berbew | 5da274ffc005c8048f6c16f3352dae1914ad1b7f6e2224f27b77e4cc26790c92

Analysis

max time kernel
148s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_70828c763b2f2090bc96a4486407f81a_elex_wannacry.exe
Size 320KB
Sample260701-e1rdpsgs6z
SHA256 5da274ffc005c8048f6c16f3352dae1914ad1b7f6e2224f27b77e4cc26790c92
MD5 70828c763b2f2090bc96a4486407f81a
SHA1 1be75544047ac0324ddfa9a46a67fd1c8d92604e
SHA512 a5f7a708c580a9f401b6a85829e8508286cb4ee0babcc8b2c0fdfa385ed8e88a6213b14fd5e82dfcedc8b2e3607cd9a3516d9572bf05214d9357017220cded3f
SSDEEP 3072:rf3baExe1QJYwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:rvbrxeWYV/Ah1G/AcQ///NR5fn
TLSH
T194644019263059EACEED1BB5AD025DDA5A41E8F014F1E23E2123DFDCC8F4DA6E805F85
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfhhml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cekhihig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Clgmkbna.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dbfoclai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddekmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddhhbngi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bedbhi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cepadh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Debnjgcp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmifkecb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dipgpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dipgpf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbaehl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cbaehl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	2026-06-30_70828c763b2f2090bc96a4486407f81a_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dbcbnlcl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dedkogqm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dpgbgpbe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmnpfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmnpfd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dlqpaafg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddhhbngi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmifkecb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dgdgijhp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Defheg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmbpjfij.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbfoclai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dlncla32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cboibm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dllffa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dlqpaafg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cleqfb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdlhgpag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmdmpe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpgbgpbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfakcj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dedkogqm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddekmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cleqfb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Clgmkbna.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Debnjgcp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmkcpdao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdnelpod.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ciknefmk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmgjee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dpefaq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddqbbo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dinjjf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmkcpdao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpjompqc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmbpjfij.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cekhihig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfjeckpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdnelpod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cepadh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dllffa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgdgijhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cboibm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmgjee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbcbnlcl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dpjompqc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dibdeegc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dibdeegc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bedbhi32.exe

Executes dropped EXE 39 IoCs

pid	Process
4340	Bedbhi32.exe
4012	Bmkjig32.exe
1068	Cfhhml32.exe
692	Cekhihig.exe
4684	Cmbpjfij.exe
1460	Cleqfb32.exe
3392	Cdlhgpag.exe
2872	Cboibm32.exe
888	Cfjeckpj.exe
4480	Cmdmpe32.exe
3368	Clgmkbna.exe
564	Cdnelpod.exe
4788	Cbaehl32.exe
3168	Cepadh32.exe
228	Ciknefmk.exe
1536	Cmgjee32.exe
5016	Dpefaq32.exe
4452	Ddqbbo32.exe
776	Dbcbnlcl.exe
4972	Debnjgcp.exe
1108	Dinjjf32.exe
4964	Dmifkecb.exe
464	Dllffa32.exe
3780	Dpgbgpbe.exe
2312	Dbfoclai.exe
1264	Dfakcj32.exe
2856	Dedkogqm.exe
5084	Dipgpf32.exe
3364	Dmkcpdao.exe
3960	Dlncla32.exe
3468	Dpjompqc.exe
3360	Ddekmo32.exe
1696	Dgdgijhp.exe
4092	Defheg32.exe
4328	Dibdeegc.exe
4660	Dmnpfd32.exe
540	Dlqpaafg.exe
2868	Ddhhbngi.exe
3344	Dbkhnk32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Cepadh32.exe	Cbaehl32.exe
File created	C:\Windows\SysWOW64\Dpgbgpbe.exe	Dllffa32.exe
File created	C:\Windows\SysWOW64\Idbgcb32.dll	Dipgpf32.exe
File created	C:\Windows\SysWOW64\Ldbeqlcg.dll	Dgdgijhp.exe
File opened for modification	C:\Windows\SysWOW64\Cmbpjfij.exe	Cekhihig.exe
File opened for modification	C:\Windows\SysWOW64\Dpefaq32.exe	Cmgjee32.exe
File created	C:\Windows\SysWOW64\Dbebgj32.dll	Bedbhi32.exe
File created	C:\Windows\SysWOW64\Ciknefmk.exe	Cepadh32.exe
File created	C:\Windows\SysWOW64\Dllffa32.exe	Dmifkecb.exe
File created	C:\Windows\SysWOW64\Ggiipk32.dll	Clgmkbna.exe
File created	C:\Windows\SysWOW64\Dbkhnk32.exe	Ddhhbngi.exe
File created	C:\Windows\SysWOW64\Cdlhgpag.exe	Cleqfb32.exe
File opened for modification	C:\Windows\SysWOW64\Cbaehl32.exe	Cdnelpod.exe
File created	C:\Windows\SysWOW64\Dpefaq32.exe	Cmgjee32.exe
File created	C:\Windows\SysWOW64\Jgfdkj32.dll	Dfakcj32.exe
File created	C:\Windows\SysWOW64\Dpjompqc.exe	Dlncla32.exe
File created	C:\Windows\SysWOW64\Cekhihig.exe	Cfhhml32.exe
File created	C:\Windows\SysWOW64\Cmgjee32.exe	Ciknefmk.exe
File created	C:\Windows\SysWOW64\Dbfoclai.exe	Dpgbgpbe.exe
File created	C:\Windows\SysWOW64\Dgdgijhp.exe	Ddekmo32.exe
File created	C:\Windows\SysWOW64\Bedbhi32.exe	2026-06-30_70828c763b2f2090bc96a4486407f81a_elex_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\Ddqbbo32.exe	Dpefaq32.exe
File opened for modification	C:\Windows\SysWOW64\Bedbhi32.exe	2026-06-30_70828c763b2f2090bc96a4486407f81a_elex_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\Cdlhgpag.exe	Cleqfb32.exe
File created	C:\Windows\SysWOW64\Cbaehl32.exe	Cdnelpod.exe
File created	C:\Windows\SysWOW64\Fiinbn32.dll	Dlncla32.exe
File created	C:\Windows\SysWOW64\Defheg32.exe	Dgdgijhp.exe
File opened for modification	C:\Windows\SysWOW64\Dibdeegc.exe	Defheg32.exe
File created	C:\Windows\SysWOW64\Ddqbbo32.exe	Dpefaq32.exe
File created	C:\Windows\SysWOW64\Dinjjf32.exe	Debnjgcp.exe
File created	C:\Windows\SysWOW64\Dmnpfd32.exe	Dibdeegc.exe
File created	C:\Windows\SysWOW64\Cleqfb32.exe	Cmbpjfij.exe
File created	C:\Windows\SysWOW64\Ladlqj32.dll	Cleqfb32.exe
File opened for modification	C:\Windows\SysWOW64\Cmdmpe32.exe	Cfjeckpj.exe
File created	C:\Windows\SysWOW64\Cdnelpod.exe	Clgmkbna.exe
File opened for modification	C:\Windows\SysWOW64\Dlncla32.exe	Dmkcpdao.exe
File created	C:\Windows\SysWOW64\Dibdeegc.exe	Defheg32.exe
File created	C:\Windows\SysWOW64\Ddhhbngi.exe	Dlqpaafg.exe
File opened for modification	C:\Windows\SysWOW64\Cfhhml32.exe	Bmkjig32.exe
File opened for modification	C:\Windows\SysWOW64\Cleqfb32.exe	Cmbpjfij.exe
File created	C:\Windows\SysWOW64\Cfjeckpj.exe	Cboibm32.exe
File created	C:\Windows\SysWOW64\Dedkogqm.exe	Dfakcj32.exe
File created	C:\Windows\SysWOW64\Dpkgac32.dll	Dibdeegc.exe
File created	C:\Windows\SysWOW64\Fjgnln32.dll	Dmnpfd32.exe
File created	C:\Windows\SysWOW64\Cmonod32.dll	Dlqpaafg.exe
File created	C:\Windows\SysWOW64\Bmkjig32.exe	Bedbhi32.exe
File created	C:\Windows\SysWOW64\Bkpjjj32.dll	Cmdmpe32.exe
File opened for modification	C:\Windows\SysWOW64\Debnjgcp.exe	Dbcbnlcl.exe
File created	C:\Windows\SysWOW64\Oihlnd32.dll	Dllffa32.exe
File opened for modification	C:\Windows\SysWOW64\Dbfoclai.exe	Dpgbgpbe.exe
File created	C:\Windows\SysWOW64\Cfhhml32.exe	Bmkjig32.exe
File opened for modification	C:\Windows\SysWOW64\Cmgjee32.exe	Ciknefmk.exe
File created	C:\Windows\SysWOW64\Eicfep32.dll	Cmgjee32.exe
File opened for modification	C:\Windows\SysWOW64\Dbcbnlcl.exe	Ddqbbo32.exe
File opened for modification	C:\Windows\SysWOW64\Dfakcj32.exe	Dbfoclai.exe
File created	C:\Windows\SysWOW64\Nfmcle32.dll	Dbfoclai.exe
File opened for modification	C:\Windows\SysWOW64\Dedkogqm.exe	Dfakcj32.exe
File opened for modification	C:\Windows\SysWOW64\Ddekmo32.exe	Dpjompqc.exe
File created	C:\Windows\SysWOW64\Cbccbiml.dll	Dpjompqc.exe
File opened for modification	C:\Windows\SysWOW64\Dlqpaafg.exe	Dmnpfd32.exe
File created	C:\Windows\SysWOW64\Dihmeahp.dll	Debnjgcp.exe
File created	C:\Windows\SysWOW64\Jaepkejo.dll	Cdnelpod.exe
File created	C:\Windows\SysWOW64\Nqbpidem.dll	Dmkcpdao.exe
File opened for modification	C:\Windows\SysWOW64\Defheg32.exe	Dgdgijhp.exe

Program crash 1 IoCs

pid	pid_target	Process
4296	3344	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 40 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmkjig32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdlhgpag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpefaq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Defheg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cekhihig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfjeckpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dlncla32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddekmo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dibdeegc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_70828c763b2f2090bc96a4486407f81a_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpgbgpbe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpjompqc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmbpjfij.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cleqfb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ciknefmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbcbnlcl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmifkecb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfakcj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddhhbngi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmgjee32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dinjjf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dllffa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgdgijhp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bedbhi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cboibm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdnelpod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbaehl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddqbbo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbfoclai.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dedkogqm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dipgpf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfhhml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Clgmkbna.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cepadh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmkcpdao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmnpfd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dlqpaafg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmdmpe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Debnjgcp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbkhnk32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgpoahbe.dll"	Ddekmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dkakfgoq.dll"	Ddqbbo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dbcbnlcl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dinjjf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmnpfd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cleqfb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dipgpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmkjig32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmbpjfij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmnpfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbebgj32.dll"	Bedbhi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bedbhi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iojghflb.dll"	Cepadh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dpefaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dihmeahp.dll"	Debnjgcp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Defheg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Defheg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dibdeegc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dlqpaafg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpaohckm.dll"	Dpefaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Befogbik.dll"	Cbaehl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	2026-06-30_70828c763b2f2090bc96a4486407f81a_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bmkjig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aoedfmpf.dll"	Cdlhgpag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qecnjaee.dll"	Cboibm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpngef32.dll"	Dbcbnlcl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dpjompqc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efiopa32.dll"	2026-06-30_70828c763b2f2090bc96a4486407f81a_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ladlqj32.dll"	Cleqfb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdlhgpag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dgdgijhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjgnln32.dll"	Dmnpfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmonod32.dll"	Dlqpaafg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cekhihig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amkejmgc.dll"	Cekhihig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dbcbnlcl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dllffa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dipgpf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dgdgijhp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	2026-06-30_70828c763b2f2090bc96a4486407f81a_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ciknefmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggiipk32.dll"	Clgmkbna.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Debnjgcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hodcma32.dll"	Dmifkecb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dpgbgpbe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ddekmo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dibdeegc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dlqpaafg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	2026-06-30_70828c763b2f2090bc96a4486407f81a_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpgnmlep.dll"	Bmkjig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mondkfmh.dll"	Cfjeckpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dpjompqc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Neiiibnn.dll"	Cmbpjfij.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmdmpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dpefaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nfmcle32.dll"	Dbfoclai.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dfakcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qfeckiie.dll"	Ciknefmk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cboibm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dinjjf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmkcpdao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmkcpdao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eicfep32.dll"	Cmgjee32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdnelpod.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 876 wrote to memory of 4340	876	2026-06-30_70828c763b2f2090bc96a4486407f81a_elex_wannacry.exe	86
PID 4340 wrote to memory of 4012	4340	Bedbhi32.exe	87
PID 4012 wrote to memory of 1068	4012	Bmkjig32.exe	88
PID 1068 wrote to memory of 692	1068	Cfhhml32.exe	89
PID 692 wrote to memory of 4684	692	Cekhihig.exe	90
PID 4684 wrote to memory of 1460	4684	Cmbpjfij.exe	91
PID 1460 wrote to memory of 3392	1460	Cleqfb32.exe	92
PID 3392 wrote to memory of 2872	3392	Cdlhgpag.exe	93
PID 2872 wrote to memory of 888	2872	Cboibm32.exe	94
PID 888 wrote to memory of 4480	888	Cfjeckpj.exe	95
PID 4480 wrote to memory of 3368	4480	Cmdmpe32.exe	96
PID 3368 wrote to memory of 564	3368	Clgmkbna.exe	97
PID 564 wrote to memory of 4788	564	Cdnelpod.exe	98
PID 4788 wrote to memory of 3168	4788	Cbaehl32.exe	99
PID 3168 wrote to memory of 228	3168	Cepadh32.exe	100
PID 228 wrote to memory of 1536	228	Ciknefmk.exe	101
PID 1536 wrote to memory of 5016	1536	Cmgjee32.exe	102
PID 5016 wrote to memory of 4452	5016	Dpefaq32.exe	103
PID 4452 wrote to memory of 776	4452	Ddqbbo32.exe	104
PID 776 wrote to memory of 4972	776	Dbcbnlcl.exe	105
PID 4972 wrote to memory of 1108	4972	Debnjgcp.exe	106
PID 1108 wrote to memory of 4964	1108	Dinjjf32.exe	107
PID 4964 wrote to memory of 464	4964	Dmifkecb.exe	108
PID 464 wrote to memory of 3780	464	Dllffa32.exe	109
PID 3780 wrote to memory of 2312	3780	Dpgbgpbe.exe	110
PID 2312 wrote to memory of 1264	2312	Dbfoclai.exe	111
PID 1264 wrote to memory of 2856	1264	Dfakcj32.exe	112
PID 2856 wrote to memory of 5084	2856	Dedkogqm.exe	113
PID 5084 wrote to memory of 3364	5084	Dipgpf32.exe	114
PID 3364 wrote to memory of 3960	3364	Dmkcpdao.exe	115
PID 3960 wrote to memory of 3468	3960	Dlncla32.exe	116
PID 3468 wrote to memory of 3360	3468	Dpjompqc.exe	117
PID 3360 wrote to memory of 1696	3360	Ddekmo32.exe	118
PID 1696 wrote to memory of 4092	1696	Dgdgijhp.exe	119
PID 4092 wrote to memory of 4328	4092	Defheg32.exe	120
PID 4328 wrote to memory of 4660	4328	Dibdeegc.exe	121
PID 4660 wrote to memory of 540	4660	Dmnpfd32.exe	122
PID 540 wrote to memory of 2868	540	Dlqpaafg.exe	123
PID 2868 wrote to memory of 3344	2868	Ddhhbngi.exe	124

C:\Users\Admin\AppData\Local\Temp\2026-06-30_70828c763b2f2090bc96a4486407f81a_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_70828c763b2f2090bc96a4486407f81a_elex_wannacry.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:876
- C:\Windows\SysWOW64\Bedbhi32.exe
  C:\Windows\system32\Bedbhi32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4340
- - C:\Windows\SysWOW64\Bmkjig32.exe
    C:\Windows\system32\Bmkjig32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4012
  - - C:\Windows\SysWOW64\Cfhhml32.exe
      C:\Windows\system32\Cfhhml32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1068
    - - C:\Windows\SysWOW64\Cekhihig.exe
        
        C:\Windows\system32\Cekhihig.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:692
      - C:\Windows\SysWOW64\Cmbpjfij.exe
        
        C:\Windows\system32\Cmbpjfij.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4684
        
        C:\Windows\SysWOW64\Cleqfb32.exe
        
        C:\Windows\system32\Cleqfb32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1460
        
        C:\Windows\SysWOW64\Cdlhgpag.exe
        
        C:\Windows\system32\Cdlhgpag.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3392
        
        C:\Windows\SysWOW64\Cboibm32.exe
        
        C:\Windows\system32\Cboibm32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2872
        
        C:\Windows\SysWOW64\Cfjeckpj.exe
        
        C:\Windows\system32\Cfjeckpj.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:888
        
        C:\Windows\SysWOW64\Cmdmpe32.exe
        
        C:\Windows\system32\Cmdmpe32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4480
        
        C:\Windows\SysWOW64\Clgmkbna.exe
        
        C:\Windows\system32\Clgmkbna.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3368
        
        C:\Windows\SysWOW64\Cdnelpod.exe
        
        C:\Windows\system32\Cdnelpod.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:564
        
        C:\Windows\SysWOW64\Cbaehl32.exe
        
        C:\Windows\system32\Cbaehl32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4788
        
        C:\Windows\SysWOW64\Cepadh32.exe
        
        C:\Windows\system32\Cepadh32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3168
        
        C:\Windows\SysWOW64\Ciknefmk.exe
        
        C:\Windows\system32\Ciknefmk.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:228
        
        C:\Windows\SysWOW64\Cmgjee32.exe
        
        C:\Windows\system32\Cmgjee32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1536
        
        C:\Windows\SysWOW64\Dpefaq32.exe
        
        C:\Windows\system32\Dpefaq32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5016
        
        C:\Windows\SysWOW64\Ddqbbo32.exe
        
        C:\Windows\system32\Ddqbbo32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4452
        
        C:\Windows\SysWOW64\Dbcbnlcl.exe
        
        C:\Windows\system32\Dbcbnlcl.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:776
        
        C:\Windows\SysWOW64\Debnjgcp.exe
        
        C:\Windows\system32\Debnjgcp.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4972
        
        C:\Windows\SysWOW64\Dinjjf32.exe
        
        C:\Windows\system32\Dinjjf32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1108
        
        C:\Windows\SysWOW64\Dmifkecb.exe
        
        C:\Windows\system32\Dmifkecb.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4964
        
        C:\Windows\SysWOW64\Dllffa32.exe
        
        C:\Windows\system32\Dllffa32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:464
        
        C:\Windows\SysWOW64\Dpgbgpbe.exe
        
        C:\Windows\system32\Dpgbgpbe.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3780
        
        C:\Windows\SysWOW64\Dbfoclai.exe
        
        C:\Windows\system32\Dbfoclai.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2312
        
        C:\Windows\SysWOW64\Dfakcj32.exe
        
        C:\Windows\system32\Dfakcj32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1264
        
        C:\Windows\SysWOW64\Dedkogqm.exe
        
        C:\Windows\system32\Dedkogqm.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2856
        
        C:\Windows\SysWOW64\Dipgpf32.exe
        
        C:\Windows\system32\Dipgpf32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5084
        
        C:\Windows\SysWOW64\Dmkcpdao.exe
        
        C:\Windows\system32\Dmkcpdao.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3364
        
        C:\Windows\SysWOW64\Dlncla32.exe
        
        C:\Windows\system32\Dlncla32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3960
        
        C:\Windows\SysWOW64\Dpjompqc.exe
        
        C:\Windows\system32\Dpjompqc.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3468
        
        C:\Windows\SysWOW64\Ddekmo32.exe
        
        C:\Windows\system32\Ddekmo32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3360
        
        C:\Windows\SysWOW64\Dgdgijhp.exe
        
        C:\Windows\system32\Dgdgijhp.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1696
        
        C:\Windows\SysWOW64\Defheg32.exe
        
        C:\Windows\system32\Defheg32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4092
        
        C:\Windows\SysWOW64\Dibdeegc.exe
        
        C:\Windows\system32\Dibdeegc.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4328
        
        C:\Windows\SysWOW64\Dmnpfd32.exe
        
        C:\Windows\system32\Dmnpfd32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4660
        
        C:\Windows\SysWOW64\Dlqpaafg.exe
        
        C:\Windows\system32\Dlqpaafg.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:540
        
        C:\Windows\SysWOW64\Ddhhbngi.exe
        
        C:\Windows\system32\Ddhhbngi.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2868
        
        C:\Windows\SysWOW64\Dbkhnk32.exe
        
        C:\Windows\system32\Dbkhnk32.exe
        40⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3344
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 400
        41⤵
        Program crash
        
        PID:4296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3344 -ip 3344
1⤵
PID:1508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Bedbhi32.exe

Path C:\Windows\SysWOW64\Bedbhi32.exe
Size 320KB
SHA256 75d47dec92c435592e8c06af1c4396e3f6cd3361904434c3529ca6da23e9f0d5
MD5 da00e20f1f5a81e557f378ccc9a305e5
SHA1 37f0ac30ec4e40f027b5a076382b11a0b59f0510
SHA512 0e954e5974ba4220e0c077e89665440c4b2ca7c47fa4990924ced2c39f6c48370f9966f17c42ac394c6a7f1551df7382918f7e3cd432e0b77021aa8b98b23fa2
SSDEEP 3072:7sov3ut6bPQxwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:7sov3pb4xV/Ah1G/AcQ///NR5fn
TLSH
T1A6641D192A3409EACEED1BB6AC5359D89145E9F014F1E13E6123DFECD8E4DA6CC09F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bmkjig32.exe

Path C:\Windows\SysWOW64\Bmkjig32.exe
Size 320KB
SHA256 f44270143a122ed63504d71e7175bb1bc03153ecc2c72943930a1333ae779ccd
MD5 dd79a8b182e6676cb8133942c91902f4
SHA1 578339c34de74bea46e92c88e8c8c147e65428ce
SHA512 07b43b4fcdeccfed0b8f5dbecd193bb05dbb5d423e83326cff1cc67e4eccfa4c4faf502d93ef9ee8b64fd6e478f33777110eda18b2a079b7bff97ea209334b6e
SSDEEP 3072:qabO5YvM/uQ9z5wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:qabO5YvUz5V/Ah1G/AcQ///NR5fn
TLSH
T136640C1926350AEACEED1BF5AC1249DC9181E9F024F1E13EA123DFDDD8E4DA2D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cbaehl32.exe

Path C:\Windows\SysWOW64\Cbaehl32.exe
Size 320KB
SHA256 a944c3253c95667617e25fb24247b78574869dc7249363a465b933fb574b8c93
MD5 008e42748e641221841cc90fe1d35dde
SHA1 de2c770b1c1a41c852ae9b1e8f743971e6caedf3
SHA512 50a8bd94537895daf2618ed77357303e9f76d2ac6bd83375a75eb8d4eaa44642be83e2cfc61b290438405094d26b6efb70f7082adca1c7653272f1b48dfe5e86
SSDEEP 3072:mwJYNN4VwdDP84wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:GNN4Vw+4V/Ah1G/AcQ///NR5fn
TLSH
T1E564FA192A7409EACEED5BB6AC1249DC9185E9F114F1E13E6123DFDCD8E4DB6C808F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cboibm32.exe

Path C:\Windows\SysWOW64\Cboibm32.exe
Size 320KB
SHA256 b31a0db322e9f8febac46e9daac71d95b309dab613aaa6d51112efc3e89d022f
MD5 10c6b36ea223c96575b067201e2782c8
SHA1 5a83b57f809ea482a1ec85513462991b763c7e94
SHA512 527cae2bbe733f31ae1ebf20c2d1472dbe1ec0c24c6d97190e76bfe1e1e8f61785fed71404a1fc6c807cfa2b2d1ed193f91ef199c2928a7e110d3ae639d8e28d
SSDEEP 3072:xKiokX3xAM7wwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:xnXhAmwV/Ah1G/AcQ///NR5fn
TLSH
T1D6640D1A2A3409FADEED1BB5AC0249D95142E4F014F1F13E6627DFECD8E4DA6D809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cdlhgpag.exe

Path C:\Windows\SysWOW64\Cdlhgpag.exe
Size 320KB
SHA256 6430f2ab7b40319bcd4cfbf5bbbd24bcd505cb77ecaa1d4fdf9ac1092b6b2c27
MD5 12d5d13c5a2ad936f20daaeb7468c96a
SHA1 e2769b034b44062d44b24e82c0e8faa771d953d4
SHA512 15e30f24879866d2eea1d5b7dc6cb6fb15eb341541dc215b9bc8da82d9c02f6507bddd56fbf71f167646ed37276e7a39793cec2f14acf119b99584a2b8f6e821
SSDEEP 3072:/5FJMR1n48QVm/xAJMCwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:/ER48Q+ASCV/Ah1G/AcQ///NR5fn
TLSH
T116642F1A263009EACEED1BB6AC1249E89141E9F014F5E23E6523DFDDDCE4DB2D914F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cdnelpod.exe

Path C:\Windows\SysWOW64\Cdnelpod.exe
Size 320KB
SHA256 326d1ecb39e4e6df7a68483f78e88bea7e9a6f901595d8851f1e30e03e0ce994
MD5 7ce66d1efde118a1b5932b0c73e4f985
SHA1 36e60e8437cc8fbbc9a144b764e81fb19da6404b
SHA512 72b0e6a755980c59e1d74d8ecbcb3f85f2c32ffdfb2a65fdeca2e1d16f5ad872de03603b7b2fc925a6c8e7efc3230a2175faa38ba33fc37652d2717eb97d2c25
SSDEEP 3072:YCMAIlUz8Q6wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:YTAIGAQ6V/Ah1G/AcQ///NR5fn
TLSH
T17B642F191A3109EACEED5BB5EC1289D8A141E9F114F1E1BE6123DFDCDCE4DA2D809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cekhihig.exe

Path C:\Windows\SysWOW64\Cekhihig.exe
Size 320KB
SHA256 04cffe1f79baaca6d32a91bd3ee207b9736c21dc2683c65f432f877a219610c9
MD5 0d8b3e3265bbc482401b0ecbdae222e1
SHA1 855d9e47e984cb534c17b1c97c324f8da9276850
SHA512 da5f621c09ac5ce2054e8e37421b2391c3baac790a3ab1b315dd043980c614755e73e40d93a7f1aca63d7e810c229b8596ed1ca3bfe6cc6191a8a9aff919c53a
SSDEEP 3072:MkXQ/4sZqdE0/8qZwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:MkXQAsZqd39ZV/Ah1G/AcQ///NR5fn
TLSH
T1D2641E1A2A3409EACDED1BF5AC1259DC9181E8F114F1E13E6123DFDCD8E4DA6D819F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cepadh32.exe

Path C:\Windows\SysWOW64\Cepadh32.exe
Size 320KB
SHA256 2f2584c05b5bd37deecc0bb698469737f0c6183b52e6bc7f7b6b308ca6d09f87
MD5 2505eb9eb57062e4ec8793f1dc576d70
SHA1 739dcb2101ec3d5e4e0546b90cd5e169644b13b2
SHA512 2b3d80d08f2326b93d0f9063622d16def4133f6fc6daea82d7b05975d860b7a799e885350acbae2563853ad7d320cb6d27dea105731ae30e7b8f51aa30db3ff3
SSDEEP 3072:jeaTlhmltpGUmdH0wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:jPEZ4H0V/Ah1G/AcQ///NR5fn
TLSH
T19A642F191A3409EACEED1BB6AC0249D99241E8F114F1E23F2523DFDCC8E5EB6D855F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cfhhml32.exe

Path C:\Windows\SysWOW64\Cfhhml32.exe
Size 320KB
SHA256 86fde300f9ddf8912279e0d54cfce24977d4cb7475c458273cbd29557cc4cca8
MD5 b4f36a609ee1f1c6a14f8f6fe812dbba
SHA1 e42f0a024e953e31a27f5c72cace0c8685d4dda1
SHA512 45f4bc4f758f1adce189275050c8ce7c2c57497639d8bf75ac0a74e3338d31f903dfe683da166638b119a1085f15fc07a36d5b66de4a5cba68843e357589ce28
SSDEEP 3072:S7QT0Ocb/Z6XgjCr07D3JEwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:SMTZKcQkyVEV/Ah1G/AcQ///NR5fn
TLSH
T14464301926300DEACEEE1FB5AD1249D85141E9F114F1E53E6A23DFECD8E5DA2E804F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cfjeckpj.exe

Path C:\Windows\SysWOW64\Cfjeckpj.exe
Size 320KB
SHA256 25a6325cd5839f96b346a4465150f7b6316d25e1f0991c4108963bf7b29d3106
MD5 8acd46d1c2da43e82a5b0ccd1e37c479
SHA1 84305094800474789ce25acdb891347d337ea747
SHA512 fc237240ec8d7e6b4a97c5ca403510ffe4dee7394cb9dd1bb600763aecf65e08db21abe84e4467b90a34458e83f2382b4d3b63b49d27727ebd08f168e05b9152
SSDEEP 3072:jgUiqajwoLd27Qy0EwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:BiqAwcZy0EV/Ah1G/AcQ///NR5fn
TLSH
T14864EA19263009EACEED2BB6EC124AD95141E9B015F1E13E6123EFDCD8F4DA2ED15F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ciknefmk.exe

Path C:\Windows\SysWOW64\Ciknefmk.exe
Size 320KB
SHA256 1daae794e161ed8a0eed9b08ee276e3f4307758b7fcbf926498d34828ac25fae
MD5 95ad6e2307b32b63332e25399df96658
SHA1 2e47f984d768d6957708b22406af140c9bdab8d7
SHA512 dd4632d2cbd9331fbf6e4b108cebb2e06b2e6a3285e9664c52a7f657907df77671f693407c259502642532c07014058371a5773f2be510d18a77422e3a360f29
SSDEEP 3072:C1mcW5xuLJB5ADr7/LdbwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:C1mcWbu9B8xbV/Ah1G/AcQ///NR5fn
TLSH
T17A64411A263409EACEED5FB5AC1249D89181E9F014F1E13E6167EFDCD8E4DA2CC19F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cleqfb32.exe

Path C:\Windows\SysWOW64\Cleqfb32.exe
Size 320KB
SHA256 6a386afc609d537c7565e4c3875dca3694c0777767fe73ed1f65f8ffc1d1dc20
MD5 f2af46b9ab818b603e62004cb5009997
SHA1 5e6c1ccdbdfaa08d625e69ce16f8cc3bae5c1b4f
SHA512 23f6bc4e1917bd4f851e338dfa0725de63a9f19e67b852378e519f975134e1ee7d9704e98678eb568f7282608e8f60b348243fa903754740a5b4c509169c6329
SSDEEP 3072:8XWSydpiaTsBG2MRPc7wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:8GSyOa/c7V/Ah1G/AcQ///NR5fn
TLSH
T12E640E191A3409FACEEE1BB5AC1649D89142E9F014F1F13E6123DFECD8E8DA6D845F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Clgmkbna.exe

Path C:\Windows\SysWOW64\Clgmkbna.exe
Size 320KB
SHA256 a2e855b5a2ff45b7f5b814f7b4c1d89c933c1bbff3c95de568a91146b8a8d2d1
MD5 20660e1ae7f894dac521ce49ef725ab4
SHA1 929786711e3796c928495de4ef7e5b0e0c4d4a3d
SHA512 d1b12072392cb8cee896486ee5c6dc31706fb31ed4870e0e499878bd3b614b03350c4b0b1de87fcdf1eedb6701a520f616fdf32cac143a29052a30bd9682b0a5
SSDEEP 3072:XUyfh/TqWFQyH/4LOwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Xph5f4LOV/Ah1G/AcQ///NR5fn
TLSH
T1F7642F19263049EACEED5BB5AC124ADC9241E9F014F5E23E6163DFDCD8E4EA7C804F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cmbpjfij.exe

Path C:\Windows\SysWOW64\Cmbpjfij.exe
Size 320KB
SHA256 e10f26c304d2612d0d6488ad5cdd66c78e370f2914647bc3fe999e24c7c9848f
MD5 f43266e0f1457defe59b196ce20bff14
SHA1 2f13b5dd80990cf1789eec125865c31ae432d36e
SHA512 24c462a2791dce72071e047c440e1095b0aedb90594478091ad866a273bd35dfd2e01276ef93032c73fbe6c8b86a91be5dd29a08af980b6e696651a0ee43092f
SSDEEP 3072:ymLBBxOW/GDSD94wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:y4B0wx4V/Ah1G/AcQ///NR5fn
TLSH
T1C3640D1A263009EADDED1FB5AC5249DC9145E8F014F5E23E2123EFDCD8E8DA6D905F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cmdmpe32.exe

Path C:\Windows\SysWOW64\Cmdmpe32.exe
Size 320KB
SHA256 538e1b23f3c49370055f769772ed1cbb30ed22b82178785b076c686945f4abc2
MD5 90035282d6d6e96ad6bd3765caad834d
SHA1 d3151a95c072a3417054ecfc7692315e97ece8ef
SHA512 81b0318cb779409af1afdb2268da5ff16a77e9bbba6da4e747d0e4b244e5e92da5fd3e8e75106bd73be339fce814130ba87422866ebe794ddd29424425e1e5b8
SSDEEP 3072:VNGpWkDjmq+zb6wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:D7+VWb6V/Ah1G/AcQ///NR5fn
TLSH
T1E2642F19163429EADEED1BB5AE1249D85141F9F014F1E13E6123DFDEECE4DA2E804F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cmgjee32.exe

Path C:\Windows\SysWOW64\Cmgjee32.exe
Size 320KB
SHA256 a8455779fed6726d659925015af137b961a9f5782479d98f5adef1682296f2f6
MD5 4e1c88b16acd0fb334e0462c21621825
SHA1 73912b0dd40e214105be3dcad5eb53fdd3f0bce8
SHA512 1fad24a57b353d692649b1a2a2c91040b3664f250b264f38f1b7168dcb13fc113e277e40f9a7e4eb2257ca234ad71004ce2d6345455da78117f6ff1706a243d8
SSDEEP 3072:5NDNEepUbunu01cWDwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:JkuutWDV/Ah1G/AcQ///NR5fn
TLSH
T1D7643D192A3009EACEED5FB5AD0259D89181EAF015F1E13E6163DFECD8F4DA2C815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dbcbnlcl.exe

Path C:\Windows\SysWOW64\Dbcbnlcl.exe
Size 320KB
SHA256 0149a69559ba2865a200a1c04a0de30484f82977134b0942705d2e38ab572727
MD5 beefd01bcbbf36ac4095d249d8aaa835
SHA1 0de253e8122fa516702586cc2b691d1d53d5ea5e
SHA512 72132ae61643de8245b9e257c155d6361523f3664d888d0000e1d05756591bc5394ed907ad0311fac0910945d0cfea76847577c28585c04aaaa8884f71853cb0
SSDEEP 3072:CBFN2f3T5jvwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:N/T5jvV/Ah1G/AcQ///NR5fn
TLSH
T1F564521A2A3009EACEED1FB5AC1249D85199E8F015F1E23E6523DFDCD8E4DA2CC05F95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dbfoclai.exe

Path C:\Windows\SysWOW64\Dbfoclai.exe
Size 320KB
SHA256 d61be71b1099b70ead89f8fe8505fa25b9fe3fc5f92de68d1925ba34dacc9147
MD5 f7ab48dcfa9f49e0c347f23db5241468
SHA1 c6ab1676aa6fff431395bfe86d7ade70910d91cc
SHA512 d3d9b1524ada11ee81393ff0958f6d3770d16b4d0744e569e0907047e14166cfc9e568e8b0c5c8cba10fc95f10fc131d62cbde326a7f55d6f56297356aa950dc
SSDEEP 3072:4OgCJWPLpMUb4nkQEwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:xgCJapMUb4kQEV/Ah1G/AcQ///NR5fn
TLSH
T11D64EA1A66340AEACEED1BB5EC0249D89181ECF114F1E13F6527AFDCD8E4DA2D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ddekmo32.exe

Path C:\Windows\SysWOW64\Ddekmo32.exe
Size 320KB
SHA256 2bc956eb4a2909723475e7462b1a771d3e9e534b32d0cfbaf032f03c532915af
MD5 2f3a1ffc4a9a6f23b3c9cea71fe8b569
SHA1 918aed6903efeca87a5527bf06fe77a33ef8aa56
SHA512 75605166ad7d3aef94bf32b5a6fd5fc3f8de7fb07ad3c191f504c3d7eed0a70ed706f1fcfe5bf38d4865ab00d9521f6eb98f6191b9b7b7575166c84fc97b25b6
SSDEEP 3072:6ruxJp5e7lZwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:6al50ZV/Ah1G/AcQ///NR5fn
TLSH
T1DD642E196A3009EACDFD1BB6AE1249D89191E9F014F1E13E6523DFDDD8E4DA2CC09F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ddqbbo32.exe

Path C:\Windows\SysWOW64\Ddqbbo32.exe
Size 320KB
SHA256 0b7ea6340928c1c5281f7697cc978be5aaf5703bbac310e733adeb297d82a151
MD5 35a3cce84870ca600face9da04a41e52
SHA1 618645d7ff1d663e2ded6dd22d2a03c744caa5ae
SHA512 192234b97b94e959125b07e0bf435fdf0c93e8f780097665b12d1b109d6aa4a2a963ee150b74f02f526227dcfdbaea43d3d9da47edb431a1e0e4c73912cd58ce
SSDEEP 3072:4ndYPqZq3OjWnFJvX4y5xJZTwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:4dDFjqX4yXLTV/Ah1G/AcQ///NR5fn
TLSH
T1BE644E192A3409EADEED1FB6AC1249D89141E9F014F1E23E6523DFDDE8E4DA3C815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Debnjgcp.exe

Path C:\Windows\SysWOW64\Debnjgcp.exe
Size 320KB
SHA256 84cba750aa5ed3fa7c9f3a696ff60518d9860683df82a1cbf94b14ee99e9ac20
MD5 c08f7cf8e0f317ea66e75781a25bfd59
SHA1 03bbfb8303420c7a6386ac478362b7fab8a75806
SHA512 c71815708b05efe436eb1bc8422b37ba194e2b26593ecf9f3de433f5122b6e9feff922fc0590550d6820f3bdd3b98e1751805b1b4ccd25908da571144c6a7729
SSDEEP 3072:wbxS1zLxBjwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:wbxGNBjV/Ah1G/AcQ///NR5fn
TLSH
T1296431196A3409EACDFD5BB9AC1249D89241E8F015F2E13F6523DFDDE8E4DA2C805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dedkogqm.exe

Path C:\Windows\SysWOW64\Dedkogqm.exe
Size 320KB
SHA256 987b04eeb9ca2ed0f0a1e62eed71c220b8199bb496c7d615976152dd4865c07a
MD5 978e6d27fa1e5463f833eeae2c776ca1
SHA1 85a26810797c63c0363f13b3f12b28eb80eecbe9
SHA512 07b0244e5d52d44ea0b553c4269332b73240396c6f246313365d6844713c263728b7969bd34003d061e14f8305db26be6fa3f1c15ba283f60819f7d2b89993d0
SSDEEP 3072:X885v/xIa2O6GXoqGQwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Z6OoQV/Ah1G/AcQ///NR5fn
TLSH
T192644119263409EACDED1FB5AD0289D9A182E9F014F5E13E6163DFDCE8E4DA2CC15F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dfakcj32.exe

Path C:\Windows\SysWOW64\Dfakcj32.exe
Size 320KB
SHA256 ce15c220a9636832b1a05a4940af36f880fc2a3720cf161ea618a265e62f90ef
MD5 3a9a2a7d4a1a901c550291d8b417285f
SHA1 17914647818c3b1ede371ae479334bd918993ff2
SHA512 6afce8b207d69734a0d465a96875ffd191d0fd6bedd58b7493b86cff354a77699e7abfea02c6bc18c810d2c968eb661106af1cc703383c6cebe4277b057fe379
SSDEEP 3072:56sEkE3+LEgRj8wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:f7EOLEg18V/Ah1G/AcQ///NR5fn
TLSH
T116642F1966341DEACEEE1BB5AC0249D85241E4F054F1E13E61A3DFDCE8E4DA6CC29F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dinjjf32.exe

Path C:\Windows\SysWOW64\Dinjjf32.exe
Size 320KB
SHA256 132a3aac742f1083f404cdcc75ca675a1c807297521f669aa78134ee1cb08056
MD5 3f73bf81d7c60672fa0821f12b213498
SHA1 46531638293a3e960acb62efc5643e0b84796987
SHA512 4d99b7123b7238f14020dc4189665ceeeb4d808d0595be63cb8818a0978ec1eced9542cc84dcbf84c6016d3b8216e4f2c21ee9e1a0d6942843ffe56829a7600b
SSDEEP 3072:cHdNwItvQusZa+wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:cH1tYba+V/Ah1G/AcQ///NR5fn
TLSH
T112642F19263409EACDED5FB5AC0289D89182E5F419F2E13E6123DFDDD8F4DA2D818F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dipgpf32.exe

Path C:\Windows\SysWOW64\Dipgpf32.exe
Size 320KB
SHA256 82700fbfaf344a238f1d453da6f32c0ddb54842ad9148349e3433f6aa4044d8c
MD5 d19411bf07a5b249e554709cc5c11b57
SHA1 dc99b6ef87f463f8b3fe966be60ccf068a76b859
SHA512 016edcbba5fcedaa5491e1a67edf8c225d931106b088d8d039612b2329ee5067d5596c5ac6a0b32a406ea225f37887185c27e8e321c20bad80b428636580d541
SSDEEP 3072:H4SjNXPVZx6LXwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:zjb6LXV/Ah1G/AcQ///NR5fn
TLSH
T1FB642E192A340AFACDED1BB5AC0249D89145E9F024F1E23E6933DFDCD8E4DA6D845F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dllffa32.exe

Path C:\Windows\SysWOW64\Dllffa32.exe
Size 320KB
SHA256 758e90a459590209bd556daa889406c0830f165943e2aed35141515cae03b786
MD5 3a941429bd15058b4a060624d1f0a077
SHA1 e02a7ea48c4289123a6f70067c3d454ed631a33f
SHA512 50c76f35da2f38d53f060cd9f8718273d1f202eb5e1aaae7aadae905cfd7aebe4fa1232a40c4a6dcf78414753b080824319566ca6d6aa512c01aab47e028920f
SSDEEP 3072:FmC5nG0S/lWU2HrwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:FV2gU2HrV/Ah1G/AcQ///NR5fn
TLSH
T1B36420192A3809EACEED6BB5AC5249D85191E9F014F1E13EA123DFDCD8F4DA2DD04F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dlncla32.exe

Path C:\Windows\SysWOW64\Dlncla32.exe
Size 320KB
SHA256 c96fd055f8b447cff351b2b5eee4db434d716136e7bc431daac489705d09492d
MD5 57c18ab313a0fc9a8107ba98c2b40ee3
SHA1 f25becb83c533593f12b5c02a3c75f272e9f1bd7
SHA512 401d200f763f05bfd1f748d0648257efa6c6bb247d0abfd9072132a927fc4fb7f8856d03584d4bc80ae605d4af5f5fe9ef254b26613381b1b13493f1151a327b
SSDEEP 3072:UnLOqwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:COqV/Ah1G/AcQ///NR5fn
TLSH
T130643E192A7009EACEED1BB5AC0259D89181F9F014F5E13E6123DFDCD9E4DA2CD09F92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dmifkecb.exe

Path C:\Windows\SysWOW64\Dmifkecb.exe
Size 320KB
SHA256 ecac0b5a421ca49eabea78300b40906f2209a86238329bd2518ab42109360343
MD5 ccb4e0dc931541a2ec83a9bfa4a2928c
SHA1 dd3d428bb3840b0f007dfe69577ef8e5fd403c94
SHA512 33425c04cc045f6263762993ff4fe3a7d0b3e540b27b041da4345a342f0a05c546daefee91bd36078962c298154836f2dfbd41b53b6d01117cac658fed7542c2
SSDEEP 3072:e+Cet5TUo4gwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:BUgV/Ah1G/AcQ///NR5fn
TLSH
T17D643E192A3409EACEED1BB5AC1249D89141E8F414F1E23E6523DFDCD8E4DA6D80EFC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dmkcpdao.exe

Path C:\Windows\SysWOW64\Dmkcpdao.exe
Size 320KB
SHA256 6b22edd0c41f5affe759619fac4daf668e4080f012b5a39cdb7907b7f480a220
MD5 bfdff7f296a501b66c39a8f9ed168ecf
SHA1 f61817505e12e0435dbde75022601ed4a3ed197a
SHA512 93f70667c15176042fc3f7dad73077fef8db9da2727503772b3dc5207a7126ac73bf1ab2423c93f2af88c398d56c4c289e46e16d0dec3df998f7833ddec73144
SSDEEP 3072:ZUOSYwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:a9YV/Ah1G/AcQ///NR5fn
TLSH
T1796430192A741DEACEED1BB5AC0249D85141F5F058F1E23E6123DFDCD8E8DA2C869F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dpefaq32.exe

Path C:\Windows\SysWOW64\Dpefaq32.exe
Size 320KB
SHA256 bcb8d3f344f741e7a9dd806b2117e5464300e5915c46dcae9ef7d543e2ba68f9
MD5 705f34586de2cccc1379546e5c583fa8
SHA1 5ab89db991b9dc0930f60c7f9389f59f20488672
SHA512 ea6346f29c08d854231166e384a7150d49b1909fc55b157cf82ff4813703380238588d2281a7e52ded34652515c3df3cbd1ea4cf221c253cdb97e09fd7310800
SSDEEP 3072:dDLoQq4nafi27kLeJVwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:WQUkLEVV/Ah1G/AcQ///NR5fn
TLSH
T17064EB192A3009EACEED1BB5BC1259D99181E9F214F1E13E6123DFDCD8E4DA6DC06F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dpgbgpbe.exe

Path C:\Windows\SysWOW64\Dpgbgpbe.exe
Size 320KB
SHA256 600bffba669314648e505b6511f2ffcfabb4d11c9283c3743d9f82187949f0ec
MD5 6c74e999fd0792430d1c0ff5ccf7a636
SHA1 4c9e24eabe87f260428fa341185050e891159c3e
SHA512 0af69e6536d8a4f7fe9314c2498672407897fd2acf75d21a455e5cf64fd30f4e10ac523b5b2c10c365bd94861d687a9b7e292683c53d73396f882e98c1af1e3d
SSDEEP 3072:jCsj8kRHe5u/wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:jB8kk5u/V/Ah1G/AcQ///NR5fn
TLSH
T1C664411A263409EACEED9FB9AC1259D89141F8F114F1E13E6523EFDCD8E4DA2D805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dpjompqc.exe

Path C:\Windows\SysWOW64\Dpjompqc.exe
Size 320KB
SHA256 fff363c798822df49162371d74f203193ab21f45441c3bbc2bf029b3b2a2bccc
MD5 bdb861249ee4ca1b28460048582bba85
SHA1 ca98d8802ad2743a85222869d0f5c332e4905332
SHA512 1b3d02bac630df7eb35f54a62e2d16dbfb2049972e79de8d00293c8ad2a0d1a9975ad45095646cc5bd7726d0f9be105d3c99ae1487d9a30e674e440596a7a284
SSDEEP 3072:iU7gtVavQ34yK8o8bKwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:V7gtVOQW8/KV/Ah1G/AcQ///NR5fn
TLSH
T1C764DB1A2A3409EACEFD1FB6AC1249D89181E9F014F1E13E6523DFDDD8E4DA2D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/228-313-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/464-297-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/540-269-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/564-319-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/692-343-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/692-344-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/776-305-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/876-342-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/876-7-0x00007FFF87D50000-0x00007FFF87F45000-memory.dmp

Download

memory/876-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/888-325-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1068-24-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1068-336-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1108-301-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1264-291-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1460-331-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1536-311-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1696-277-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2312-293-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2856-289-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2868-267-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2872-327-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3168-315-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3344-265-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3360-279-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3364-285-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3368-321-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3392-329-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3468-281-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3780-295-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3960-283-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4012-338-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4012-22-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4092-275-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4328-273-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4340-340-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4340-8-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4452-307-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4480-323-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4660-271-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4684-333-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4788-317-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4964-299-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4972-303-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5016-309-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5084-287-0x0000000000400000-0x000000000046D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads