berbew | 2b869ce1c9917c0781d2ce4132149aa7d190390007d9e0dc83601272c6384b1d

Analysis

max time kernel
149s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/04/2026, 01:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-26_9bae726fc222d8e8d8ab0ab8456b4814_elex_wannacry.exe
Size 320KB
Sample260426-begetsbx5v
SHA256 2b869ce1c9917c0781d2ce4132149aa7d190390007d9e0dc83601272c6384b1d
MD5 9bae726fc222d8e8d8ab0ab8456b4814
SHA1 88431039d70953e84d2d3729bcb86961d896b0b2
SHA512 c1266a6c4642c37d6eafc3f0b49228d20dd9bc40c88ebd6696b0a3e3888f9591891ea91722313294cd54155515dd93cbd3e79cce1628b17f4137108c031c945b
SSDEEP 3072:KovzNeF6PFFbzwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:nvzvFbzV/Ah1G/AcQ///NR5fn
TLSH
T15B641D192A3409EADEED1BB5AC1249D99142F9F018F1E23E6123DFDCD8E4DA6C815FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Khdoqefq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbjbnnfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Khihld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klddlckd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdpiqehp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lbqinm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldbefe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbcedmnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdkoef32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kahinkaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kalcik32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kopcbo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbqinm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lbcedmnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lknjhokg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lahbei32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjkdlall.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdffjgpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kblpcndd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kocphojh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kemhei32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbebilli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Llngbabj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	2026-04-26_9bae726fc222d8e8d8ab0ab8456b4814_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jacpcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbbmmo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Khfkfedn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kkegbpca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lahbei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lkqgno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lefkkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Khabke32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkegbpca.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kejloi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lddble32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llngbabj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Khabke32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdmlkfjb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lddble32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llkjmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lbebilli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lbhool32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdffjgpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kkbkmqed.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkgdhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdpiqehp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkqgno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jjkdlall.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kaaldjil.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llimgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lefkkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	2026-04-26_9bae726fc222d8e8d8ab0ab8456b4814_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klpjad32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkbkmqed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klddlckd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kahinkaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klpjad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Khfkfedn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lkiamp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Laffpi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdkoef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdmlkfjb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkiamp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Llimgb32.exe

Executes dropped EXE 47 IoCs

pid	Process
4856	Jacpcl32.exe
3224	Jjkdlall.exe
4228	Jbbmmo32.exe
2144	Kahinkaf.exe
4956	Kdffjgpj.exe
2036	Khabke32.exe
516	Kkpnga32.exe
992	Khdoqefq.exe
2100	Klpjad32.exe
2996	Kkbkmqed.exe
700	Kbjbnnfg.exe
2992	Kalcik32.exe
220	Kdkoef32.exe
2120	Khfkfedn.exe
4344	Kkegbpca.exe
3048	Kopcbo32.exe
2320	Kblpcndd.exe
2304	Kaopoj32.exe
1396	Kejloi32.exe
4592	Kdmlkfjb.exe
4224	Khihld32.exe
1708	Klddlckd.exe
1016	Kkgdhp32.exe
4724	Kocphojh.exe
4704	Kaaldjil.exe
3880	Kemhei32.exe
1492	Kdpiqehp.exe
3932	Klgqabib.exe
4604	Lkiamp32.exe
4548	Lbqinm32.exe
2516	Leoejh32.exe
852	Ldbefe32.exe
2800	Llimgb32.exe
4836	Lklnconj.exe
4452	Lbcedmnl.exe
3812	Laffpi32.exe
1028	Lddble32.exe
4356	Llkjmb32.exe
3816	Lknjhokg.exe
2208	Lbebilli.exe
4624	Lahbei32.exe
4112	Ldfoad32.exe
2292	Llngbabj.exe
5000	Lkqgno32.exe
3252	Lbhool32.exe
3988	Lefkkg32.exe
3888	Ldikgdpe.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Cboleq32.dll	Kalcik32.exe
File created	C:\Windows\SysWOW64\Fbkcnp32.dll	Kejloi32.exe
File created	C:\Windows\SysWOW64\Llngbabj.exe	Ldfoad32.exe
File created	C:\Windows\SysWOW64\Olkpol32.dll	Lbhool32.exe
File created	C:\Windows\SysWOW64\Kocphojh.exe	Kkgdhp32.exe
File created	C:\Windows\SysWOW64\Kemhei32.exe	Kaaldjil.exe
File opened for modification	C:\Windows\SysWOW64\Kdpiqehp.exe	Kemhei32.exe
File created	C:\Windows\SysWOW64\Acibndof.dll	Kdpiqehp.exe
File opened for modification	C:\Windows\SysWOW64\Ldbefe32.exe	Leoejh32.exe
File created	C:\Windows\SysWOW64\Llkjmb32.exe	Lddble32.exe
File created	C:\Windows\SysWOW64\Lkqgno32.exe	Llngbabj.exe
File created	C:\Windows\SysWOW64\Ljnakk32.dll	Jbbmmo32.exe
File opened for modification	C:\Windows\SysWOW64\Lbqinm32.exe	Lkiamp32.exe
File created	C:\Windows\SysWOW64\Lbcedmnl.exe	Lklnconj.exe
File created	C:\Windows\SysWOW64\Elmoqj32.dll	2026-04-26_9bae726fc222d8e8d8ab0ab8456b4814_elex_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\Kbjbnnfg.exe	Kkbkmqed.exe
File created	C:\Windows\SysWOW64\Japjfm32.dll	Kkbkmqed.exe
File opened for modification	C:\Windows\SysWOW64\Kalcik32.exe	Kbjbnnfg.exe
File opened for modification	C:\Windows\SysWOW64\Kaopoj32.exe	Kblpcndd.exe
File created	C:\Windows\SysWOW64\Kkgdhp32.exe	Klddlckd.exe
File created	C:\Windows\SysWOW64\Lklnconj.exe	Llimgb32.exe
File created	C:\Windows\SysWOW64\Kkegbpca.exe	Khfkfedn.exe
File created	C:\Windows\SysWOW64\Hnggccfl.dll	Lklnconj.exe
File opened for modification	C:\Windows\SysWOW64\Kocphojh.exe	Kkgdhp32.exe
File created	C:\Windows\SysWOW64\Kdpiqehp.exe	Kemhei32.exe
File created	C:\Windows\SysWOW64\Cjbdmo32.dll	Ldbefe32.exe
File created	C:\Windows\SysWOW64\Lddble32.exe	Laffpi32.exe
File created	C:\Windows\SysWOW64\Jjkdlall.exe	Jacpcl32.exe
File created	C:\Windows\SysWOW64\Kahinkaf.exe	Jbbmmo32.exe
File created	C:\Windows\SysWOW64\Kaopoj32.exe	Kblpcndd.exe
File opened for modification	C:\Windows\SysWOW64\Kaaldjil.exe	Kocphojh.exe
File created	C:\Windows\SysWOW64\Najlgpeb.dll	Llkjmb32.exe
File created	C:\Windows\SysWOW64\Jacpcl32.exe	2026-04-26_9bae726fc222d8e8d8ab0ab8456b4814_elex_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\Kejloi32.exe	Kaopoj32.exe
File created	C:\Windows\SysWOW64\Kdmlkfjb.exe	Kejloi32.exe
File opened for modification	C:\Windows\SysWOW64\Lkiamp32.exe	Klgqabib.exe
File created	C:\Windows\SysWOW64\Leoejh32.exe	Lbqinm32.exe
File created	C:\Windows\SysWOW64\Lahbei32.exe	Lbebilli.exe
File created	C:\Windows\SysWOW64\Okahhpqj.dll	Lahbei32.exe
File created	C:\Windows\SysWOW64\Bekdaogi.dll	Lefkkg32.exe
File created	C:\Windows\SysWOW64\Khecje32.dll	Kdffjgpj.exe
File created	C:\Windows\SysWOW64\Lamgof32.dll	Kopcbo32.exe
File created	C:\Windows\SysWOW64\Lkiamp32.exe	Klgqabib.exe
File opened for modification	C:\Windows\SysWOW64\Jacpcl32.exe	2026-04-26_9bae726fc222d8e8d8ab0ab8456b4814_elex_wannacry.exe
File created	C:\Windows\SysWOW64\Khdoqefq.exe	Kkpnga32.exe
File opened for modification	C:\Windows\SysWOW64\Kkegbpca.exe	Khfkfedn.exe
File created	C:\Windows\SysWOW64\Bfdkqcmb.dll	Kaaldjil.exe
File created	C:\Windows\SysWOW64\Mobpnd32.dll	Kdkoef32.exe
File opened for modification	C:\Windows\SysWOW64\Kblpcndd.exe	Kopcbo32.exe
File opened for modification	C:\Windows\SysWOW64\Lbhool32.exe	Lkqgno32.exe
File created	C:\Windows\SysWOW64\Gpejnp32.dll	Jjkdlall.exe
File opened for modification	C:\Windows\SysWOW64\Kkgdhp32.exe	Klddlckd.exe
File created	C:\Windows\SysWOW64\Jhmimi32.dll	Leoejh32.exe
File opened for modification	C:\Windows\SysWOW64\Llkjmb32.exe	Lddble32.exe
File opened for modification	C:\Windows\SysWOW64\Kkbkmqed.exe	Klpjad32.exe
File created	C:\Windows\SysWOW64\Pmbpeafn.dll	Kbjbnnfg.exe
File created	C:\Windows\SysWOW64\Klddlckd.exe	Khihld32.exe
File opened for modification	C:\Windows\SysWOW64\Llimgb32.exe	Ldbefe32.exe
File created	C:\Windows\SysWOW64\Jjmannfj.dll	Jacpcl32.exe
File opened for modification	C:\Windows\SysWOW64\Kopcbo32.exe	Kkegbpca.exe
File created	C:\Windows\SysWOW64\Ehilac32.dll	Kdmlkfjb.exe
File created	C:\Windows\SysWOW64\Kaaldjil.exe	Kocphojh.exe
File created	C:\Windows\SysWOW64\Bkclkjqn.dll	Laffpi32.exe
File opened for modification	C:\Windows\SysWOW64\Kdffjgpj.exe	Kahinkaf.exe

Program crash 1 IoCs

pid	pid_target	Process
3800	3888	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 48 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldikgdpe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbjbnnfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kocphojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdpiqehp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klgqabib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llkjmb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jacpcl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kkpnga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lkiamp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldbefe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llimgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lahbei32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llngbabj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdffjgpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khfkfedn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jbbmmo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kahinkaf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kblpcndd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kaopoj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kkgdhp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lklnconj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lknjhokg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khdoqefq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kkbkmqed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kkegbpca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kejloi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khihld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kemhei32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbcedmnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lddble32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-26_9bae726fc222d8e8d8ab0ab8456b4814_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jjkdlall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khabke32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klddlckd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldfoad32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lkqgno32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lefkkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klpjad32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kalcik32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdkoef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdmlkfjb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbqinm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Leoejh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Laffpi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kopcbo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kaaldjil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbebilli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbhool32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kemhei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kdpiqehp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpjkgoka.dll"	Lkiamp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kkegbpca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kopcbo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kaaldjil.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ldbefe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Llimgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lahbei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elmoqj32.dll"	2026-04-26_9bae726fc222d8e8d8ab0ab8456b4814_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kblpcndd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kaopoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ichnpf32.dll"	Lbqinm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Leoejh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Najlgpeb.dll"	Llkjmb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Khfkfedn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aomqdipk.dll"	Kblpcndd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmfchehg.dll"	Ldfoad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lbhool32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Acibndof.dll"	Kdpiqehp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjmannfj.dll"	Jacpcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjlhjjnc.dll"	Kkpnga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Khihld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkjbah32.dll"	Kkgdhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eqfnqg32.dll"	Kocphojh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Llfgke32.dll"	Kkegbpca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epqblnhh.dll"	Kemhei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lkiamp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lknjhokg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lkqgno32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lbhool32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Japjfm32.dll"	Kkbkmqed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lamgof32.dll"	Kopcbo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Klgqabib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgcnomaa.dll"	Lbcedmnl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lbebilli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfeliqka.dll"	Lbebilli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jbbmmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jbbmmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Khdoqefq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kocphojh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjbdmo32.dll"	Ldbefe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmbpeafn.dll"	Kbjbnnfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kalcik32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofnfbijk.dll"	Khihld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfdkqcmb.dll"	Kaaldjil.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lbcedmnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhjaco32.dll"	Lkqgno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kkpnga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kopcbo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qekjhmdj.dll"	Kaopoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kdmlkfjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcnhog32.dll"	Klgqabib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfdklc32.dll"	Llimgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkclkjqn.dll"	Laffpi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Laffpi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anjkcakk.dll"	Klpjad32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kkbkmqed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnggccfl.dll"	Lklnconj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ldfoad32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	2026-04-26_9bae726fc222d8e8d8ab0ab8456b4814_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jacpcl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kdpiqehp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lefkkg32.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 3984 wrote to memory of 4856	3984	2026-04-26_9bae726fc222d8e8d8ab0ab8456b4814_elex_wannacry.exe	86
PID 4856 wrote to memory of 3224	4856	Jacpcl32.exe	87
PID 3224 wrote to memory of 4228	3224	Jjkdlall.exe	88
PID 4228 wrote to memory of 2144	4228	Jbbmmo32.exe	89
PID 2144 wrote to memory of 4956	2144	Kahinkaf.exe	90
PID 4956 wrote to memory of 2036	4956	Kdffjgpj.exe	91
PID 2036 wrote to memory of 516	2036	Khabke32.exe	92
PID 516 wrote to memory of 992	516	Kkpnga32.exe	93
PID 992 wrote to memory of 2100	992	Khdoqefq.exe	94
PID 2100 wrote to memory of 2996	2100	Klpjad32.exe	95
PID 2996 wrote to memory of 700	2996	Kkbkmqed.exe	96
PID 700 wrote to memory of 2992	700	Kbjbnnfg.exe	97
PID 2992 wrote to memory of 220	2992	Kalcik32.exe	98
PID 220 wrote to memory of 2120	220	Kdkoef32.exe	99
PID 2120 wrote to memory of 4344	2120	Khfkfedn.exe	100
PID 4344 wrote to memory of 3048	4344	Kkegbpca.exe	101
PID 3048 wrote to memory of 2320	3048	Kopcbo32.exe	102
PID 2320 wrote to memory of 2304	2320	Kblpcndd.exe	103
PID 2304 wrote to memory of 1396	2304	Kaopoj32.exe	104
PID 1396 wrote to memory of 4592	1396	Kejloi32.exe	105
PID 4592 wrote to memory of 4224	4592	Kdmlkfjb.exe	106
PID 4224 wrote to memory of 1708	4224	Khihld32.exe	107
PID 1708 wrote to memory of 1016	1708	Klddlckd.exe	108
PID 1016 wrote to memory of 4724	1016	Kkgdhp32.exe	109
PID 4724 wrote to memory of 4704	4724	Kocphojh.exe	110
PID 4704 wrote to memory of 3880	4704	Kaaldjil.exe	111
PID 3880 wrote to memory of 1492	3880	Kemhei32.exe	112
PID 1492 wrote to memory of 3932	1492	Kdpiqehp.exe	113
PID 3932 wrote to memory of 4604	3932	Klgqabib.exe	114
PID 4604 wrote to memory of 4548	4604	Lkiamp32.exe	115
PID 4548 wrote to memory of 2516	4548	Lbqinm32.exe	116
PID 2516 wrote to memory of 852	2516	Leoejh32.exe	117
PID 852 wrote to memory of 2800	852	Ldbefe32.exe	118
PID 2800 wrote to memory of 4836	2800	Llimgb32.exe	119
PID 4836 wrote to memory of 4452	4836	Lklnconj.exe	120
PID 4452 wrote to memory of 3812	4452	Lbcedmnl.exe	121
PID 3812 wrote to memory of 1028	3812	Laffpi32.exe	122
PID 1028 wrote to memory of 4356	1028	Lddble32.exe	123
PID 4356 wrote to memory of 3816	4356	Llkjmb32.exe	124
PID 3816 wrote to memory of 2208	3816	Lknjhokg.exe	125
PID 2208 wrote to memory of 4624	2208	Lbebilli.exe	126
PID 4624 wrote to memory of 4112	4624	Lahbei32.exe	127
PID 4112 wrote to memory of 2292	4112	Ldfoad32.exe	128
PID 2292 wrote to memory of 5000	2292	Llngbabj.exe	129
PID 5000 wrote to memory of 3252	5000	Lkqgno32.exe	130
PID 3252 wrote to memory of 3988	3252	Lbhool32.exe	131
PID 3988 wrote to memory of 3888	3988	Lefkkg32.exe	132

C:\Users\Admin\AppData\Local\Temp\2026-04-26_9bae726fc222d8e8d8ab0ab8456b4814_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-26_9bae726fc222d8e8d8ab0ab8456b4814_elex_wannacry.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Windows\SysWOW64\Jacpcl32.exe
  C:\Windows\system32\Jacpcl32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Windows\SysWOW64\Jjkdlall.exe
    C:\Windows\system32\Jjkdlall.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3224
  - - C:\Windows\SysWOW64\Jbbmmo32.exe
      C:\Windows\system32\Jbbmmo32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4228
    - - C:\Windows\SysWOW64\Kahinkaf.exe
        
        C:\Windows\system32\Kahinkaf.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2144
      - C:\Windows\SysWOW64\Kdffjgpj.exe
        
        C:\Windows\system32\Kdffjgpj.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4956
        
        C:\Windows\SysWOW64\Khabke32.exe
        
        C:\Windows\system32\Khabke32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2036
        
        C:\Windows\SysWOW64\Kkpnga32.exe
        
        C:\Windows\system32\Kkpnga32.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:516
        
        C:\Windows\SysWOW64\Khdoqefq.exe
        
        C:\Windows\system32\Khdoqefq.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:992
        
        C:\Windows\SysWOW64\Klpjad32.exe
        
        C:\Windows\system32\Klpjad32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2100
        
        C:\Windows\SysWOW64\Kkbkmqed.exe
        
        C:\Windows\system32\Kkbkmqed.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2996
        
        C:\Windows\SysWOW64\Kbjbnnfg.exe
        
        C:\Windows\system32\Kbjbnnfg.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:700
        
        C:\Windows\SysWOW64\Kalcik32.exe
        
        C:\Windows\system32\Kalcik32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2992
        
        C:\Windows\SysWOW64\Kdkoef32.exe
        
        C:\Windows\system32\Kdkoef32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:220
        
        C:\Windows\SysWOW64\Khfkfedn.exe
        
        C:\Windows\system32\Khfkfedn.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2120
        
        C:\Windows\SysWOW64\Kkegbpca.exe
        
        C:\Windows\system32\Kkegbpca.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4344
        
        C:\Windows\SysWOW64\Kopcbo32.exe
        
        C:\Windows\system32\Kopcbo32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3048
        
        C:\Windows\SysWOW64\Kblpcndd.exe
        
        C:\Windows\system32\Kblpcndd.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2320
        
        C:\Windows\SysWOW64\Kaopoj32.exe
        
        C:\Windows\system32\Kaopoj32.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2304
        
        C:\Windows\SysWOW64\Kejloi32.exe
        
        C:\Windows\system32\Kejloi32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1396
        
        C:\Windows\SysWOW64\Kdmlkfjb.exe
        
        C:\Windows\system32\Kdmlkfjb.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4592
        
        C:\Windows\SysWOW64\Khihld32.exe
        
        C:\Windows\system32\Khihld32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4224
        
        C:\Windows\SysWOW64\Klddlckd.exe
        
        C:\Windows\system32\Klddlckd.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1708
        
        C:\Windows\SysWOW64\Kkgdhp32.exe
        
        C:\Windows\system32\Kkgdhp32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1016
        
        C:\Windows\SysWOW64\Kocphojh.exe
        
        C:\Windows\system32\Kocphojh.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4724
        
        C:\Windows\SysWOW64\Kaaldjil.exe
        
        C:\Windows\system32\Kaaldjil.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4704
        
        C:\Windows\SysWOW64\Kemhei32.exe
        
        C:\Windows\system32\Kemhei32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3880
        
        C:\Windows\SysWOW64\Kdpiqehp.exe
        
        C:\Windows\system32\Kdpiqehp.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1492
        
        C:\Windows\SysWOW64\Klgqabib.exe
        
        C:\Windows\system32\Klgqabib.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3932
        
        C:\Windows\SysWOW64\Lkiamp32.exe
        
        C:\Windows\system32\Lkiamp32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4604
        
        C:\Windows\SysWOW64\Lbqinm32.exe
        
        C:\Windows\system32\Lbqinm32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4548
        
        C:\Windows\SysWOW64\Leoejh32.exe
        
        C:\Windows\system32\Leoejh32.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2516
        
        C:\Windows\SysWOW64\Ldbefe32.exe
        
        C:\Windows\system32\Ldbefe32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:852
        
        C:\Windows\SysWOW64\Llimgb32.exe
        
        C:\Windows\system32\Llimgb32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2800
        
        C:\Windows\SysWOW64\Lklnconj.exe
        
        C:\Windows\system32\Lklnconj.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4836
        
        C:\Windows\SysWOW64\Lbcedmnl.exe
        
        C:\Windows\system32\Lbcedmnl.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4452
        
        C:\Windows\SysWOW64\Laffpi32.exe
        
        C:\Windows\system32\Laffpi32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3812
        
        C:\Windows\SysWOW64\Lddble32.exe
        
        C:\Windows\system32\Lddble32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1028
        
        C:\Windows\SysWOW64\Llkjmb32.exe
        
        C:\Windows\system32\Llkjmb32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4356
        
        C:\Windows\SysWOW64\Lknjhokg.exe
        
        C:\Windows\system32\Lknjhokg.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3816
        
        C:\Windows\SysWOW64\Lbebilli.exe
        
        C:\Windows\system32\Lbebilli.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2208
        
        C:\Windows\SysWOW64\Lahbei32.exe
        
        C:\Windows\system32\Lahbei32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4624
        
        C:\Windows\SysWOW64\Ldfoad32.exe
        
        C:\Windows\system32\Ldfoad32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4112
        
        C:\Windows\SysWOW64\Llngbabj.exe
        
        C:\Windows\system32\Llngbabj.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2292
        
        C:\Windows\SysWOW64\Lkqgno32.exe
        
        C:\Windows\system32\Lkqgno32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5000
        
        C:\Windows\SysWOW64\Lbhool32.exe
        
        C:\Windows\system32\Lbhool32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3252
        
        C:\Windows\SysWOW64\Lefkkg32.exe
        
        C:\Windows\system32\Lefkkg32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3988
        
        C:\Windows\SysWOW64\Ldikgdpe.exe
        
        C:\Windows\system32\Ldikgdpe.exe
        48⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3888
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 400
        49⤵
        Program crash
        
        PID:3800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3888 -ip 3888
1⤵
PID:1972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Jacpcl32.exe

Path C:\Windows\SysWOW64\Jacpcl32.exe
Size 320KB
SHA256 9e506966b35c9a0d3a918e7d1995810298cf68a287ca76ad442518ab3beccd37
MD5 5422ba49dd941c67dadd1f15d90efb1e
SHA1 382e9116e3291cbc4e7dd5334bab545f772bbc96
SHA512 81d6ebe6f6690ef1de29ec90da59b760f6551aaf84f73600214fc4b4aa93541f099f675062cb5a725afee49a13b90856d97529dc74a988c01d928ecb04a0e9af
SSDEEP 3072:AHSieLR+8KMwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:eSLLgMV/Ah1G/AcQ///NR5fn
TLSH
T1FB642E192A3449EADEED1BF6AC0249D85141E9F114F1E23E6163FFDCD8E8DA2D814F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jbbmmo32.exe

Path C:\Windows\SysWOW64\Jbbmmo32.exe
Size 320KB
SHA256 cc1c6b97b13e6fa41cd1650af76159df3b5edb06c1bfae25c68ed9dd89f9351f
MD5 dfffdfd48fa4aa2756130475e011a629
SHA1 0f7fc7dc7805d1963416933d0a3527936636ee46
SHA512 6310a5105a069d496e550b28fe07625347a2729f3e6c2e1c573d42f5ebf0cbc00828ef9bfad51d1c744a7284b7f3d71dfcd56d324fd4cde12569cd6a39cd66d0
SSDEEP 3072:UZgrrDvciwEQwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:UArGEQV/Ah1G/AcQ///NR5fn
TLSH
T119640E192A3819EACDED1BB5EC1249D86241E9F054F1E23E6133DFDCE8E4DA2C815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jjkdlall.exe

Path C:\Windows\SysWOW64\Jjkdlall.exe
Size 320KB
SHA256 5a264d9ec72235263a36bb688c4fac19d96d4b3537173bb29b3f2ac5bc336064
MD5 3ec2e9e089436e8adaac7cd544416a33
SHA1 f4e329778599235f9da186bccc040c1eaede67df
SHA512 a0740ba386382e705bc4eb0675033e092616d12f01b56ac044c53207f502560cd803e8aa79b44f4caadbc2c064203a1fd5163a89b0c590ef9d9f3ff55eedd541
SSDEEP 3072:fcalu/VYMWuXVzFJ6DrwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:fcaluPWQVzFJ4rV/Ah1G/AcQ///NR5fn
TLSH
T1E2642019163409EAEEED1FB5AC0249D89141ECF018F1E57E6123EFDED8E4DA6C825F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kaaldjil.exe

Path C:\Windows\SysWOW64\Kaaldjil.exe
Size 320KB
SHA256 a2a5813c44aeddf09e0313a05ab7ec877814a208a21ef18cc09c9afcf67e9b53
MD5 3fd9c528e5f482999e6d910dc3d23922
SHA1 a7e1daf8c3ee934bf19ffb96086c22df2106ca06
SHA512 7a15609d29e8366c50169052afa69ea0ccf48a1945c6994acc5729d8a3ebd130dc2a890f022ec928bcf2762f45014bb526832678635d03dd26c728d16d56af58
SSDEEP 3072:bbpBYQZ/AxiBwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:bbAZoBV/Ah1G/AcQ///NR5fn
TLSH
T1DA641F2926340AEACDED2FB5AC1249D85541EAF014F1F13E6127DFECD8E4DA2D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kahinkaf.exe

Path C:\Windows\SysWOW64\Kahinkaf.exe
Size 320KB
SHA256 2c794bf78d772721e6f65d013f3745a36524ba85a5785c49c90e952b1da02bae
MD5 af67d47daa119d68ab9f3a446e842261
SHA1 8ea2024a192d165ed904e4c46096fcb13837d912
SHA512 ed21b51e1215649637f7f3aebdf56cd018247f35984ab6394e858f35f6bcfa54ba960530eab406166f72983b3b0f532a1378dcb522ad72f21d75890dd33a1c33
SSDEEP 3072:JYmi9Cevsi1TWKX5w34zaawS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:mXc9aV/Ah1G/AcQ///NR5fn
TLSH
T18E641F192A3409EACDED1FB5AC2249D89181E9F014F1F13E652BDFDCD8E4DA2E805F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kalcik32.exe

Path C:\Windows\SysWOW64\Kalcik32.exe
Size 320KB
SHA256 4d97da9a19bea9adefd43ecd8fe5cfdf2e322e50266fb5a531cf599124b1aa52
MD5 199c8a690bfa58c2a3973064c8e4e82c
SHA1 a7d0ba751532a3d2496eb1200d8bb1632597e514
SHA512 701f6b87a06e59c88a5dffb918191dc013e3885ef07f071d9d9a2aa89569416bf3ab9a6a5cc28ecaba9afdeaf328835d6a76a7ef70478db90a63d98ac35ec9f1
SSDEEP 3072:rSrdnbfZuBuwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:rSBbfZ2uV/Ah1G/AcQ///NR5fn
TLSH
T17664FC19263429EACDED5BB6AD124DD85141E9F014F1E23E6123EFDCECE4DA2E814F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kaopoj32.exe

Path C:\Windows\SysWOW64\Kaopoj32.exe
Size 320KB
SHA256 7e3d0fc8f5d07487c4467305595a909128936c69ebc14a58429b10de8e6363ab
MD5 26462f58d9776083667c8a0cee06d235
SHA1 68a653b81dfcea5c5e3f6f67f4f1077305f778c6
SHA512 de9a34ea657f28448c1e696165280c63b64c57878df5434f468ccb4d589be9d62cca32310c3d356ec054176e856bfa716763742b16772ef28aa29617593f022a
SSDEEP 3072:ca+DSo0D0AGDbwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:AcD0AqbV/Ah1G/AcQ///NR5fn
TLSH
T1716453596A3009EACDED2FB6AD0249D86141E8F014F1E13EA623DFDCD8E4DA6DC05F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kbjbnnfg.exe

Path C:\Windows\SysWOW64\Kbjbnnfg.exe
Size 320KB
SHA256 a9336df991a09ee2596263f13ece8fd544e53e64474196b779b1faf5db3716c0
MD5 4ce9adace0e3e73ee2c4b5e1aa050af7
SHA1 e3d6c734bb20e2a737167719655626c60f5661d9
SHA512 a7e9bbc16a30688388dbbaafa28d04783b0c3b3e965220f16213ae798faad77f2375e305ec5aaefccc4a0c4a6d0637fe91dae684bb3e9ec31282736b0c8dc9a0
SSDEEP 3072:Gfra9an6No84NqwfwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:OraAn6No84IwfV/Ah1G/AcQ///NR5fn
TLSH
T12A643F19663409EACEED1FB5AC1249DC5242E8F114F1E13E6923DFDDD8E4DA2C829F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kblpcndd.exe

Path C:\Windows\SysWOW64\Kblpcndd.exe
Size 320KB
SHA256 2cb5a16b58c1920ed0925cc3c8c2c494bb6ddadbf0116df5b3af88ab9305f0d6
MD5 6942b9572ca0432c32168c7b0834962d
SHA1 716afd8c833784be393a961a4d999e103e93ef9d
SHA512 c8eaa9d6f8cb4782ce832dbfb760766635bd335773d44446ef08c0746cca42af32c10bd7808d1ebcf4f3f871db7d596bc8aaf24b79f03d62e0f7325fd3d00de8
SSDEEP 3072:vtz/QVC8EnSSOUwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:vtz/QSS9UV/Ah1G/AcQ///NR5fn
TLSH
T1A864FB1926340DEACEED1BB5AD0259D85146F9B024F2E13E6623DFDCD8E4EA6C814FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kdffjgpj.exe

Path C:\Windows\SysWOW64\Kdffjgpj.exe
Size 320KB
SHA256 59772bc0a1648c02320dd8410562595c1e03d2d0c707347be62b459e947fc13f
MD5 dca8f6735e0ced2165657a8751d1e5c1
SHA1 dd92f07230f3c586617ee9306fa73e5bd20e3a98
SHA512 3c9d18361190ea2cfd629de964db9cbb806fdb05aff69df0cb0a9d7dd8cc2c5653498fe293ff2383aa006feca1d191dfaf7433c0f5c138f50edf88169c9fd479
SSDEEP 3072:+u37q9KVJkJIgwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:N+9KVJkJIgV/Ah1G/AcQ///NR5fn
TLSH
T1C5643E1A2A3009EACEED5BB6BC0269D84141E8F054F1E17E6527DFDCC8E4DA6CC19F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kdkoef32.exe

Path C:\Windows\SysWOW64\Kdkoef32.exe
Size 320KB
SHA256 f8ffef7fed7de79804891bccb00a98cc10422108a7c30d07040b42104edc9020
MD5 c9137f509aa36b27a0fdb1589cb0c344
SHA1 d63e59bb9f5ad077db6bd7d0e5b146266763c82c
SHA512 5333992eda003df544f122941a1a8c3202d3c302dee14924d6841ddd3e8329dd4eec5c8ab3f44376a449a2250d7106f02acda634ee86bb12b260634b9dfa2935
SSDEEP 3072:aHljrgMCqYtOWXY9LwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:AjrgMCrDXwLV/Ah1G/AcQ///NR5fn
TLSH
T12F64401A267509FADEED1BB9AC0249D85141E9F014F6E13E6123DFDCCCE5EA2C858F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kdmlkfjb.exe

Path C:\Windows\SysWOW64\Kdmlkfjb.exe
Size 320KB
SHA256 80ea2f906623095aa3fa90ec1c2401817dd92053af200ab8d5d8e103b492191f
MD5 16ab2aa88c8cdb16403cbae07aaae29d
SHA1 beb80b405ec2de0bb152a62cf0b56553ec1e41a5
SHA512 0ceff0f34b1bee5a4f542cafe225487021aa6d64a3ca4d39eedf5f1d545a2ed607938272130eae08eb8e1aa3371d4d09dd5cbbd6f958fa3c637811a1080ccfcd
SSDEEP 3072:B1bwkVHlBTm2tjRxB0wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:PHVFBTm2BF0V/Ah1G/AcQ///NR5fn
TLSH
T18164FA1A2A3409EACDED1BF6EE5249D95141E8B014F5E13EA127DFDCC8F4DA2D818F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kdpiqehp.exe

Path C:\Windows\SysWOW64\Kdpiqehp.exe
Size 320KB
SHA256 a0d6c21c494b0b45058f2fa839cc9424f337e8c8a9a2f8fee9ae251313584ed6
MD5 5d95fdb8c0778621a72279b5324e6e2f
SHA1 5707a11a587f9a9d01e0b526644e5a7491b5dd33
SHA512 757166194d59113ddcaf864dfed83345854f64a64be05d732fc8a812ce3c79f9e3ea4ebdc7d7fbe5d4b4777fa68d8d23e4028fd8788f781018cdffead7b7acfa
SSDEEP 3072:lTR/oovO44ZQEdCyPVwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:RR/oovl4Z1dCIVV/Ah1G/AcQ///NR5fn
TLSH
T1D7640C192A380DEACEED1BF5AC1249D89581E8F014F1E53E6523DFDCD8E4DA6D809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kejloi32.exe

Path C:\Windows\SysWOW64\Kejloi32.exe
Size 320KB
SHA256 28f6826cfbd9a85912d296eca99f3030750f5c26b281a479d27e4f58ae2ec07e
MD5 cff7e9bbc5bfe11070f42f7d74863d02
SHA1 cdc415219e6e534df5af5ce7f50206a6cc9e78b3
SHA512 080bec10d39ffb85c8e24f3a9fe242147aa10727b4d56372ba258666c5bf31fed4557797fd5c1535e4344267595161fb0d119e295495e008d2073ebb61c12535
SSDEEP 6144:9mXk3hKHgU/g7SxV/Ah1G/AcQ///NR5fn:96k3hKHgb5/Nv
TLSH
T190641D292A3009EACDED1BB5BD0249E89141E9F014F5E23E6127DFDCD8E4DA7C819F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kemhei32.exe

Path C:\Windows\SysWOW64\Kemhei32.exe
Size 320KB
SHA256 2b695d89ea877a982c63ae6358f63e19933d0a350d17f3ef61e5efdc8bf0ae49
MD5 de296de14ef6bb431ee342f1237224e6
SHA1 f20ee47aa3b6cdad68b8aad6dfc9cd1611136524
SHA512 f06401b6779bc3533ed49476d2549b4338901d08949c6f3bf2e0d3d8e55d8369e2ffd56512af5e250bcfe391f67cf6c4b2abca3cb2af3b07811326558fd07dad
SSDEEP 3072:xzd7MKhXXX1UvwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:x6KjUvV/Ah1G/AcQ///NR5fn
TLSH
T197640D192A7009EACDED1BB6BC1249D89141E9F014F2F23E6123DFDCD9E4DA6D816F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Khabke32.exe

Path C:\Windows\SysWOW64\Khabke32.exe
Size 320KB
SHA256 4dc191334810e6d473512fd21b14f607e72f48aa7a9127d482410cdcf93f96b9
MD5 c8d9380b27dddffe3f7571f5e2c6bae7
SHA1 acb5c7144c979342c6083ebf938bc7ccced0751f
SHA512 7eb739d7c759d7201175caf56fd5d49ab46e67217f1888a93e42ff9124bcac2a3fa2686e1a6ab5274a0ac320c683b6e7c8676d4b511f6a33968a9857e392a6c6
SSDEEP 3072:Dxos7zM972tOfwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:esztOfV/Ah1G/AcQ///NR5fn
TLSH
T1C964002A273409EACEED1BB5AC1249D86141FAF154F1E63EA123DFDCD8E4D62C815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Khdoqefq.exe

Path C:\Windows\SysWOW64\Khdoqefq.exe
Size 320KB
SHA256 82ca3013566dc420bc611ecbbef5721116f7244c6f0c91491a18693354611428
MD5 46cbe1f6ea58e84bcba4de66a19909ad
SHA1 5fd61570c7000fbf52a0f6359a891f487a050e4c
SHA512 1ac6b458b5de26954710eb66116a8a962414a4f6b578fdee9ea86219ae5906212519a28f7170a080ea5cb5262c2c0a13035a821154b161df22141543cadd7854
SSDEEP 3072:f247oSWXlu8H6jFulxwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:O47m11H6olxV/Ah1G/AcQ///NR5fn
TLSH
T125640E1926340EEACEED1BB5AC5249D85181E9F014F1E13EA123DFDCD8E8DB6D815F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Khfkfedn.exe

Path C:\Windows\SysWOW64\Khfkfedn.exe
Size 320KB
SHA256 ad1add0320c03858c83c9b912f5061615638a407d3189b106bd9d5501a92e614
MD5 bd8c5699be355cc0a2f88f838eb48e87
SHA1 e987b613caceeb515518a02db97fb7fd79b39015
SHA512 b4b1a17ba2204792b0eae71936baec08b875029d7da70c23350354b7ea200fdad681875aeac4f81434c29452a753042d361ff58254188f29af7ab80775a30683
SSDEEP 3072:VI/fOF1qwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:VlqV/Ah1G/AcQ///NR5fn
TLSH
T127640E192A3409EACEEE1FB5AC025DE85146E9F014F1E13E6123EFDCD8E4DA6D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Khihld32.exe

Path C:\Windows\SysWOW64\Khihld32.exe
Size 320KB
SHA256 b77e88af039be87c9617635236993d7895da1d13264ce1f8d354fcbb7960feb2
MD5 b6f91b33361c06ef03f7d42fd7431844
SHA1 d506771e233dd0b5ec9bcebacd68a542d9a4030f
SHA512 be322f29bd3f9b1617850c8a250a85d00023fb469349066ecf2802ed0f360f381feade791bdb60610abe951dc68f1c5990e03ea9ed0e5d7a50c681fa84b8f773
SSDEEP 3072:yu40BPa+rVTVwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:X40BJrtVV/Ah1G/AcQ///NR5fn
TLSH
T1DE643F1A363009FACDED1BB5AC4249D99591E8F418F1E13E2923DFDDD8E4DA2C819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kkbkmqed.exe

Path C:\Windows\SysWOW64\Kkbkmqed.exe
Size 320KB
SHA256 45f6aa29b9db6c3ef428ad6223c394f68e36aa4d68669c4bd6bd9911b8b4e7ba
MD5 7425d0f8d5917098a0d890527f5711f0
SHA1 546640603786f87080f3bd65a2788deafe663b4f
SHA512 6c6d73b7445251778ac990659267628f1d56f5b2be272a4c358a431020f5542c1a160a15d5e042138f9cfb78fc340650f164dd3ba8d9a7841570e4a6f229ba21
SSDEEP 3072:MIxoa6BetEOXgqWoV3wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:FULOXgFoV3V/Ah1G/AcQ///NR5fn
TLSH
T10464311A167809EACEED1BB9BC0689D89141E8F014F5E13E6123DFDCD9E4DA3D908F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kkegbpca.exe

Path C:\Windows\SysWOW64\Kkegbpca.exe
Size 320KB
SHA256 049287fb628b947357d98aaab393b5f71344e20e4ccd35decc9c2569e216fa70
MD5 1539225aa40ef4c0129ef621f8ea50ea
SHA1 35ce26dfc908f3fae5850e33a5b40cc3dbe0af1d
SHA512 ebeb6f5cdd0a13fea0532fbb6113e497e7db9be749ddd51e8e8325932a4e8db6af109375fb8107f68e10c91271dd665e4c603506e9bc8226ae3e3b1b2d932025
SSDEEP 3072:asVCI/+RzrzwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:asVCI/qrzV/Ah1G/AcQ///NR5fn
TLSH
T115642D296A3009EACEFD9FB6AC1249D95141E9F014F1E13E6523DFDCD8E6DA2D804F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kkgdhp32.exe

Path C:\Windows\SysWOW64\Kkgdhp32.exe
Size 320KB
SHA256 91fcdef6419f8dd591ae9b284f34d7f4553c959be6db8babf01e198a972979dc
MD5 5336af1baa30b1db185fca82da6aa23f
SHA1 3f71abdf0f53b62b69703ef497fa2dfa747055fe
SHA512 2436c1279c455210895e769dd071290d65aec9b562ee013cd01798831842518b4117cdcd3f353d7bb69e5e742b10e8fc65db1539d8591c298dfcd9e3913077b3
SSDEEP 3072:HybwaMhU+WwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:HmwaMbWV/Ah1G/AcQ///NR5fn
TLSH
T1586421191A340AFACDED1FB6AC124AE89151E9F014F1E13E5523DFDCD8E4EA6D809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kkpnga32.exe

Path C:\Windows\SysWOW64\Kkpnga32.exe
Size 320KB
SHA256 a25864a962e034aed06143644a439173f48ba0277aab98350ea8292f887aeff6
MD5 318208d2ca0d7970cfd37e0fe5c69708
SHA1 c570226e03e048e44d1fb698064c040abb016717
SHA512 8cf494852186d3f4e9bce9dcb14775d803f5e5ca98f00e2f7a5d098a88b5bed16bcc0f898ff0c032adb7c01d09bbc6da95d35801121621add62f7535e5f55292
SSDEEP 3072:7MvZPMGOpdERru6ruCfwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:4R+pdEQSzfV/Ah1G/AcQ///NR5fn
TLSH
T12064FC192A7809EACDFD1BB5AD2249D89141EAF014F1E13E6163DFDCC8E4DA6CC16F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Klddlckd.exe

Path C:\Windows\SysWOW64\Klddlckd.exe
Size 320KB
SHA256 a34c6d55221449d1813ee58c98587a763b01f9eaab63f3b5908c210e8ff9651b
MD5 21a9ff168ad31af0e7195b78faebf442
SHA1 a33bae5f2ed2ded3324fd9aef59181c3d9e47d59
SHA512 168b393466454452b516047c60e6e9bf3df283b0664d58c77961e565065f14f71f5b091637791a3b1a335fee373da3ffeeb2dfe424ba332c28083f4d79a77a06
SSDEEP 3072:CV+GAGF0kW+u6dgvZOpgokwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:C8Lq0RokV/Ah1G/AcQ///NR5fn
TLSH
T1166430192A3409EACDEE1FB5AC0249E96191E9F015F1E13E6123DFDCC8E5DA2DC19F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Klgqabib.exe

Path C:\Windows\SysWOW64\Klgqabib.exe
Size 320KB
SHA256 caccee245d40d1d1462b3ac8495b837e7d801961fabe33269d21ff85fbad1d01
MD5 b5ed1f5830f02e850b9e2b3a0cb667a6
SHA1 ff5b7c45f48fdb09cdc7b6a96caa837f9df72f26
SHA512 da5a067d7e0caf01fa4b819febe322e1eb60fc8c885a6a211a5357124fe72355587fae03e6b84f02f34342ececd9882639a862302bfdf20812eb9e88820e7842
SSDEEP 3072:bYsAU+0KFd3V24kHAGUp0GwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:CU+0KFPGEDV/Ah1G/AcQ///NR5fn
TLSH
T13964C91A2A3409EACEED2BB5AC1649D85141E9B014F1F13E6123EFDCD8F4DA6CC19F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Klpjad32.exe

Path C:\Windows\SysWOW64\Klpjad32.exe
Size 320KB
SHA256 be650034f1574996356831cb320379a3dc6f5b1914325000c7be2a5f103a4c10
MD5 715f1d61936fc0f8f7b8111fcebc259b
SHA1 02402247cc8d54ecaf6e1cc1c401581e7c447889
SHA512 62fa5ac317e2bb23966f97a48d090e812094d422c8f11d110487f455d2bacf56cf413491a72a3c70f60fdd460dfaa5688624cea531692fdd74b0e1330afacefc
SSDEEP 3072:G/K4o7GGkUFWn7C+7TyzwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:BXbE++7+zV/Ah1G/AcQ///NR5fn
TLSH
T1E36440192A3009EACEED5FB5AE1249D89141E8F015F2E13E6523DFDCD8E4DA2DC09F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kocphojh.exe

Path C:\Windows\SysWOW64\Kocphojh.exe
Size 320KB
SHA256 4691e8e8e0a59b93b6c589a78a3cb609ca0bb63e6db6054447595739bddceb75
MD5 682f217b4732ebe5b9655b5ea1132833
SHA1 650957876190ae29d8c9314b2943e2e913dacff0
SHA512 4437c8fa4102a29d6311c8fa23383ba4b982ef738f4ff33737d520d1c80e2534592f819807d5500d8e03dc61962531bbf9c7d9cd3ebe4495c35034ede79cd01c
SSDEEP 3072:cClEl6Z6qiwCv4UZPb8SPwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:F29X47SPV/Ah1G/AcQ///NR5fn
TLSH
T1DB6420152A3009EACEED5FB5AD024AD89141E6F018F1F13EA123DFDCD9E5DA2D818F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kopcbo32.exe

Path C:\Windows\SysWOW64\Kopcbo32.exe
Size 320KB
SHA256 9b530479d605543160ac438326f2b21c20045bcdfb62f3c52957232965624545
MD5 6da94b4f34aa38e763a8b25b051c6360
SHA1 37b7ae6fee56f860a838e0df5c7c7e2a0fa25882
SHA512 09fb5569094d10efbe0fe90cd1d9810630ef57feef1142e816fad3a3b705319da4ea99f0f0e5fc62a6167fbebc499eefd97045e035990e67f357761b5af9155a
SSDEEP 3072:BxyzwUXdhooDNP01w0+wtwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:mwOH/Pv0tV/Ah1G/AcQ///NR5fn
TLSH
T143641E191AB409FADDED1BB5BC1249D8A141EAF014F1E13E6123DFDCD8E8DA6D818F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lbqinm32.exe

Path C:\Windows\SysWOW64\Lbqinm32.exe
Size 320KB
SHA256 8512d29ba92d7e8186418ca1aa2080322f63b961ac671ee483322393e9add46b
MD5 ae8b2eaadeb852bbaf16ca7ba45877a2
SHA1 6715475b37c68122554352ab53b783c6c144f845
SHA512 cdbc97b80968dd0907b3e1dd0e90012bf57a9b2b9028eb52f5f3c5e84f2765d4040ca31f69cf9a7e3859b69fb02e8b380efdceb7513d23e0b89de66a312708d2
SSDEEP 3072:PHGY83WPvwU52wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:PhZN2V/Ah1G/AcQ///NR5fn
TLSH
T162642E192A3009EADEED1FB5AD1249D8A991E9F014F1E13E6123DFDCD8E4DA3D805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ldbefe32.exe

Path C:\Windows\SysWOW64\Ldbefe32.exe
Size 320KB
SHA256 9907c3b48df49c83e1ff8617fcf7381ff16a06ce25eca324ad5df3a028cfccd5
MD5 b06e9dbf4c95f810dec2840f715e2855
SHA1 8dd7579bfe28b83c792d4d9b47f2c47678985ac2
SHA512 96172b516db825a236ca55d551877095264114c6348a66a62a9acae14b45652ca1ce814f000623a3a41f6edc637b85d721cba11f2cb2c1ca3b78926dc91b0f96
SSDEEP 3072:4Zixooj6VQ4swS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Ik6VFsV/Ah1G/AcQ///NR5fn
TLSH
T15F643F19263409EACEED5BB5AC2259D89141E9F018F1F23F6123DFDCC8E4DA6D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Leoejh32.exe

Path C:\Windows\SysWOW64\Leoejh32.exe
Size 320KB
SHA256 25f086115c2e4a3e7a958899374f1c55840b13068b2e6003179d6ab8b3dca0f7
MD5 abe50ae0d546532780480276293f8569
SHA1 1faec254c5c66bf17c1234c2a5d280fdf498dbce
SHA512 ac4379a8b42d2002ea1a0ccde8076dfb117cafa2ef0e7dd07cdbc073fe6f802c979e0b5de5dd393f0995ad06b4d198a94407b14b961cec255a6caa3a63cc3dc6
SSDEEP 3072:scBAjWcNJAH/kwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:TBwJAH/kV/Ah1G/AcQ///NR5fn
TLSH
T13764EA192A300DEACEEE1BB5AC1249D89241F5B014F5E13E6123EFDDD8E5DA6DC49F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lkiamp32.exe

Path C:\Windows\SysWOW64\Lkiamp32.exe
Size 320KB
SHA256 456363d91d5888413c02f2c1c9a7cda37b5ab78f191d860e45fed328001c9eaf
MD5 2663cd6ac77ccd0eb5890f1db1d2d1cf
SHA1 4f4dc818e37c9113f7d517f54699caa96d0b281a
SHA512 5f2f26f3662497431d5cd2af23398a07549994903e1995b245da0f7da79b8e09f5cd47546259801ae523ccafafbe1fde61975cef7789452c48082091a96fa9eb
SSDEEP 3072:wXrQqQlgh6MWdtRwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:w7QfMWdtRV/Ah1G/AcQ///NR5fn
TLSH
T1E2642E1A263419EACEED1FB5AC0289D85141E9F014F1E17E6123DFEDD8E4DB6C816F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/220-448-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/220-447-0x00000000008B0000-0x000000000098C000-memory.dmp

Download

memory/516-466-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/516-56-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/516-465-0x0000000000800000-0x00000000008DC000-memory.dmp

Download

memory/700-453-0x0000000000670000-0x000000000074C000-memory.dmp

Download

memory/700-454-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/700-94-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/852-390-0x0000000000840000-0x000000000091C000-memory.dmp

Download

memory/852-260-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/852-391-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/992-70-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/992-463-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/992-462-0x00000000007D0000-0x00000000008AC000-memory.dmp

Download

memory/1016-417-0x00000000005B0000-0x000000000068C000-memory.dmp

Download

memory/1016-418-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1016-188-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1028-376-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1028-375-0x00000000008B0000-0x000000000098C000-memory.dmp

Download

memory/1028-290-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1396-156-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1396-429-0x0000000000860000-0x000000000093C000-memory.dmp

Download

memory/1396-430-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1492-220-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1492-406-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1492-405-0x00000000007D0000-0x00000000008AC000-memory.dmp

Download

memory/1708-180-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1708-421-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1708-420-0x0000000000830000-0x000000000090C000-memory.dmp

Download

memory/2036-54-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2036-468-0x00000000008B0000-0x000000000098C000-memory.dmp

Download

memory/2036-469-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2100-77-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2100-459-0x00000000005D0000-0x00000000006AC000-memory.dmp

Download

memory/2100-460-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2120-117-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2120-444-0x0000000000850000-0x000000000092C000-memory.dmp

Download

memory/2120-445-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2144-474-0x00000000007E0000-0x00000000008BC000-memory.dmp

Download

memory/2144-33-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2144-475-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2208-307-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2208-366-0x00000000007C0000-0x000000000089C000-memory.dmp

Download

memory/2208-367-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2292-357-0x00000000008D0000-0x00000000009AC000-memory.dmp

Download

memory/2292-358-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2304-148-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2304-432-0x0000000000840000-0x000000000091C000-memory.dmp

Download

memory/2304-433-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2320-435-0x0000000000670000-0x000000000074C000-memory.dmp

Download

memory/2320-436-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2516-393-0x0000000000670000-0x000000000074C000-memory.dmp

Download

memory/2516-394-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2516-252-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2800-265-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2800-388-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2800-387-0x00000000007C0000-0x000000000089C000-memory.dmp

Download

memory/2992-102-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2992-450-0x0000000000830000-0x000000000090C000-memory.dmp

Download

memory/2992-451-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2996-456-0x0000000000870000-0x000000000094C000-memory.dmp

Download

memory/2996-457-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2996-86-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3048-439-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3048-438-0x00000000007C0000-0x000000000089C000-memory.dmp

Download

memory/3048-133-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3224-17-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3224-481-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3224-480-0x0000000000870000-0x000000000094C000-memory.dmp

Download

memory/3252-336-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3252-351-0x00000000007A0000-0x000000000087C000-memory.dmp

Download

memory/3252-352-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3812-284-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3812-379-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3812-378-0x00000000007E0000-0x00000000008BC000-memory.dmp

Download

memory/3816-369-0x00000000007B0000-0x000000000088C000-memory.dmp

Download

memory/3816-301-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3816-370-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3880-212-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3880-408-0x00000000007A0000-0x000000000087C000-memory.dmp

Download

memory/3880-409-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3888-347-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3888-343-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3888-345-0x0000000000860000-0x000000000093C000-memory.dmp

Download

memory/3932-402-0x0000000000870000-0x000000000094C000-memory.dmp

Download

memory/3932-228-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3932-403-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3984-1-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/3984-486-0x0000000000920000-0x00000000009FC000-memory.dmp

Download

memory/3984-487-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3984-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3988-342-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3988-348-0x00000000007F0000-0x00000000008CC000-memory.dmp

Download

memory/3988-349-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4112-319-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4112-360-0x0000000000790000-0x000000000086C000-memory.dmp

Download

memory/4112-361-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4224-423-0x00000000007C0000-0x000000000089C000-memory.dmp

Download

memory/4224-172-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4224-424-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4228-25-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4228-478-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4228-477-0x0000000000950000-0x0000000000A2C000-memory.dmp

Download

memory/4344-442-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4344-125-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4344-441-0x0000000000870000-0x000000000094C000-memory.dmp

Download

memory/4356-372-0x0000000000810000-0x00000000008EC000-memory.dmp

Download

memory/4356-373-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4452-278-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4452-381-0x0000000000830000-0x000000000090C000-memory.dmp

Download

memory/4452-382-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4548-244-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4548-397-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4548-396-0x0000000000870000-0x000000000094C000-memory.dmp

Download

memory/4592-426-0x0000000000780000-0x000000000085C000-memory.dmp

Download

memory/4592-164-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4592-427-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4604-236-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4604-400-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4604-399-0x00000000007E0000-0x00000000008BC000-memory.dmp

Download

memory/4624-364-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4624-313-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4624-363-0x00000000006B0000-0x000000000078C000-memory.dmp

Download

memory/4704-411-0x00000000007B0000-0x000000000088C000-memory.dmp

Download

memory/4704-412-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4704-204-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4724-415-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4724-196-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4724-414-0x0000000000770000-0x000000000084C000-memory.dmp

Download

memory/4836-384-0x0000000000840000-0x000000000091C000-memory.dmp

Download

memory/4836-385-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4836-272-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4856-483-0x0000000000810000-0x00000000008EC000-memory.dmp

Download

memory/4856-484-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4856-9-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4956-471-0x0000000000840000-0x000000000091C000-memory.dmp

Download

memory/4956-472-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4956-40-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5000-330-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5000-355-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5000-354-0x00000000007C0000-0x000000000089C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads