berbew | b74ce8d58bd3438b84c95741226dbb7f89aa3e2ffe8699f0f5e0eb080406984f

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/11/2026, 18:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-31_f61f7e76ee97592cae7c9732ea0a1e9d_elex_wannacry.exe
Size 429KB
Sample261101-ww8kvsxthy
SHA256 b74ce8d58bd3438b84c95741226dbb7f89aa3e2ffe8699f0f5e0eb080406984f
MD5 f61f7e76ee97592cae7c9732ea0a1e9d
SHA1 c27df4ed5e1b7eee1223fbd298b7a368c868346b
SHA512 8e20b556e77fc46e2e0698d7047b7a22ad9e75864979a08d4cfbc0a81ad30202d6997e86666df96d71d27f2484798f76a7e58372441519c7a44dbf91e4561f16
SSDEEP 6144:fn8a6GiAV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:fU/NcZ7/N
TLSH
T1679482656A3069E6DDEE6BB5AC2249D88585E5F104F1F13E6633DFDCC8E4DA2CC04B80
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnafgd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Coldbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jifemfcl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aajggjap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fepehm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Galoin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kcjjajop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nqmocjdf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfihkq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncmhee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pplhab32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iefgln32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Akblpo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Egqeckkg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adqghpbp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcanfakf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jgoflpal.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Foocegea.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jamafidm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlcgam32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Opphed32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qjdpoacp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iobeno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipgkcabd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncpejd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Knpeii32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmaafcml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cglbanmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Felkmnci.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipgkcabd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mfbaka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njpjap32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofeggo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pffghc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cpajdc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hbenio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ledeicdf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqmocjdf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enhpje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iefgln32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mqhmbqlh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qjfmda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dqkmkb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ladpnepb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmkopgep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nclbjk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enfceefi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hiljpi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klbnjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ookokeqd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jiglgl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhkfdcbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnjkbi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Conagl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cponodge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cglbanmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eoagdi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lhpepoel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ppclej32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmiidnko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dgbhbm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lhpepoel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ledeicdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pbgghn32.exe

Executes dropped EXE 64 IoCs

pid	Process
5676	Iefgln32.exe
2904	Jiglgl32.exe
1836	Jcanfakf.exe
5444	Jgoflpal.exe
5924	Kllodfpd.exe
1204	Knnhdied.exe
5256	Knpeii32.exe
3320	Kflink32.exe
1784	Lgpocm32.exe
5944	Lmaafcml.exe
4720	Mflbdibj.exe
2664	Mqafbaap.exe
872	Mqhmbqlh.exe
2740	Njaakf32.exe
4984	Nclbjk32.exe
3380	Nnafgd32.exe
5112	Nfohafad.exe
1320	Npgmjl32.exe
5808	Ogcnfheb.exe
3988	Ofhkgeij.exe
476	Ppclej32.exe
4508	Pdqelh32.exe
3512	Pmiidnko.exe
3496	Pfanmcao.exe
5348	Pffghc32.exe
2524	Qpolahdj.exe
1732	Qjdpoacp.exe
2872	Qpahghbg.exe
5644	Qjfmda32.exe
1752	Aphngglp.exe
1144	Amloakki.exe
2092	Agdcja32.exe
5576	Aajggjap.exe
4784	Akblpo32.exe
4352	Bgkijp32.exe
4016	Bhkfdcbd.exe
4420	Bpfkiepp.exe
1480	Bnjkbi32.exe
3936	Coigllel.exe
2244	Coldbl32.exe
5840	Conagl32.exe
3836	Cponodge.exe
4656	Cpajdc32.exe
204	Cglbanmo.exe
5096	Cdpckbli.exe
4628	Daccdf32.exe
3624	Dnjdigpf.exe
1608	Dgbhbm32.exe
3656	Dqkmkb32.exe
5872	Dkqahk32.exe
1508	Dbmfje32.exe
3392	Eoagdi32.exe
5012	Enfceefi.exe
2984	Enhpje32.exe
1148	Egqeckkg.exe
4596	Ebfiqcjm.exe
4884	Ekoniian.exe
3984	Edgbbo32.exe
4868	Foocegea.exe
6036	Felkmnci.exe
4328	Fqblbo32.exe
5104	Fepehm32.exe
3492	Gebanm32.exe
4244	Gnkfgb32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Kafcmglb.exe	Jbagkkgj.exe
File created	C:\Windows\SysWOW64\Dnlhdhpl.dll	Lhpepoel.exe
File opened for modification	C:\Windows\SysWOW64\Qppambnl.exe	Qjcidkpd.exe
File opened for modification	C:\Windows\SysWOW64\Afmfolcf.exe	Aiifeg32.exe
File opened for modification	C:\Windows\SysWOW64\Galoin32.exe	Geenclkn.exe
File opened for modification	C:\Windows\SysWOW64\Gpolld32.exe	Ganlnmop.exe
File created	C:\Windows\SysWOW64\Kpiqpo32.exe	Kedlbf32.exe
File created	C:\Windows\SysWOW64\Ladpnepb.exe	Llggeobk.exe
File created	C:\Windows\SysWOW64\Ojaldgoc.dll	Jcanfakf.exe
File created	C:\Windows\SysWOW64\Mnponp32.dll	Jifemfcl.exe
File opened for modification	C:\Windows\SysWOW64\Lfgboc32.exe	Ledeicdf.exe
File created	C:\Windows\SysWOW64\Effcokoh.dll	Mqeibk32.exe
File created	C:\Windows\SysWOW64\Opphed32.exe	Ojcpmm32.exe
File opened for modification	C:\Windows\SysWOW64\Jiglgl32.exe	Iefgln32.exe
File created	C:\Windows\SysWOW64\Ifcgpk32.dll	Pmiidnko.exe
File created	C:\Windows\SysWOW64\Gipdba32.dll	Ganlnmop.exe
File created	C:\Windows\SysWOW64\Mbdiecbp.exe	Mhldlnko.exe
File created	C:\Windows\SysWOW64\Aabgponf.dll	Mhldlnko.exe
File created	C:\Windows\SysWOW64\Qppambnl.exe	Qjcidkpd.exe
File opened for modification	C:\Windows\SysWOW64\Mqafbaap.exe	Mflbdibj.exe
File opened for modification	C:\Windows\SysWOW64\Nnafgd32.exe	Nclbjk32.exe
File created	C:\Windows\SysWOW64\Flllnb32.dll	Bgkijp32.exe
File created	C:\Windows\SysWOW64\Bnjkbi32.exe	Bpfkiepp.exe
File created	C:\Windows\SysWOW64\Ljojemhg.dll	Bpfkiepp.exe
File opened for modification	C:\Windows\SysWOW64\Ncpejd32.exe	Nijqml32.exe
File opened for modification	C:\Windows\SysWOW64\Ojcpmm32.exe	Oqkkdh32.exe
File opened for modification	C:\Windows\SysWOW64\Aiifeg32.exe	Qppambnl.exe
File created	C:\Windows\SysWOW64\Pffghc32.exe	Pfanmcao.exe
File opened for modification	C:\Windows\SysWOW64\Bnjkbi32.exe	Bpfkiepp.exe
File created	C:\Windows\SysWOW64\Gebanm32.exe	Fepehm32.exe
File created	C:\Windows\SysWOW64\Iobeno32.exe	Hbldinjb.exe
File opened for modification	C:\Windows\SysWOW64\Cdpckbli.exe	Cglbanmo.exe
File opened for modification	C:\Windows\SysWOW64\Egqeckkg.exe	Enhpje32.exe
File created	C:\Windows\SysWOW64\Hbenio32.exe	Hiljpi32.exe
File created	C:\Windows\SysWOW64\Mhjhfnma.exe	Mlcgam32.exe
File opened for modification	C:\Windows\SysWOW64\Pmkopgep.exe	Padnkf32.exe
File created	C:\Windows\SysWOW64\Iagqlkak.dll	Jiglgl32.exe
File created	C:\Windows\SysWOW64\Aojbdqid.dll	Akblpo32.exe
File created	C:\Windows\SysWOW64\Lohqgj32.exe	Ladpnepb.exe
File created	C:\Windows\SysWOW64\Ofckao32.exe	Omjfij32.exe
File created	C:\Windows\SysWOW64\Mqafbaap.exe	Mflbdibj.exe
File created	C:\Windows\SysWOW64\Kpfpci32.dll	Pffghc32.exe
File created	C:\Windows\SysWOW64\Pochllfo.dll	Mcolcgmh.exe
File opened for modification	C:\Windows\SysWOW64\Opphed32.exe	Ojcpmm32.exe
File created	C:\Windows\SysWOW64\Qkloqefm.dll	Daccdf32.exe
File created	C:\Windows\SysWOW64\Edgbbo32.exe	Ekoniian.exe
File created	C:\Windows\SysWOW64\Iioplg32.exe	Ipgkcabd.exe
File opened for modification	C:\Windows\SysWOW64\Mhldlnko.exe	Mcolcgmh.exe
File opened for modification	C:\Windows\SysWOW64\Ncmhee32.exe	Nfihkq32.exe
File created	C:\Windows\SysWOW64\Ieojqi32.exe	Ilfehcnp.exe
File created	C:\Windows\SysWOW64\Lnqkfl32.dll	Mbdiecbp.exe
File created	C:\Windows\SysWOW64\Hnhpmc32.dll	Nqmocjdf.exe
File created	C:\Windows\SysWOW64\Nijqml32.exe	Ncmhee32.exe
File opened for modification	C:\Windows\SysWOW64\Pcnalbce.exe	Pihmojco.exe
File created	C:\Windows\SysWOW64\Paaaeg32.exe	Pcnalbce.exe
File opened for modification	C:\Windows\SysWOW64\Padnkf32.exe	Pfojmn32.exe
File created	C:\Windows\SysWOW64\Kmbmdc32.dll	Amloakki.exe
File created	C:\Windows\SysWOW64\Aajggjap.exe	Agdcja32.exe
File created	C:\Windows\SysWOW64\Fmklob32.dll	Aiifeg32.exe
File created	C:\Windows\SysWOW64\Ogcnfheb.exe	Npgmjl32.exe
File opened for modification	C:\Windows\SysWOW64\Lmaafcml.exe	Lgpocm32.exe
File created	C:\Windows\SysWOW64\Hfpjphap.dll	Mqafbaap.exe
File opened for modification	C:\Windows\SysWOW64\Njaakf32.exe	Mqhmbqlh.exe
File opened for modification	C:\Windows\SysWOW64\Pdqelh32.exe	Ppclej32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6236	5588	WerFault.exe	224

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njjmgo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofeggo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adqghpbp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Egqeckkg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iobeno32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ladpnepb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mqeibk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofhkgeij.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgbhbm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Geenclkn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojcpmm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Knpeii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iioplg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pihmojco.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npgmjl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ekoniian.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Foocegea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpiqpo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Obebla32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aajggjap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Felkmnci.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nijqml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ookokeqd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmkopgep.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jiglgl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hiljpi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jbagkkgj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klbnjo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncmhee32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iefgln32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Enhpje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ebfiqcjm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ganlnmop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gndima32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Padnkf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qppambnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-31_f61f7e76ee97592cae7c9732ea0a1e9d_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jgoflpal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmaafcml.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdpckbli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njpjap32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Coldbl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dqkmkb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hpdegdci.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lohqgj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlcgam32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pbgghn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkqahk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gebanm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcnalbce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kllodfpd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhkfdcbd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fqblbo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kedlbf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kflink32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Conagl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbmfje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kcjjajop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mhldlnko.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mfbaka32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nqmocjdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hicpqh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qakdke32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfanmcao.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jocnem32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnlhdhpl.dll"	Lhpepoel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jgoflpal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Giqemh32.dll"	Knnhdied.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Galoin32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mhjhfnma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ondicl32.dll"	Padnkf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qppambnl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Adqghpbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omfoojfd.dll"	Ofhkgeij.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmiidnko.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dkqahk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kafcmglb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncpejd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Afmfolcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lgpocm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Npgmjl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aeadmn32.dll"	Coldbl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dnjdigpf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Egqeckkg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kpiqpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Objnfe32.dll"	Ncpejd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qpolahdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Foaoie32.dll"	Galoin32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnafgd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pfanmcao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdlkho32.dll"	Qpolahdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Boebfmja.dll"	Qjdpoacp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hhagaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nambpl32.dll"	Hiackied.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ladpnepb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njpjap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aildndia.dll"	Gndima32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hicpqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkgileqg.dll"	Kekbce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Obebla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qjcnnm32.dll"	Pplhab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jengfefa.dll"	Afmfolcf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	2026-10-31_f61f7e76ee97592cae7c9732ea0a1e9d_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cknqppmi.dll"	Kflink32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpfpci32.dll"	Pffghc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aoeooiqn.dll"	Cdpckbli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dkqahk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnglhn32.dll"	Jamafidm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Locgljca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pochllfo.dll"	Mcolcgmh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jgoflpal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kflink32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njaakf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Akblpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dgbhbm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Foocegea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmfiheah.dll"	Gebanm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elopkgoa.dll"	Ladpnepb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idcpofaf.dll"	Qjfmda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmheflog.dll"	Bhkfdcbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ikhfkk32.dll"	Dnjdigpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbbcmdai.dll"	Enfceefi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hiljpi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Daenfb32.dll"	Kafcmglb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mlcgam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Effcokoh.dll"	Mqeibk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aomcelfe.dll"	Hhagaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dqkmkb32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5972 wrote to memory of 5676	5972	2026-10-31_f61f7e76ee97592cae7c9732ea0a1e9d_elex_wannacry.exe	88
PID 5676 wrote to memory of 2904	5676	Iefgln32.exe	89
PID 2904 wrote to memory of 1836	2904	Jiglgl32.exe	90
PID 1836 wrote to memory of 5444	1836	Jcanfakf.exe	91
PID 5444 wrote to memory of 5924	5444	Jgoflpal.exe	92
PID 5924 wrote to memory of 1204	5924	Kllodfpd.exe	93
PID 1204 wrote to memory of 5256	1204	Knnhdied.exe	94
PID 5256 wrote to memory of 3320	5256	Knpeii32.exe	95
PID 3320 wrote to memory of 1784	3320	Kflink32.exe	96
PID 1784 wrote to memory of 5944	1784	Lgpocm32.exe	97
PID 5944 wrote to memory of 4720	5944	Lmaafcml.exe	98
PID 4720 wrote to memory of 2664	4720	Mflbdibj.exe	99
PID 2664 wrote to memory of 872	2664	Mqafbaap.exe	100
PID 872 wrote to memory of 2740	872	Mqhmbqlh.exe	101
PID 2740 wrote to memory of 4984	2740	Njaakf32.exe	102
PID 4984 wrote to memory of 3380	4984	Nclbjk32.exe	103
PID 3380 wrote to memory of 5112	3380	Nnafgd32.exe	104
PID 5112 wrote to memory of 1320	5112	Nfohafad.exe	105
PID 1320 wrote to memory of 5808	1320	Npgmjl32.exe	106
PID 5808 wrote to memory of 3988	5808	Ogcnfheb.exe	107
PID 3988 wrote to memory of 476	3988	Ofhkgeij.exe	108
PID 476 wrote to memory of 4508	476	Ppclej32.exe	109
PID 4508 wrote to memory of 3512	4508	Pdqelh32.exe	110
PID 3512 wrote to memory of 3496	3512	Pmiidnko.exe	111
PID 3496 wrote to memory of 5348	3496	Pfanmcao.exe	112
PID 5348 wrote to memory of 2524	5348	Pffghc32.exe	113
PID 2524 wrote to memory of 1732	2524	Qpolahdj.exe	114
PID 1732 wrote to memory of 2872	1732	Qjdpoacp.exe	115
PID 2872 wrote to memory of 5644	2872	Qpahghbg.exe	116
PID 5644 wrote to memory of 1752	5644	Qjfmda32.exe	117
PID 1752 wrote to memory of 1144	1752	Aphngglp.exe	118
PID 1144 wrote to memory of 2092	1144	Amloakki.exe	119
PID 2092 wrote to memory of 5576	2092	Agdcja32.exe	120
PID 5576 wrote to memory of 4784	5576	Aajggjap.exe	121
PID 4784 wrote to memory of 4352	4784	Akblpo32.exe	122
PID 4352 wrote to memory of 4016	4352	Bgkijp32.exe	123
PID 4016 wrote to memory of 4420	4016	Bhkfdcbd.exe	124
PID 4420 wrote to memory of 1480	4420	Bpfkiepp.exe	125
PID 1480 wrote to memory of 3936	1480	Bnjkbi32.exe	126
PID 3936 wrote to memory of 2244	3936	Coigllel.exe	127
PID 2244 wrote to memory of 5840	2244	Coldbl32.exe	128
PID 5840 wrote to memory of 3836	5840	Conagl32.exe	129
PID 3836 wrote to memory of 4656	3836	Cponodge.exe	130
PID 4656 wrote to memory of 204	4656	Cpajdc32.exe	131
PID 204 wrote to memory of 5096	204	Cglbanmo.exe	132
PID 5096 wrote to memory of 4628	5096	Cdpckbli.exe	133
PID 4628 wrote to memory of 3624	4628	Daccdf32.exe	134
PID 3624 wrote to memory of 1608	3624	Dnjdigpf.exe	135
PID 1608 wrote to memory of 3656	1608	Dgbhbm32.exe	136
PID 3656 wrote to memory of 5872	3656	Dqkmkb32.exe	137
PID 5872 wrote to memory of 1508	5872	Dkqahk32.exe	138
PID 1508 wrote to memory of 3392	1508	Dbmfje32.exe	139
PID 3392 wrote to memory of 5012	3392	Eoagdi32.exe	140
PID 5012 wrote to memory of 2984	5012	Enfceefi.exe	141
PID 2984 wrote to memory of 1148	2984	Enhpje32.exe	142
PID 1148 wrote to memory of 4596	1148	Egqeckkg.exe	143
PID 4596 wrote to memory of 4884	4596	Ebfiqcjm.exe	144
PID 4884 wrote to memory of 3984	4884	Ekoniian.exe	145
PID 3984 wrote to memory of 4868	3984	Edgbbo32.exe	146
PID 4868 wrote to memory of 6036	4868	Foocegea.exe	147
PID 6036 wrote to memory of 4328	6036	Felkmnci.exe	148
PID 4328 wrote to memory of 5104	4328	Fqblbo32.exe	149
PID 5104 wrote to memory of 3492	5104	Fepehm32.exe	150
PID 3492 wrote to memory of 4244	3492	Gebanm32.exe	151

C:\Users\Admin\AppData\Local\Temp\2026-10-31_f61f7e76ee97592cae7c9732ea0a1e9d_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-31_f61f7e76ee97592cae7c9732ea0a1e9d_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5972
- C:\Windows\SysWOW64\Iefgln32.exe
  C:\Windows\system32\Iefgln32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5676
- - C:\Windows\SysWOW64\Jiglgl32.exe
    C:\Windows\system32\Jiglgl32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2904
  - - C:\Windows\SysWOW64\Jcanfakf.exe
      C:\Windows\system32\Jcanfakf.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:1836
    - - C:\Windows\SysWOW64\Jgoflpal.exe
        
        C:\Windows\system32\Jgoflpal.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5444
      - C:\Windows\SysWOW64\Kllodfpd.exe
        
        C:\Windows\system32\Kllodfpd.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5924
        
        C:\Windows\SysWOW64\Knnhdied.exe
        
        C:\Windows\system32\Knnhdied.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1204
        
        C:\Windows\SysWOW64\Knpeii32.exe
        
        C:\Windows\system32\Knpeii32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5256
        
        C:\Windows\SysWOW64\Kflink32.exe
        
        C:\Windows\system32\Kflink32.exe
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3320
        
        C:\Windows\SysWOW64\Lgpocm32.exe
        
        C:\Windows\system32\Lgpocm32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1784
        
        C:\Windows\SysWOW64\Lmaafcml.exe
        
        C:\Windows\system32\Lmaafcml.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5944
        
        C:\Windows\SysWOW64\Mflbdibj.exe
        
        C:\Windows\system32\Mflbdibj.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4720
        
        C:\Windows\SysWOW64\Mqafbaap.exe
        
        C:\Windows\system32\Mqafbaap.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2664
        
        C:\Windows\SysWOW64\Mqhmbqlh.exe
        
        C:\Windows\system32\Mqhmbqlh.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:872
        
        C:\Windows\SysWOW64\Njaakf32.exe
        
        C:\Windows\system32\Njaakf32.exe
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2740
        
        C:\Windows\SysWOW64\Nclbjk32.exe
        
        C:\Windows\system32\Nclbjk32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4984
        
        C:\Windows\SysWOW64\Nnafgd32.exe
        
        C:\Windows\system32\Nnafgd32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3380
        
        C:\Windows\SysWOW64\Nfohafad.exe
        
        C:\Windows\system32\Nfohafad.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5112
        
        C:\Windows\SysWOW64\Npgmjl32.exe
        
        C:\Windows\system32\Npgmjl32.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1320
        
        C:\Windows\SysWOW64\Ogcnfheb.exe
        
        C:\Windows\system32\Ogcnfheb.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5808
        
        C:\Windows\SysWOW64\Ofhkgeij.exe
        
        C:\Windows\system32\Ofhkgeij.exe
        21⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3988
        
        C:\Windows\SysWOW64\Ppclej32.exe
        
        C:\Windows\system32\Ppclej32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:476
        
        C:\Windows\SysWOW64\Pdqelh32.exe
        
        C:\Windows\system32\Pdqelh32.exe
        23⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4508
        
        C:\Windows\SysWOW64\Pmiidnko.exe
        
        C:\Windows\system32\Pmiidnko.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3512
        
        C:\Windows\SysWOW64\Pfanmcao.exe
        
        C:\Windows\system32\Pfanmcao.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3496
        
        C:\Windows\SysWOW64\Pffghc32.exe
        
        C:\Windows\system32\Pffghc32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5348
        
        C:\Windows\SysWOW64\Qpolahdj.exe
        
        C:\Windows\system32\Qpolahdj.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2524
        
        C:\Windows\SysWOW64\Qjdpoacp.exe
        
        C:\Windows\system32\Qjdpoacp.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1732
        
        C:\Windows\SysWOW64\Qpahghbg.exe
        
        C:\Windows\system32\Qpahghbg.exe
        29⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2872
        
        C:\Windows\SysWOW64\Qjfmda32.exe
        
        C:\Windows\system32\Qjfmda32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5644
        
        C:\Windows\SysWOW64\Aphngglp.exe
        
        C:\Windows\system32\Aphngglp.exe
        31⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1752
        
        C:\Windows\SysWOW64\Amloakki.exe
        
        C:\Windows\system32\Amloakki.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1144
        
        C:\Windows\SysWOW64\Agdcja32.exe
        
        C:\Windows\system32\Agdcja32.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2092
        
        C:\Windows\SysWOW64\Aajggjap.exe
        
        C:\Windows\system32\Aajggjap.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5576
        
        C:\Windows\SysWOW64\Akblpo32.exe
        
        C:\Windows\system32\Akblpo32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4784
        
        C:\Windows\SysWOW64\Bgkijp32.exe
        
        C:\Windows\system32\Bgkijp32.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4352
        
        C:\Windows\SysWOW64\Bhkfdcbd.exe
        
        C:\Windows\system32\Bhkfdcbd.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4016
        
        C:\Windows\SysWOW64\Bpfkiepp.exe
        
        C:\Windows\system32\Bpfkiepp.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4420
        
        C:\Windows\SysWOW64\Bnjkbi32.exe
        
        C:\Windows\system32\Bnjkbi32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1480
        
        C:\Windows\SysWOW64\Coigllel.exe
        
        C:\Windows\system32\Coigllel.exe
        40⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3936
        
        C:\Windows\SysWOW64\Coldbl32.exe
        
        C:\Windows\system32\Coldbl32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2244
        
        C:\Windows\SysWOW64\Conagl32.exe
        
        C:\Windows\system32\Conagl32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5840
        
        C:\Windows\SysWOW64\Cponodge.exe
        
        C:\Windows\system32\Cponodge.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3836
        
        C:\Windows\SysWOW64\Cpajdc32.exe
        
        C:\Windows\system32\Cpajdc32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4656
        
        C:\Windows\SysWOW64\Cglbanmo.exe
        
        C:\Windows\system32\Cglbanmo.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:204
        
        C:\Windows\SysWOW64\Cdpckbli.exe
        
        C:\Windows\system32\Cdpckbli.exe
        46⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5096
        
        C:\Windows\SysWOW64\Daccdf32.exe
        
        C:\Windows\system32\Daccdf32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4628
        
        C:\Windows\SysWOW64\Dnjdigpf.exe
        
        C:\Windows\system32\Dnjdigpf.exe
        48⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3624
        
        C:\Windows\SysWOW64\Dgbhbm32.exe
        
        C:\Windows\system32\Dgbhbm32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1608
        
        C:\Windows\SysWOW64\Dqkmkb32.exe
        
        C:\Windows\system32\Dqkmkb32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3656
        
        C:\Windows\SysWOW64\Dkqahk32.exe
        
        C:\Windows\system32\Dkqahk32.exe
        51⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5872
        
        C:\Windows\SysWOW64\Dbmfje32.exe
        
        C:\Windows\system32\Dbmfje32.exe
        52⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1508
        
        C:\Windows\SysWOW64\Eoagdi32.exe
        
        C:\Windows\system32\Eoagdi32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3392
        
        C:\Windows\SysWOW64\Enfceefi.exe
        
        C:\Windows\system32\Enfceefi.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5012
        
        C:\Windows\SysWOW64\Enhpje32.exe
        
        C:\Windows\system32\Enhpje32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2984
        
        C:\Windows\SysWOW64\Egqeckkg.exe
        
        C:\Windows\system32\Egqeckkg.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1148
        
        C:\Windows\SysWOW64\Ebfiqcjm.exe
        
        C:\Windows\system32\Ebfiqcjm.exe
        57⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4596
        
        C:\Windows\SysWOW64\Ekoniian.exe
        
        C:\Windows\system32\Ekoniian.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4884
        
        C:\Windows\SysWOW64\Edgbbo32.exe
        
        C:\Windows\system32\Edgbbo32.exe
        59⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3984
        
        C:\Windows\SysWOW64\Foocegea.exe
        
        C:\Windows\system32\Foocegea.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4868
        
        C:\Windows\SysWOW64\Felkmnci.exe
        
        C:\Windows\system32\Felkmnci.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6036
        
        C:\Windows\SysWOW64\Fqblbo32.exe
        
        C:\Windows\system32\Fqblbo32.exe
        62⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4328
        
        C:\Windows\SysWOW64\Fepehm32.exe
        
        C:\Windows\system32\Fepehm32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5104
        
        C:\Windows\SysWOW64\Gebanm32.exe
        
        C:\Windows\system32\Gebanm32.exe
        64⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3492
        
        C:\Windows\SysWOW64\Gnkfgb32.exe
        
        C:\Windows\system32\Gnkfgb32.exe
        65⤵
        Executes dropped EXE
        
        PID:4244
        
        C:\Windows\SysWOW64\Geenclkn.exe
        
        C:\Windows\system32\Geenclkn.exe
        66⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2024
        
        C:\Windows\SysWOW64\Galoin32.exe
        
        C:\Windows\system32\Galoin32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2304
        
        C:\Windows\SysWOW64\Ganlnmop.exe
        
        C:\Windows\system32\Ganlnmop.exe
        68⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4020
        
        C:\Windows\SysWOW64\Gpolld32.exe
        
        C:\Windows\system32\Gpolld32.exe
        69⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\Gndima32.exe
        
        C:\Windows\system32\Gndima32.exe
        70⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2788
        
        C:\Windows\SysWOW64\Hpdegdci.exe
        
        C:\Windows\system32\Hpdegdci.exe
        71⤵
        System Location Discovery: System Language Discovery
        
        PID:1652
        
        C:\Windows\SysWOW64\Hiljpi32.exe
        
        C:\Windows\system32\Hiljpi32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3136
        
        C:\Windows\SysWOW64\Hbenio32.exe
        
        C:\Windows\system32\Hbenio32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5456
        
        C:\Windows\SysWOW64\Hhagaf32.exe
        
        C:\Windows\system32\Hhagaf32.exe
        74⤵
        Modifies registry class
        
        PID:5708
        
        C:\Windows\SysWOW64\Hiackied.exe
        
        C:\Windows\system32\Hiackied.exe
        75⤵
        Modifies registry class
        
        PID:3520
        
        C:\Windows\SysWOW64\Hicpqh32.exe
        
        C:\Windows\system32\Hicpqh32.exe
        76⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2388
        
        C:\Windows\SysWOW64\Hbldinjb.exe
        
        C:\Windows\system32\Hbldinjb.exe
        77⤵
        Drops file in System32 directory
        
        PID:1936
        
        C:\Windows\SysWOW64\Iobeno32.exe
        
        C:\Windows\system32\Iobeno32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4756
        
        C:\Windows\SysWOW64\Ilfehcnp.exe
        
        C:\Windows\system32\Ilfehcnp.exe
        79⤵
        Drops file in System32 directory
        
        PID:4872
        
        C:\Windows\SysWOW64\Ieojqi32.exe
        
        C:\Windows\system32\Ieojqi32.exe
        80⤵
        
        PID:1256
        
        C:\Windows\SysWOW64\Ipgkcabd.exe
        
        C:\Windows\system32\Ipgkcabd.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6028
        
        C:\Windows\SysWOW64\Iioplg32.exe
        
        C:\Windows\system32\Iioplg32.exe
        82⤵
        System Location Discovery: System Language Discovery
        
        PID:5992
        
        C:\Windows\SysWOW64\Jamafidm.exe
        
        C:\Windows\system32\Jamafidm.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:812
        
        C:\Windows\SysWOW64\Jifemfcl.exe
        
        C:\Windows\system32\Jifemfcl.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6076
        
        C:\Windows\SysWOW64\Jocnem32.exe
        
        C:\Windows\system32\Jocnem32.exe
        85⤵
        Modifies registry class
        
        PID:3544
        
        C:\Windows\SysWOW64\Jbagkkgj.exe
        
        C:\Windows\system32\Jbagkkgj.exe
        86⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5420
        
        C:\Windows\SysWOW64\Kafcmglb.exe
        
        C:\Windows\system32\Kafcmglb.exe
        87⤵
        Modifies registry class
        
        PID:4668
        
        C:\Windows\SysWOW64\Kedlbf32.exe
        
        C:\Windows\system32\Kedlbf32.exe
        88⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3396
        
        C:\Windows\SysWOW64\Kpiqpo32.exe
        
        C:\Windows\system32\Kpiqpo32.exe
        89⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5608
        
        C:\Windows\SysWOW64\Kcjjajop.exe
        
        C:\Windows\system32\Kcjjajop.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2088
        
        C:\Windows\SysWOW64\Klbnjo32.exe
        
        C:\Windows\system32\Klbnjo32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:724
        
        C:\Windows\SysWOW64\Kekbce32.exe
        
        C:\Windows\system32\Kekbce32.exe
        92⤵
        Modifies registry class
        
        PID:1044
        
        C:\Windows\SysWOW64\Locgljca.exe
        
        C:\Windows\system32\Locgljca.exe
        93⤵
        Modifies registry class
        
        PID:5272
        
        C:\Windows\SysWOW64\Llggeobk.exe
        
        C:\Windows\system32\Llggeobk.exe
        94⤵
        Drops file in System32 directory
        
        PID:1288
        
        C:\Windows\SysWOW64\Ladpnepb.exe
        
        C:\Windows\system32\Ladpnepb.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:252
        
        C:\Windows\SysWOW64\Lohqgj32.exe
        
        C:\Windows\system32\Lohqgj32.exe
        96⤵
        System Location Discovery: System Language Discovery
        
        PID:3728
        
        C:\Windows\SysWOW64\Lhpepoel.exe
        
        C:\Windows\system32\Lhpepoel.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:3784
        
        C:\Windows\SysWOW64\Ledeicdf.exe
        
        C:\Windows\system32\Ledeicdf.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1088
        
        C:\Windows\SysWOW64\Lfgboc32.exe
        
        C:\Windows\system32\Lfgboc32.exe
        99⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Moofhiid.exe
        
        C:\Windows\system32\Moofhiid.exe
        100⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\Mlcgam32.exe
        
        C:\Windows\system32\Mlcgam32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:832
        
        C:\Windows\SysWOW64\Mhjhfnma.exe
        
        C:\Windows\system32\Mhjhfnma.exe
        102⤵
        Modifies registry class
        
        PID:2392
        
        C:\Windows\SysWOW64\Mcolcgmh.exe
        
        C:\Windows\system32\Mcolcgmh.exe
        103⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5740
        
        C:\Windows\SysWOW64\Mhldlnko.exe
        
        C:\Windows\system32\Mhldlnko.exe
        104⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1680
        
        C:\Windows\SysWOW64\Mbdiecbp.exe
        
        C:\Windows\system32\Mbdiecbp.exe
        105⤵
        Drops file in System32 directory
        
        PID:4824
        
        C:\Windows\SysWOW64\Mqeibk32.exe
        
        C:\Windows\system32\Mqeibk32.exe
        106⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1948
        
        C:\Windows\SysWOW64\Mfbaka32.exe
        
        C:\Windows\system32\Mfbaka32.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4364
        
        C:\Windows\SysWOW64\Njpjap32.exe
        
        C:\Windows\system32\Njpjap32.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4488
        
        C:\Windows\SysWOW64\Njbgfp32.exe
        
        C:\Windows\system32\Njbgfp32.exe
        109⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\Nqmocjdf.exe
        
        C:\Windows\system32\Nqmocjdf.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5024
        
        C:\Windows\SysWOW64\Nfihkq32.exe
        
        C:\Windows\system32\Nfihkq32.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5712
        
        C:\Windows\SysWOW64\Ncmhee32.exe
        
        C:\Windows\system32\Ncmhee32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4828
        
        C:\Windows\SysWOW64\Nijqml32.exe
        
        C:\Windows\system32\Nijqml32.exe
        113⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2672
        
        C:\Windows\SysWOW64\Ncpejd32.exe
        
        C:\Windows\system32\Ncpejd32.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4684
        
        C:\Windows\SysWOW64\Njjmgo32.exe
        
        C:\Windows\system32\Njjmgo32.exe
        115⤵
        System Location Discovery: System Language Discovery
        
        PID:1064
        
        C:\Windows\SysWOW64\Obebla32.exe
        
        C:\Windows\system32\Obebla32.exe
        116⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5300
        
        C:\Windows\SysWOW64\Omjfij32.exe
        
        C:\Windows\system32\Omjfij32.exe
        117⤵
        Drops file in System32 directory
        
        PID:5604
        
        C:\Windows\SysWOW64\Ofckao32.exe
        
        C:\Windows\system32\Ofckao32.exe
        118⤵
        
        PID:2544
        
        C:\Windows\SysWOW64\Ookokeqd.exe
        
        C:\Windows\system32\Ookokeqd.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3016
        
        C:\Windows\SysWOW64\Ofeggo32.exe
        
        C:\Windows\system32\Ofeggo32.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2876
        
        C:\Windows\SysWOW64\Oqkkdh32.exe
        
        C:\Windows\system32\Oqkkdh32.exe
        121⤵
        Drops file in System32 directory
        
        PID:2380
        
        C:\Windows\SysWOW64\Ojcpmm32.exe
        
        C:\Windows\system32\Ojcpmm32.exe
        122⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4280
        
        C:\Windows\SysWOW64\Opphed32.exe
        
        C:\Windows\system32\Opphed32.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:976
        
        C:\Windows\SysWOW64\Pihmojco.exe
        
        C:\Windows\system32\Pihmojco.exe
        124⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4920
        
        C:\Windows\SysWOW64\Pcnalbce.exe
        
        C:\Windows\system32\Pcnalbce.exe
        125⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4164
        
        C:\Windows\SysWOW64\Paaaeg32.exe
        
        C:\Windows\system32\Paaaeg32.exe
        126⤵
        
        PID:2764
        
        C:\Windows\SysWOW64\Pfojmn32.exe
        
        C:\Windows\system32\Pfojmn32.exe
        127⤵
        Drops file in System32 directory
        
        PID:1708
        
        C:\Windows\SysWOW64\Padnkf32.exe
        
        C:\Windows\system32\Padnkf32.exe
        128⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3240
        
        C:\Windows\SysWOW64\Pmkopgep.exe
        
        C:\Windows\system32\Pmkopgep.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3800
        
        C:\Windows\SysWOW64\Pbgghn32.exe
        
        C:\Windows\system32\Pbgghn32.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4260
        
        C:\Windows\SysWOW64\Pplhab32.exe
        
        C:\Windows\system32\Pplhab32.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4592
        
        C:\Windows\SysWOW64\Qakdke32.exe
        
        C:\Windows\system32\Qakdke32.exe
        132⤵
        System Location Discovery: System Language Discovery
        
        PID:2824
        
        C:\Windows\SysWOW64\Qjcidkpd.exe
        
        C:\Windows\system32\Qjcidkpd.exe
        133⤵
        Drops file in System32 directory
        
        PID:1056
        
        C:\Windows\SysWOW64\Qppambnl.exe
        
        C:\Windows\system32\Qppambnl.exe
        134⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4440
        
        C:\Windows\SysWOW64\Aiifeg32.exe
        
        C:\Windows\system32\Aiifeg32.exe
        135⤵
        Drops file in System32 directory
        
        PID:6100
        
        C:\Windows\SysWOW64\Afmfolcf.exe
        
        C:\Windows\system32\Afmfolcf.exe
        136⤵
        Modifies registry class
        
        PID:1080
        
        C:\Windows\SysWOW64\Adqghpbp.exe
        
        C:\Windows\system32\Adqghpbp.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3140
        
        C:\Windows\SysWOW64\Aimoqgqg.exe
        
        C:\Windows\system32\Aimoqgqg.exe
        138⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5588 -s 452
        139⤵
        Program crash
        
        PID:6236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5588 -ip 5588
1⤵
PID:6212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Agdcja32.exe

Path C:\Windows\SysWOW64\Agdcja32.exe
Size 429KB
SHA256 05a9143f07cc01bc39589f88bf35b7d8cb090a2d16668e1bd31bfb69a33826d0
MD5 e4b7d785cdcee643d82de5d638b4f072
SHA1 d22fa0f82cf823502ada92e9152380ee20a2703e
SHA512 decdaacc5d23b24c30930ca4e74b4d441eb3d48102d04a8ccb800d86c618ff023c48dd9db4fbd75ebc7b6e8f685967e849ecfe1d4115e7e90b02bbc848ec4bae
SSDEEP 6144:UJEpDzaV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:UJEpDL/NcZ7/N
TLSH
T1A5945F696A312DE6DDEE6FB5AC1289D98181E4B114F1F13E6637DFDCC8E4DA1C804B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Amloakki.exe

Path C:\Windows\SysWOW64\Amloakki.exe
Size 429KB
SHA256 3cd8f7b9589fb94ac213b2bf3925a2e7282339dfa8593a85f4e177d8bb19793f
MD5 38164ac528f01b56dcaa93a287b7c3ba
SHA1 711b040166043991d91e5b16a7d51d020be38b88
SHA512 47cb7ff132a822cd1cf05a534bf8d299e60f534899c8773fb181fd1ed8800eec318c67b07bfa1e5c5715e7ef743468d17fc398916d9667acd59fdf8aae5c2664
SSDEEP 6144:RzhLY2YNHV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:RzOW/NcZ7/N
TLSH
T1DE9460656A3059EADDEE6BB5AC1249E881C1E9B114F1F13E6633DFDCC8E4DA1CC04B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Aphngglp.exe

Path C:\Windows\SysWOW64\Aphngglp.exe
Size 429KB
SHA256 eaa269a3e2697e5dbc9502c8de58611460b0b20097dbff937e87b677fd6d622c
MD5 8c816d58935bdbb68dc81d23a8878819
SHA1 fcedb6610dce100bacd9e25d4aaa95038548d373
SHA512 06ea84c2b611dc9671531ef801aef465b6669061771d0438a417355bca77d1b2428f136cd154b4ec810f9462214103ec6d1b74510809e1b174db6f108f84e151
SSDEEP 6144:hoL2dNm4V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:hoL2DE/NcZ7/N
TLSH
T1029472296A351DE6DDEE6BB5AC5249E88181E4B184F1F13E6633DFDCC8E4DA1CC04B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Iefgln32.exe

Path C:\Windows\SysWOW64\Iefgln32.exe
Size 429KB
SHA256 91bc6636ee42fb8b554e271cd0dff359b3fe4fb6e19ce2aeb289416f1fa4ce86
MD5 303a3fa25572a886d60430d6df64f900
SHA1 ae33c969edd1840aa4976f3fe48eb6d45cf60af5
SHA512 b1a685f120be8ebfae6e7cdb99d7c13a62d5853a5187dee90db2f42d9d3910f17a85564311ce8ca931f57d5d3f0ca72479e4a3f961137112cb08635e795f7404
SSDEEP 6144:efx1+0APV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:O+4/NcZ7/N
TLSH
T1559483666A3059E5EDEE6BF5AD1249D88281E4B114F1F23E6633DFDCC8E4DA1CC44B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jcanfakf.exe

Path C:\Windows\SysWOW64\Jcanfakf.exe
Size 429KB
SHA256 197a28bfe4a8390f16413938ae7e1cb7e73439df1827461ec8fb20aeaf1dfa8c
MD5 578bd772be29eaf0d5c1d50148cf996b
SHA1 be3e13d8839063cae4edffbab4f54106b4484399
SHA512 9667e64aac36eaec48081a51f6a74e95b87f746b6d1de3a78f376d484465ae4c3865512220783b55734b0deb6f24bfc3c0abcbdd826c2fb15dad47c2f04a2ecf
SSDEEP 6144:hyt86vDXd6V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:hyt8G/NcZ7/N
TLSH
T1F59493A56A301DE6DEEE6BB5AD1249E88181E4B514F1F13E6633DFDCC9E4DA1CC04B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jgoflpal.exe

Path C:\Windows\SysWOW64\Jgoflpal.exe
Size 429KB
SHA256 de347b2bd4ca2baaa8b2c21207245e0977620fb2a0f6ed48d753288a0efa4997
MD5 c77c474fcf07581d8083c09eae2ec950
SHA1 b8b15167ba96d37cc9579032338db2c61416314e
SHA512 379c37f45d76b52dc65c90a92945a64d195f9e616a629ab609a4e620c55a1e03e7ceb0aa8e88bcfd69d521f180d07795b8c2d16d455d5d4f8ae7101e808a7ba4
SSDEEP 6144:SG1YB5iK3tX4PWV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:C5H39C/NcZ7/N
TLSH
T1689481256A3019EADDEEABB5AC1249D89181E8B444F1F13E6633DFDDC8E5DA1CC04F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jiglgl32.exe

Path C:\Windows\SysWOW64\Jiglgl32.exe
Size 429KB
SHA256 d973979a14954db0bc6d9cfb80a611e6a85d3020054b1ab2660ad976ecaf13bd
MD5 83384741beb94f89f3ab2141073bd3a0
SHA1 cec9854782c01033f60f8ed4d3f513114acfcbfd
SHA512 41fd421bc5d8491f2e92da13e58dfecf7578c32e66e638bcff23d53828bff6f872376b6f584c8f2fa9de6d1da59b59d37e7c105b0e1005bfc8e3c7647e838a29
SSDEEP 6144:TLtr9J6V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:zd/NcZ7/N
TLSH
T14F9470292A3019E6DDEE6BB5AC1249E88181E5F104F9F17E6633DFDCC8E4D61DC84B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kflink32.exe

Path C:\Windows\SysWOW64\Kflink32.exe
Size 429KB
SHA256 d10cb4b93a49ef7cab2d56b069ad3b606fac3a5d4c926d7ba723cb69c0eb7055
MD5 695633735c33d2911013feea4b261df5
SHA1 212f126c6e8dc38fd2cbda5b40241dfc1157b465
SHA512 5c35e0d3838e2d148e661b9cb83e877d80b950922800c89410d6ba00dadfca03c65c071f37daf19dad1ef26f012cc260d78a5e0a041dbc2f359e3f3a061a1146
SSDEEP 6144:8XURWp4V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:yb/NcZ7/N
TLSH
T112946F262A701AE6DDEE6BB5AC1249D88081E4B525F1F13F6623DFDDD8E4DA1CC05F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kllodfpd.exe

Path C:\Windows\SysWOW64\Kllodfpd.exe
Size 429KB
SHA256 f8c4a8c8291f7bb6fc8e3bec97434e4c4a76e49d359c770bbf986c05b909acce
MD5 803614a59afc9d69c13589f54310ba77
SHA1 dbc4a72d859960f4963a04032f574e27ea820dd9
SHA512 25d3a029bd3cf7bedc0468dd26b453d59b854817642f8922ba964538c3241174a359e87c0e57201fcdaea380e32ced11e4823bb3dc6ea34cdb95c0c6d13a8dc9
SSDEEP 6144:8PaAEjAjgzUq8V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:8Pagg4c/NcZ7/N
TLSH
T14C946F256A301AE6DDEE6BF5AC1249E88181E4B124F1F17E6633DFDCC9E8D61CC05B84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Knnhdied.exe

Path C:\Windows\SysWOW64\Knnhdied.exe
Size 429KB
SHA256 db33818ba81e056fe56c4ce88845e2b5ba9ff41e5d070dde5f0d70a16d3bc086
MD5 3fa1885520f836506435e873d49ec5d8
SHA1 ebefe6e96393febd9778da58e10f21ad0d0ccab8
SHA512 2dd6f364cea075d19d8679bd414cee9c9372c4a835f47c764f3bca90c7da2c9c16384584ad5f9bc7f4ba13d1943c833064b29e940b145d421ccaafd5666f33d2
SSDEEP 6144:wtsgu8EV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:Zgl/NcZ7/N
TLSH
T1959482652A7019E6DDEEABB9AC1249D88581E5F104F1F13E6633DFDEC8E5DA1CC04B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Knpeii32.exe

Path C:\Windows\SysWOW64\Knpeii32.exe
Size 429KB
SHA256 a50a2825e5346ec980d5e4ade130d8a08c937744c8bad638a23cf33f1091660f
MD5 54306dcf1834a865d56882e312de3d68
SHA1 28fe3e0ff1cb64031bb6488b93469b5810e261ce
SHA512 32c5eba3a857213c5c90e7988f8f966bc42abed4965d4de9324a0552ae437c9eb7caecd42fba15d4996751a7bd744c961ac21b3387e074596716ed4efa905734
SSDEEP 6144:xmgkzvV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:Ug9/NcZ7/N
TLSH
T1799460666A3019E5DEEE6BB5AC1249D88181E8B114F1F13E6733DFECC8E5DA5CC04B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lgpocm32.exe

Path C:\Windows\SysWOW64\Lgpocm32.exe
Size 429KB
SHA256 7b1880192b9092bb27ddcdd73499bba765c0d143b17c644830b28eed1c367386
MD5 b7adc2280c25a2857508ba8b1fc64e8e
SHA1 6ad9a2808020c6e7b9a7419dac24d9795c8ceae1
SHA512 322a6e2b0ff72169cf995e7a72500e3c520a698a0ca230f56649daab3cd3c16a2f936c5cbfc6a577574bfabd92d70670c466811e281669c9267ac7e03dc8585c
SSDEEP 6144:aT6t+J2GoV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:X+JN/NcZ7/N
TLSH
T1129450656A3019E5DDEE6FB5AC1249E88182E8B114F1F13E6A33DFDCC8E4D62CC45B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lmaafcml.exe

Path C:\Windows\SysWOW64\Lmaafcml.exe
Size 429KB
SHA256 457a896a3f9233df79b43d68be4c7010deef5c483b1233e3dc80697a38ff8026
MD5 a823ce9ca29ea238e03b4db4c6dd4efb
SHA1 99260ed2969a0c39e5e6c92b9acb959e2602b4ae
SHA512 eecea02f3de9a68ef6ab972825c9cbdb7d0641b48cacdbee15c6da510ef228a976709e6c38f0288d11c109ad76399a174864008900069d3ac74ed60268bfe0a1
SSDEEP 6144:VRb1DGjxNV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:VzGG/NcZ7/N
TLSH
T1819472666A301DE5DDEE6BB5AC124AD88182E5B104F2F13E6633DFDCD8E4D61CC04B89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mflbdibj.exe

Path C:\Windows\SysWOW64\Mflbdibj.exe
Size 429KB
SHA256 214541130deb60bc44b0457550de100bdd1b65794f12c1e7783a708d5ff1b06a
MD5 1a66a453c241c6718806733e8a9ba394
SHA1 9c7d28adc39cb5edc1072eec30776eb411aaf9af
SHA512 99e2560018f8b98d8dce0b32fd36209ab0f4defe4768118a2cef04c29292442bb6f503369e985c8b3cfa82d83a8f4a1cd5e85381c3c910ee1c5bd687fffc8dfc
SSDEEP 6144:mNrwcEZV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:/cz/NcZ7/N
TLSH
T17F94516526302AE9DDEE6BF5AC1249D88281E6B114F2F53E5633DFDCC8E4D62DC04B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mqafbaap.exe

Path C:\Windows\SysWOW64\Mqafbaap.exe
Size 429KB
SHA256 b6559b9775e7a3b1e42408a2ebb25e807d929986043f3affbddc378cf954b20a
MD5 902273ac1da17abf36444f4bdc6ce5cc
SHA1 4e9203f7d1039571d102ab3fcf0462fc5f2c25bf
SHA512 1c8da98a93d95c1b58aa951cbac8b35b4ed430a4f531098997934bdfb16d90785d630a22a920fdc51d836e9916cb4e00730f000b7672efd195fa8d25b06cb036
SSDEEP 6144:tHsf5+/LWWv+luoiHiV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:tX/LW6+luoiX/NcZ7/N
TLSH
T1FC945FA52A302AE5DDEE6FB5AC5259D88181E4B114F1F53E6623DFDCC8E4DA2CC04F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mqhmbqlh.exe

Path C:\Windows\SysWOW64\Mqhmbqlh.exe
Size 429KB
SHA256 301e0889453fd7ae2f2e6b0dbd6cd25b1a29d9dd664c97cfde4212f188523cee
MD5 b5638cb3ab22086241589678dce74abb
SHA1 a6403e3151979923f33783c47d1c5dca361b2e6e
SHA512 35c6e6e8d5e68785a1f903a49eeed52d327e476a48a8250358b6f580a1294ef34397abb773a1d33b168499bf30ac9e595d6b1e91bae380987c7ed6a01fe2c08b
SSDEEP 6144:MTTBaV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:ITp/NcZ7/N
TLSH
T1EC9491652A3419EADDEE6BB5AC1249E88181F4B154F1F17E6A33DFDCC8E4DA1DC04B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nclbjk32.exe

Path C:\Windows\SysWOW64\Nclbjk32.exe
Size 429KB
SHA256 4a0d78efd5050c2a7691ae55921f37258945f65d7ab820ab726c2fcbd689f54d
MD5 0e1bb0583ad61fff2b1a8a23db73713c
SHA1 2840dbaf7a706ab8ef5c16c3fb7138f2a01330cd
SHA512 ec7c7c3e8f63f286711f32e6df497c23e855befbb50b3d7266c8297380f1c011c7c093e7640f11dc773b30ea4c8e7344d946a0ae10b67e16681d707685dcdde4
SSDEEP 6144:Na3stpJlxOG/UV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:U3sIQ/NcZ7/N
TLSH
T1539491293A3019E6DDEE6BB5AC1249D98181E9B105F1F13E6633DFDDC9E4DA1CC08B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nfohafad.exe

Path C:\Windows\SysWOW64\Nfohafad.exe
Size 429KB
SHA256 7b2563fc074740e047c05cc3e6ebeb9c9215295e449e5d30b48c3ab95cf3a5f6
MD5 17f52c3b82def8fa6f446aa1fb8450b5
SHA1 f2c3f2c8165be0837fe8f81c49358c2eff52b052
SHA512 f3eefa52428d62c9884435ae27f1fc0db74d2314e81227e5638c34267f258aeeddded5f9f7c30e2b8f2ceb003bcf4868cd0dd9fd958a350c7adad625060947a3
SSDEEP 6144:Gp4woviMqN4V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:G7BMk/NcZ7/N
TLSH
T17B946F266A3019E6DDEE6BB5BC1249E88181E5B154F1F13E6633DFDCD8E4DA2CD04B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Njaakf32.exe

Path C:\Windows\SysWOW64\Njaakf32.exe
Size 429KB
SHA256 598d1d59e5f9501dfb149dbacbc340b68611f9a7b8616339af8373cb1f0f48a0
MD5 2737a6a7a25ba708a0308aabfa603ea2
SHA1 c85d8361f829fa0ea7664662bc065b40e23c0ba0
SHA512 1ebb922f408fd89bdb64d8de3a5daed14085d3ba5212a20b7762963c6314318e8f3a285f1e97d487946a694074945d6699e42b5a88456da2186c320e252e1eeb
SSDEEP 6144:+/gswK5LWNkV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:+/gswK5qv/NcZ7/N
TLSH
T1D6947225663829E9DDEEABB5AC1259D89181E5B108F1F13E5637DFDCC8E4EA1CC04F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nnafgd32.exe

Path C:\Windows\SysWOW64\Nnafgd32.exe
Size 429KB
SHA256 ac8b9aa45594439e7724a285021c3e630e781d04302b5dc21b420c170b3ab95b
MD5 ff5ce8b4c9fb556c5becbcf117939816
SHA1 81a517f399dc1d3d3f5ae20858fd5650e384b9ac
SHA512 d4a4f4da6746efe9f199ce3aa9cacc8722f9f095bffa658bd1f7c456c39b1f5c351f5f5e54e027782851ce455e2ae7449734c9c9129efa64a844ceafc1b68d0e
SSDEEP 6144:4Kk7foJV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:Hof3/NcZ7/N
TLSH
T17B9480256A381DE6DDEE6BB5AC1249D88181E9B114F1F17E6633DFDCC9E4DA2CC04B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Npgmjl32.exe

Path C:\Windows\SysWOW64\Npgmjl32.exe
Size 429KB
SHA256 d94ebcde0ca431bd6c4f3e78f9e5893144f2a2456cd8423073e141116550d71b
MD5 d49bc78a29551db1df96dc7822d4f664
SHA1 c8a1ed233c8ea1f745467e02f2316fbed297993c
SHA512 90514203be4664ac1584c6165845f2b8fbd26434ea4a9fdb8a18105759b66e7942a762c5ab92729c15124acddffd484dfbaed5e06d3233d4b5fa95f21d881952
SSDEEP 6144:Z0sVwHJGoBV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:mHpy/NcZ7/N
TLSH
T1E09471262A3019E5DEEE6BB5AC1249D88181E5F115F1F1BEA637DFDCC8E4D62CD04B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ofhkgeij.exe

Path C:\Windows\SysWOW64\Ofhkgeij.exe
Size 429KB
SHA256 50b3e4579d4ca19deb7f818acf49bc4a7d4e24900ef556586d4fc7c1d1063998
MD5 9a79934ba8be0cd53c03933da139d979
SHA1 44e1a684ec7a7ccc2317d2bf37899ed937592eb8
SHA512 7cadbc73f77a60f0ea6e68abaa1f62ea7e5e2a698f22b703b99cfd56ed608b47004c931cc01ceebbde529a073c753d684c8e046a0129382349b5aeec77963ff8
SSDEEP 6144:4cKGGfTGSV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:NKGG7u/NcZ7/N
TLSH
T1B89471A5263119E5DEEE6BB5AC5249D88185E4B014F1F13EA633DFECC9E4DA6CC04F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ogcnfheb.exe

Path C:\Windows\SysWOW64\Ogcnfheb.exe
Size 429KB
SHA256 6db316171768180bebe1a7db9ee2ba42ebb6443305c8685d89f6c826e16cb167
MD5 1a8022d7d9ae94292a0beba0ecea4b83
SHA1 6cf18cee93d288b8e054977d5309ee595879ffda
SHA512 ed78a11f76533d015ec988dc2a8906dea965e29cc4346f2231df73ae1b265493312212c454941557983eadec10268db6851be3e590c4fb9c9806a1d247fa8e47
SSDEEP 6144:la8y4prV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:Y8T4/NcZ7/N
TLSH
T1B1944E656A301DEADDEE6BB5AC1249E98181E4B114F1F13E66339FDCC8E4DB6CC04B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pdqelh32.exe

Path C:\Windows\SysWOW64\Pdqelh32.exe
Size 429KB
SHA256 2599f25594121db7baa23c335b1f86f42d173e088d0210ad276eea37bd985220
MD5 1688a89fdf947f9d686b03a4628b7db7
SHA1 18310fc1cf843178bfd0facc13202cdcc30a1409
SHA512 17c60c925616325d73ef680763ba064491e0cd7a790bedce4985c57d816b3193882a987b9ff5e9f37308a60a6c5db10515f1eb552e7c494ff290c2754cf0df3e
SSDEEP 6144:wApXe5V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:/X/NcZ7/N
TLSH
T19C944F65663019E6DDEE6BB5AC1289D88182E8F114F1F53F6633DFDCC8E4DA6D804B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pfanmcao.exe

Path C:\Windows\SysWOW64\Pfanmcao.exe
Size 429KB
SHA256 3f742ad32d25e62eb3bfcbf731006fa7a85d5dac85f4a114c151b6abcddcf602
MD5 1e92a172e38c8f3cd99541dd9e924906
SHA1 df2aeaa1a6cb54b760d9b57533351784a69ca8dc
SHA512 a0962d917698a2f468e749fbbd0693cd99a8a24be9859411f25c7ae3896fd8504fb21951f48d4900166d6c770c748ce210a37941268fe7f52c1601a8ea2115d7
SSDEEP 6144:aBm3GrBlvtV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:aBRtlo/NcZ7/N
TLSH
T15C947F252A301DE6DDEE6BB1AC0289D89681E4B514F1F13E6673DFDCC8E5D62DC48B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pffghc32.exe

Path C:\Windows\SysWOW64\Pffghc32.exe
Size 429KB
SHA256 4bedec238c9ad80f8feb18721d784d1ed2dfecf1cdc77794e0553756539df9e2
MD5 7c6ac7ae7993e62ff28f5b5072174e99
SHA1 cb08992aaf2942ecfab0c3361da9fc27e1b48711
SHA512 9785710de6fa2301fc6a3c7602b44bdfe69f442bd32640b6bc432d0ea7368d82ebacf6c710d64a291d7ec99af878b880897616bd27f43e403e42c55c4b866133
SSDEEP 6144:mdLEzieL0Z9V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:mdLEueL0e/NcZ7/N
TLSH
T19D9493256A3459E9DDEE6BB5AC124ED98082E4B504F1F13E6633DFECC8E5DA1CC04B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pmiidnko.exe

Path C:\Windows\SysWOW64\Pmiidnko.exe
Size 429KB
SHA256 ecd891ff8c3cdffc13f3aca3e30606a766536b01998b7e8ff5943654325c8e29
MD5 1db85079054801b50a46dec9ae06d660
SHA1 acd6d6eb6df5e9bd9b0125365f2046f02726170b
SHA512 81a84e03fea6403a356470ca4e12298c57d5c7abad41fadd315c3ecbd7ceb6f362a603f09e209244b1645a3b75e19c9411d9e7d5009193b0f21889112cb6ec3b
SSDEEP 6144:EOZa33qkpRV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:EP3qkK/NcZ7/N
TLSH
T12694836566301EE5DDEE6BB5AC5289D88181E5B114F1F23E5633DFDCC8E8E62EC04B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ppclej32.exe

Path C:\Windows\SysWOW64\Ppclej32.exe
Size 429KB
SHA256 7098d306d4d3b1cb0dc404aca8d3c32c767abb5939828f7d2b1d33df2b6f351b
MD5 50fbaeb8adc5efea0f1d3d9b5786d380
SHA1 ea0f49b2d7d5f01ee8e220fb59e7b4176c8b53a5
SHA512 d44c9106027bd3e8fd50dd6c543d6d1e250e3b96db08384401c4a9c2924e2c08e3d667f40c63355d02b0a5e045d9b0d78e11a69c0593ef24406ffe5e8ab3033e
SSDEEP 6144:ISlNHVCV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:ISl5R/NcZ7/N
TLSH
T1909460252A701AE6DDEE6BB9AC1249D88181E4B154F1F13F6623DFDDC9E4DA1CC48F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qjdpoacp.exe

Path C:\Windows\SysWOW64\Qjdpoacp.exe
Size 429KB
SHA256 be759eef13a1ca7d4147f51d15eca6b1122286a962d148d6716357042cb05034
MD5 fb29f3ce8a4eb8b3c3ac6b5ce3a20f60
SHA1 c91ed583ef6fc26a4a338fefe7e98b6e0b75a7c9
SHA512 7894529285de4cd263596db5d7c688fd60d2e9e0842eb4f6bdc34be762940f54fedf5a64a1c6c09467a689763540723232661f879cdfea49fdda238a577f4c64
SSDEEP 6144:XFDNJoWv92YLqDV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:VDsYD/NcZ7/N
TLSH
T1C5945F656A3019E9DDEE6BF6AC2249D881C1E5B114F2F23E6633DFDCC8E4D65C804B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qjfmda32.exe

Path C:\Windows\SysWOW64\Qjfmda32.exe
Size 429KB
SHA256 da746c0ff57561414510c300fc2341653cd44ed445f0ad3a82cb42075708d544
MD5 a1fd20d5ff5ce00678e54ce480d259e3
SHA1 0dc31a4dc51163e5d8baed3bac939be2ae001730
SHA512 9cdfc27d46b5de0fe5a2d049f0801af5b4190da043ffbbeeb80b74ac0ef9346bdbdbfefc37fb5af6d3b994250250e88ef84b9738635d89c0c953bdf9caac01a0
SSDEEP 6144:jXXXBSZzVV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:jHd/NcZ7/N
TLSH
T1309481666A311EE6DDEE6BB5AC1249D89081E9B104F1F13E6637DFDCC8E4DA1CC04B84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qpahghbg.exe

Path C:\Windows\SysWOW64\Qpahghbg.exe
Size 429KB
SHA256 3849aa2714ce232c22987578ec680929c19a21e8f669604ba21b2765d26e8bf8
MD5 365acb877a340197415687d091ed712e
SHA1 467b0d76eef5e6b7f3c91a167c7f26d23531fdcd
SHA512 e1e5ef3753fa353b452c406fa75bc4d98350171b02d25b14faff04ac4ab1fcc073b36806e60b85c643bf79c672680da87d65ae726e470321f73489c0606a3054
SSDEEP 6144:J4LxNV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:u2/NcZ7/N
TLSH
T141949229763019E5EDEE6BB5AC1249D98282E4B104F1F57E6633EFDCC8E4D62DC44B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qpolahdj.exe

Path C:\Windows\SysWOW64\Qpolahdj.exe
Size 429KB
SHA256 784f623d4d5beece60da8bd70466f9866f76777b7a2eb434f2d642e20a1bb8a3
MD5 541443eecc2e90a82c3dcaaff5b00088
SHA1 883bd1b6587088355426641d125aa58dbadbc748
SHA512 d537472e0f0b74f6e6b9fd40e2613c3c6fe28bd1575af12ce9737b4ab70e3e393e191cb0d302510fc20e58b149515804c5306e1a5f19f9eba39bf8393b956137
SSDEEP 6144:kAb9ovMjUHdV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:/9oEjh/NcZ7/N
TLSH
T13F9481656A701DE6DEEE6BB5AC1249D88185E8B124F1F13E6633DFDCC8E4DA1CC04B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/204-285-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/476-147-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/812-480-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/872-91-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1144-217-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1148-340-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1204-42-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1204-506-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1256-461-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1320-126-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1480-255-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1508-320-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1608-305-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1652-415-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1732-189-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1752-211-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1784-63-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1836-486-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1836-21-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1936-445-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2024-390-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2092-224-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2244-265-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2304-395-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2388-440-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2524-182-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2664-84-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2740-98-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2788-410-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2872-196-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2904-479-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2904-14-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2984-335-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3136-420-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3320-56-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3380-112-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3392-325-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3396-513-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3492-380-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3496-168-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3512-161-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3520-435-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3544-492-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3624-300-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3656-310-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3836-275-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3936-260-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3984-355-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3988-140-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4016-245-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4020-400-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4244-385-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4328-370-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4352-240-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4420-252-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4508-154-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4596-345-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4628-295-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4656-280-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4668-507-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4720-77-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4756-450-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4784-235-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4868-360-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4872-455-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4884-350-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4984-105-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5012-330-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5096-290-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5100-405-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5104-375-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5112-119-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5256-49-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5256-512-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5348-175-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5420-499-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5444-28-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5444-491-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5456-428-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5576-230-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5644-203-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5676-7-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5676-472-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5708-430-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5808-133-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5840-270-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5872-315-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5924-35-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5924-498-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5944-71-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5972-460-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5972-1-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/5972-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5992-474-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6028-467-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6036-365-0x0000000000400000-0x000000000046D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads