berbew | 284a756312aabf0a42158d5fe2bcd61ea08be2842710493d3a4fda137b71a775

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/08/2026, 15:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_cdb165842a062173e668ac5d65f67d49_elex_wannacry.exe
Size 376KB
Sample260801-s85sysch97
SHA256 284a756312aabf0a42158d5fe2bcd61ea08be2842710493d3a4fda137b71a775
MD5 cdb165842a062173e668ac5d65f67d49
SHA1 f98255ba48f981ace23a2701bcaf29b4f44c019e
SHA512 562fe4906ef1396bcf45c0d8f762868eff4d6bed9fe32eb86d9870fe934b1e24fb175de378cd910d97d0d9f1cc153c8b4bd0a846c66cbe77e963608338c0e08c
SSDEEP 6144:rwa1Cpf7HjPr/bnDvLEws4taC7oQ0IV/Atl/AtW1OE43V1+25CzRoQ0Ibl4HdE4X:sacf7HjPr/bnDvLEws4350I2mi4lCzbq
TLSH
T19184282DAE72CA99C09818FF00E31A98E156E7BD0DEA8F757EC0F6491A352CBDC17154
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://crutop.ru/index.php
http://mazafaka.ru/index.php
http://color-bank.ru/index.php
http://asechka.ru/index.php
http://trojan.ru/index.php
http://fuck.ru/index.php
http://goldensand.ru/index.php
http://filesearch.ru/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://lovingod.host.sk/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://mazafaka.ru/index.htm
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm
http://fethard.biz/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Icogcjde.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlfhke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jnedgq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jacpcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jeolckne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdmlkfjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lbqinm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ijbbfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jdopjh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jhoeef32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbcedmnl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbebilli.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lajokiaa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Loemnnhe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdmcdhhe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jeaiij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Igjbci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	2026-08-01_cdb165842a062173e668ac5d65f67d49_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdhbpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lajokiaa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hjaioe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jhmhpfmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klmnkdal.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Khihld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Leoejh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hgcmbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ijbbfc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kajfdk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kopcbo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lknjhokg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Leoejh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lahbei32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Igjbci32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Khkdad32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlkafdco.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Khfkfedn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kkgdhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Llimgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Loemnnhe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdopjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jlfhke32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jnedgq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jjkdlall.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Koimbpbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kkpnga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kalcik32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkbkmqed.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkegbpca.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kopcbo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kaopoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Khihld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkgdhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lklnconj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldfoad32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jeolckne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jaemilci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kbgfhnhi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kalcik32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kocphojh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkiamp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lhmafcnf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jjihfbno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Llkjmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lbhool32.exe

Executes dropped EXE 64 IoCs

pid	Process
1672	Hgcmbj32.exe
4564	Hjaioe32.exe
2536	Hbiapb32.exe
4672	Icogcjde.exe
1692	Igjbci32.exe
4736	Ijiopd32.exe
2300	Infhebbh.exe
2068	Inidkb32.exe
3144	Ijbbfc32.exe
4420	Jnnnfalp.exe
3832	Janghmia.exe
3052	Jdmcdhhe.exe
5116	Jldkeeig.exe
1248	Jdopjh32.exe
4112	Jhkljfok.exe
2576	Jlfhke32.exe
3652	Jjihfbno.exe
1516	Jnedgq32.exe
4656	Jacpcl32.exe
212	Jeolckne.exe
1296	Jdalog32.exe
1776	Jhmhpfmi.exe
440	Jjkdlall.exe
3556	Jogqlpde.exe
4524	Jaemilci.exe
768	Jeaiij32.exe
5008	Jhoeef32.exe
416	Jlkafdco.exe
3252	Koimbpbc.exe
1480	Kbeibo32.exe
3516	Keceoj32.exe
4104	Kdffjgpj.exe
4100	Klmnkdal.exe
1152	Kkpnga32.exe
2976	Kbgfhnhi.exe
3384	Kajfdk32.exe
3764	Kdhbpf32.exe
612	Khdoqefq.exe
3964	Kkbkmqed.exe
3760	Kbjbnnfg.exe
1872	Kalcik32.exe
4500	Kdkoef32.exe
4164	Khfkfedn.exe
4412	Kkegbpca.exe
2076	Kopcbo32.exe
5012	Kaopoj32.exe
3728	Kdmlkfjb.exe
1984	Khihld32.exe
3688	Kkgdhp32.exe
3856	Kocphojh.exe
792	Kaaldjil.exe
4288	Kemhei32.exe
4704	Khkdad32.exe
3128	Lkiamp32.exe
4068	Loemnnhe.exe
3424	Lbqinm32.exe
4592	Leoejh32.exe
3480	Lhmafcnf.exe
2184	Llimgb32.exe
1196	Lklnconj.exe
3332	Lbcedmnl.exe
3228	Leabphmp.exe
2192	Lddble32.exe
2084	Llkjmb32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Khihld32.exe	Kdmlkfjb.exe
File created	C:\Windows\SysWOW64\Eqfnqg32.dll	Kocphojh.exe
File created	C:\Windows\SysWOW64\Lbebilli.exe	Lknjhokg.exe
File created	C:\Windows\SysWOW64\Jdopjh32.exe	Jldkeeig.exe
File opened for modification	C:\Windows\SysWOW64\Jogqlpde.exe	Jjkdlall.exe
File opened for modification	C:\Windows\SysWOW64\Kkpnga32.exe	Klmnkdal.exe
File created	C:\Windows\SysWOW64\Ehilac32.dll	Kdmlkfjb.exe
File created	C:\Windows\SysWOW64\Cjbdmo32.dll	Lhmafcnf.exe
File created	C:\Windows\SysWOW64\Hbiapb32.exe	Hjaioe32.exe
File opened for modification	C:\Windows\SysWOW64\Jhkljfok.exe	Jdopjh32.exe
File created	C:\Windows\SysWOW64\Jkfood32.dll	Jeolckne.exe
File created	C:\Windows\SysWOW64\Jeaiij32.exe	Jaemilci.exe
File created	C:\Windows\SysWOW64\Ifkqol32.dll	Jlkafdco.exe
File created	C:\Windows\SysWOW64\Kdkoef32.exe	Kalcik32.exe
File opened for modification	C:\Windows\SysWOW64\Lbebilli.exe	Lknjhokg.exe
File opened for modification	C:\Windows\SysWOW64\Janghmia.exe	Jnnnfalp.exe
File opened for modification	C:\Windows\SysWOW64\Jdmcdhhe.exe	Janghmia.exe
File created	C:\Windows\SysWOW64\Jldkeeig.exe	Jdmcdhhe.exe
File opened for modification	C:\Windows\SysWOW64\Koimbpbc.exe	Jlkafdco.exe
File opened for modification	C:\Windows\SysWOW64\Khfkfedn.exe	Kdkoef32.exe
File created	C:\Windows\SysWOW64\Mobpnd32.dll	Kdkoef32.exe
File opened for modification	C:\Windows\SysWOW64\Lkiamp32.exe	Khkdad32.exe
File opened for modification	C:\Windows\SysWOW64\Icogcjde.exe	Hbiapb32.exe
File created	C:\Windows\SysWOW64\Pmbpeafn.dll	Kbjbnnfg.exe
File created	C:\Windows\SysWOW64\Fbkcnp32.dll	Kaopoj32.exe
File opened for modification	C:\Windows\SysWOW64\Kaaldjil.exe	Kocphojh.exe
File created	C:\Windows\SysWOW64\Llimgb32.exe	Lhmafcnf.exe
File opened for modification	C:\Windows\SysWOW64\Ldfoad32.exe	Lahbei32.exe
File created	C:\Windows\SysWOW64\Fhjaco32.dll	Lkqgno32.exe
File opened for modification	C:\Windows\SysWOW64\Lajokiaa.exe	Lbhool32.exe
File created	C:\Windows\SysWOW64\Jlbngnmk.dll	Jdopjh32.exe
File created	C:\Windows\SysWOW64\Ekheml32.dll	Kkpnga32.exe
File created	C:\Windows\SysWOW64\Mjlhjjnc.dll	Kdhbpf32.exe
File created	C:\Windows\SysWOW64\Japjfm32.dll	Kkbkmqed.exe
File created	C:\Windows\SysWOW64\Fbbojb32.dll	Khfkfedn.exe
File created	C:\Windows\SysWOW64\Kaopoj32.exe	Kopcbo32.exe
File opened for modification	C:\Windows\SysWOW64\Lbqinm32.exe	Loemnnhe.exe
File created	C:\Windows\SysWOW64\Llkjmb32.exe	Lddble32.exe
File created	C:\Windows\SysWOW64\Hbhgkfkg.dll	Kbeibo32.exe
File created	C:\Windows\SysWOW64\Ebpmamlm.dll	Khihld32.exe
File created	C:\Windows\SysWOW64\Kemhei32.exe	Kaaldjil.exe
File created	C:\Windows\SysWOW64\Bfdkqcmb.dll	Kaaldjil.exe
File created	C:\Windows\SysWOW64\Hnggccfl.dll	Lklnconj.exe
File opened for modification	C:\Windows\SysWOW64\Llkjmb32.exe	Lddble32.exe
File created	C:\Windows\SysWOW64\Lahbei32.exe	Lbebilli.exe
File opened for modification	C:\Windows\SysWOW64\Hjaioe32.exe	Hgcmbj32.exe
File created	C:\Windows\SysWOW64\Celipg32.dll	Hbiapb32.exe
File created	C:\Windows\SysWOW64\Jacpcl32.exe	Jnedgq32.exe
File created	C:\Windows\SysWOW64\Qfqbll32.dll	Jjkdlall.exe
File created	C:\Windows\SysWOW64\Koimbpbc.exe	Jlkafdco.exe
File opened for modification	C:\Windows\SysWOW64\Kalcik32.exe	Kbjbnnfg.exe
File opened for modification	C:\Windows\SysWOW64\Kaopoj32.exe	Kopcbo32.exe
File created	C:\Windows\SysWOW64\Kjejmalo.dll	Kemhei32.exe
File created	C:\Windows\SysWOW64\Jhbejblj.dll	Hjaioe32.exe
File created	C:\Windows\SysWOW64\Mnpkiqbe.dll	Jnnnfalp.exe
File created	C:\Windows\SysWOW64\Jhkljfok.exe	Jdopjh32.exe
File opened for modification	C:\Windows\SysWOW64\Kocphojh.exe	Kkgdhp32.exe
File created	C:\Windows\SysWOW64\Eilbckfb.dll	Lkiamp32.exe
File created	C:\Windows\SysWOW64\Leoejh32.exe	Lbqinm32.exe
File created	C:\Windows\SysWOW64\Lajokiaa.exe	Lbhool32.exe
File opened for modification	C:\Windows\SysWOW64\Ldikgdpe.exe	Lajokiaa.exe
File opened for modification	C:\Windows\SysWOW64\Kdhbpf32.exe	Kajfdk32.exe
File created	C:\Windows\SysWOW64\Qfmjjmdm.dll	Hgcmbj32.exe
File created	C:\Windows\SysWOW64\Lqcnhf32.dll	Igjbci32.exe

Program crash 1 IoCs

pid	pid_target	Process
5508	5416	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jdmcdhhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Koimbpbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbjbnnfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lknjhokg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lahbei32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hbiapb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khfkfedn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lkqgno32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jnnnfalp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jnedgq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbeibo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kkegbpca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Icogcjde.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jacpcl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbgfhnhi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdkoef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khihld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lddble32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lajokiaa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jdopjh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jeaiij32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kopcbo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kemhei32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbebilli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Infhebbh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdhbpf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdmlkfjb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kocphojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbcedmnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klmnkdal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khdoqefq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kaopoj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khkdad32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lhmafcnf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lklnconj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Leabphmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldikgdpe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_cdb165842a062173e668ac5d65f67d49_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hjaioe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jaemilci.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kajfdk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kkgdhp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lkiamp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbqinm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ijbbfc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlfhke32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jdalog32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jogqlpde.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kalcik32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kaaldjil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loemnnhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Leoejh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Janghmia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldfoad32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lhbkac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Igjbci32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jldkeeig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbhool32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ijiopd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jhmhpfmi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jhoeef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hgcmbj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jeolckne.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llkjmb32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Icogcjde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jnnnfalp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Janghmia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jdmcdhhe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jjihfbno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jeolckne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kaopoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kdmlkfjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jhkljfok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jjihfbno.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jaemilci.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jlkafdco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Khfkfedn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kemhei32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lkiamp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lkiamp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbnefjjd.dll"	Jldkeeig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Afgfhaab.dll"	Jhkljfok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jlfhke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anjkcakk.dll"	Khdoqefq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kbjbnnfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kkegbpca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjbdmo32.dll"	Lhmafcnf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Leabphmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jhkljfok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jdalog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jhmhpfmi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kdkoef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Llfgke32.dll"	Kkegbpca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kemhei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eilbckfb.dll"	Lkiamp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpjkgoka.dll"	Loemnnhe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jdopjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifkqol32.dll"	Jlkafdco.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kkpnga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Japjfm32.dll"	Kkbkmqed.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kalcik32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mobpnd32.dll"	Kdkoef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kocphojh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lhbkac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pinffi32.dll"	Ijiopd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Denlcd32.dll"	Infhebbh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkojhm32.dll"	Ijbbfc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kajfdk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kdhbpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbbojb32.dll"	Khfkfedn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kkegbpca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfeliqka.dll"	Lbebilli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijaaij32.dll"	Jogqlpde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cboleq32.dll"	Kalcik32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kopcbo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kkgdhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lkqgno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbfhni32.dll"	Lbhool32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lajokiaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	2026-08-01_cdb165842a062173e668ac5d65f67d49_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qfmjjmdm.dll"	Hgcmbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qbddhbhn.dll"	Inidkb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jdalog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjmannfj.dll"	Jhmhpfmi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jeaiij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fncnpk32.dll"	Kdffjgpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndnoffic.dll"	Kajfdk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ijiopd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 1672	4004	2026-08-01_cdb165842a062173e668ac5d65f67d49_elex_wannacry.exe	85
PID 1672 wrote to memory of 4564	1672	Hgcmbj32.exe	86
PID 4564 wrote to memory of 2536	4564	Hjaioe32.exe	87
PID 2536 wrote to memory of 4672	2536	Hbiapb32.exe	88
PID 4672 wrote to memory of 1692	4672	Icogcjde.exe	89
PID 1692 wrote to memory of 4736	1692	Igjbci32.exe	90
PID 4736 wrote to memory of 2300	4736	Ijiopd32.exe	91
PID 2300 wrote to memory of 2068	2300	Infhebbh.exe	92
PID 2068 wrote to memory of 3144	2068	Inidkb32.exe	93
PID 3144 wrote to memory of 4420	3144	Ijbbfc32.exe	94
PID 4420 wrote to memory of 3832	4420	Jnnnfalp.exe	95
PID 3832 wrote to memory of 3052	3832	Janghmia.exe	96
PID 3052 wrote to memory of 5116	3052	Jdmcdhhe.exe	97
PID 5116 wrote to memory of 1248	5116	Jldkeeig.exe	98
PID 1248 wrote to memory of 4112	1248	Jdopjh32.exe	99
PID 4112 wrote to memory of 2576	4112	Jhkljfok.exe	100
PID 2576 wrote to memory of 3652	2576	Jlfhke32.exe	101
PID 3652 wrote to memory of 1516	3652	Jjihfbno.exe	102
PID 1516 wrote to memory of 4656	1516	Jnedgq32.exe	103
PID 4656 wrote to memory of 212	4656	Jacpcl32.exe	104
PID 212 wrote to memory of 1296	212	Jeolckne.exe	105
PID 1296 wrote to memory of 1776	1296	Jdalog32.exe	106
PID 1776 wrote to memory of 440	1776	Jhmhpfmi.exe	107
PID 440 wrote to memory of 3556	440	Jjkdlall.exe	108
PID 3556 wrote to memory of 4524	3556	Jogqlpde.exe	109
PID 4524 wrote to memory of 768	4524	Jaemilci.exe	110
PID 768 wrote to memory of 5008	768	Jeaiij32.exe	111
PID 5008 wrote to memory of 416	5008	Jhoeef32.exe	112
PID 416 wrote to memory of 3252	416	Jlkafdco.exe	113
PID 3252 wrote to memory of 1480	3252	Koimbpbc.exe	114
PID 1480 wrote to memory of 3516	1480	Kbeibo32.exe	115
PID 3516 wrote to memory of 4104	3516	Keceoj32.exe	116
PID 4104 wrote to memory of 4100	4104	Kdffjgpj.exe	117
PID 4100 wrote to memory of 1152	4100	Klmnkdal.exe	118
PID 1152 wrote to memory of 2976	1152	Kkpnga32.exe	119
PID 2976 wrote to memory of 3384	2976	Kbgfhnhi.exe	120
PID 3384 wrote to memory of 3764	3384	Kajfdk32.exe	121
PID 3764 wrote to memory of 612	3764	Kdhbpf32.exe	122
PID 612 wrote to memory of 3964	612	Khdoqefq.exe	123
PID 3964 wrote to memory of 3760	3964	Kkbkmqed.exe	124
PID 3760 wrote to memory of 1872	3760	Kbjbnnfg.exe	125
PID 1872 wrote to memory of 4500	1872	Kalcik32.exe	126
PID 4500 wrote to memory of 4164	4500	Kdkoef32.exe	127
PID 4164 wrote to memory of 4412	4164	Khfkfedn.exe	128
PID 4412 wrote to memory of 2076	4412	Kkegbpca.exe	129
PID 2076 wrote to memory of 5012	2076	Kopcbo32.exe	130
PID 5012 wrote to memory of 3728	5012	Kaopoj32.exe	131
PID 3728 wrote to memory of 1984	3728	Kdmlkfjb.exe	132
PID 1984 wrote to memory of 3688	1984	Khihld32.exe	133
PID 3688 wrote to memory of 3856	3688	Kkgdhp32.exe	134
PID 3856 wrote to memory of 792	3856	Kocphojh.exe	135
PID 792 wrote to memory of 4288	792	Kaaldjil.exe	136
PID 4288 wrote to memory of 4704	4288	Kemhei32.exe	137
PID 4704 wrote to memory of 3128	4704	Khkdad32.exe	138
PID 3128 wrote to memory of 4068	3128	Lkiamp32.exe	139
PID 4068 wrote to memory of 3424	4068	Loemnnhe.exe	140
PID 3424 wrote to memory of 4592	3424	Lbqinm32.exe	141
PID 4592 wrote to memory of 3480	4592	Leoejh32.exe	142
PID 3480 wrote to memory of 2184	3480	Lhmafcnf.exe	143
PID 2184 wrote to memory of 1196	2184	Llimgb32.exe	144
PID 1196 wrote to memory of 3332	1196	Lklnconj.exe	145
PID 3332 wrote to memory of 3228	3332	Lbcedmnl.exe	146
PID 3228 wrote to memory of 2192	3228	Leabphmp.exe	147
PID 2192 wrote to memory of 2084	2192	Lddble32.exe	148

C:\Users\Admin\AppData\Local\Temp\2026-08-01_cdb165842a062173e668ac5d65f67d49_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_cdb165842a062173e668ac5d65f67d49_elex_wannacry.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Windows\SysWOW64\Hgcmbj32.exe
  C:\Windows\system32\Hgcmbj32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Windows\SysWOW64\Hjaioe32.exe
    C:\Windows\system32\Hjaioe32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4564
  - - C:\Windows\SysWOW64\Hbiapb32.exe
      C:\Windows\system32\Hbiapb32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2536
    - - C:\Windows\SysWOW64\Icogcjde.exe
        
        C:\Windows\system32\Icogcjde.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4672
      - C:\Windows\SysWOW64\Igjbci32.exe
        
        C:\Windows\system32\Igjbci32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1692
        
        C:\Windows\SysWOW64\Ijiopd32.exe
        
        C:\Windows\system32\Ijiopd32.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4736
        
        C:\Windows\SysWOW64\Infhebbh.exe
        
        C:\Windows\system32\Infhebbh.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2300
        
        C:\Windows\SysWOW64\Inidkb32.exe
        
        C:\Windows\system32\Inidkb32.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2068
        
        C:\Windows\SysWOW64\Ijbbfc32.exe
        
        C:\Windows\system32\Ijbbfc32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3144
        
        C:\Windows\SysWOW64\Jnnnfalp.exe
        
        C:\Windows\system32\Jnnnfalp.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4420
        
        C:\Windows\SysWOW64\Janghmia.exe
        
        C:\Windows\system32\Janghmia.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3832
        
        C:\Windows\SysWOW64\Jdmcdhhe.exe
        
        C:\Windows\system32\Jdmcdhhe.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3052
        
        C:\Windows\SysWOW64\Jldkeeig.exe
        
        C:\Windows\system32\Jldkeeig.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5116
        
        C:\Windows\SysWOW64\Jdopjh32.exe
        
        C:\Windows\system32\Jdopjh32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1248
        
        C:\Windows\SysWOW64\Jhkljfok.exe
        
        C:\Windows\system32\Jhkljfok.exe
        16⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4112
        
        C:\Windows\SysWOW64\Jlfhke32.exe
        
        C:\Windows\system32\Jlfhke32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2576
        
        C:\Windows\SysWOW64\Jjihfbno.exe
        
        C:\Windows\system32\Jjihfbno.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3652
        
        C:\Windows\SysWOW64\Jnedgq32.exe
        
        C:\Windows\system32\Jnedgq32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1516
        
        C:\Windows\SysWOW64\Jacpcl32.exe
        
        C:\Windows\system32\Jacpcl32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4656
        
        C:\Windows\SysWOW64\Jeolckne.exe
        
        C:\Windows\system32\Jeolckne.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:212
        
        C:\Windows\SysWOW64\Jdalog32.exe
        
        C:\Windows\system32\Jdalog32.exe
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1296
        
        C:\Windows\SysWOW64\Jhmhpfmi.exe
        
        C:\Windows\system32\Jhmhpfmi.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1776
        
        C:\Windows\SysWOW64\Jjkdlall.exe
        
        C:\Windows\system32\Jjkdlall.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:440
        
        C:\Windows\SysWOW64\Jogqlpde.exe
        
        C:\Windows\system32\Jogqlpde.exe
        25⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3556
        
        C:\Windows\SysWOW64\Jaemilci.exe
        
        C:\Windows\system32\Jaemilci.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4524
        
        C:\Windows\SysWOW64\Jeaiij32.exe
        
        C:\Windows\system32\Jeaiij32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:768
        
        C:\Windows\SysWOW64\Jhoeef32.exe
        
        C:\Windows\system32\Jhoeef32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5008
        
        C:\Windows\SysWOW64\Jlkafdco.exe
        
        C:\Windows\system32\Jlkafdco.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:416
        
        C:\Windows\SysWOW64\Koimbpbc.exe
        
        C:\Windows\system32\Koimbpbc.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3252
        
        C:\Windows\SysWOW64\Kbeibo32.exe
        
        C:\Windows\system32\Kbeibo32.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1480
        
        C:\Windows\SysWOW64\Keceoj32.exe
        
        C:\Windows\system32\Keceoj32.exe
        32⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3516
        
        C:\Windows\SysWOW64\Kdffjgpj.exe
        
        C:\Windows\system32\Kdffjgpj.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4104
        
        C:\Windows\SysWOW64\Klmnkdal.exe
        
        C:\Windows\system32\Klmnkdal.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4100
        
        C:\Windows\SysWOW64\Kkpnga32.exe
        
        C:\Windows\system32\Kkpnga32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1152
        
        C:\Windows\SysWOW64\Kbgfhnhi.exe
        
        C:\Windows\system32\Kbgfhnhi.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2976
        
        C:\Windows\SysWOW64\Kajfdk32.exe
        
        C:\Windows\system32\Kajfdk32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3384
        
        C:\Windows\SysWOW64\Kdhbpf32.exe
        
        C:\Windows\system32\Kdhbpf32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3764
        
        C:\Windows\SysWOW64\Khdoqefq.exe
        
        C:\Windows\system32\Khdoqefq.exe
        39⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:612
        
        C:\Windows\SysWOW64\Kkbkmqed.exe
        
        C:\Windows\system32\Kkbkmqed.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3964
        
        C:\Windows\SysWOW64\Kbjbnnfg.exe
        
        C:\Windows\system32\Kbjbnnfg.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3760
        
        C:\Windows\SysWOW64\Kalcik32.exe
        
        C:\Windows\system32\Kalcik32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1872
        
        C:\Windows\SysWOW64\Kdkoef32.exe
        
        C:\Windows\system32\Kdkoef32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4500
        
        C:\Windows\SysWOW64\Khfkfedn.exe
        
        C:\Windows\system32\Khfkfedn.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4164
        
        C:\Windows\SysWOW64\Kkegbpca.exe
        
        C:\Windows\system32\Kkegbpca.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4412
        
        C:\Windows\SysWOW64\Kopcbo32.exe
        
        C:\Windows\system32\Kopcbo32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2076
        
        C:\Windows\SysWOW64\Kaopoj32.exe
        
        C:\Windows\system32\Kaopoj32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5012
        
        C:\Windows\SysWOW64\Kdmlkfjb.exe
        
        C:\Windows\system32\Kdmlkfjb.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3728
        
        C:\Windows\SysWOW64\Khihld32.exe
        
        C:\Windows\system32\Khihld32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1984
        
        C:\Windows\SysWOW64\Kkgdhp32.exe
        
        C:\Windows\system32\Kkgdhp32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3688
        
        C:\Windows\SysWOW64\Kocphojh.exe
        
        C:\Windows\system32\Kocphojh.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3856
        
        C:\Windows\SysWOW64\Kaaldjil.exe
        
        C:\Windows\system32\Kaaldjil.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:792
        
        C:\Windows\SysWOW64\Kemhei32.exe
        
        C:\Windows\system32\Kemhei32.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4288
        
        C:\Windows\SysWOW64\Khkdad32.exe
        
        C:\Windows\system32\Khkdad32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4704
        
        C:\Windows\SysWOW64\Lkiamp32.exe
        
        C:\Windows\system32\Lkiamp32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3128
        
        C:\Windows\SysWOW64\Loemnnhe.exe
        
        C:\Windows\system32\Loemnnhe.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4068
        
        C:\Windows\SysWOW64\Lbqinm32.exe
        
        C:\Windows\system32\Lbqinm32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3424
        
        C:\Windows\SysWOW64\Leoejh32.exe
        
        C:\Windows\system32\Leoejh32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4592
        
        C:\Windows\SysWOW64\Lhmafcnf.exe
        
        C:\Windows\system32\Lhmafcnf.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3480
        
        C:\Windows\SysWOW64\Llimgb32.exe
        
        C:\Windows\system32\Llimgb32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2184
        
        C:\Windows\SysWOW64\Lklnconj.exe
        
        C:\Windows\system32\Lklnconj.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1196
        
        C:\Windows\SysWOW64\Lbcedmnl.exe
        
        C:\Windows\system32\Lbcedmnl.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3332
        
        C:\Windows\SysWOW64\Leabphmp.exe
        
        C:\Windows\system32\Leabphmp.exe
        63⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3228
        
        C:\Windows\SysWOW64\Lddble32.exe
        
        C:\Windows\system32\Lddble32.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2192
        
        C:\Windows\SysWOW64\Llkjmb32.exe
        
        C:\Windows\system32\Llkjmb32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2084
        
        C:\Windows\SysWOW64\Lknjhokg.exe
        
        C:\Windows\system32\Lknjhokg.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4844
        
        C:\Windows\SysWOW64\Lbebilli.exe
        
        C:\Windows\system32\Lbebilli.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5140
        
        C:\Windows\SysWOW64\Lahbei32.exe
        
        C:\Windows\system32\Lahbei32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5180
        
        C:\Windows\SysWOW64\Ldfoad32.exe
        
        C:\Windows\system32\Ldfoad32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5220
        
        C:\Windows\SysWOW64\Lhbkac32.exe
        
        C:\Windows\system32\Lhbkac32.exe
        70⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5260
        
        C:\Windows\SysWOW64\Lkqgno32.exe
        
        C:\Windows\system32\Lkqgno32.exe
        71⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5300
        
        C:\Windows\SysWOW64\Lbhool32.exe
        
        C:\Windows\system32\Lbhool32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5336
        
        C:\Windows\SysWOW64\Lajokiaa.exe
        
        C:\Windows\system32\Lajokiaa.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5376
        
        C:\Windows\SysWOW64\Ldikgdpe.exe
        
        C:\Windows\system32\Ldikgdpe.exe
        74⤵
        System Location Discovery: System Language Discovery
        
        PID:5416
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5416 -s 400
        75⤵
        Program crash
        
        PID:5508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5416 -ip 5416
1⤵
PID:5484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Hbiapb32.exe

Path C:\Windows\SysWOW64\Hbiapb32.exe
Size 376KB
SHA256 ca339f2b4eaaf0afc8493f585c0a35f6c58bbdb4b32b896746a84b6d96f3d6ce
MD5 32fe1ed406e290ab4530ec6ee9b31ef4
SHA1 f37d033507c7a2ae2289cfaa9b98c94a3350ee78
SHA512 dfb0eef9a0abe2b8c3bf53651c0225ed835e099f9c0dfab344dccbd798348369400e06de6ee10cd5d8cfaf379a87751ba80e41f01a56f343edb941ae0cca7917
SSDEEP 6144:58NbHIC7oQ0IV/Atl/AtW1OE43V1+25CzRoQ0Ibl4HdE43V1+2T:58R50I2mi4lCzb0IF4X
TLSH
T1B284383E9E768A91C09910FF00A31A94E250E7BD0DE58F35FED2FA491A36AC3DC67154
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hgcmbj32.exe

Path C:\Windows\SysWOW64\Hgcmbj32.exe
Size 376KB
SHA256 39fad08db3222fb9b455c887331d157bc5c4054a40573c9e53311d44b63bdc61
MD5 6971de54325605cbaf0bcd7d6ef6de3b
SHA1 0c7808bc670d2a34a87233f39e7c80a954409a46
SHA512 9073b44e07dcd40c28ddf847d8acbbf13006b442b49e596a07b2f37af5a25be6e842e8af7d08c05ce9ccd8597a7f788f852198ec1adc37369835bdb9d4ffd030
SSDEEP 6144:iRJOhqTC7oQ0IV/Atl/AtW1OE43V1+25CzRoQ0Ibl4HdE43V1+2T:iehJ50I2mi4lCzb0IF4X
TLSH
T18984172DEE728A42C49810FF00E326A4A164D77D0DE9AF7DFED4FA691A351C3D827194
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hjaioe32.exe

Path C:\Windows\SysWOW64\Hjaioe32.exe
Size 376KB
SHA256 9f77682d967c7adfb684f438f64643b95281bc8df7e6b6b32096893617c95433
MD5 13f0f79db5cc66012151d34f54d15dd5
SHA1 ace62b34580ffce8ba98f5e51ac00206b6ad6be1
SHA512 b72256963ff1cd3de46038cd81a364fc6e7dfe4b944cf2cbd3bbf3a49159934210825ef26c0abdfd32fe7af06cec59cd6a4ca5499f3cab35b466ab0ed7939709
SSDEEP 6144:QfzhoI4C7oQ0IV/Atl/AtW1OE43V1+25CzRoQ0Ibl4HdE43V1+2T:Q7hoW50I2mi4lCzb0IF4X
TLSH
T11684382EDEB28B81E05410FF80631698E164E7BD0DE58FB5BED0FA491AB61C3DC5B254
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Icogcjde.exe

Path C:\Windows\SysWOW64\Icogcjde.exe
Size 376KB
SHA256 b0506aa3d1efc39dbc72f88abd64b3815b6fcf98f7dc0f5f37204a608547bbfe
MD5 97e479ce3ef77b6b67595b7ede0c888d
SHA1 e07cf1e905094803e97487d9653c9218cb400eef
SHA512 6363e9a5d800cf451dda8c2753f251066af64a30df5c5b896177ebf66ee900a9aecdf6f94152d0d48cd99c25060740dbb09b703f93accfdb0d7103b9fb5e5bc7
SSDEEP 6144:osRGE/JC7oQ0IV/Atl/AtW1OE43V1+25CzRoQ0Ibl4HdE43V1+2T:osRt850I2mi4lCzb0IF4X
TLSH
T17484062DAE768E92C09810FF20E316D8A154E6BD0DE58F767ED0F7491B26DC3D81B294
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Igjbci32.exe

Path C:\Windows\SysWOW64\Igjbci32.exe
Size 376KB
SHA256 e5a1c8bc7bcdba83ce01eac29d8f3caa716495b151ea33b40fd182280b79d2b1
MD5 2d268ce7565745873b083f5485a497b4
SHA1 20e0ffe96859200401a5bd6238dbe5b9c31bbd48
SHA512 2a0e8b90b2ea3a514ff3f52fce8063366e2759d208001d50f092b07a859e9b549bb8868aaf8974e8ba024fa84ac6cb94c83c5f45e63ec1cd2060dbd364792998
SSDEEP 6144:1QR0E0YC7oQ0IV/Atl/AtW1OE43V1+25CzRoQ0Ibl4HdE43V1+2T:1np50I2mi4lCzb0IF4X
TLSH
T1B884296DFE728A81E09924FF80A31698E154E77D0DE98F397ED1F6092A361C3DC17258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ijbbfc32.exe

Path C:\Windows\SysWOW64\Ijbbfc32.exe
Size 376KB
SHA256 dbf65cd415aa8bbde4f680d1c6136a0ef6cff65f3b42ee2448cbc2ad332b04aa
MD5 98446ba0cb3651d057a9dca82c9a1284
SHA1 79fcd92e35a5a8105690b6607645ddf7340c220c
SHA512 0a72195a7f2762f2ea5b1067b9dcf5b82c181157efc54cad83d2b6f91da956f340b47e2250e35741f7e25aed647fc6f636aa6d5140e166301a23b18ac82eb0e1
SSDEEP 6144:JadkH/j/FU7R/18C7oQ0IV/Atl/AtW1OE43V1+25CzRoQ0Ibl4HdE43V1+2T:JDfY750I2mi4lCzb0IF4X
TLSH
T1F084392DBE768A81C09910FF006B1298E154EABD8DF98F75BED0F649193A3CBDE17114
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ijiopd32.exe

Path C:\Windows\SysWOW64\Ijiopd32.exe
Size 376KB
SHA256 b189b2cf03442ea9573279ca3c09e08fb19dfb65241634e8ae98be698b7dc895
MD5 92d389eef5394647dc3159ddb21f8f9c
SHA1 ceebba4b533026da031e7d477687f2312dfa2e94
SHA512 6dfb3fcb202aa8f7a13293158c71b833e495adda40b8c9cd07a3b75814d522505e7d5a0fab18204b3238a1364ed092c58508cc49a9e8a9a0611568a9a5da6e22
SSDEEP 6144:kUU4SUniC7oQ0IV/Atl/AtW1OE43V1+25CzRoQ0Ibl4HdE43V1+2T:HU4l50I2mi4lCzb0IF4X
TLSH
T1628439AD9E728AC1C45810FF00A31696A854D3BD0DE58F75BEE2F60D2A3A2E3DC571D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Infhebbh.exe

Path C:\Windows\SysWOW64\Infhebbh.exe
Size 376KB
SHA256 ca46662b55a4327df6f1360b39719604a8ab2d42ed2ca25abe1a60271a0bbb07
MD5 c24e0eb162ef6e6c8248b90abeb9231f
SHA1 61a46613885d1c23a370fd984437aa865e3c6163
SHA512 22fa4be1a45d43e03f7467259ea6c6d0bcf911e398880a8bed1d68b7bec68231fc73bf2f4a0564c0408714ac5bc37af31c91b6b87e5687e3d967cfad1e3b5986
SSDEEP 6144:abE4wjWqic/C7oQ0IV/Atl/AtW1OE43V1+25CzRoQ0Ibl4HdE43V1+2T:Yi450I2mi4lCzb0IF4X
TLSH
T1C884282D5E728A43C08910FF02631298E156E3BD0DE98F357EDCF64A1A363CBD86B156
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Inidkb32.exe

Path C:\Windows\SysWOW64\Inidkb32.exe
Size 376KB
SHA256 06fcd1cdc5aeb709bd29d95d0d8ed168474ca0c3b4be79bf3b1bd37c970ab3c1
MD5 b46b5568208f1314f432bb8154a5a83c
SHA1 487ec43faa08ee5978185be5ffe6db121c6a4ba9
SHA512 33f304d1f73f4519f2215fe512731ffa2bec8a53bfc936516337337beb4523ff1f008680ecca10f21688f7b0ae31ab2ce87e2ab809489974cd3710121684565e
SSDEEP 6144:gUARwEMFiC7oQ0IV/Atl/AtW1OE43V1+25CzRoQ0Ibl4HdE43V1+2T:V1f50I2mi4lCzb0IF4X
TLSH
T1A684283D5E36AA82C45810FF0063129EA158FBBE0DE58F75BED6F6491AB22C3DC1B154
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jacpcl32.exe

Path C:\Windows\SysWOW64\Jacpcl32.exe
Size 376KB
SHA256 c95a532f284b269a25cda8abf7b5d07cd54742c92b24efc2696d4f1958d0ba1b
MD5 5c78ba8cc4fe12c91ece3d3248c754f7
SHA1 50e20d6b8a00a9b272deabc13de18250e4fb383d
SHA512 6c4cd896bd4090a3005a8a7be15f892f4fc939787eccc7fbaeb34d93d9524a762066cea8317176f6d9834f7b9594e63c2cc1593bb676d702c33501d5ac99bb8a
SSDEEP 6144:HDAmzOwOgxsxiyC7oQ0IV/Atl/AtW1OE43V1+25CzRoQ0Ibl4HdE43V1+2T:HDAmzOwOW50I2mi4lCzb0IF4X
TLSH
T19284492D9E368A92D09810FF00A31698E160E7BD0DE58F79BED6F609DA3E2C7DC17154
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jaemilci.exe

Path C:\Windows\SysWOW64\Jaemilci.exe
Size 376KB
SHA256 d2d072414c6dabd5e64403ce3724961f885139ce8ca87703d01445b80dda5746
MD5 655a0adff37e4d7e4efba6a1564ad810
SHA1 fe875721df9ecae7e9cb9ac07d7423787ee66f1b
SHA512 983abcd23147843b8452bbee5c0a63c61c1275c8941c00d7090399433e14308644d94013959b3a7317d4a4eef763246d216f447f8804aa5247caf2a42ee580c7
SSDEEP 6144:GjlX5pC7oQ0IV/Atl/AtW1OE43V1+25CzRoQ0Ibl4HdE43V1+2T:4lq50I2mi4lCzb0IF4X
TLSH
T1BB84286DAE768AD1C05A12FF00631294A1B0E6BC2DE58F7DBEE0FB895A351C3DC17116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Janghmia.exe

Path C:\Windows\SysWOW64\Janghmia.exe
Size 376KB
SHA256 a50036b5091641f215741dc93f7f14ae449067a60c0a3d7a4aa0ab40a80d1867
MD5 41e77b189b30ecc2147938ae03110371
SHA1 bc586e3e4bfee56735c7f6177fe8411a315b6b97
SHA512 13f58a30677185af25e01d4452422219046aeefab5259a5d4ca4f32e9d9a7c1cc72eceb5817ccd8190a33af64f6aca650bb1e69c7e285eebe40e7501501556f9
SSDEEP 6144:tyLSSIRC7oQ0IV/Atl/AtW1OE43V1+25CzRoQ0Ibl4HdE43V1+2T:UrN50I2mi4lCzb0IF4X
TLSH
T12E84262D9E328A81D09910FF04A313A8E164E7BD8DE59F7DBED0F7091AB62CBD817154
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jdalog32.exe

Path C:\Windows\SysWOW64\Jdalog32.exe
Size 376KB
SHA256 8500e987367af5c0be91d0d0cb75ce41febe36a45a9a736e5ad3961b5115efa3
MD5 23fd9e3c218b25e7e4d5ef2d01e83def
SHA1 176252efaa04bcf60ba258e8b4d80e5df74cdc96
SHA512 bba508110bdc4cb57aa5b825f4b26b775d4e3c30eae1f4cd90e221db1d5eddf3d225d765b728c9a84de7fcca65cfaf1183a71444e7a7c2b357b0ca7398891e92
SSDEEP 6144:xIU0zT0UC7oQ0IV/Atl/AtW1OE43V1+25CzRoQ0Ibl4HdE43V1+2T:e850I2mi4lCzb0IF4X
TLSH
T1F284076DAE768E81C45814FF03A32698B154F2BD0DE58F39BED0F6491A362C3DC971A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jdmcdhhe.exe

Path C:\Windows\SysWOW64\Jdmcdhhe.exe
Size 376KB
SHA256 c6d410732d7c98e8caa0b9151ea53b9d8f8e9975ef15c403109dd854872a9ea5
MD5 dba357ab16e409f459a9834c0a08f81a
SHA1 a5fa121838e60ce6bd1a87f052daac4bbb9fd6a5
SHA512 19308e6ae3713158bec6111df749dcc149f68a2aae9450e67ca9be46a54e074e01607459cde7c3bd75b746346c7b9f6bb953e7ae4f90cf1a1ff04c1611fb4bc4
SSDEEP 6144:htDbB6C7oQ0IV/Atl/AtW1OE43V1+25CzRoQ0Ibl4HdE43V1+2T:ht50I2mi4lCzb0IF4X
TLSH
T1F084282D9E768A61E49910FF00631298E1B4E77C0DF59F7DBEE0F6092A362CBE817154
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jdopjh32.exe

Path C:\Windows\SysWOW64\Jdopjh32.exe
Size 376KB
SHA256 2e534b0c9988d63ebfc55f835e1b228680c11b04ceb67bb092454963904262e8
MD5 ec1f135011f78679bc5af430ae8bd861
SHA1 097f2d37a6d193ecab101e80c37ae98c21609adc
SHA512 8fc3d172d65a21c6ecea95265587d9d880464b7205e99dd546a9267e137ab6ef72e4725e68dfd08412c612bae0f5b9b211f48c64a13de57c6e51caf0128290e9
SSDEEP 6144:0r8C7oQ0IV/Atl/AtW1OE43V1+25CzRoQ0Ibl4HdE43V1+2T:O50I2mi4lCzb0IF4X
TLSH
T1DC84182DAEB68A81C49910FF00F3169AA194FB7D2DE68F35BED0F7491A351C3D82B154
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jeaiij32.exe

Path C:\Windows\SysWOW64\Jeaiij32.exe
Size 376KB
SHA256 5cad9b49938b5e09514ba039222e5dd05c8de684ac575fc8f4539255bbfc7881
MD5 370ae021fb11242321dbbc9b41e3e32c
SHA1 2b86ac8c0d8e3a7c2c427ce07f9690d6862111c4
SHA512 c967056d15c6f273bb8d18d3e090b4f5d422d69eeea0bb021ecdf05f0b9625b1144913208bc98bf3dd4db116a67070d60d4ed543368128e417d67162de6eda6a
SSDEEP 6144:rWIBBKDRC7oQ0IV/Atl/AtW1OE43V1+25CzRoQ0Ibl4HdE43V1+2T:rjBt50I2mi4lCzb0IF4X
TLSH
T15884382D5F36AA81C69924FF01E31698E1A4E7BD0DE98F397ED0F6491A322C3DC17158
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jeolckne.exe

Path C:\Windows\SysWOW64\Jeolckne.exe
Size 376KB
SHA256 badf4a9dc824190c8281c66841b90aab8672a29d52a4b52fdf1ca74e5b3b1377
MD5 e4ec9d6cce693d658473d62b050a6b8d
SHA1 d05614042733e489e1f8eed11205a5f468b2e6ac
SHA512 1a85fdb8bb028d50fcbfbb1c6cf01a57f81db637bf14bc0ec9ee24b0a01469f0443882b1c37207f0083c54b28721eb5c0baadd7cbd7a26b6313053f448263135
SSDEEP 6144:Lv1JulkRcC7oQ0IV/Atl/AtW1OE43V1+25CzRoQ0Ibl4HdE43V1+2T:Lv/ui50I2mi4lCzb0IF4X
TLSH
T12884062D5E368A41C4981CFF00A312D4B1E2E6BD09E58F76BFD4F6491A2B2C3DC9B954
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jhkljfok.exe

Path C:\Windows\SysWOW64\Jhkljfok.exe
Size 376KB
SHA256 fcd08b272ce3da7ce6660467afe20fcfcd58d5166e776b38478b2a78a4cf3466
MD5 fbc60f3bfd79f2880674b1535364ea43
SHA1 3d919c2ad2d9cce0853d18c828c9f32342241f16
SHA512 9fa1703220169eaa7e8c7800b090b25a90fd3386e6ea724b82a7bde76029e3d906bdec3541dc771f53c546c5b0916eb1e99da579e91f5d30e379e488eb5d5070
SSDEEP 6144:NipiiIUlpHC7oQ0IV/Atl/AtW1OE43V1+25CzRoQ0Ibl4HdE43V1+2T:NiprIsY50I2mi4lCzb0IF4X
TLSH
T18184172DAE368B81C04498FF00A316A4B164D2BD1EE5CF75BEF8F6092E359C3D897156
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jhmhpfmi.exe

Path C:\Windows\SysWOW64\Jhmhpfmi.exe
Size 376KB
SHA256 431cc22ff6aa774cc0631c304c107162e5e1b68f220387f44ce7ba7a42b23732
MD5 fda64589a36f033ee0bac5bec9e007dd
SHA1 a3a8a11cb20c9904f087f7c37c8df988bbd83e61
SHA512 ce503ed4e86d1b47cad168ad4761e2cb484bad32dbf9b3dc66d99b830bc1ecb030b6a040d081fc18d2b0b3e6baaba85331f1356a2815f38fe376ec011e4dbb28
SSDEEP 6144:odNO/C7oQ0IV/Atl/AtW1OE43V1+25CzRoQ0Ibl4HdE43V1+2T:c50I2mi4lCzb0IF4X
TLSH
T1C984382DAE768AD6C05820FF01A312D8A194E7BD0DE58F397ED0F65A1A361C3EC971D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jhoeef32.exe

Path C:\Windows\SysWOW64\Jhoeef32.exe
Size 376KB
SHA256 93b12a2dc8cf20e905f011a4ec5833ae047fba4fd382e913d532d2ad6ce396f3
MD5 c90ec233a655279a3532e3929f156e5f
SHA1 72116311668e94a38caa69bca082ede67264dabd
SHA512 f55bbad62b2cffa29059b4bf56f1a1e45a5b10da4560ee1263cde8b12011d269d1ee3515aa6e33630056ca67ecafaab4eec1948ee9797ea0c96171093e47aea6
SSDEEP 6144:r65sWkq/GaqgfC7oQ0IV/Atl/AtW1OE43V1+25CzRoQ0Ibl4HdE43V1+2T:r65sWkq/GPz50I2mi4lCzb0IF4X
TLSH
T14684176D9E728A81C89918FF00A327A4A156E7BD0DE98F36FED0F64D1A361C3DC1B154
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jjihfbno.exe

Path C:\Windows\SysWOW64\Jjihfbno.exe
Size 376KB
SHA256 478f2cd528329cee9477e91132c099f6486e19ff177bcd4706f29a68c62ecbfd
MD5 aff64b0e1da669e0a417e3aac86336b9
SHA1 6e728e5ccf261df4231cf5a1fc237511009b596d
SHA512 a7ddff80f82a11c276cf0260ef8a07d8cb739e334577ff3709825e8e5d7e0e1f746cea92288090c6a8150272e401c9ddb4911d7c3b76210a8a0873672dfe7f9c
SSDEEP 6144:6ij3zBRLAC7oQ0IV/Atl/AtW1OE43V1+25CzRoQ0Ibl4HdE43V1+2T:jj3VRP50I2mi4lCzb0IF4X
TLSH
T10D84182DAE724A53C4D810FF00B33694A064D6BD1DE58F76BED4F6892A361CBD8172B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jjkdlall.exe

Path C:\Windows\SysWOW64\Jjkdlall.exe
Size 376KB
SHA256 f360da83c161d10086b3e4a12494a14bead464faf3f64fa87711eba895623152
MD5 8887e8c7bf2c06bd2c616fd993fd9de7
SHA1 113ecca96d967272c1ea5c0b0812b9484be890fa
SHA512 ff0391f1c81f0587b3202406d8aff52bc64faf51d79201721366e9dbb4e6ffa86ded87966edc4ae86e7a9b7f6e4a572d0ee68b0c091a0d33ae1c8decfd693c90
SSDEEP 6144:VWPshA9C7oQ0IV/Atl/AtW1OE43V1+25CzRoQ0Ibl4HdE43V1+2T:VWEht50I2mi4lCzb0IF4X
TLSH
T15684162D5F368AD2E49810FF00A312E4A154EEBD0DE98FB5BED4F64A1A362C3D877154
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jldkeeig.exe

Path C:\Windows\SysWOW64\Jldkeeig.exe
Size 376KB
SHA256 85ea92abab9f5cbebc71f3c03213c006cd3c6218b70f2ef81e335399bc725070
MD5 445db0d1febffdd2f80e75492adba630
SHA1 7bd2d89adba3f1d43cb21a6b03eb018a67c728ff
SHA512 0a4425e0bf98e8b07415b21a0b178658b750d5f95244fbe48c4300d7200fe29ef66203332c07dcb40cf73d577baec59d8f1f44f45ee4592fdf32d284140cefff
SSDEEP 6144:kWfC7oQ0IV/Atl/AtW1OE43V1+25CzRoQ0Ibl4HdE43V1+2T:kl50I2mi4lCzb0IF4X
TLSH
T13884176D5E768A82C49810FF02A31B98A194E7FD0DF98F35FED0F6491A261C3D89B174
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jlfhke32.exe

Path C:\Windows\SysWOW64\Jlfhke32.exe
Size 376KB
SHA256 907b4d02d9e0ee7f1f1e976bb3a858a1577a39ea56e33b8afd07e194d0346a67
MD5 20a063ca332597795daae53aae473955
SHA1 f45ceb3d58cb7693148405ab3b13c2a4697aeaed
SHA512 20acf1ea94e1f1aa0d81e8c3dd75b0f54b7088d006b44171f68aea34b28700d5c7784c1f563abeba7382f30925843bc6b2f7ac832077a2e8accb177b2097fafd
SSDEEP 6144:0+VC21ipVmgiC7oQ0IV/Atl/AtW1OE43V1+25CzRoQ0Ibl4HdE43V1+2T:TVC21vY50I2mi4lCzb0IF4X
TLSH
T190846B6E9E768A4AC09810FF00A39698E158E7BD2DE58F35BFD0F6691A3D2C3DC47054
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jlkafdco.exe

Path C:\Windows\SysWOW64\Jlkafdco.exe
Size 376KB
SHA256 80f7d44237f22998a4fd9fb6455e3bda88b140e7ca2e4610d0431b16faad128c
MD5 dedaf6aa7f2e7568347c327e96e5760b
SHA1 aed3294370f1928cfb6314052e901b66a2ec1737
SHA512 1639896e00ea3af37ef9e6ddcfbfd691bea6172b67eda66773643c1fd95c4a035cc651f13241e2242f477242b34c5139661542adfeda67226795346a89dd27ee
SSDEEP 6144:DHxAD867C7oQ0IV/Atl/AtW1OE43V1+25CzRoQ0Ibl4HdE43V1+2T:DHxADM50I2mi4lCzb0IF4X
TLSH
T19F84392DAE728A85C09810FF00A31698E166E7BD0DE58F757EC0F64A1B362C7DC1795E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jnedgq32.exe

Path C:\Windows\SysWOW64\Jnedgq32.exe
Size 376KB
SHA256 bdda2285c5331ce33c21757da4be2bd5e879f904c7f35e2eb6d2e1800f302f8f
MD5 09700ad82296b0b769804cd06157802f
SHA1 5be93412162a3ee132222e0d60546bb8d7ad59a6
SHA512 fe3a4928c51cda4e74fd3fa5afd081cf5e54a3b5568e6de3dc9602d20ddbd781435ffdcb291c4a686fd12fcca2d5672f13af248e2061fae0c0305223bdc905a5
SSDEEP 6144:tNubpRC7oQ0IV/Atl/AtW1OE43V1+25CzRoQ0Ibl4HdE43V1+2T:zube50I2mi4lCzb0IF4X
TLSH
T1CE8439AD9E72AA83E05910FF00B31298E150E7BD2DE58FB57ED4F6091A322C3DC97954
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jnnnfalp.exe

Path C:\Windows\SysWOW64\Jnnnfalp.exe
Size 376KB
SHA256 06d5a25f85654bcdba9479691cfd21dae31e5da392b3aa965f34cbb96fa44112
MD5 580b60300d9b2afc2ad893c2525c48b3
SHA1 d2e2b25e21e33155fe09c7a1c917d0fecb0be820
SHA512 7e90ede24e39e9be90247244aa998f23c8025ebd240b2b3a44f09076751c5323ad37d4bf7b5852722b84a46128742e439ec6e505dfa1b5fec32d2e7d57344636
SSDEEP 6144:WY5ndDC7oQ0IV/Atl/AtW1OE43V1+25CzRoQ0Ibl4HdE43V1+2T:WYtE50I2mi4lCzb0IF4X
TLSH
T1D784172E9E76CA81C09D10FF00631698A161E7BE0DE58F75BFD0F6093A26DC3DA1B156
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jogqlpde.exe

Path C:\Windows\SysWOW64\Jogqlpde.exe
Size 376KB
SHA256 3a11c6f70f1723cf66eabdd4ac68b5a242112b86b30c505e497a5bf610b041fb
MD5 6406f168eb62b555ca2d4470960e5776
SHA1 6c8445669a83fdf7bfa789f0d8e25533803d9b75
SHA512 f744479193b25ab5ae9dd6ecefcf1b9dd93581f2e3743b38ef3f9be18f733108cc6cb724d37941e68f0de76d281207f1cf4f36592977b42fb371a20cd29988ec
SSDEEP 6144:S0+I4kNyE4BEC7oQ0IV/Atl/AtW1OE43V1+25CzRoQ0Ibl4HdE43V1+2T:SvI4kNyE4Z50I2mi4lCzb0IF4X
TLSH
T15184372D9E76CA92C49810FF20A31A9AA254E7BD0DE58F75BED0F6093B362C3DC17154
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kbeibo32.exe

Path C:\Windows\SysWOW64\Kbeibo32.exe
Size 376KB
SHA256 c8471e72c355cb1c86f4e741493b5f409228caa681f30c1cd8a5be13d24046b4
MD5 46326f1b85d07774ee3ed7b29cc8d9f3
SHA1 11e7b730986f194affda7f7b614ba061bd56a743
SHA512 1a84a86624c151cf762f28418bce5d32f012a45eb80ceff4f4a43ba1aa77fa4f0b07ca92c0322d5b0e3ca14af4fe11b1a0fe187e4a70ece64ec6dc90201c9ae2
SSDEEP 6144:fxsrnp7PiC7oQ0IV/Atl/AtW1OE43V1+25CzRoQ0Ibl4HdE43V1+2T:fkpR50I2mi4lCzb0IF4X
TLSH
T1C384272D6E33AA81CC9914FF0063D698A150E3BD0DE58F3DBEC6F6491A2A5C3DC67194
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kdffjgpj.exe

Path C:\Windows\SysWOW64\Kdffjgpj.exe
Size 376KB
SHA256 65f214a6fc28be2d3fa5e64358b10b83142d37eab53f5a6812f05df093d0394b
MD5 c212352d3fb0bed42ad5ad017ea17d9c
SHA1 d1fa8697870ec37214ae2f82ec9e0e30c507e147
SHA512 ba9a983b9dbcad6493f3b60ca1908fa041ff4a5171624cda0c23302bd262693c3de19901a61e2facc20d7efa58714d322e8e2b041b09cde045deb20333c24dfd
SSDEEP 6144:+YEEjy9TSdPzBSWaZC7oQ0IV/Atl/AtW1OE43V1+25CzRoQ0Ibl4HdE43V1+2T:He9TSdPlSW750I2mi4lCzb0IF4X
TLSH
T115844A2D5E728A53C09890FF20A33298E154EBBD8DE58FB97EC8F6491A361C7DC17158
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Keceoj32.exe

Path C:\Windows\SysWOW64\Keceoj32.exe
Size 376KB
SHA256 d778b2d567933c6acc8f08d99eb7af7c2891eb7db0fe758d0b46a578a950c8c5
MD5 85ce039369d8949ac06b0917fe0400de
SHA1 85d85bb6504d8c73971dcd6972136742fd816d4d
SHA512 49c352043e96faa371007976b1823cd5218a614393687eeb93fc68d8435e989e3db720ee99a2e975aa4250043d6f590079f6a3231132cab3468d480fbe0af4ad
SSDEEP 6144:wnQquxaZC++C7oQ0IV/Atl/AtW1OE43V1+25CzRoQ0Ibl4HdE43V1+2T:KYaIq50I2mi4lCzb0IF4X
TLSH
T1A284062FAE768A92C49910FF00B31298E1A4D67D0DE58F75BED2FA491A371C3DC17258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Koimbpbc.exe

Path C:\Windows\SysWOW64\Koimbpbc.exe
Size 376KB
SHA256 0b0326dad6fb4c64bc4cbd316dbddeadc291971e8dc2627ebeb0fdcc87689480
MD5 4361d6a77a678dae5a0f7d9512b73eca
SHA1 85f7e033c890ffa2a3853dae95c7ad04271cd285
SHA512 64f0560360e7c156bb96087a2fc208c2882ea67567ee24b71789af3df6f33a2ed3c3e7bbaf73690cf7e9c1aa56e95569dcd7af299d957c0c42c05d14cac44e97
SSDEEP 6144:w/fmFAC7oQ0IV/Atl/AtW1OE43V1+25CzRoQ0Ibl4HdE43V1+2T:w2l50I2mi4lCzb0IF4X
TLSH
T1F584062F9EB68A92C09D90FF007312A4A164E6BD0DE5CF35BED0F7091A262C3DD57A54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/212-164-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/416-226-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/440-188-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/612-294-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/792-372-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/792-543-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/1152-270-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/1196-525-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/1196-425-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/1248-116-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/1296-172-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/1480-242-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/1516-148-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/1672-8-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/1692-45-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/1776-180-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/1872-312-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/1984-549-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/1984-354-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/2068-65-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/2076-336-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/2084-448-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/2084-517-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/2184-527-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/2184-419-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/2192-519-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/2300-62-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/2536-25-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/2576-132-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/2976-276-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/3052-101-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/3128-537-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/3228-437-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/3228-521-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/3252-234-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/3332-431-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/3332-523-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/3384-282-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/3424-533-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/3424-401-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/3480-529-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/3480-413-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/3516-250-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/3556-196-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/3652-140-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/3688-360-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/3688-547-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/3728-348-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/3728-551-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/3760-306-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/3764-288-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/3832-100-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/3856-366-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/3856-545-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/3964-300-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4004-0-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4004-1-0x0000000000431000-0x0000000000432000-memory.dmp

Download

memory/4068-535-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4068-395-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4100-264-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4104-258-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4112-124-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4164-324-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4288-378-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4288-541-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4412-330-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4420-79-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4500-318-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4564-24-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4592-531-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4592-407-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4656-156-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4672-33-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4704-384-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4704-539-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4736-53-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4844-454-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4844-515-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/5008-218-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/5012-342-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/5116-103-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/5140-460-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/5140-513-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/5180-466-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/5180-511-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/5220-509-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/5220-472-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/5260-507-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/5300-483-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/5300-505-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/5336-503-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/5336-489-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/5376-501-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/5376-495-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/5416-499-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/5416-497-0x0000000000400000-0x000000000045E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads