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4532-265-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4556-63-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4580-335-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4616-235-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4644-35-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4644-494-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4696-365-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4708-210-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4716-445-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4740-285-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4804-370-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4852-189-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4980-435-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5020-154-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5096-455-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5184-161-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5292-310-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5296-501-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5436-390-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5444-295-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5652-350-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5700-240-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5752-196-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5812-148-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5824-112-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5944-270-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5948-385-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6088-345-0x0000000000400000-0x000000000046D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads