berbew | 12867e8d104c5f87a8a7fd4bb7362ce5231c6fe30041b47df3ff7ddcab9df23f

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 06:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_fe7863154bd2b0cf955adaaf0597c902_elex_wannacry.exe
Size 429KB
Sample260930-g45fvazzbw
SHA256 12867e8d104c5f87a8a7fd4bb7362ce5231c6fe30041b47df3ff7ddcab9df23f
MD5 fe7863154bd2b0cf955adaaf0597c902
SHA1 e60f50f5299096455f62fb5ee683eb3f06bae970
SHA512 496c8cd28913b74577fc8d823bde9abbf3b5579e90c6340df20948d0c20248b9bc03b1af7e41b3159ba97775d3093ddd3abd4f0621b4039e290210afdfba59c7
SSDEEP 6144:NykuqodzNV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:NykDws/NcZ7/N
TLSH
T152945F65263029E5EDEE6BB5AC1249E891C1E5B124F1F23E6633DFDCC8E5DA1CC04B81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oggqho32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdjfmjhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lcmopeae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkgdfb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Okgfdm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojmcej32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kilhqq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kkmapc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkepgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nneiikqe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbhkjicf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojmcej32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmnjan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnjbdj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocnampdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ogqcon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fihqfh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jagqfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmbkfp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdffiinp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lkbkkbdj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqdnld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogqcon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Peddhb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgkooeen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgdklb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncgkma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfnnel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gfnnel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hfhqkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iffmmihf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjoeoedo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jjoeoedo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jidbpa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kaemgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hboaql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibojgikg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjhonfjg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmnjan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Maefnk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncpelbap.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jplmglbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnlfclip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oggqho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oqdnld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpenpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Himche32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iffmmihf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdffiinp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkbkkbdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpoljg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nacboi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fihqfh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfhqkk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hboaql32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgkooeen.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcmopeae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcdepd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Maefnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgggaamn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jidbpa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpccgk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgphje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lkgdfb32.exe

Executes dropped EXE 53 IoCs

pid	Process
5960	Fihqfh32.exe
1940	Gfnnel32.exe
5808	Hfhqkk32.exe
1160	Hboaql32.exe
5352	Hpenpp32.exe
2920	Himche32.exe
4600	Iffmmihf.exe
1756	Ibojgikg.exe
1200	Jjhonfjg.exe
4568	Jjklcf32.exe
1196	Jagqfp32.exe
3208	Jjoeoedo.exe
3844	Jplmglbf.exe
1604	Jidbpa32.exe
1056	Jdjfmjhm.exe
2652	Kmbkfp32.exe
6104	Kgkooeen.exe
4112	Kpccgk32.exe
1952	Kilhqq32.exe
1068	Kgphje32.exe
5552	Kaemgn32.exe
5548	Kkmapc32.exe
712	Kdffiinp.exe
5160	Lmnjan32.exe
4392	Lkbkkbdj.exe
4912	Lcmopeae.exe
3936	Lanpml32.exe
4864	Lkgdfb32.exe
2412	Lkiqla32.exe
1104	Mcdepd32.exe
1988	Maefnk32.exe
3828	Mnlfclip.exe
1728	Mgdklb32.exe
2912	Mgggaamn.exe
4924	Mpoljg32.exe
3096	Mkepgp32.exe
3160	Ncpelbap.exe
4424	Nneiikqe.exe
2424	Ncbaabom.exe
2844	Nacboi32.exe
5944	Nnjbdj32.exe
4604	Ncgkma32.exe
1312	Nbhkjicf.exe
5372	Nkqpcnig.exe
5388	Oggqho32.exe
3624	Ocnampdp.exe
5580	Onceji32.exe
2080	Okgfdm32.exe
4268	Oqdnld32.exe
1564	Ojmcej32.exe
4560	Ogqcon32.exe
4788	Peddhb32.exe
4748	Pqkdmc32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Liiiei32.dll	Nacboi32.exe
File created	C:\Windows\SysWOW64\Lgfceo32.dll	Kaemgn32.exe
File created	C:\Windows\SysWOW64\Oqdnld32.exe	Okgfdm32.exe
File created	C:\Windows\SysWOW64\Lckmpaek.dll	Jjoeoedo.exe
File created	C:\Windows\SysWOW64\Odfcal32.dll	Lkiqla32.exe
File opened for modification	C:\Windows\SysWOW64\Mnlfclip.exe	Maefnk32.exe
File created	C:\Windows\SysWOW64\Mpoljg32.exe	Mgggaamn.exe
File opened for modification	C:\Windows\SysWOW64\Ojmcej32.exe	Oqdnld32.exe
File created	C:\Windows\SysWOW64\Kmnkaeeg.dll	Jjklcf32.exe
File opened for modification	C:\Windows\SysWOW64\Kilhqq32.exe	Kpccgk32.exe
File created	C:\Windows\SysWOW64\Ipabdl32.dll	Mgdklb32.exe
File created	C:\Windows\SysWOW64\Nacboi32.exe	Ncbaabom.exe
File created	C:\Windows\SysWOW64\Amaegbgd.dll	Jjhonfjg.exe
File created	C:\Windows\SysWOW64\Lcmopeae.exe	Lkbkkbdj.exe
File created	C:\Windows\SysWOW64\Dbgpfl32.dll	Lanpml32.exe
File opened for modification	C:\Windows\SysWOW64\Mcdepd32.exe	Lkiqla32.exe
File created	C:\Windows\SysWOW64\Jiepaa32.dll	Mnlfclip.exe
File created	C:\Windows\SysWOW64\Leomnbbm.dll	Ojmcej32.exe
File created	C:\Windows\SysWOW64\Akljinhl.dll	Peddhb32.exe
File created	C:\Windows\SysWOW64\Ibojgikg.exe	Iffmmihf.exe
File created	C:\Windows\SysWOW64\Kmbkfp32.exe	Jdjfmjhm.exe
File created	C:\Windows\SysWOW64\Ncpelbap.exe	Mkepgp32.exe
File opened for modification	C:\Windows\SysWOW64\Nneiikqe.exe	Ncpelbap.exe
File created	C:\Windows\SysWOW64\Ojmcej32.exe	Oqdnld32.exe
File created	C:\Windows\SysWOW64\Kgkooeen.exe	Kmbkfp32.exe
File opened for modification	C:\Windows\SysWOW64\Hboaql32.exe	Hfhqkk32.exe
File created	C:\Windows\SysWOW64\Oeglogfo.dll	Nneiikqe.exe
File opened for modification	C:\Windows\SysWOW64\Nbhkjicf.exe	Ncgkma32.exe
File created	C:\Windows\SysWOW64\Kbcildbi.dll	Ncgkma32.exe
File created	C:\Windows\SysWOW64\Hfhqkk32.exe	Gfnnel32.exe
File opened for modification	C:\Windows\SysWOW64\Iffmmihf.exe	Himche32.exe
File opened for modification	C:\Windows\SysWOW64\Jdjfmjhm.exe	Jidbpa32.exe
File opened for modification	C:\Windows\SysWOW64\Lkgdfb32.exe	Lanpml32.exe
File opened for modification	C:\Windows\SysWOW64\Okgfdm32.exe	Onceji32.exe
File created	C:\Windows\SysWOW64\Ihidjh32.dll	Fihqfh32.exe
File opened for modification	C:\Windows\SysWOW64\Hpenpp32.exe	Hboaql32.exe
File created	C:\Windows\SysWOW64\Kaemgn32.exe	Kgphje32.exe
File opened for modification	C:\Windows\SysWOW64\Kdffiinp.exe	Kkmapc32.exe
File created	C:\Windows\SysWOW64\Lajpbbei.dll	Kdffiinp.exe
File created	C:\Windows\SysWOW64\Nneiikqe.exe	Ncpelbap.exe
File opened for modification	C:\Windows\SysWOW64\Ncgkma32.exe	Nnjbdj32.exe
File opened for modification	C:\Windows\SysWOW64\Pqkdmc32.exe	Peddhb32.exe
File opened for modification	C:\Windows\SysWOW64\Gfnnel32.exe	Fihqfh32.exe
File created	C:\Windows\SysWOW64\Cmjhoq32.dll	Himche32.exe
File opened for modification	C:\Windows\SysWOW64\Jidbpa32.exe	Jplmglbf.exe
File opened for modification	C:\Windows\SysWOW64\Kmbkfp32.exe	Jdjfmjhm.exe
File created	C:\Windows\SysWOW64\Ifihbhkb.dll	Kpccgk32.exe
File opened for modification	C:\Windows\SysWOW64\Lcmopeae.exe	Lkbkkbdj.exe
File created	C:\Windows\SysWOW64\Nnmbaadg.dll	Mpoljg32.exe
File opened for modification	C:\Windows\SysWOW64\Ncpelbap.exe	Mkepgp32.exe
File created	C:\Windows\SysWOW64\Jjoeoedo.exe	Jagqfp32.exe
File created	C:\Windows\SysWOW64\Pnjnnclb.dll	Jdjfmjhm.exe
File created	C:\Windows\SysWOW64\Kpccgk32.exe	Kgkooeen.exe
File created	C:\Windows\SysWOW64\Egbefc32.dll	Kgkooeen.exe
File created	C:\Windows\SysWOW64\Kapilbaa.dll	Kilhqq32.exe
File created	C:\Windows\SysWOW64\Jjklcf32.exe	Jjhonfjg.exe
File created	C:\Windows\SysWOW64\Cbdijhno.dll	Gfnnel32.exe
File created	C:\Windows\SysWOW64\Kklfkfie.dll	Hfhqkk32.exe
File created	C:\Windows\SysWOW64\Hmeqhlfm.dll	Kmbkfp32.exe
File created	C:\Windows\SysWOW64\Qgihkehk.dll	Kgphje32.exe
File created	C:\Windows\SysWOW64\Pobbkfof.dll	Lmnjan32.exe
File created	C:\Windows\SysWOW64\Jdjfmjhm.exe	Jidbpa32.exe
File created	C:\Windows\SysWOW64\Hboaql32.exe	Hfhqkk32.exe
File opened for modification	C:\Windows\SysWOW64\Lkiqla32.exe	Lkgdfb32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3580	4748	WerFault.exe	141

System Location Discovery: System Language Discovery 1 TTPs 54 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_fe7863154bd2b0cf955adaaf0597c902_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gfnnel32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jjhonfjg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jdjfmjhm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kmbkfp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kilhqq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lanpml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Maefnk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncpelbap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocnampdp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onceji32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojmcej32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jjklcf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fihqfh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Himche32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iffmmihf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kaemgn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lkgdfb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnjbdj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Peddhb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hpenpp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jjoeoedo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jidbpa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdffiinp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lkbkkbdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mpoljg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqdnld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mnlfclip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgdklb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mkepgp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nneiikqe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncbaabom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nacboi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oggqho32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jagqfp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jplmglbf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kgkooeen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpccgk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kkmapc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmnjan32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgggaamn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Okgfdm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hboaql32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibojgikg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nbhkjicf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogqcon32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqkdmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hfhqkk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kgphje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lcmopeae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lkiqla32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcdepd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncgkma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nkqpcnig.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kklfkfie.dll"	Hfhqkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbgpfl32.dll"	Lanpml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lanpml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncgkma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nkqpcnig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jidbpa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kilhqq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lkbkkbdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipabdl32.dll"	Mgdklb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oeglogfo.dll"	Nneiikqe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naamaled.dll"	Ocnampdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohlkam32.dll"	Ibojgikg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lcmopeae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mpoljg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cbdijhno.dll"	Gfnnel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jdjfmjhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldpmilab.dll"	Ogqcon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gfnnel32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jjoeoedo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jjoeoedo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phbdoakj.dll"	Kkmapc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kdffiinp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lkiqla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nmajndjb.dll"	Maefnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ocnampdp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	2026-09-30_fe7863154bd2b0cf955adaaf0597c902_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	2026-09-30_fe7863154bd2b0cf955adaaf0597c902_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmjhoq32.dll"	Himche32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jplmglbf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kpccgk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lkgdfb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnmbaadg.dll"	Mpoljg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akljinhl.dll"	Peddhb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fihqfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jjklcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kmbkfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lgfceo32.dll"	Kaemgn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mnlfclip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mkepgp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iffmmihf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ibojgikg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgcccmnm.dll"	Mgggaamn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nbhkjicf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amaegbgd.dll"	Jjhonfjg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kmbkfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifihbhkb.dll"	Kpccgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dkedcfgf.dll"	Onceji32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oqdnld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gipgea32.dll"	Oqdnld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Peddhb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmeqhlfm.dll"	Kmbkfp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lcmopeae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjfehn32.dll"	Lkgdfb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgdklb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgdklb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnjbdj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aekeqi32.dll"	Mcdepd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Maefnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmiodlkh.dll"	Mkepgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncpelbap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nkqpcnig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Okgfdm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	2026-09-30_fe7863154bd2b0cf955adaaf0597c902_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hpenpp32.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 468 wrote to memory of 5960	468	2026-09-30_fe7863154bd2b0cf955adaaf0597c902_elex_wannacry.exe	89
PID 5960 wrote to memory of 1940	5960	Fihqfh32.exe	90
PID 1940 wrote to memory of 5808	1940	Gfnnel32.exe	91
PID 5808 wrote to memory of 1160	5808	Hfhqkk32.exe	92
PID 1160 wrote to memory of 5352	1160	Hboaql32.exe	93
PID 5352 wrote to memory of 2920	5352	Hpenpp32.exe	94
PID 2920 wrote to memory of 4600	2920	Himche32.exe	95
PID 4600 wrote to memory of 1756	4600	Iffmmihf.exe	96
PID 1756 wrote to memory of 1200	1756	Ibojgikg.exe	97
PID 1200 wrote to memory of 4568	1200	Jjhonfjg.exe	98
PID 4568 wrote to memory of 1196	4568	Jjklcf32.exe	99
PID 1196 wrote to memory of 3208	1196	Jagqfp32.exe	100
PID 3208 wrote to memory of 3844	3208	Jjoeoedo.exe	101
PID 3844 wrote to memory of 1604	3844	Jplmglbf.exe	102
PID 1604 wrote to memory of 1056	1604	Jidbpa32.exe	103
PID 1056 wrote to memory of 2652	1056	Jdjfmjhm.exe	104
PID 2652 wrote to memory of 6104	2652	Kmbkfp32.exe	105
PID 6104 wrote to memory of 4112	6104	Kgkooeen.exe	106
PID 4112 wrote to memory of 1952	4112	Kpccgk32.exe	107
PID 1952 wrote to memory of 1068	1952	Kilhqq32.exe	108
PID 1068 wrote to memory of 5552	1068	Kgphje32.exe	109
PID 5552 wrote to memory of 5548	5552	Kaemgn32.exe	110
PID 5548 wrote to memory of 712	5548	Kkmapc32.exe	111
PID 712 wrote to memory of 5160	712	Kdffiinp.exe	112
PID 5160 wrote to memory of 4392	5160	Lmnjan32.exe	113
PID 4392 wrote to memory of 4912	4392	Lkbkkbdj.exe	114
PID 4912 wrote to memory of 3936	4912	Lcmopeae.exe	115
PID 3936 wrote to memory of 4864	3936	Lanpml32.exe	116
PID 4864 wrote to memory of 2412	4864	Lkgdfb32.exe	117
PID 2412 wrote to memory of 1104	2412	Lkiqla32.exe	118
PID 1104 wrote to memory of 1988	1104	Mcdepd32.exe	119
PID 1988 wrote to memory of 3828	1988	Maefnk32.exe	120
PID 3828 wrote to memory of 1728	3828	Mnlfclip.exe	121
PID 1728 wrote to memory of 2912	1728	Mgdklb32.exe	122
PID 2912 wrote to memory of 4924	2912	Mgggaamn.exe	123
PID 4924 wrote to memory of 3096	4924	Mpoljg32.exe	124
PID 3096 wrote to memory of 3160	3096	Mkepgp32.exe	125
PID 3160 wrote to memory of 4424	3160	Ncpelbap.exe	126
PID 4424 wrote to memory of 2424	4424	Nneiikqe.exe	127
PID 2424 wrote to memory of 2844	2424	Ncbaabom.exe	128
PID 2844 wrote to memory of 5944	2844	Nacboi32.exe	129
PID 5944 wrote to memory of 4604	5944	Nnjbdj32.exe	130
PID 4604 wrote to memory of 1312	4604	Ncgkma32.exe	131
PID 1312 wrote to memory of 5372	1312	Nbhkjicf.exe	132
PID 5372 wrote to memory of 5388	5372	Nkqpcnig.exe	133
PID 5388 wrote to memory of 3624	5388	Oggqho32.exe	134
PID 3624 wrote to memory of 5580	3624	Ocnampdp.exe	135
PID 5580 wrote to memory of 2080	5580	Onceji32.exe	136
PID 2080 wrote to memory of 4268	2080	Okgfdm32.exe	137
PID 4268 wrote to memory of 1564	4268	Oqdnld32.exe	138
PID 1564 wrote to memory of 4560	1564	Ojmcej32.exe	139
PID 4560 wrote to memory of 4788	4560	Ogqcon32.exe	140
PID 4788 wrote to memory of 4748	4788	Peddhb32.exe	141

C:\Users\Admin\AppData\Local\Temp\2026-09-30_fe7863154bd2b0cf955adaaf0597c902_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_fe7863154bd2b0cf955adaaf0597c902_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:468
- C:\Windows\SysWOW64\Fihqfh32.exe
  C:\Windows\system32\Fihqfh32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5960
- - C:\Windows\SysWOW64\Gfnnel32.exe
    C:\Windows\system32\Gfnnel32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1940
  - - C:\Windows\SysWOW64\Hfhqkk32.exe
      C:\Windows\system32\Hfhqkk32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:5808
    - - C:\Windows\SysWOW64\Hboaql32.exe
        
        C:\Windows\system32\Hboaql32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1160
      - C:\Windows\SysWOW64\Hpenpp32.exe
        
        C:\Windows\system32\Hpenpp32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5352
        
        C:\Windows\SysWOW64\Himche32.exe
        
        C:\Windows\system32\Himche32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2920
        
        C:\Windows\SysWOW64\Iffmmihf.exe
        
        C:\Windows\system32\Iffmmihf.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4600
        
        C:\Windows\SysWOW64\Ibojgikg.exe
        
        C:\Windows\system32\Ibojgikg.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1756
        
        C:\Windows\SysWOW64\Jjhonfjg.exe
        
        C:\Windows\system32\Jjhonfjg.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1200
        
        C:\Windows\SysWOW64\Jjklcf32.exe
        
        C:\Windows\system32\Jjklcf32.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4568
        
        C:\Windows\SysWOW64\Jagqfp32.exe
        
        C:\Windows\system32\Jagqfp32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1196
        
        C:\Windows\SysWOW64\Jjoeoedo.exe
        
        C:\Windows\system32\Jjoeoedo.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3208
        
        C:\Windows\SysWOW64\Jplmglbf.exe
        
        C:\Windows\system32\Jplmglbf.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3844
        
        C:\Windows\SysWOW64\Jidbpa32.exe
        
        C:\Windows\system32\Jidbpa32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1604
        
        C:\Windows\SysWOW64\Jdjfmjhm.exe
        
        C:\Windows\system32\Jdjfmjhm.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1056
        
        C:\Windows\SysWOW64\Kmbkfp32.exe
        
        C:\Windows\system32\Kmbkfp32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2652
        
        C:\Windows\SysWOW64\Kgkooeen.exe
        
        C:\Windows\system32\Kgkooeen.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6104
        
        C:\Windows\SysWOW64\Kpccgk32.exe
        
        C:\Windows\system32\Kpccgk32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4112
        
        C:\Windows\SysWOW64\Kilhqq32.exe
        
        C:\Windows\system32\Kilhqq32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1952
        
        C:\Windows\SysWOW64\Kgphje32.exe
        
        C:\Windows\system32\Kgphje32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1068
        
        C:\Windows\SysWOW64\Kaemgn32.exe
        
        C:\Windows\system32\Kaemgn32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5552
        
        C:\Windows\SysWOW64\Kkmapc32.exe
        
        C:\Windows\system32\Kkmapc32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5548
        
        C:\Windows\SysWOW64\Kdffiinp.exe
        
        C:\Windows\system32\Kdffiinp.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:712
        
        C:\Windows\SysWOW64\Lmnjan32.exe
        
        C:\Windows\system32\Lmnjan32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5160
        
        C:\Windows\SysWOW64\Lkbkkbdj.exe
        
        C:\Windows\system32\Lkbkkbdj.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4392
        
        C:\Windows\SysWOW64\Lcmopeae.exe
        
        C:\Windows\system32\Lcmopeae.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4912
        
        C:\Windows\SysWOW64\Lanpml32.exe
        
        C:\Windows\system32\Lanpml32.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3936
        
        C:\Windows\SysWOW64\Lkgdfb32.exe
        
        C:\Windows\system32\Lkgdfb32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4864
        
        C:\Windows\SysWOW64\Lkiqla32.exe
        
        C:\Windows\system32\Lkiqla32.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2412
        
        C:\Windows\SysWOW64\Mcdepd32.exe
        
        C:\Windows\system32\Mcdepd32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1104
        
        C:\Windows\SysWOW64\Maefnk32.exe
        
        C:\Windows\system32\Maefnk32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1988
        
        C:\Windows\SysWOW64\Mnlfclip.exe
        
        C:\Windows\system32\Mnlfclip.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3828
        
        C:\Windows\SysWOW64\Mgdklb32.exe
        
        C:\Windows\system32\Mgdklb32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1728
        
        C:\Windows\SysWOW64\Mgggaamn.exe
        
        C:\Windows\system32\Mgggaamn.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2912
        
        C:\Windows\SysWOW64\Mpoljg32.exe
        
        C:\Windows\system32\Mpoljg32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4924
        
        C:\Windows\SysWOW64\Mkepgp32.exe
        
        C:\Windows\system32\Mkepgp32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3096
        
        C:\Windows\SysWOW64\Ncpelbap.exe
        
        C:\Windows\system32\Ncpelbap.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3160
        
        C:\Windows\SysWOW64\Nneiikqe.exe
        
        C:\Windows\system32\Nneiikqe.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4424
        
        C:\Windows\SysWOW64\Ncbaabom.exe
        
        C:\Windows\system32\Ncbaabom.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2424
        
        C:\Windows\SysWOW64\Nacboi32.exe
        
        C:\Windows\system32\Nacboi32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2844
        
        C:\Windows\SysWOW64\Nnjbdj32.exe
        
        C:\Windows\system32\Nnjbdj32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5944
        
        C:\Windows\SysWOW64\Ncgkma32.exe
        
        C:\Windows\system32\Ncgkma32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4604
        
        C:\Windows\SysWOW64\Nbhkjicf.exe
        
        C:\Windows\system32\Nbhkjicf.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1312
        
        C:\Windows\SysWOW64\Nkqpcnig.exe
        
        C:\Windows\system32\Nkqpcnig.exe
        45⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5372
        
        C:\Windows\SysWOW64\Oggqho32.exe
        
        C:\Windows\system32\Oggqho32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5388
        
        C:\Windows\SysWOW64\Ocnampdp.exe
        
        C:\Windows\system32\Ocnampdp.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3624
        
        C:\Windows\SysWOW64\Onceji32.exe
        
        C:\Windows\system32\Onceji32.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5580
        
        C:\Windows\SysWOW64\Okgfdm32.exe
        
        C:\Windows\system32\Okgfdm32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2080
        
        C:\Windows\SysWOW64\Oqdnld32.exe
        
        C:\Windows\system32\Oqdnld32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4268
        
        C:\Windows\SysWOW64\Ojmcej32.exe
        
        C:\Windows\system32\Ojmcej32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1564
        
        C:\Windows\SysWOW64\Ogqcon32.exe
        
        C:\Windows\system32\Ogqcon32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4560
        
        C:\Windows\SysWOW64\Peddhb32.exe
        
        C:\Windows\system32\Peddhb32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4788
        
        C:\Windows\SysWOW64\Pqkdmc32.exe
        
        C:\Windows\system32\Pqkdmc32.exe
        54⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4748
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 260
        55⤵
        Program crash
        
        PID:3580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4748 -ip 4748
1⤵
PID:2404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Fihqfh32.exe

Path C:\Windows\SysWOW64\Fihqfh32.exe
Size 429KB
SHA256 7550abf21c2ee10601eb9599d2ea5ca5d4c5d6d628a632926ed13b1dcf44a4f7
MD5 1c6235e01bc06243ccafe9f814b51af9
SHA1 bfe6cc7914bf86ce20c584117718f17f0882aec5
SHA512 65a47c490dcd945822265fa74f74482a84521bf7820a4635878653162f870e9250fc39e3833bdd37157b7e99fc2acd0f95c70d0f3aee3abebe10f683e6f88bda
SSDEEP 6144:Vowxqt9hiV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:Vowxi/NcZ7/N
TLSH
T15094A2A52A311AE6DDEE6FB5AC0249D89581E5B504F1F13E6633DFDCC8E8DA1DC04B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gfnnel32.exe

Path C:\Windows\SysWOW64\Gfnnel32.exe
Size 429KB
SHA256 1a55f637a47460885bd6e5bd8555173f31d5ed074144e5ab3e4999111458ee5e
MD5 550b2482242afbf68c7af58ca896b8ec
SHA1 1ab00dfc7967e34b1771f061759dfeb0156ef39c
SHA512 880a4064dd3fa75bdc92c2a0a6cfe7924e35d5517e7e995bce049f8fd7ab52254f1292438267caf84791e2b04ae3dffb4153ced46484ed2a574d1cf619521e16
SSDEEP 6144:Rk+db20V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:R5S/NcZ7/N
TLSH
T1F79481652A3019E6DDEE6BB6AC1249D88185E8F114F1F13E6633DFDDC8E4DA9CC04B84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hboaql32.exe

Path C:\Windows\SysWOW64\Hboaql32.exe
Size 429KB
SHA256 fa148ca01e33f6f66ea7b7df4e0c9e73bb7a55c88e5ac604c5b76dd4145ab92a
MD5 1dc0fdb9f4d1f47602bcfd3c0d7b5895
SHA1 42c9ccf3d693179069f6107768199cb799d0c214
SHA512 01ccf1b160cfc8937a644671ecd4a86c7c0646b272d14a262ccaab475811b7d140dce1b7a7e52006dbadb7cd7685f5cfef0e442a8596e012b3bb0a8599d1bea3
SSDEEP 6144:+/lPFEU1E1XZ0V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:CEU1E1Xz/NcZ7/N
TLSH
T103944D656A3019EADDEE6BB5AC1249E88181E5B114F1F13E6633DFDDC8E4DB2CC04B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hfhqkk32.exe

Path C:\Windows\SysWOW64\Hfhqkk32.exe
Size 429KB
SHA256 65b1a0ac2e2231aacfcfc37b46f31b3d1d20c3492cc959a8c798839d0f9510e8
MD5 2d479d9bc23e694a7f5ba235266c8f56
SHA1 043915e892e8a35bccbecf3c3a8cda00246124b1
SHA512 deb1ffcd31b8063180c09aadd1ecbfcc2da9a29a465f820b69b7f23a45a92274e5988750c22fcaa579c7173d805c5b56ab32af3a39e8421bd0d61f19c6041418
SSDEEP 6144:7DvTf9Xygfh9nV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:73hZI/NcZ7/N
TLSH
T195945E252A3119E6DDEE7BB5AC1249E88085E9B114F1F13F66279FDCC8E4DA1CC49F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Himche32.exe

Path C:\Windows\SysWOW64\Himche32.exe
Size 429KB
SHA256 5a5265fd052fa4993f98e9ab3ceca6eeef6e150880b7b260b31075ca3601a864
MD5 cf6723e63c94715bbe528e45c8f0e771
SHA1 23e0d94359f57d9c1b3fe89806f8d15d0ff3634d
SHA512 b2b348dfe0be93e95d1989c3abfa8872c5a79c002e26dc5a3da7194f17bf7f5e4d482177e14b7d88c48931587cad633f01238584909247ac81d6252ffba4c839
SSDEEP 6144:SSQoYFdB4Pj9MOWf0pV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:S0jMdv/NcZ7/N
TLSH
T1AD949325AA3019E6DEEE6BB5AC1249D88181E5B244F5F13E6637DFDCC8E5D62CC04F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hpenpp32.exe

Path C:\Windows\SysWOW64\Hpenpp32.exe
Size 429KB
SHA256 9b1eb3cf8c401e8467cd03062ab785d5a343bd47a3884a1e8c2c743cb2417eb3
MD5 cbba9b7080e5bc45396e8df500c4d9dd
SHA1 664556d66ba96ee26e9c0bee3f84b127c27904da
SHA512 fb4b762e3d630563a208b08c65df2e0de4f909c58d47f81bfbb2e1edeca1e6d655c93706e97c96d1cc54ef737714f7de9a8c227fad81263a54658651289b4c8b
SSDEEP 6144:SWdWafcV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:DdZN/NcZ7/N
TLSH
T1F2944D656A3019E6DDEE6BF6AC1289D88181F9B154F1F13E66239FDCC8E4DA5CC04F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ibojgikg.exe

Path C:\Windows\SysWOW64\Ibojgikg.exe
Size 429KB
SHA256 1e9f9b943d66bcde16d468fbbf5611e4c8678003c0b9d562bc926bcc4d0274c7
MD5 487138a68e632c1f014972d76c646a67
SHA1 eb2583bdfbfe8c442f2a71c30f73da65369ec2db
SHA512 6a5e4f8698fdb344d883f3259c950de9ffe46859f3143a0284242a03c5ad8bbfa1304f70b62dfb7706cd896507c5eb3f701aa7799126a6ed02a5a784d60cac6f
SSDEEP 6144:djVLN9HNPV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:djVLN9k/NcZ7/N
TLSH
T1F29470252A3019E9DDEE6BB1AD1249D98181E9B024F1F53E6633DFDCD8E4DA6CC04F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Iffmmihf.exe

Path C:\Windows\SysWOW64\Iffmmihf.exe
Size 429KB
SHA256 c7d5624a533e8651b9baef77c0450198376c9f814222e714016ee3ddd4dfca9c
MD5 2d9b230785f82782c017d70ee43b0806
SHA1 195afc4890587ed144013cb665e69eabdb408aa5
SHA512 a5cc633f1c9b6a95a210fbddd8891aaee09c38054221fb4cc3eb08a8f6993f3d36f4292055db6db8ff6baa39f6765574e6c436d4a5c508288dcd9e7601168f39
SSDEEP 6144:ewtKA/UnbV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:fcA/v/NcZ7/N
TLSH
T1F59460256A3419E5EDEE6BB9AD1249E88181E4B205F1F13E6633DFDCC8E5D62CC04F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jagqfp32.exe

Path C:\Windows\SysWOW64\Jagqfp32.exe
Size 429KB
SHA256 891fd99bf31c57c0282ec96a074f8d34ccefe00ca6ec7a7559f4b6d2456ee97f
MD5 37c1e44059ab2e0ba5ed513aac246410
SHA1 0fad9259a5a7880eed86ea25cf1b3c7b565a2d8e
SHA512 b541afad19444cb806fd7df8f05af1759d5c93cac29034cfdcdbe5129a286aa3db03d2f2370352bce4ac68d72e034108bdd3ecf08f350f7fbc2c36f30b68417f
SSDEEP 6144:psH5l1Aifr5o4V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:0TTfY/NcZ7/N
TLSH
T13C947065AB3019E6DDEE6BB5AC1259E88182E6B104F1F13E6673DFDCC8E4D61CC44B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jdjfmjhm.exe

Path C:\Windows\SysWOW64\Jdjfmjhm.exe
Size 429KB
SHA256 2450a06848727423be329a21344b4a849ca47b13a604cc816072292018aaee43
MD5 a18d5ac32d3625e967562d6a7fa1ffea
SHA1 87451cf4b66f11c4f26fa03b46b5ff8dc2bdc975
SHA512 c9d337ea1fc83053a0a0a93abc442411db1d13fc3f683568debdf17096dc89a57a41cea1b09ae7cdd1c9c88a67eb87a528d7be787d969ca26957a542d710df07
SSDEEP 6144:ZZCl0V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:zu/NcZ7/N
TLSH
T121947365273019E5DDEEABB5AD2289D89081E4B114F1F23EA633DFDCC8E5E61CC05B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jidbpa32.exe

Path C:\Windows\SysWOW64\Jidbpa32.exe
Size 429KB
SHA256 af62fba12aaa42f17f4c6eacf6090033615cceaa6726468b02d550c435064ff9
MD5 d2da07a0264791bd9e2f38fd71a5390f
SHA1 45b2e78849a6a882a7970ee7d704fd61797e398a
SHA512 d70b85bfc5849373617ed927a799825e4f2c70acad87bba26de7affca569ec356982907ba49babad82ba41b8c8e6565330bba53e5b7c06ee5446806247c5cb0e
SSDEEP 6144:yX5UDXmqV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:yX+DW/NcZ7/N
TLSH
T132946165667419E5DDEE6FB5AC2289D88181E4B118F1F23E9633EFDCC8E4DA1CC04B90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jjhonfjg.exe

Path C:\Windows\SysWOW64\Jjhonfjg.exe
Size 429KB
SHA256 117aa23b16af11e7bd0a7b64c8605a50d583d6b4d79a92135a95ef59c678093c
MD5 e2531f1cf5fae6306615ad42ed1c577c
SHA1 dbce163b33ed8c6a23599974cbf46430b35ed2aa
SHA512 c7dca868abfe2b2afb6b298f162d30945d8a126aaab574c15464a38a51017896d22010f0842d3d03e9f2fa2bcab40119b9d91cca2b2c06a85fc61b8519be37d7
SSDEEP 6144:lQK6N2RmM/fV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:lQKgmo/NcZ7/N
TLSH
T118945F652A3019E6EDEE6BB5BC1249E89181E9B114F1F13E6633DFDCC8E5DA5CC04B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jjklcf32.exe

Path C:\Windows\SysWOW64\Jjklcf32.exe
Size 429KB
SHA256 c4733e451d3862acf5748074153e27dd894501a60f1c434f06b46c86c44498c1
MD5 b8d7a22e5eacd5b69645aeb603578630
SHA1 ab92198932037ff547aa1bb3344f001df71f7d6b
SHA512 4dfe046183d2d1859b4c9471e2bae392f521bdeedaf9b3acf63dec35c726afb128dbb28d0c9779bd1abed03bd8e4fdee885de1ce95f9a98825d1620e57865d06
SSDEEP 6144:oVQeiJ6V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:beiZ/NcZ7/N
TLSH
T1B69483656A3019EAEDEE6BB5AC124AD88581E4F114F1F13EA633DFDCC8E4D61DD04B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jjoeoedo.exe

Path C:\Windows\SysWOW64\Jjoeoedo.exe
Size 429KB
SHA256 041f5fdad239469939584b7677f7c728830be0b930af157dec06c89bd5e31150
MD5 2368cb249b897c20e53f415b798589eb
SHA1 9a22a1e13fcec9980415ee577b8949732c775635
SHA512 32b5290f9f720d0acc15f8f5b5943ddb9e34977b1dc65249b90a4fc056981cf1a9fac46126f16fb089b6024eb5bf807352faf4e26f59e029775312aa9dd83c53
SSDEEP 6144:h1JKJs0V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:vJKw/NcZ7/N
TLSH
T10E9471656A301EE6DDEE6BB5AC1249D88181E5B104F1F13E6A33DFDCC8E4EA1DC05B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jplmglbf.exe

Path C:\Windows\SysWOW64\Jplmglbf.exe
Size 429KB
SHA256 f0afdeb55bca2e822d49b92049d4a85933f4c953de546dcba432e436c3c03045
MD5 2e67c6462e80d00cece8017d8886e0b5
SHA1 8ffcbc286c0a229c64945ea9ce704d69bcd5a1ce
SHA512 93826114cd0196324f02f4935cce04a2f4e912aedf92a7c4d2c58ba9129741fa6be1ce0f63bf924405b6c69a75c1b72377bd8468d86bc6b21a7c949decb5d362
SSDEEP 6144:Fw2xPcsOV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:Fw8UI/NcZ7/N
TLSH
T1DF94726966301DE5EEEE6BB5AC2249E88181E5B114F1F13E6633DFDCC8E4DA1DC04B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kaemgn32.exe

Path C:\Windows\SysWOW64\Kaemgn32.exe
Size 429KB
SHA256 99c76cfd86542f7493d1f3c888d6d7f268460dfc747b4b7af207cff01f5d2ee9
MD5 c9fd83d742796594615f56b9833a6bc8
SHA1 c269a03bd0d1d1ae600d5c6a9b31f48dbad0d978
SHA512 c9ec4faa786bd81bc1798a071c829fc5eebb0bee27b435b10d30c7cbd79bcde948b1709fc5b3cc515b27809b5c8d4a0477d035f9c7ec4f9e12c91eafb8467a47
SSDEEP 6144:uRfpdRI8/qoT9780V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:CdI8/qoT97q/NcZ7/N
TLSH
T1E19471652A3019EADDEE6FB5AC1259D88181E4B114F5F13EA633DFDCC8E4DA1CC18B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kdffiinp.exe

Path C:\Windows\SysWOW64\Kdffiinp.exe
Size 429KB
SHA256 ae848c08c5622f8a241994ef532750a22cf8d54dcb9bf41dc5050e0b1d95b717
MD5 e6e11ff412a3ae7216243a7f85ea8791
SHA1 2cd28ccadaa5439cb73de7300d1fc71733feb676
SHA512 7d86487c2a998c42d776ebdbcb201002a5784f073555f90c9d1810e5a295379ed27ac012818316d85045c7d5f953ac9b5893a1eecb31e5dcd5a65b8dd27b0b0f
SSDEEP 6144:HWEVBn3WBV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:3B3Z/NcZ7/N
TLSH
T1A2947F252A3119EADDEE6FB5AC1249E88185E4B014F1F13E6633DFDDC8E4DA2CC14B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kgkooeen.exe

Path C:\Windows\SysWOW64\Kgkooeen.exe
Size 429KB
SHA256 013e977ef5599f2a3c8bc7bcb05db306b93bcb56efca92e38f95772e3f0d8ebd
MD5 72bac810f9f9614511a232ebb90b8c8f
SHA1 a67b8779b0e49684b2d02a5f90b1009ef043483f
SHA512 afa70017ae7ad92bb1831650e49501e4f8a2d785cd61bcb8bd55c79324ebbba25e75441f7acef2a19c6ba110c727d373284dac773cdfac16d4a604738ec7bee1
SSDEEP 6144:FdfdCcuV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:3fdCw/NcZ7/N
TLSH
T1299461696A3019E6DDEE6BB5AC124AD88181E5F114F1F13E6633DFECC8E4DA5CC04B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kgphje32.exe

Path C:\Windows\SysWOW64\Kgphje32.exe
Size 429KB
SHA256 fa5e6312d7e9342a9c8e42497ea462adf8f9b7417624974ffa316b38a220e021
MD5 c4eda54f3771756fe18caaa8443db1f8
SHA1 382db8be57fe30fb400b56456c9f1f01ffd84aef
SHA512 d70274338bb11ed80c440c93050bd47ad7eea755529aeae4776502c8cde7aea36a1c76e3e08a622c08a41a360fe57dcf1bd0378dda9068f0c749ed0509b15c30
SSDEEP 6144:abO3yknV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:U/NcZ7/N
TLSH
T1F9945F252A3419E6DDEE6BB5AC124AD881C1E9B104F1F13E6633DFDCE8E4D61CC05B86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kilhqq32.exe

Path C:\Windows\SysWOW64\Kilhqq32.exe
Size 429KB
SHA256 5536f1b75530cf72ebc1a62cd9b1e5ca9104f9920fdadf7b24a1a30680ee23bc
MD5 87706bf06975dc84e6382d60c052226c
SHA1 f4490f5a70237ca9dcbd87ceb660a9ce29de7a6d
SHA512 70f78adf18df5258d59c98c871a887893e7625386761ecf56a5e13d4fa8be980fc04e77d74cc72f3d34190900b7f29e38171005a844939f1eccb93ecd2bc47f9
SSDEEP 6144:qsyhMV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:qsy3/NcZ7/N
TLSH
T1799460652A3019E6DDEE6BB5AC1249D88181E5B104F2F13F6633DFECC8E5DA2DC04B85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kkmapc32.exe

Path C:\Windows\SysWOW64\Kkmapc32.exe
Size 429KB
SHA256 317be44a3772cba4e05fd2faccdf5e51fa0bdc1e2c01f15bcfbef72a712a03c5
MD5 b78406345036c5910479f35cdced0b36
SHA1 d46ae63a03d3cdba31182080a1d9f12fb76b7b7a
SHA512 a81aef9197030b60faa8713f844d633253e9245c10de2c8fb78244ed6b494ce96aae19ec429402da47828814ce965cefb940e46fd0164005f34e93df814c2041
SSDEEP 6144:N0li7VyV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:mil/NcZ7/N
TLSH
T17E9461256A3019E9EDEE6BB5AC2249D88181E9B114F1F13E6633DFDCD8E4D62CC44F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kmbkfp32.exe

Path C:\Windows\SysWOW64\Kmbkfp32.exe
Size 429KB
SHA256 05d98dcb2da1aedfc0834614525317441a72026116c799da2d8bb8db563a0109
MD5 aa0e019fc3571472d9fd1729b030d062
SHA1 af07d66ac937d7bdf4b48480f614400f8cead69c
SHA512 886bf67d949edc5ac2193f5a9498b858ac29a7b63050baaa41bd3a056ae0285f1adaf736c29ff9054c93581ea3e471425c49822434e29430a4a95c796488492e
SSDEEP 6144:Ko+ETybUKzfrKYV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:d+Syo2frE/NcZ7/N
TLSH
T17894626566301AE6DEEE6BB5AC1249E881D2E5B114F1F13E5633DFECD8E4DA1CC04B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kpccgk32.exe

Path C:\Windows\SysWOW64\Kpccgk32.exe
Size 429KB
SHA256 54abe183746b24ff72a17671b78813c96ab3c2f8ebcb4ecb711a5d39c33b7031
MD5 dc6ab265eabbc3e290dacc98cff075b5
SHA1 6164bc2e603c8ecedc11a0a880890c11db20dd07
SHA512 cc910987448c6ac20fc5a0f0174ab249f93df1554eca70f54ba5b8835b568ab959876016255224c9e1a0efa58b3a2bc4cf029ed13c69b7ef29108779730a68a6
SSDEEP 6144:bgW6TlVnxuyjEKepMDdIeV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:bJ6A/NcZ7/N
TLSH
T1589483656A3019E6DDEEABB5AC1249D88181E8B514F1F23E6633DFDDC8E4DA1CC04F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lanpml32.exe

Path C:\Windows\SysWOW64\Lanpml32.exe
Size 429KB
SHA256 7d673d940136801af27b74974e9b463381f5496bf4267e42bb29a051da99f0b4
MD5 3c03f0ea25cbcad9ad92a390221efba8
SHA1 0eb48cc09cb17cd9a37134e65346035ca641a944
SHA512 a967435618c0673c356755fb4bf900f1bab30e26d76947a20e26e8234c73a51aeb95d632132dd8bfda8f51d151617469da6c96e9d18ae47ff66eb19279f0c46b
SSDEEP 6144:lJHppV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:7u/NcZ7/N
TLSH
T1119473956A302AE5DDEE6BF5AC1249D89181E6B105F1F23E5633DFDCC8E4E62CC04B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lcmopeae.exe

Path C:\Windows\SysWOW64\Lcmopeae.exe
Size 429KB
SHA256 412d07206b5ff44cbe3496fc6938794855f7ce3ced11c31698389042649046d4
MD5 f1dc792fa5559b47a0d995a6832edce6
SHA1 abdc1f585add270387458e90b153ca24275490d0
SHA512 d9e41231232e87b97705896b80c28dfe3bbc3a149131dcee953e947b3c932e9613adc916996743bc88660f182a373532eca23aa2e4022608665936a1ac6d1f96
SSDEEP 6144:Pvjh3PClV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:PvjhB/NcZ7/N
TLSH
T1C1946F692B3019E5DDEE6BB5AC1249D8A085E8B115F1F13E6A33DFDDC8E4DA1CC04B84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lkbkkbdj.exe

Path C:\Windows\SysWOW64\Lkbkkbdj.exe
Size 429KB
SHA256 2a58c638c68ce0edd971b849c1a1414d4d2b1dda27a7cfb1b99800324be5f981
MD5 abfd3b869463310dbe48c24212a4b04a
SHA1 47a75fc6a15143c2bfd46c202bce34aacfc6f5a0
SHA512 1801badccb7890bd7f050c887235972e1e96df7a5048679f373ce62e61a8f3898defd767cea20ab62be6618035335145ce202fb98f3aa7c04518a64cb9f33d10
SSDEEP 6144:LULMTKprSXGBkV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:LULkhX2/NcZ7/N
TLSH
T159945F752A3019EADDEE6BB5AC1249D88285E5F264F1F13E6623DFDCC8E4D61CC14B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lkgdfb32.exe

Path C:\Windows\SysWOW64\Lkgdfb32.exe
Size 429KB
SHA256 4300c92050414d57f44181915aebc5fb795ec1a3e6f837d43fe09e080ae387dd
MD5 599227e9e88ac4019c760fb0d6a6a65a
SHA1 63c9d69a2134c264694db343c05dd629354c73f9
SHA512 f78bfe27d06c6217bead447c4dfbc7088797adacd1805c7c45b83a2df61922a5d9b7272744338cf24c185a6a6f30ffb35f463435649497e0dbfb2bf7a83ee0fe
SSDEEP 6144:xnPWPPvvvsUrPV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:xGi/NcZ7/N
TLSH
T130945E256A301EE6DDEE6BB5AC1249E88181E4F114F1F13E6623DFDCC8E4DA2C815F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lkiqla32.exe

Path C:\Windows\SysWOW64\Lkiqla32.exe
Size 429KB
SHA256 c790cb883aa36cbf9cfb38559fe1123358645d60cb15c34a4c53940ead835dba
MD5 da9c59a7c1543193dc74fa51a14f2070
SHA1 a4d620e04cfcc0997c85fdf405a37ff8250e8955
SHA512 d8df6f9eb051936fbc79a12c5de4e2410b4d279f9528c3fd258193d966c57283defd5df6a236571520ec70fa6a646ba04fda4971a2078815765a4c59fb90dfe8
SSDEEP 6144:do0La1kV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:dov/NcZ7/N
TLSH
T1F59482652A3019E9EDEE6BB5AC1249D88085E5B114F2F13F6633DFDCC8E8DA5CC05B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lmnjan32.exe

Path C:\Windows\SysWOW64\Lmnjan32.exe
Size 429KB
SHA256 c9b949baefc4bde09882d5c3cc41f9a69426758f72438d630e2fb310c4264984
MD5 e3a305627c3658be63898e8b86a49df0
SHA1 1ee51451e0ae0a4b9d20a328b317f25bae77cb79
SHA512 c74838220ac702fcfccd0bc82a6bf0ef229c1ec7debcf1413092d284f03d5651e0c1ec9b1fad950deec6e9dd3525b0fdf69984a8171e24cbb99d166e7673db14
SSDEEP 6144:yklDV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:yp/NcZ7/N
TLSH
T1E1946E652A311DE6EDEE6BB5AD1249D990C2E8B104F5F13E6633DFDCD8E4DA1C804B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Maefnk32.exe

Path C:\Windows\SysWOW64\Maefnk32.exe
Size 429KB
SHA256 fd8aa8108a26e94e920e62fdb61886cd511530619eb5a54b4343d09aa6718269
MD5 37e91379037d46149521c91eee66a3bd
SHA1 f650236319bcf44fc4c0879e830f19c841c179e9
SHA512 3dccdbadb0e3d51fd517e806f3b2c8f99d9a07d8ed9a09c0c466a804e0a5560ff828a16297c9de819ab4bb16f42524bf770df241c6f761e01e8c1c5af4fad951
SSDEEP 6144:CrYXLFNN/V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:CrYJNY/NcZ7/N
TLSH
T16D9481292A3019E6DDEE6BB5AC124AE881C5E4B104F5F13E6633DFDCD8E4DA5CC15B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mcdepd32.exe

Path C:\Windows\SysWOW64\Mcdepd32.exe
Size 429KB
SHA256 f849baf3d0413619f95e297bab29ba84a70557b10195d0e2085ef9921f1bf234
MD5 a5125c4283bf085d7c936fe7875e678f
SHA1 b10c733a7d40a151162eade1fe54b4ba11ed9ebb
SHA512 b7129cbcbb553c6f1d0cf31f6ee38945571d6bbba9ca39604b76f82a8ceaca8107418a2cf582f6e9741b13055c89bcb156dbc08db1d41f56aa9c2fd3b95d6638
SSDEEP 6144:vJShsktG8V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:RSFU/NcZ7/N
TLSH
T18F944E256B311EEADDEE6BB5AC1249E881C1E5B114F1E17E6623DFDCC9E4DA1C804F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mnlfclip.exe

Path C:\Windows\SysWOW64\Mnlfclip.exe
Size 429KB
SHA256 8bdca5bd2a645ac8226e384e2e47614950d62875517ae13b970994c9bb34f80a
MD5 463a0f677d50ee4268befcfba9c21aec
SHA1 971e3227bbb4e2be5132bbb0454e2187bc3fb884
SHA512 ad6198636ef8f170f7161da6863c08f253e3cde42bae30d1a1620c63e6881d19680441770ea549bc6d9b648f86605ac6a28ad57d952c50cf98553f9c9c7b1394
SSDEEP 6144:Ch4/kduKaLV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:tW/NcZ7/N
TLSH
T1A99492662A3819E5DDEE6BB5AC1249D89181E4F104F5F13E6A33DFDEC8E4E61CC04B84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/468-1-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/468-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/712-161-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/712-392-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1056-408-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1056-105-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1068-140-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1068-399-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1104-210-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1104-377-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1160-28-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1196-77-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1200-63-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1312-352-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1312-280-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1564-338-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1564-315-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1604-98-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1604-412-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1728-372-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1728-230-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1756-56-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1940-14-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1952-133-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1952-402-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1988-379-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1988-217-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2080-305-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2080-341-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2412-203-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2412-380-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2424-360-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2424-260-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2652-409-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2652-112-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2844-265-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2844-358-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2912-370-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2912-235-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2920-42-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3096-366-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3096-245-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3160-364-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3160-250-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3208-413-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3208-84-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3624-346-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3624-295-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3828-374-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3828-225-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3844-91-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3936-384-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3936-189-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4112-404-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4112-126-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4268-342-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4268-310-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4392-389-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4392-175-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4424-255-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4424-362-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4560-335-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4560-320-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4568-70-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4600-49-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4604-275-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4604-354-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4748-337-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4748-330-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4788-325-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4788-334-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4864-382-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4864-196-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4912-388-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4912-182-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4924-368-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4924-240-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5160-168-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5160-390-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5352-36-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5372-285-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5372-350-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5388-348-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5388-290-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5548-394-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5548-154-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5552-147-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5552-396-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5580-344-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5580-300-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5808-21-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5944-356-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5944-270-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5960-7-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6104-406-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6104-119-0x0000000000400000-0x000000000046D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads