berbew | 97fcd051bd009bd2011c11a56805269cd66e6969e484577b29b50fe871bc6425

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 20:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_76345005f17af5cb65a7800fe8f41dc6_elex_wannacry.exe
Size 320KB
Sample260810-yy1ddaxdkd
SHA256 97fcd051bd009bd2011c11a56805269cd66e6969e484577b29b50fe871bc6425
MD5 76345005f17af5cb65a7800fe8f41dc6
SHA1 0d12a65dd83f4e5e60e7fe612f49b58ca2eaed1a
SHA512 cef46a6b0d02da139f338615e22770c5f4eab3db814396d779ade6acfb7460a923e09beb247b371fc8cb6062c142ff9f71f6e00b4fce4bc52b116e112e063058
SSDEEP 3072:P5JybUeRTk+HiYxqwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:P5q9kmPxqV/Ah1G/AcQ///NR5fn
TLSH
T127641E5A2A7409EACEED2BB5AD0249D89141F8F114F1E13E6523DFDCD8E4EB2C815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odkjgm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqfdgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocdqcikl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjcbkbnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gdnjabab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hihbco32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ikmepj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpeibdfp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfanen32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgokflpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdjapphl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fcfhhk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbeinb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oqfdgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gdqgfbop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hkdbik32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imonol32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlhbja32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Npfkqpjk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Odmgmmhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnbeie32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdnjabab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gofkckoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klgqmfpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbmheomi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mmlphfed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdjapphl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fomhnmgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Immaimnj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmnlnfcb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onqbjccl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pgiojf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eocegn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gofkckoe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnlhod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oncopcqj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofqpje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pddmml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gohhik32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgokflpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmlphfed.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofqpje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pddmml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	2026-08-10_76345005f17af5cb65a7800fe8f41dc6_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kikafjoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnlhod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	2026-08-10_76345005f17af5cb65a7800fe8f41dc6_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gohhik32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpfdkiac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ikmepj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfeoip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kifhkkci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lplpcc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngkjbkem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eoollocp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hmoehojj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njlcdf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npfkqpjk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olaeqp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekqcfpmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fomhnmgp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jioajliq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmppmh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnbeie32.exe

Executes dropped EXE 64 IoCs

pid	Process
5684	Eojcao32.exe
364	Ekqcfpmj.exe
3116	Eoollocp.exe
2220	Eocegn32.exe
5212	Fcfhhk32.exe
1196	Fomhnmgp.exe
300	Fckacknf.exe
812	Gdnjabab.exe
4252	Gdqgfbop.exe
2316	Gofkckoe.exe
1092	Gfpcpefb.exe
5012	Gohhik32.exe
6076	Hmoehojj.exe
3428	Hkdbik32.exe
2680	Hihbco32.exe
2928	Hkhkdjkl.exe
5220	Hpfdkiac.exe
556	Ikmepj32.exe
1036	Immaimnj.exe
2308	Imonol32.exe
1096	Ildkpiqo.exe
2580	Ibncmchl.exe
2540	Imdgjlgb.exe
5832	Jbeinb32.exe
3640	Jioajliq.exe
3568	Jfeoip32.exe
5720	Kifhkkci.exe
2440	Klgqmfpj.exe
2728	Kfmejopp.exe
1556	Kikafjoc.exe
5372	Kpeibdfp.exe
2756	Kfanen32.exe
5732	Lplpcc32.exe
1952	Lmppmh32.exe
6140	Lbmheomi.exe
4320	Lpqioclc.exe
576	Lgkakm32.exe
2828	Lbabpn32.exe
5392	Mmgfmg32.exe
6108	Mgokflpj.exe
3684	Mdckpqod.exe
3628	Mmlphfed.exe
712	Mmnlnfcb.exe
5776	Midmcgif.exe
4988	Mdjapphl.exe
5896	Nnbeie32.exe
1368	Ngkjbkem.exe
2012	Nlhbja32.exe
1104	Njlcdf32.exe
5816	Npfkqpjk.exe
2060	Nebdighb.exe
3416	Ngbpbjoe.exe
2880	Nnlhod32.exe
4952	Nciahk32.exe
3544	Olaeqp32.exe
484	Ocknmjcf.exe
5876	Onqbjccl.exe
2596	Odkjgm32.exe
3036	Oncopcqj.exe
5944	Odmgmmhf.exe
5116	Olhlaoea.exe
5048	Ofqpje32.exe
4748	Oqfdgn32.exe
4212	Ocdqcikl.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Fpcpph32.dll	Imdgjlgb.exe
File created	C:\Windows\SysWOW64\Lhdceo32.dll	Jbeinb32.exe
File created	C:\Windows\SysWOW64\Lplpcc32.exe	Kfanen32.exe
File created	C:\Windows\SysWOW64\Mhkadh32.dll	Mmnlnfcb.exe
File created	C:\Windows\SysWOW64\Phefeg32.dll	Midmcgif.exe
File created	C:\Windows\SysWOW64\Kljgjdib.dll	Mdjapphl.exe
File created	C:\Windows\SysWOW64\Cahijaij.dll	Kifhkkci.exe
File created	C:\Windows\SysWOW64\Lehhhj32.dll	Kfanen32.exe
File opened for modification	C:\Windows\SysWOW64\Lpqioclc.exe	Lbmheomi.exe
File opened for modification	C:\Windows\SysWOW64\Ikmepj32.exe	Hpfdkiac.exe
File created	C:\Windows\SysWOW64\Ekqcfpmj.exe	Eojcao32.exe
File created	C:\Windows\SysWOW64\Olgbff32.dll	Eojcao32.exe
File created	C:\Windows\SysWOW64\Ipllghgi.dll	Eoollocp.exe
File opened for modification	C:\Windows\SysWOW64\Gdqgfbop.exe	Gdnjabab.exe
File created	C:\Windows\SysWOW64\Imonol32.exe	Immaimnj.exe
File created	C:\Windows\SysWOW64\Okbked32.dll	Immaimnj.exe
File created	C:\Windows\SysWOW64\Bkbakm32.dll	Imonol32.exe
File created	C:\Windows\SysWOW64\Clfdhpfj.dll	Lgkakm32.exe
File opened for modification	C:\Windows\SysWOW64\Mdckpqod.exe	Mgokflpj.exe
File created	C:\Windows\SysWOW64\Mmnlnfcb.exe	Mmlphfed.exe
File created	C:\Windows\SysWOW64\Mdjapphl.exe	Midmcgif.exe
File created	C:\Windows\SysWOW64\Biepoi32.dll	Nnlhod32.exe
File created	C:\Windows\SysWOW64\Gohhik32.exe	Gfpcpefb.exe
File opened for modification	C:\Windows\SysWOW64\Mgokflpj.exe	Mmgfmg32.exe
File opened for modification	C:\Windows\SysWOW64\Njlcdf32.exe	Nlhbja32.exe
File created	C:\Windows\SysWOW64\Ongopg32.dll	Npfkqpjk.exe
File opened for modification	C:\Windows\SysWOW64\Nciahk32.exe	Nnlhod32.exe
File opened for modification	C:\Windows\SysWOW64\Ocknmjcf.exe	Olaeqp32.exe
File created	C:\Windows\SysWOW64\Oqfdgn32.exe	Ofqpje32.exe
File opened for modification	C:\Windows\SysWOW64\Oqfdgn32.exe	Ofqpje32.exe
File opened for modification	C:\Windows\SysWOW64\Gohhik32.exe	Gfpcpefb.exe
File created	C:\Windows\SysWOW64\Jjefil32.dll	Gohhik32.exe
File opened for modification	C:\Windows\SysWOW64\Kfanen32.exe	Kpeibdfp.exe
File opened for modification	C:\Windows\SysWOW64\Lbmheomi.exe	Lmppmh32.exe
File opened for modification	C:\Windows\SysWOW64\Ngbpbjoe.exe	Nebdighb.exe
File opened for modification	C:\Windows\SysWOW64\Nnlhod32.exe	Ngbpbjoe.exe
File opened for modification	C:\Windows\SysWOW64\Ofqpje32.exe	Olhlaoea.exe
File created	C:\Windows\SysWOW64\Algaplmg.dll	Ocdqcikl.exe
File opened for modification	C:\Windows\SysWOW64\Eoollocp.exe	Ekqcfpmj.exe
File opened for modification	C:\Windows\SysWOW64\Immaimnj.exe	Ikmepj32.exe
File opened for modification	C:\Windows\SysWOW64\Mmgfmg32.exe	Lbabpn32.exe
File created	C:\Windows\SysWOW64\Pjcbkbnc.exe	Pcijoh32.exe
File opened for modification	C:\Windows\SysWOW64\Nebdighb.exe	Npfkqpjk.exe
File created	C:\Windows\SysWOW64\Jececi32.dll	Ofqpje32.exe
File created	C:\Windows\SysWOW64\Pcijoh32.exe	Pnlafaio.exe
File opened for modification	C:\Windows\SysWOW64\Jbeinb32.exe	Imdgjlgb.exe
File created	C:\Windows\SysWOW64\Lmppmh32.exe	Lplpcc32.exe
File opened for modification	C:\Windows\SysWOW64\Lmppmh32.exe	Lplpcc32.exe
File created	C:\Windows\SysWOW64\Lpqioclc.exe	Lbmheomi.exe
File created	C:\Windows\SysWOW64\Mmlphfed.exe	Mdckpqod.exe
File created	C:\Windows\SysWOW64\Naqhjb32.dll	Mdckpqod.exe
File opened for modification	C:\Windows\SysWOW64\Mdjapphl.exe	Midmcgif.exe
File created	C:\Windows\SysWOW64\Nlhbja32.exe	Ngkjbkem.exe
File opened for modification	C:\Windows\SysWOW64\Fckacknf.exe	Fomhnmgp.exe
File created	C:\Windows\SysWOW64\Pmklqblp.dll	Fckacknf.exe
File created	C:\Windows\SysWOW64\Ikmepj32.exe	Hpfdkiac.exe
File created	C:\Windows\SysWOW64\Immaimnj.exe	Ikmepj32.exe
File opened for modification	C:\Windows\SysWOW64\Ibncmchl.exe	Ildkpiqo.exe
File opened for modification	C:\Windows\SysWOW64\Jfeoip32.exe	Jioajliq.exe
File created	C:\Windows\SysWOW64\Pgnnkfll.dll	Lbabpn32.exe
File created	C:\Windows\SysWOW64\Midmcgif.exe	Mmnlnfcb.exe
File created	C:\Windows\SysWOW64\Hmoehojj.exe	Gohhik32.exe
File opened for modification	C:\Windows\SysWOW64\Hmoehojj.exe	Gohhik32.exe
File created	C:\Windows\SysWOW64\Qcnhngkp.dll	Hkdbik32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5636	3012	WerFault.exe	160

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jbeinb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olaeqp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdifhkni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gofkckoe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpqioclc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgokflpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofqpje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hihbco32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odmgmmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hpfdkiac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kfmejopp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kfanen32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocdqcikl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmdkmnkd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fcfhhk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gdnjabab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ildkpiqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onqbjccl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pddmml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fckacknf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gdqgfbop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gohhik32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfeoip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmppmh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngkjbkem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nciahk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ekqcfpmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibncmchl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpeibdfp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcijoh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eojcao32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkhkdjkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ikmepj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kifhkkci.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdjapphl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnbeie32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qfolkcpb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_76345005f17af5cb65a7800fe8f41dc6_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eocegn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbabpn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngbpbjoe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oncopcqj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkdbik32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Imdgjlgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnlafaio.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Immaimnj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Imonol32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lgkakm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njlcdf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npfkqpjk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocknmjcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odkjgm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eoollocp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lplpcc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdckpqod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmnlnfcb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Midmcgif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nebdighb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olhlaoea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jioajliq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqfdgn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gfpcpefb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klgqmfpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kikafjoc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gdqgfbop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ampdej32.dll"	Hmoehojj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jbeinb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jioajliq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cahijaij.dll"	Kifhkkci.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hihbco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lgkakm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ocknmjcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjaecj32.dll"	Olhlaoea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhjhln32.dll"	Pcijoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpkokb32.dll"	Pjcbkbnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gdqgfbop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lbmheomi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhkadh32.dll"	Mmnlnfcb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njlcdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Algaplmg.dll"	Ocdqcikl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmdkmnkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nocebkkf.dll"	Pgiojf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipllghgi.dll"	Eoollocp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejjgok32.dll"	Fomhnmgp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hpfdkiac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Imonol32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Midmcgif.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nebdighb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Maojmg32.dll"	Nciahk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Olaeqp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lanhgdgm.dll"	Gdqgfbop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gofkckoe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kifhkkci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kpeibdfp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mmgfmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ocknmjcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Onqbjccl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khaahimc.dll"	Odkjgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gdnjabab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hihbco32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pdifhkni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pmdkmnkd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Immaimnj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kfmejopp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Odmgmmhf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ofqpje32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pjcbkbnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlmcgbbp.dll"	Eocegn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fcfhhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Knboee32.dll"	Gofkckoe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gfpcpefb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hmoehojj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkbakm32.dll"	Imonol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lehhhj32.dll"	Kfanen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohbfmj32.dll"	Lmppmh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	2026-08-10_76345005f17af5cb65a7800fe8f41dc6_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	2026-08-10_76345005f17af5cb65a7800fe8f41dc6_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpcpph32.dll"	Imdgjlgb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jfeoip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jedodcbl.dll"	Jfeoip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lpqioclc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ngbpbjoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bddcep32.dll"	Oncopcqj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kfmejopp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nciahk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oncopcqj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Olhlaoea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pnlafaio.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5836 wrote to memory of 5684	5836	2026-08-10_76345005f17af5cb65a7800fe8f41dc6_elex_wannacry.exe	89
PID 5684 wrote to memory of 364	5684	Eojcao32.exe	90
PID 364 wrote to memory of 3116	364	Ekqcfpmj.exe	91
PID 3116 wrote to memory of 2220	3116	Eoollocp.exe	92
PID 2220 wrote to memory of 5212	2220	Eocegn32.exe	93
PID 5212 wrote to memory of 1196	5212	Fcfhhk32.exe	94
PID 1196 wrote to memory of 300	1196	Fomhnmgp.exe	95
PID 300 wrote to memory of 812	300	Fckacknf.exe	96
PID 812 wrote to memory of 4252	812	Gdnjabab.exe	97
PID 4252 wrote to memory of 2316	4252	Gdqgfbop.exe	98
PID 2316 wrote to memory of 1092	2316	Gofkckoe.exe	99
PID 1092 wrote to memory of 5012	1092	Gfpcpefb.exe	100
PID 5012 wrote to memory of 6076	5012	Gohhik32.exe	101
PID 6076 wrote to memory of 3428	6076	Hmoehojj.exe	102
PID 3428 wrote to memory of 2680	3428	Hkdbik32.exe	103
PID 2680 wrote to memory of 2928	2680	Hihbco32.exe	104
PID 2928 wrote to memory of 5220	2928	Hkhkdjkl.exe	105
PID 5220 wrote to memory of 556	5220	Hpfdkiac.exe	106
PID 556 wrote to memory of 1036	556	Ikmepj32.exe	107
PID 1036 wrote to memory of 2308	1036	Immaimnj.exe	108
PID 2308 wrote to memory of 1096	2308	Imonol32.exe	109
PID 1096 wrote to memory of 2580	1096	Ildkpiqo.exe	110
PID 2580 wrote to memory of 2540	2580	Ibncmchl.exe	111
PID 2540 wrote to memory of 5832	2540	Imdgjlgb.exe	112
PID 5832 wrote to memory of 3640	5832	Jbeinb32.exe	113
PID 3640 wrote to memory of 3568	3640	Jioajliq.exe	114
PID 3568 wrote to memory of 5720	3568	Jfeoip32.exe	115
PID 5720 wrote to memory of 2440	5720	Kifhkkci.exe	116
PID 2440 wrote to memory of 2728	2440	Klgqmfpj.exe	117
PID 2728 wrote to memory of 1556	2728	Kfmejopp.exe	118
PID 1556 wrote to memory of 5372	1556	Kikafjoc.exe	119
PID 5372 wrote to memory of 2756	5372	Kpeibdfp.exe	120
PID 2756 wrote to memory of 5732	2756	Kfanen32.exe	121
PID 5732 wrote to memory of 1952	5732	Lplpcc32.exe	122
PID 1952 wrote to memory of 6140	1952	Lmppmh32.exe	123
PID 6140 wrote to memory of 4320	6140	Lbmheomi.exe	124
PID 4320 wrote to memory of 576	4320	Lpqioclc.exe	125
PID 576 wrote to memory of 2828	576	Lgkakm32.exe	126
PID 2828 wrote to memory of 5392	2828	Lbabpn32.exe	127
PID 5392 wrote to memory of 6108	5392	Mmgfmg32.exe	128
PID 6108 wrote to memory of 3684	6108	Mgokflpj.exe	129
PID 3684 wrote to memory of 3628	3684	Mdckpqod.exe	130
PID 3628 wrote to memory of 712	3628	Mmlphfed.exe	131
PID 712 wrote to memory of 5776	712	Mmnlnfcb.exe	132
PID 5776 wrote to memory of 4988	5776	Midmcgif.exe	133
PID 4988 wrote to memory of 5896	4988	Mdjapphl.exe	134
PID 5896 wrote to memory of 1368	5896	Nnbeie32.exe	135
PID 1368 wrote to memory of 2012	1368	Ngkjbkem.exe	136
PID 2012 wrote to memory of 1104	2012	Nlhbja32.exe	137
PID 1104 wrote to memory of 5816	1104	Njlcdf32.exe	138
PID 5816 wrote to memory of 2060	5816	Npfkqpjk.exe	139
PID 2060 wrote to memory of 3416	2060	Nebdighb.exe	140
PID 3416 wrote to memory of 2880	3416	Ngbpbjoe.exe	141
PID 2880 wrote to memory of 4952	2880	Nnlhod32.exe	142
PID 4952 wrote to memory of 3544	4952	Nciahk32.exe	143
PID 3544 wrote to memory of 484	3544	Olaeqp32.exe	144
PID 484 wrote to memory of 5876	484	Ocknmjcf.exe	145
PID 5876 wrote to memory of 2596	5876	Onqbjccl.exe	146
PID 2596 wrote to memory of 3036	2596	Odkjgm32.exe	147
PID 3036 wrote to memory of 5944	3036	Oncopcqj.exe	148
PID 5944 wrote to memory of 5116	5944	Odmgmmhf.exe	149
PID 5116 wrote to memory of 5048	5116	Olhlaoea.exe	150
PID 5048 wrote to memory of 4748	5048	Ofqpje32.exe	151
PID 4748 wrote to memory of 4212	4748	Oqfdgn32.exe	152

C:\Users\Admin\AppData\Local\Temp\2026-08-10_76345005f17af5cb65a7800fe8f41dc6_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_76345005f17af5cb65a7800fe8f41dc6_elex_wannacry.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5836
- C:\Windows\SysWOW64\Eojcao32.exe
  C:\Windows\system32\Eojcao32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5684
- - C:\Windows\SysWOW64\Ekqcfpmj.exe
    C:\Windows\system32\Ekqcfpmj.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:364
  - - C:\Windows\SysWOW64\Eoollocp.exe
      C:\Windows\system32\Eoollocp.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3116
    - - C:\Windows\SysWOW64\Eocegn32.exe
        
        C:\Windows\system32\Eocegn32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2220
      - C:\Windows\SysWOW64\Fcfhhk32.exe
        
        C:\Windows\system32\Fcfhhk32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5212
        
        C:\Windows\SysWOW64\Fomhnmgp.exe
        
        C:\Windows\system32\Fomhnmgp.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1196
        
        C:\Windows\SysWOW64\Fckacknf.exe
        
        C:\Windows\system32\Fckacknf.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:300
        
        C:\Windows\SysWOW64\Gdnjabab.exe
        
        C:\Windows\system32\Gdnjabab.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:812
        
        C:\Windows\SysWOW64\Gdqgfbop.exe
        
        C:\Windows\system32\Gdqgfbop.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4252
        
        C:\Windows\SysWOW64\Gofkckoe.exe
        
        C:\Windows\system32\Gofkckoe.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2316
        
        C:\Windows\SysWOW64\Gfpcpefb.exe
        
        C:\Windows\system32\Gfpcpefb.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1092
        
        C:\Windows\SysWOW64\Gohhik32.exe
        
        C:\Windows\system32\Gohhik32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5012
        
        C:\Windows\SysWOW64\Hmoehojj.exe
        
        C:\Windows\system32\Hmoehojj.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:6076
        
        C:\Windows\SysWOW64\Hkdbik32.exe
        
        C:\Windows\system32\Hkdbik32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3428
        
        C:\Windows\SysWOW64\Hihbco32.exe
        
        C:\Windows\system32\Hihbco32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2680
        
        C:\Windows\SysWOW64\Hkhkdjkl.exe
        
        C:\Windows\system32\Hkhkdjkl.exe
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2928
        
        C:\Windows\SysWOW64\Hpfdkiac.exe
        
        C:\Windows\system32\Hpfdkiac.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5220
        
        C:\Windows\SysWOW64\Ikmepj32.exe
        
        C:\Windows\system32\Ikmepj32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:556
        
        C:\Windows\SysWOW64\Immaimnj.exe
        
        C:\Windows\system32\Immaimnj.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1036
        
        C:\Windows\SysWOW64\Imonol32.exe
        
        C:\Windows\system32\Imonol32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2308
        
        C:\Windows\SysWOW64\Ildkpiqo.exe
        
        C:\Windows\system32\Ildkpiqo.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1096
        
        C:\Windows\SysWOW64\Ibncmchl.exe
        
        C:\Windows\system32\Ibncmchl.exe
        23⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2580
        
        C:\Windows\SysWOW64\Imdgjlgb.exe
        
        C:\Windows\system32\Imdgjlgb.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2540
        
        C:\Windows\SysWOW64\Jbeinb32.exe
        
        C:\Windows\system32\Jbeinb32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5832
        
        C:\Windows\SysWOW64\Jioajliq.exe
        
        C:\Windows\system32\Jioajliq.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3640
        
        C:\Windows\SysWOW64\Jfeoip32.exe
        
        C:\Windows\system32\Jfeoip32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3568
        
        C:\Windows\SysWOW64\Kifhkkci.exe
        
        C:\Windows\system32\Kifhkkci.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5720
        
        C:\Windows\SysWOW64\Klgqmfpj.exe
        
        C:\Windows\system32\Klgqmfpj.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2440
        
        C:\Windows\SysWOW64\Kfmejopp.exe
        
        C:\Windows\system32\Kfmejopp.exe
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2728
        
        C:\Windows\SysWOW64\Kikafjoc.exe
        
        C:\Windows\system32\Kikafjoc.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1556
        
        C:\Windows\SysWOW64\Kpeibdfp.exe
        
        C:\Windows\system32\Kpeibdfp.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5372
        
        C:\Windows\SysWOW64\Kfanen32.exe
        
        C:\Windows\system32\Kfanen32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2756
        
        C:\Windows\SysWOW64\Lplpcc32.exe
        
        C:\Windows\system32\Lplpcc32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5732
        
        C:\Windows\SysWOW64\Lmppmh32.exe
        
        C:\Windows\system32\Lmppmh32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1952
        
        C:\Windows\SysWOW64\Lbmheomi.exe
        
        C:\Windows\system32\Lbmheomi.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:6140
        
        C:\Windows\SysWOW64\Lpqioclc.exe
        
        C:\Windows\system32\Lpqioclc.exe
        37⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4320
        
        C:\Windows\SysWOW64\Lgkakm32.exe
        
        C:\Windows\system32\Lgkakm32.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:576
        
        C:\Windows\SysWOW64\Lbabpn32.exe
        
        C:\Windows\system32\Lbabpn32.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2828
        
        C:\Windows\SysWOW64\Mmgfmg32.exe
        
        C:\Windows\system32\Mmgfmg32.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5392
        
        C:\Windows\SysWOW64\Mgokflpj.exe
        
        C:\Windows\system32\Mgokflpj.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6108
        
        C:\Windows\SysWOW64\Mdckpqod.exe
        
        C:\Windows\system32\Mdckpqod.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3684
        
        C:\Windows\SysWOW64\Mmlphfed.exe
        
        C:\Windows\system32\Mmlphfed.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3628
        
        C:\Windows\SysWOW64\Mmnlnfcb.exe
        
        C:\Windows\system32\Mmnlnfcb.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:712
        
        C:\Windows\SysWOW64\Midmcgif.exe
        
        C:\Windows\system32\Midmcgif.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5776
        
        C:\Windows\SysWOW64\Mdjapphl.exe
        
        C:\Windows\system32\Mdjapphl.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4988
        
        C:\Windows\SysWOW64\Nnbeie32.exe
        
        C:\Windows\system32\Nnbeie32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5896
        
        C:\Windows\SysWOW64\Ngkjbkem.exe
        
        C:\Windows\system32\Ngkjbkem.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1368
        
        C:\Windows\SysWOW64\Nlhbja32.exe
        
        C:\Windows\system32\Nlhbja32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2012
        
        C:\Windows\SysWOW64\Njlcdf32.exe
        
        C:\Windows\system32\Njlcdf32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1104
        
        C:\Windows\SysWOW64\Npfkqpjk.exe
        
        C:\Windows\system32\Npfkqpjk.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5816
        
        C:\Windows\SysWOW64\Nebdighb.exe
        
        C:\Windows\system32\Nebdighb.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2060
        
        C:\Windows\SysWOW64\Ngbpbjoe.exe
        
        C:\Windows\system32\Ngbpbjoe.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3416
        
        C:\Windows\SysWOW64\Nnlhod32.exe
        
        C:\Windows\system32\Nnlhod32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2880
        
        C:\Windows\SysWOW64\Nciahk32.exe
        
        C:\Windows\system32\Nciahk32.exe
        55⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4952
        
        C:\Windows\SysWOW64\Olaeqp32.exe
        
        C:\Windows\system32\Olaeqp32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3544
        
        C:\Windows\SysWOW64\Ocknmjcf.exe
        
        C:\Windows\system32\Ocknmjcf.exe
        57⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:484
        
        C:\Windows\SysWOW64\Onqbjccl.exe
        
        C:\Windows\system32\Onqbjccl.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5876
        
        C:\Windows\SysWOW64\Odkjgm32.exe
        
        C:\Windows\system32\Odkjgm32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2596
        
        C:\Windows\SysWOW64\Oncopcqj.exe
        
        C:\Windows\system32\Oncopcqj.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3036
        
        C:\Windows\SysWOW64\Odmgmmhf.exe
        
        C:\Windows\system32\Odmgmmhf.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5944
        
        C:\Windows\SysWOW64\Olhlaoea.exe
        
        C:\Windows\system32\Olhlaoea.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5116
        
        C:\Windows\SysWOW64\Ofqpje32.exe
        
        C:\Windows\system32\Ofqpje32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5048
        
        C:\Windows\SysWOW64\Oqfdgn32.exe
        
        C:\Windows\system32\Oqfdgn32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4748
        
        C:\Windows\SysWOW64\Ocdqcikl.exe
        
        C:\Windows\system32\Ocdqcikl.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4212
        
        C:\Windows\SysWOW64\Pddmml32.exe
        
        C:\Windows\system32\Pddmml32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3420
        
        C:\Windows\SysWOW64\Pnlafaio.exe
        
        C:\Windows\system32\Pnlafaio.exe
        67⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4412
        
        C:\Windows\SysWOW64\Pcijoh32.exe
        
        C:\Windows\system32\Pcijoh32.exe
        68⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5968
        
        C:\Windows\SysWOW64\Pjcbkbnc.exe
        
        C:\Windows\system32\Pjcbkbnc.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1964
        
        C:\Windows\SysWOW64\Pdifhkni.exe
        
        C:\Windows\system32\Pdifhkni.exe
        70⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4124
        
        C:\Windows\SysWOW64\Pmdkmnkd.exe
        
        C:\Windows\system32\Pmdkmnkd.exe
        71⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:984
        
        C:\Windows\SysWOW64\Pgiojf32.exe
        
        C:\Windows\system32\Pgiojf32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2004
        
        C:\Windows\SysWOW64\Qfolkcpb.exe
        
        C:\Windows\system32\Qfolkcpb.exe
        73⤵
        System Location Discovery: System Language Discovery
        
        PID:3012
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 448
        74⤵
        Program crash
        
        PID:5636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3012 -ip 3012
1⤵
PID:3552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Ekqcfpmj.exe

Path C:\Windows\SysWOW64\Ekqcfpmj.exe
Size 320KB
SHA256 d0422f9f89134479f26d7df6a6b9159f74e1273cff25d3e2c96efbbded660fbd
MD5 71bbae986cb2f1b0e9e0a3c3bd12b3a0
SHA1 613d1577dede1c9d1598d13ffe942d97ed5091e5
SHA512 54fec074fc2b57be7f19b948056cf066fcad49f439d7fbee054b91736fc385eb038aa4abc49efa0a86e7cfe5a1466099c386aa7cc165668e58bc5413564f035a
SSDEEP 6144:BHALE+G1TYXtP3Jja7gstyV/Ah1G/AcQ///NR5fn:BH8GiX2/Nv
TLSH
T10C641D192A3409EADDED5BB9AC0269DC5141F4F014F1E23EA123DFEDE8E4DA2C855F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eocegn32.exe

Path C:\Windows\SysWOW64\Eocegn32.exe
Size 320KB
SHA256 9914bd6554deaf1747e462d0bc10ea8aea400bda6f6f73ab4974d92c6915dc4a
MD5 1ad30718b4efbca2f585cf67ea03cf00
SHA1 0f10cb29737b376958a58685c89488e6e1a99628
SHA512 1dda817119ec8d739bd28f607e974c94e27bb6f08cdae45fc30d62cf6eb6ef566e8b7aac2c39222eb4db766e1cd6bd83a5e959caa1369c0fd3c9a7256f527888
SSDEEP 3072:s11aZ8G2z4YokvbUpqB7GnNvHwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:vZLCspYGhHV/Ah1G/AcQ///NR5fn
TLSH
T196643F192A3419EBCEED1FB9AC1249D89141E9F014F2E23E6123DFDDD8E4DA2C915F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eojcao32.exe

Path C:\Windows\SysWOW64\Eojcao32.exe
Size 320KB
SHA256 991e19f46863ca093d429543eb7e78af8653910ee410aaf7a13736bb9b8774e7
MD5 f5acbbd8884a46dfd71f13cde36df775
SHA1 faf7ad3a6d5b3717bac179d94c4bc4d6c63713bf
SHA512 d3664b751d3a57a7ce4a27bed464d2e8a8fadfbeac0dc402d5654def278e507fc0d92baae1bc8ed8b9e2df8125242ab1888ae885d2a3a31be96b68bca8d73419
SSDEEP 3072:SiCtdzLgZSYKqD3bswS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:kwZd3bsV/Ah1G/AcQ///NR5fn
TLSH
T1D36400192A340DEACDED1BB5AD1349E89185E9F018F1E23E6123DFDCD8E4DA2D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eoollocp.exe

Path C:\Windows\SysWOW64\Eoollocp.exe
Size 320KB
SHA256 7224f4bdcbb4d4b2f771726cd9912a380680d6db8a75c628bd1f243b6376b789
MD5 173cd3ce5caa3e58a20e003c94d81b07
SHA1 def79e13de18358ca275d10a590e7c37a009ca7a
SHA512 ed59e8f0eb2ee92bee88ead37746dae6ac2f1ca2a1d6065cc0996f95f94e4ae0ee951b7c211db4e228395ed552239056cb7cb20fcbfabb46c0baf3fea93bb2e4
SSDEEP 3072:iUnAhxBsfkXwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Axi8XV/Ah1G/AcQ///NR5fn
TLSH
T100643319263409EACDED5FB5AC1249D85141E9F014F1E13EA223DFECD8E4DA2EE06F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fcfhhk32.exe

Path C:\Windows\SysWOW64\Fcfhhk32.exe
Size 320KB
SHA256 706afba8d3762b9f8839c6b9e74b6353d0a9a7ddf9e5dd24594522764c7a220d
MD5 49659b69d53611fdf28517a546f505ae
SHA1 1d4169be1dc2609e22058d0e919eb0461f21af35
SHA512 49b162f4e5529a540bd557387a44765c2b80a38758108948b754b121fa44d1471a6d21170ceb081d49d33890c5abb06df6c9d65176eb8158425f61d76194a2d8
SSDEEP 3072:9q+ARqjFHt0L6zwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:UbRSHt0L6zV/Ah1G/AcQ///NR5fn
TLSH
T1CA640F19263009EACDED5BB5EC1249D85245E9F018F1E13E6223DFEDECE4EA2D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fckacknf.exe

Path C:\Windows\SysWOW64\Fckacknf.exe
Size 320KB
SHA256 394ffa323ba14c959b481c676d0bdcb699bb10c8e2f59dfc5ab397afece03d39
MD5 56f3ebf9143d72e41fd16593fa55c9e3
SHA1 b8993d46945f4cc2345cb73c7a21b663de93c49d
SHA512 fa66346ebd86f2b9d1c7afcb8877a79d127f2410991baedfb19252e0882bf27174f1dabb6738d3a66ed724ddf51887f0fcc621c7eb0edf9db236b1074b179981
SSDEEP 3072:FntO8XQEcgLjEbhBmdwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:FntO8XQEPPEVUdV/Ah1G/AcQ///NR5fn
TLSH
T1F0641E5A16300AEACEED2BB5AD024DD85181E9F014F1E13EA127DFDCD9E4EA2DC15F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fomhnmgp.exe

Path C:\Windows\SysWOW64\Fomhnmgp.exe
Size 320KB
SHA256 d874bb3e834f39bb584341cc45b204711258439102ad605381da2ec791a83eb1
MD5 096bae08892b3a80b8bb72a5ee987651
SHA1 809488684091fa043e1f1cd36cdb8b86a9afbff9
SHA512 6a13d79cbe3f62ecf9c0f761bcc23f0fa0c24c7f75ad61e8c48f9b52e4a015917e9886da7cafaa26a7f12526d8756a1342ee4bd53fa9ba3071bcd8359f648acd
SSDEEP 3072:c5K6ubgLalqwZkDwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:bRgJwaDV/Ah1G/AcQ///NR5fn
TLSH
T1B464305A263019EACDED1FF5AC0249D8A585E9F014F1E13E6523DFDCD9E4EA6C808F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gdnjabab.exe

Path C:\Windows\SysWOW64\Gdnjabab.exe
Size 320KB
SHA256 7fdacd8d50cdc134342f5e9fe14dd78d6fa9c6123fb9c4ed1e06877355d20604
MD5 79c9066e0d088851953fce70ef936254
SHA1 b0bbb4dadf1738b71d5ac978b5cd97a22d0808ca
SHA512 2ae8b50b44f80fe483bcd501a36ca7b6fdd626b11e69568d6c593ec6a929d177c97ed5fc350c78c8d1a920d2746811b3ee70c3814cc9244c21002d74ce7d331a
SSDEEP 3072:+YmtcCIfcgU7hkLwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:/mSvChkLV/Ah1G/AcQ///NR5fn
TLSH
T120642F19263409EADEED1BB9EC1289D89145E5F014F1E13E6923DFECD8E4DA2DC09F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gdqgfbop.exe

Path C:\Windows\SysWOW64\Gdqgfbop.exe
Size 320KB
SHA256 99dd6e4d461bf6b7292b3a21f0beda6b9699e8599d675613446c0f31c1634b5a
MD5 abbf88924535a67dbfb649b0acbe733e
SHA1 0283daf4d860f2f828c5390ff4791c964c2aa60b
SHA512 0f62242b6a14295d328b1a698530b8c698ef148737a7a7b34a10c3815a12f07e322c6c474d19fee8bdd92bdf2278809b017794799035600495dcccf763fac9cf
SSDEEP 3072:AgDz5CTBvI65tuGLwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:AggTxLXuGLV/Ah1G/AcQ///NR5fn
TLSH
T18D640C192A7009EACEED5BB6AD1249DC9181F9F014F1E13E6123DFDCD8E4DA2D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gfpcpefb.exe

Path C:\Windows\SysWOW64\Gfpcpefb.exe
Size 320KB
SHA256 ff94b0f67237209e7ca9279c07bce0c8c9eb730001d2f892b8bb155243283e3c
MD5 d2a0208fca75cb45a97cc8d9fdc648b6
SHA1 56f7cb16d5852361859606eadc1b629a17370873
SHA512 5e3c314b3dc3302040fea93e87145f57d0fbb81d522ae2981e954d09f10568766aa1981b0e55785ce0f7d9fd3c56b8433922859660d5ea06289476a148f05f5d
SSDEEP 3072:A1QbnglDuDsbcqwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:A1QzglfvV/Ah1G/AcQ///NR5fn
TLSH
T19D64201A2A3809EACEED1BB5EC1249D99181E5F014F1E23E6123DFDCD9E4DA6DC05F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gofkckoe.exe

Path C:\Windows\SysWOW64\Gofkckoe.exe
Size 320KB
SHA256 256b5ec8400748e94a765a6b0e6270a85dba291fe36a8f88c7ba54a62f464744
MD5 e20fdd444ddd0d9b868678b9678ac822
SHA1 5c0e1aaf2f163cc3e6abe7f7493a107db515f396
SHA512 7dd2cf68e863fe31858d5a80ae85902cbe0e671fac3afe39ee1a98fadb9da3bfedd934293dcbd8af2f392ceb10ccd3ac4c70de42c780cd05de67f1210b15c3cd
SSDEEP 3072:rQ9hSSPqxjkd/5iUr833wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:MnZyxjkF5Pr833V/Ah1G/AcQ///NR5fn
TLSH
T1DE640C1A2A341AEACDED1BB5AC5349D8A141E9F014F1E13E6123DFDCD8E4DB2D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gohhik32.exe

Path C:\Windows\SysWOW64\Gohhik32.exe
Size 320KB
SHA256 7762d35698c6362b3dddcc5a599b37205ac46c2256fbb8f01614cf8ecb8ec5c3
MD5 cbfaf98e4a30d647d2da448bff3f6a60
SHA1 efa73a7f9bfa2b812bbb6b574e04609529e55fb7
SHA512 0f64c3ee02166d4b428e9e9de8fcb513712461c69db7f70a4949d83debe9e34d9851a1e3d7ac2a8dec210795c904049ee698cdc7468e688da9309e72d623fc22
SSDEEP 3072:8ijZqaMC080mQW5w2T2wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:8iyC3nPT2V/Ah1G/AcQ///NR5fn
TLSH
T1E76430191A310AFACEEE1BB5BD1249E85151EAF114F1E53E5123EFDCD8E4DA6C805F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hihbco32.exe

Path C:\Windows\SysWOW64\Hihbco32.exe
Size 320KB
SHA256 d6452818564a998a1920a49025efa9558eb80bb175f8d13c9da4c8aa3aae5d47
MD5 a3724d0448245214d143d536aa4010c6
SHA1 58491f33e1f0b096c0e39396e7b7f28c59b7e93a
SHA512 5e28ac608ca0d8181d31786467c6ec8dfebacdc5ea83e68ca6adf08b8afa52fc2c8342a6c411603d2bf887fbf114a818f0f31fa46b67598cfc55577c11711c18
SSDEEP 3072:qCq3K1kWNd5JoQ8tdwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:p1kjdV/Ah1G/AcQ///NR5fn
TLSH
T13E64101A263409EACEED1FB5AC124AD89141EAF014F1F63E5523DFDCD8E4DA6C819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hkdbik32.exe

Path C:\Windows\SysWOW64\Hkdbik32.exe
Size 320KB
SHA256 976b42d6a876b2794d0c1230ff4022b17eb0a1aba0c60e8b5d98026b2d779350
MD5 d8016db55a65561ef4449895932dd9d4
SHA1 baf394c87189c8f930ce9216ebb7fe98038c34ac
SHA512 2d724e1c05fbf6f484e0df2705cd135a5747f1c0e0b2a1e66191311dc2f9ae1929f3f8d2f64a186097c917f8aea099e8c9a13f7e1c8103f02645ca49ec5eab5a
SSDEEP 3072:JB4gfOiMdwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:JBudV/Ah1G/AcQ///NR5fn
TLSH
T10C640E192A340AFACDED6BB6EC1249D85141E9F014F1E23EA123DFDCD8E4DA2D815F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hkhkdjkl.exe

Path C:\Windows\SysWOW64\Hkhkdjkl.exe
Size 320KB
SHA256 eaf687894872c26987db66e3a035ed11c45e66bcd3ec28e590b160db577fff13
MD5 7100b0594f32b577140ece1bed9f44e1
SHA1 b0cb7dfe6568aabf037ee9e25170ff7d7384449c
SHA512 12a8203d1382e4552260f639ac48485cd8bbcfbe7eb826663f4adb2095128263638a97cbc9ee0134407cbbcbb52f90e59e3fb5f988df867b5f6fdfa94534a1be
SSDEEP 3072:R+9Neb5QpBN5wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:keVQ15V/Ah1G/AcQ///NR5fn
TLSH
T190644219263409EACEED1FB5AD1249D89581E9F058F1E13E6223DFECC8E4DA6CC15F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hmoehojj.exe

Path C:\Windows\SysWOW64\Hmoehojj.exe
Size 320KB
SHA256 48b326c809804a293595d07a6a4174e74e3df00a2eb7aaf9b4b4bfe64dd37165
MD5 ad04138725a1af9f7e7028d052a85232
SHA1 2a5b461ed50e37f672e4bb25751021d77831f5fd
SHA512 60079ac208792512abe2068d67a86a9c8617781e3f516693df78c86c7bf5c638340e38a3e9d64833a7a3ccd53ba7b6e14ff16c358b3cd7dc8f4afaca1b1414c9
SSDEEP 3072:rAhoFu2pvQKwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:MhCu4QKV/Ah1G/AcQ///NR5fn
TLSH
T13564421A1A3409EACDED1FB5AC1259D8A141E9F014F1E23E6223DFDCD8E4DA6CC25F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hpfdkiac.exe

Path C:\Windows\SysWOW64\Hpfdkiac.exe
Size 320KB
SHA256 6cbc3b71bd5f2edf3646c64d5b69e4e90d749554a72f178ce15a8eacaaf92f9a
MD5 e31da32560eb69d68be836a8fd37dda7
SHA1 1488193cf8428d65830caa64e24faaaa1313b8b5
SHA512 c284b58e086f7696d7d0ea29d0c4af7ef5e9824b9f63c83923ced664767e4b3a36842edc50741555aa95c34bf8358c1413d93101843ebe1ee9e8d4cfd5162135
SSDEEP 3072:bYuXdvzwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:UuXJzV/Ah1G/AcQ///NR5fn
TLSH
T1C6642F192A3409EACEED1BB5ED0289D89141E9F014F5E13E6127DFDCD8F4DA6C819F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ibncmchl.exe

Path C:\Windows\SysWOW64\Ibncmchl.exe
Size 320KB
SHA256 027d32b509ddafc39730f3c66b1aefd13fdd324852a1aa276196fdb7463f76f1
MD5 aede36eae2d7034d3230b4ebe9a106ff
SHA1 b76f605f971286dff2187c12a8987c7b148e0b69
SHA512 53012301391d0c351ecb2e7fce041009737728edc26745f295551e8ad1f257c6abeb95241454d5a94c329f3ee598023eb1475e1b0b0e3d8860e6ab2f32b97c97
SSDEEP 3072:ngziAe6IWfI0stveH+wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:gllfM2+V/Ah1G/AcQ///NR5fn
TLSH
T13B64FC192A3409EACEED1FB5AC1349D85141E9F018F1E23E6123DFDDD8E4DAAC856F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ikmepj32.exe

Path C:\Windows\SysWOW64\Ikmepj32.exe
Size 320KB
SHA256 5c111d484b0ee61cb4f049bb874d7d88ce27f38401a2e6fb5fe40fba5f016617
MD5 24833b06baa23cf9bf658eaf9e374208
SHA1 f631527ce9afd984374d619ada20b5c1eaaf30b0
SHA512 4b509dd65099986dd1e01a32e0d8182141f07953a45ca2f769464b9e1aed3f550d42457b259c351949bf048d0f85a4714d722214320b1aaaccc1e5ed4616f2d4
SSDEEP 3072:IuxePqgZs3wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:txePqGs3V/Ah1G/AcQ///NR5fn
TLSH
T1BD64221A16340AEADEFD1FB5AC024AD85141E9F014F1E13E6123DFDDD8E4DA6D81AF82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ildkpiqo.exe

Path C:\Windows\SysWOW64\Ildkpiqo.exe
Size 320KB
SHA256 8f66d581c7bfea90a8fb05a9b54d2037a80be6e9f78627e98f8df598e312263c
MD5 3efbd9e084af882cf581147043652aeb
SHA1 e940cbcbc6a457f806630e14c72c0c6810b1faf9
SHA512 57140580b90f71396555aba63c76482c5263585a36276134e8c1a73b61577c332ebbe8eced876487b65581b42372a35eff902f61c91664bede1c151a81bb6df0
SSDEEP 3072:QCx5oER3pMEFuj8wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Zoa3pMV8V/Ah1G/AcQ///NR5fn
TLSH
T16A64431A263409EACDED2FB6AC0249E85241E8F514F5E13E6523DFDDC8E4DA6DC05F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Imdgjlgb.exe

Path C:\Windows\SysWOW64\Imdgjlgb.exe
Size 320KB
SHA256 8256416ccaa89d264527428f9c78e5dc062ae882502c7bbceb14d376e02d7f99
MD5 a7be9c9195adf642e227bffbc9f0271a
SHA1 5a224488837e04de9d2b70dce7cceb14ccd3d624
SHA512 fd5c636f2f6ddd4d716ea18aef2e0a7410a46cf1799d358c82c00991cf39c963a582f51131e0dd45ca0e3daca3e899bb5be3c2e6cacd54767e976d2302e8f9e6
SSDEEP 3072:BTJxHo44sqG+WQ+BwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:B2kQ+BV/Ah1G/AcQ///NR5fn
TLSH
T16E64321926B00EEADDED2BB5AC2259D85242F8F024F1E13E5523DFDCD8E4DA2D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Immaimnj.exe

Path C:\Windows\SysWOW64\Immaimnj.exe
Size 320KB
SHA256 c33530e55399fb95c444f9f6e655ef8242277bec73034641d64beed5a6b4f9ec
MD5 0358280d506e01a1ca2ce6d5de9cc45c
SHA1 58328535840b2b5359345b1898c0ff427c1cae7c
SHA512 ba8c21e8bdd2d48e5c645e22d220c83402314c9a13d30fc4cf55bc417273f9e546c729d774e58bd87af757b0462efb43248f040b130b7daf92b4d8fbf613646d
SSDEEP 3072:7hTUCmKzMyXPp6sViGvpwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:B8KYy/pV/Ah1G/AcQ///NR5fn
TLSH
T15F643F1A2A3409EACEED1BB5EC1249D89141E6F014F1E13E6123EFDDD9E5DA6D808FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Imonol32.exe

Path C:\Windows\SysWOW64\Imonol32.exe
Size 320KB
SHA256 3df92cc23df4198a3f81112202c36e480578ecd75a36b02f5d784c2e1a36730b
MD5 d5bee635b08899eeb01e83b00946a520
SHA1 3b8d5eb0a704ec5d3ed2cde70e6d54e40c658009
SHA512 f5e680a73f0efafc2308a75ba4d43f507380aadbfa5e1eb3b7beb08182dfaf4825f82a1225907b03beac5b21f2065a919ba54ffa94f9eda63717fe4dc0ba3111
SSDEEP 3072:4n3F9S6pX549dj11wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:s3PFpX5G11V/Ah1G/AcQ///NR5fn
TLSH
T1A5641E1926300AEACEED1BF5AC5259DA5281E8F118F1E13E6123DFDDD8E4DA6DC04F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jbeinb32.exe

Path C:\Windows\SysWOW64\Jbeinb32.exe
Size 320KB
SHA256 aa2af2add50cd61476f5f03439a100cec5512ed3fbde8bcb0908b4987506d2a5
MD5 0f1b37fdff6461a23637edba8a8e5955
SHA1 4c7f36300450064cf8dbe20845b69ea04788a1f7
SHA512 70fa40cbe32c661b18e06d757ad2fecba892ae90d33ac6e6cc07904d2184200aabede1af2512533c4d5021654ba0844dcbd9a36a847502fc4289ff746cdb8601
SSDEEP 3072:Ei7r+v/Y/JSD3BwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:zfM/Y/JSD3BV/Ah1G/AcQ///NR5fn
TLSH
T111642119263409EACEEE1FB5BD1289D85141E9F414F2E13E6123DFECD8E4DA2C859F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jfeoip32.exe

Path C:\Windows\SysWOW64\Jfeoip32.exe
Size 320KB
SHA256 f9d64760847b6c269a5549d4f3e3d6c3cd74a97827e72dd9aa7c5ea4c377ac21
MD5 672f30f96626f2b7d08e9f11d0276955
SHA1 c96ec495a6e74445f3f7521340a537c5d278767a
SHA512 477f42496beab739027683ca30fe8cd89532ce67bd1603cf5c3b375af0483ce83826ee34e2131f361d699657402d9c18913c0f5c2aa2c4d43a2302a7b117569a
SSDEEP 3072:7QFjCbzVr79N4M4IwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:tldNmIV/Ah1G/AcQ///NR5fn
TLSH
T1646440196A3909EAEEED1FB5AC1299D89141E8F014F1E53E2123DFDDD8E4DA6CC05F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jioajliq.exe

Path C:\Windows\SysWOW64\Jioajliq.exe
Size 320KB
SHA256 e232af027437874bd02866d66eb244c7d317c58a82c6b5206290c624ccf9fcea
MD5 97cd8c6764a4c9484d71d3ec11662cab
SHA1 58857c2fc300ec57de7e464bff6ee9f3624139b5
SHA512 28ace2dd292d3b9e138d6d11e153ce8cc26f08217b66c1cbb82cd98cda4cff5965ca93d9bf7af2cfdbbd34332bbb8fd8635c79ba9b4977c17b21671529fd0cf6
SSDEEP 3072:C9pqN7LEpezwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Sq5fzV/Ah1G/AcQ///NR5fn
TLSH
T1BD641E192A7409EACEED1BB5EC1249E89141E9F014F9E13E6263DFDCC8E4DB2D845F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kfanen32.exe

Path C:\Windows\SysWOW64\Kfanen32.exe
Size 320KB
SHA256 31d1f5a1cdf4de0f9777fd27c5f457c8817d984a72e4352d9ce02874c9cb3927
MD5 e9477454d121a43e67637cdbce3a7253
SHA1 90dd36d8bfbc457e1b268b820fb701a4109580b1
SHA512 e2e2b0e3b015ae2827b41b608c9edb3371ca3e109ec8cbd68b5c0a1a827e5c45565cc17db1633f6928ed9a76c8408b8965e6172dc5fdf9e66a9dabf12b1eac8e
SSDEEP 3072:23y+pAvZo873VlwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:KaJ3VlV/Ah1G/AcQ///NR5fn
TLSH
T1EA642D1A2A3449EACEED1BB5AC1249DC5181E9F014F1F13E6123DFDCD8E4DAAD819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kfmejopp.exe

Path C:\Windows\SysWOW64\Kfmejopp.exe
Size 320KB
SHA256 14038ddc39ab583196d0c31a4d66ac622ce1988c60950f406f742fb26cac492c
MD5 82bcf5f31d82ded27d79fba381ac1140
SHA1 50a60cdcdb6c750922d3075c311b8d864a90a0f8
SHA512 8def7669a6b40c612dc855ff31a89df5e28d5842b370540b28e59ddfca35d3815822478c2ee794f9ea9389598eff3be8d8895019a6f7b0768cfbaf93fcf8eff2
SSDEEP 3072:jcjv9sFHRwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:4jv8HRV/Ah1G/AcQ///NR5fn
TLSH
T150644F192A3019EACDED6BF6AC0249DC9141E9F654F1E13E6123DFDCE9E5DA2C804F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kifhkkci.exe

Path C:\Windows\SysWOW64\Kifhkkci.exe
Size 320KB
SHA256 df078ff1a6b5b627d8b90dde40c6c3ea174f08e5d2093da61a8578dc64152aba
MD5 ae9e6286c1a11ba79212895311a4969e
SHA1 6ae446fe77165f0535e16653b43a6df3cc956ede
SHA512 c1496e1462e00fa9c41917b269e828a5e3098728efd287beef0c16125a7a85a241c20c280811ccf4a453b412eab54e004c4bc3d56f0f65e48dddbfa0d6f30d84
SSDEEP 3072:4haVg88C2wc+lsFEK0ZPOxBGIwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:4hj82D+bMxBDV/Ah1G/AcQ///NR5fn
TLSH
T10664C719662409EACEEE1FB5EC0249DC5141EAB014F2E13E6563DFDCD9F4DA2C909F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kikafjoc.exe

Path C:\Windows\SysWOW64\Kikafjoc.exe
Size 320KB
SHA256 249c601b15cacc01b3bdc57674936c2bf879d27b4ec732480582eedc223b892e
MD5 cc59020c0547ce89a8001b6eddee7693
SHA1 5f95a3e5db3977130c697350c9fd8e270bbf2109
SHA512 20e2358a73412c5cc1d86d16b35b1cdeec8ee2ee34b1ed6c39a029d7fa7d8c6661cfa48004b78440d79226f672a4d5fc3fb591971c81fb8bfba8c9ea32a1b219
SSDEEP 6144:+WEpOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO1OOO/5OO2OOOOOOOd3O5O563OOO7:+e/Nv
TLSH
T182643F192B305AEACEED5FB6AC0249E85141E9F424F1E13E6523DFDCC8E4DA2D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Klgqmfpj.exe

Path C:\Windows\SysWOW64\Klgqmfpj.exe
Size 320KB
SHA256 04386d2bc527d7f4e27f387bed4d04309376f8e56580d6f652c2392beaad513a
MD5 fb728b20c77060374e946e5cbca267c3
SHA1 4a7b279cd195adbd288421f76d28a8f4749ec586
SHA512 042788dec02c36130098b58b566f301c36530d554c4ad143d3cee4c41de592650f8e87eaba01bed221154e447a170feb6cb65022f9c30b1e50818f5f6a5259fa
SSDEEP 3072:lNmFmZnY+wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Y5+V/Ah1G/AcQ///NR5fn
TLSH
T14C64ED192A3509EACEED1BB9ED1289D89195E8F014F1E13E6133DFDCD8E4DA6C805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kpeibdfp.exe

Path C:\Windows\SysWOW64\Kpeibdfp.exe
Size 320KB
SHA256 4064fd05aaac459a65925e7d340f71857324934602333ee8fffd26a0a56b12d1
MD5 b350346c42aeb2fd81ba94b9db6ddd25
SHA1 92fc6575c046d3b73f35ce3991f41c891f027b3a
SHA512 7767f7bb5898e33a953ea649eee7a9b13915a26dad5733473f535033e728440566e1dacf5d95fc7ce2a14ad70fc6d3899ce9670f0f4d52d4cc1140f0bedccf5e
SSDEEP 3072:l7bgNQmDXb6p0AmUCwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:1gTb6pxCV/Ah1G/AcQ///NR5fn
TLSH
T17864CA19263409FACEED1FB6AC1249D89181F9B114F1E13E6523DFDCD8E8DA6C845F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/300-49-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/364-14-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/484-345-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/556-126-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/576-250-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/712-280-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/812-56-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/984-431-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/984-415-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1036-133-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1092-77-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1096-148-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1104-310-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1196-42-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1368-300-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1556-210-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1952-235-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1964-405-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1964-458-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2004-420-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2004-429-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2012-305-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2060-320-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2060-468-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2220-28-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2308-140-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2316-70-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2440-196-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2540-162-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2580-154-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2596-355-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2596-454-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2680-105-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2728-203-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2756-224-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2828-255-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2880-330-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2880-464-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2928-113-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3012-428-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3012-425-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3036-452-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3036-360-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3116-21-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3416-325-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3416-466-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3420-390-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3420-440-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3428-98-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3544-460-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3544-340-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3568-183-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3628-275-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3640-176-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3684-270-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4124-433-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4124-410-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4212-385-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4212-442-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4252-63-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4320-245-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4412-438-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4412-395-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4748-383-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4748-444-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4952-335-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4952-462-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4988-290-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5012-84-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5048-446-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5048-375-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5116-448-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5116-370-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5212-35-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5220-119-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5372-218-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5392-260-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5684-7-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5720-189-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5732-230-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5776-285-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5816-470-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5816-315-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5832-168-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5836-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5836-1-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/5876-456-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5876-350-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5896-295-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5944-450-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5944-365-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5968-400-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5968-436-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6076-91-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6108-265-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6140-240-0x0000000000400000-0x000000000046D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads