berbew | f001cf7ff96b12848e0feeb4492461c6f37b1b8155161455a4d33cb305eafeb5

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 11:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_a410dc77929d1729a2c2a15bef486f14_elex_wannacry.exe
Size 320KB
Sample260727-nbgyea1wev
SHA256 f001cf7ff96b12848e0feeb4492461c6f37b1b8155161455a4d33cb305eafeb5
MD5 a410dc77929d1729a2c2a15bef486f14
SHA1 b7459415ee583d0ceabd3a3f4210d454f258ba71
SHA512 a9d57da6dbd5167462d96bffb9f699464d2af8720ec2863558b1bcc72d82fe69d59bcbf5af6c975ada5a4303767bba18d106bc4154b96022124b4bed6aa69aba
SSDEEP 3072:O7z4xx/QNql2uonHkUfLetTlojEwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:c0xx/mqnmwV/Ah1G/AcQ///NR5fn
TLSH
T15A6430191A3009EAEDEE1FB5AD1249D89181E8F014F1E53F6123DFDCD8E5DA6D828F81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://crutop.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm
http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://kaspersky.ru/index.php

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 44 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cncnob32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	2026-07-27_a410dc77929d1729a2c2a15bef486f14_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ahmjjoig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amcehdod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhkfkmmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnhgjaml.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qacameaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qdaniq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhkfkmmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bkibgh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgbpaipl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qaqegecm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qacameaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qdaniq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bgbpaipl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ckebcg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Coqncejg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahmjjoig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Akkffkhk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aogbfi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amqhbe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amcehdod.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bkibgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cklhcfle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnjdpaki.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qaqegecm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akkffkhk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aogbfi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akdilipp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnaaib32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cklhcfle.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnjdpaki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Boihcf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnaaib32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckebcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Coqncejg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amqhbe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Akdilipp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bphgeo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Boihcf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnhgjaml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	2026-07-27_a410dc77929d1729a2c2a15bef486f14_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bphgeo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cncnob32.exe

Executes dropped EXE 22 IoCs

pid	Process
1852	Qaqegecm.exe
4624	Qacameaj.exe
2120	Qdaniq32.exe
6064	Ahmjjoig.exe
5204	Akkffkhk.exe
5224	Aogbfi32.exe
812	Amqhbe32.exe
3684	Akdilipp.exe
4792	Amcehdod.exe
3300	Bhkfkmmg.exe
2832	Bkibgh32.exe
1180	Bphgeo32.exe
4116	Bgbpaipl.exe
1520	Boihcf32.exe
4744	Cnaaib32.exe
2252	Ckebcg32.exe
5384	Coqncejg.exe
4788	Cncnob32.exe
5196	Cnhgjaml.exe
916	Cklhcfle.exe
3020	Cnjdpaki.exe
368	Dkqaoe32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Dkqaoe32.exe	Cnjdpaki.exe
File opened for modification	C:\Windows\SysWOW64\Bkibgh32.exe	Bhkfkmmg.exe
File opened for modification	C:\Windows\SysWOW64\Coqncejg.exe	Ckebcg32.exe
File opened for modification	C:\Windows\SysWOW64\Cncnob32.exe	Coqncejg.exe
File created	C:\Windows\SysWOW64\Coqncejg.exe	Ckebcg32.exe
File opened for modification	C:\Windows\SysWOW64\Ckebcg32.exe	Cnaaib32.exe
File created	C:\Windows\SysWOW64\Akdilipp.exe	Amqhbe32.exe
File opened for modification	C:\Windows\SysWOW64\Akdilipp.exe	Amqhbe32.exe
File created	C:\Windows\SysWOW64\Fgijpe32.dll	Bphgeo32.exe
File created	C:\Windows\SysWOW64\Cnaaib32.exe	Boihcf32.exe
File created	C:\Windows\SysWOW64\Biafno32.dll	Cnhgjaml.exe
File created	C:\Windows\SysWOW64\Lbandhne.dll	Qacameaj.exe
File created	C:\Windows\SysWOW64\Aogbfi32.exe	Akkffkhk.exe
File created	C:\Windows\SysWOW64\Qkhnbpne.dll	Amqhbe32.exe
File created	C:\Windows\SysWOW64\Bgbpaipl.exe	Bphgeo32.exe
File created	C:\Windows\SysWOW64\Ennamn32.dll	Cklhcfle.exe
File created	C:\Windows\SysWOW64\Hockka32.dll	Qaqegecm.exe
File opened for modification	C:\Windows\SysWOW64\Bgbpaipl.exe	Bphgeo32.exe
File created	C:\Windows\SysWOW64\Nflnbh32.dll	Boihcf32.exe
File created	C:\Windows\SysWOW64\Cnjdpaki.exe	Cklhcfle.exe
File opened for modification	C:\Windows\SysWOW64\Qacameaj.exe	Qaqegecm.exe
File opened for modification	C:\Windows\SysWOW64\Ahmjjoig.exe	Qdaniq32.exe
File created	C:\Windows\SysWOW64\Amcehdod.exe	Akdilipp.exe
File created	C:\Windows\SysWOW64\Bhkfkmmg.exe	Amcehdod.exe
File opened for modification	C:\Windows\SysWOW64\Bhkfkmmg.exe	Amcehdod.exe
File created	C:\Windows\SysWOW64\Bkibgh32.exe	Bhkfkmmg.exe
File opened for modification	C:\Windows\SysWOW64\Boihcf32.exe	Bgbpaipl.exe
File opened for modification	C:\Windows\SysWOW64\Cnhgjaml.exe	Cncnob32.exe
File created	C:\Windows\SysWOW64\Oingap32.dll	Akkffkhk.exe
File created	C:\Windows\SysWOW64\Iohmnmmb.dll	Akdilipp.exe
File created	C:\Windows\SysWOW64\Bphgeo32.exe	Bkibgh32.exe
File opened for modification	C:\Windows\SysWOW64\Amqhbe32.exe	Aogbfi32.exe
File created	C:\Windows\SysWOW64\Pkoaeldi.dll	Bgbpaipl.exe
File opened for modification	C:\Windows\SysWOW64\Cnaaib32.exe	Boihcf32.exe
File created	C:\Windows\SysWOW64\Hgncclck.dll	Cncnob32.exe
File created	C:\Windows\SysWOW64\Qdaniq32.exe	Qacameaj.exe
File created	C:\Windows\SysWOW64\Cnhgjaml.exe	Cncnob32.exe
File created	C:\Windows\SysWOW64\Dkqaoe32.exe	Cnjdpaki.exe
File created	C:\Windows\SysWOW64\Glfdiedd.dll	Cnjdpaki.exe
File created	C:\Windows\SysWOW64\Hbobifpp.dll	Ckebcg32.exe
File created	C:\Windows\SysWOW64\Cncnob32.exe	Coqncejg.exe
File created	C:\Windows\SysWOW64\Qaqegecm.exe	2026-07-27_a410dc77929d1729a2c2a15bef486f14_elex_wannacry.exe
File created	C:\Windows\SysWOW64\Mkfefigf.dll	2026-07-27_a410dc77929d1729a2c2a15bef486f14_elex_wannacry.exe
File created	C:\Windows\SysWOW64\Ahmjjoig.exe	Qdaniq32.exe
File created	C:\Windows\SysWOW64\Kioghlbd.dll	Qdaniq32.exe
File opened for modification	C:\Windows\SysWOW64\Aogbfi32.exe	Akkffkhk.exe
File created	C:\Windows\SysWOW64\Ieoigp32.dll	Aogbfi32.exe
File created	C:\Windows\SysWOW64\Fbjieo32.dll	Amcehdod.exe
File created	C:\Windows\SysWOW64\Boihcf32.exe	Bgbpaipl.exe
File created	C:\Windows\SysWOW64\Jlkidpke.dll	Coqncejg.exe
File opened for modification	C:\Windows\SysWOW64\Cklhcfle.exe	Cnhgjaml.exe
File opened for modification	C:\Windows\SysWOW64\Cnjdpaki.exe	Cklhcfle.exe
File created	C:\Windows\SysWOW64\Akkffkhk.exe	Ahmjjoig.exe
File created	C:\Windows\SysWOW64\Qacameaj.exe	Qaqegecm.exe
File created	C:\Windows\SysWOW64\Bpcaaeme.dll	Ahmjjoig.exe
File opened for modification	C:\Windows\SysWOW64\Amcehdod.exe	Akdilipp.exe
File opened for modification	C:\Windows\SysWOW64\Bphgeo32.exe	Bkibgh32.exe
File created	C:\Windows\SysWOW64\Cklhcfle.exe	Cnhgjaml.exe
File created	C:\Windows\SysWOW64\Ofkhal32.dll	Bhkfkmmg.exe
File created	C:\Windows\SysWOW64\Gjecbd32.dll	Bkibgh32.exe
File created	C:\Windows\SysWOW64\Aijjhbli.dll	Cnaaib32.exe
File opened for modification	C:\Windows\SysWOW64\Akkffkhk.exe	Ahmjjoig.exe
File opened for modification	C:\Windows\SysWOW64\Qaqegecm.exe	2026-07-27_a410dc77929d1729a2c2a15bef486f14_elex_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\Qdaniq32.exe	Qacameaj.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3484	368	WerFault.exe	107

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkqaoe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akdilipp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgbpaipl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnaaib32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cklhcfle.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_a410dc77929d1729a2c2a15bef486f14_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qdaniq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aogbfi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhkfkmmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckebcg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Coqncejg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnjdpaki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qaqegecm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amqhbe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cncnob32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnhgjaml.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bkibgh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bphgeo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qacameaj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahmjjoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akkffkhk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amcehdod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Boihcf32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlkidpke.dll"	Coqncejg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qdaniq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Akdilipp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbjieo32.dll"	Amcehdod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bhkfkmmg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aogbfi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	2026-07-27_a410dc77929d1729a2c2a15bef486f14_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qaqegecm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nflnbh32.dll"	Boihcf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnaaib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cnaaib32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnjdpaki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glfdiedd.dll"	Cnjdpaki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Biafno32.dll"	Cnhgjaml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cnjdpaki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbandhne.dll"	Qacameaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgijpe32.dll"	Bphgeo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkoaeldi.dll"	Bgbpaipl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aogbfi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cncnob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cnhgjaml.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qdaniq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kioghlbd.dll"	Qdaniq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofkhal32.dll"	Bhkfkmmg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qacameaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qkhnbpne.dll"	Amqhbe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Akdilipp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bgbpaipl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkfefigf.dll"	2026-07-27_a410dc77929d1729a2c2a15bef486f14_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Amcehdod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bkibgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bphgeo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cncnob32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	2026-07-27_a410dc77929d1729a2c2a15bef486f14_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Akkffkhk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Amqhbe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgncclck.dll"	Cncnob32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnhgjaml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbobifpp.dll"	Ckebcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpcaaeme.dll"	Ahmjjoig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ahmjjoig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iohmnmmb.dll"	Akdilipp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bkibgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bgbpaipl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Coqncejg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cklhcfle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	2026-07-27_a410dc77929d1729a2c2a15bef486f14_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oingap32.dll"	Akkffkhk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ieoigp32.dll"	Aogbfi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qacameaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Amcehdod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bhkfkmmg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bphgeo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Boihcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Akkffkhk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Amqhbe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	2026-07-27_a410dc77929d1729a2c2a15bef486f14_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qaqegecm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ckebcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Coqncejg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ahmjjoig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ennamn32.dll"	Cklhcfle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cklhcfle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	2026-07-27_a410dc77929d1729a2c2a15bef486f14_elex_wannacry.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 5556 wrote to memory of 1852	5556	2026-07-27_a410dc77929d1729a2c2a15bef486f14_elex_wannacry.exe	86
PID 1852 wrote to memory of 4624	1852	Qaqegecm.exe	87
PID 4624 wrote to memory of 2120	4624	Qacameaj.exe	88
PID 2120 wrote to memory of 6064	2120	Qdaniq32.exe	89
PID 6064 wrote to memory of 5204	6064	Ahmjjoig.exe	90
PID 5204 wrote to memory of 5224	5204	Akkffkhk.exe	91
PID 5224 wrote to memory of 812	5224	Aogbfi32.exe	92
PID 812 wrote to memory of 3684	812	Amqhbe32.exe	93
PID 3684 wrote to memory of 4792	3684	Akdilipp.exe	94
PID 4792 wrote to memory of 3300	4792	Amcehdod.exe	95
PID 3300 wrote to memory of 2832	3300	Bhkfkmmg.exe	96
PID 2832 wrote to memory of 1180	2832	Bkibgh32.exe	97
PID 1180 wrote to memory of 4116	1180	Bphgeo32.exe	98
PID 4116 wrote to memory of 1520	4116	Bgbpaipl.exe	99
PID 1520 wrote to memory of 4744	1520	Boihcf32.exe	100
PID 4744 wrote to memory of 2252	4744	Cnaaib32.exe	101
PID 2252 wrote to memory of 5384	2252	Ckebcg32.exe	102
PID 5384 wrote to memory of 4788	5384	Coqncejg.exe	103
PID 4788 wrote to memory of 5196	4788	Cncnob32.exe	104
PID 5196 wrote to memory of 916	5196	Cnhgjaml.exe	105
PID 916 wrote to memory of 3020	916	Cklhcfle.exe	106
PID 3020 wrote to memory of 368	3020	Cnjdpaki.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-27_a410dc77929d1729a2c2a15bef486f14_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_a410dc77929d1729a2c2a15bef486f14_elex_wannacry.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5556
- C:\Windows\SysWOW64\Qaqegecm.exe
  C:\Windows\system32\Qaqegecm.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1852
- - C:\Windows\SysWOW64\Qacameaj.exe
    C:\Windows\system32\Qacameaj.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4624
  - - C:\Windows\SysWOW64\Qdaniq32.exe
      C:\Windows\system32\Qdaniq32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2120
    - - C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:6064
      - C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5204
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5224
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:812
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3684
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4792
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3300
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2832
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1180
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4116
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1520
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4744
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2252
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5384
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4788
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5196
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:916
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3020
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        23⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:368
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 368 -s 400
        24⤵
        Program crash
        
        PID:3484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 368 -ip 368
1⤵
PID:1152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Ahmjjoig.exe

Path C:\Windows\SysWOW64\Ahmjjoig.exe
Size 320KB
SHA256 d4661e8415eca75e7b30133256bce020dba3ade2f317e65df0f4e349cb86786e
MD5 fd2e020d329b21ffe183d499922eb366
SHA1 b0aace02a65d19715c17ef4eda2e69f90a0d9c44
SHA512 ebdf213dcf5d2a6b61c6c8a5f39dc3b4a59082a44042495e11376fc91cda1e220e6d207ce99b4670759eff14e9d0236874613e3bc41957a6acd02fec48e398ff
SSDEEP 3072:re2r2DDhsVGJzeLwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:reoGJzeLV/Ah1G/AcQ///NR5fn
TLSH
T1E564201B2A3409EACEED1FB5AC1289D85141E9F114F1E13E6127DFDDD8E4DA2D809F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Akdilipp.exe

Path C:\Windows\SysWOW64\Akdilipp.exe
Size 320KB
SHA256 aff9fac0d6e5f0621d397b5eb90bfb580210b0d1119227fa12bf5e6d8ea7efbb
MD5 10748255c5b2f52a5113c10b326e7b39
SHA1 9f65150f196c114ba029aa8fef24cb465c0f60da
SHA512 7f5046003651437f63e332cbd799fa6d7239d83c46dec4386ef9a6db517f31f59f30d4a9baa27d0aff0c38897235fa961b1e2d3a24cbe9b12eff0b6b8c3a6cb2
SSDEEP 3072:Jcafk5D7ot3TfZDsoldwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:W4Tfoo3V/Ah1G/AcQ///NR5fn
TLSH
T148641E192A3409FACEED1BBAEE1249D95141E9F014F1E13E6123DFDCC8E5DA6C819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Akkffkhk.exe

Path C:\Windows\SysWOW64\Akkffkhk.exe
Size 320KB
SHA256 8270ae243157a06135286353c7d55c845601539f30ae8e2842a80b13feb31798
MD5 b4601dfebfa49340aa0afc1f8172b12f
SHA1 2fde829f69520239ca32f285a8f6c6cbe8a92131
SHA512 b22e7c8384d8440178d26fadc395b6124fbf02cce852323ff83935f00dcb501b30ddd1bb23edcb6c53dcc8e25c95ab4ba3424439c13e203f7f4a83f39c4359b1
SSDEEP 3072:G8ZnAYl67iwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:7drqiV/Ah1G/AcQ///NR5fn
TLSH
T13A640A59263809EAEEED1BB5FC0259D89141E8F015F0E13EA163DFDDD8E4DA2C825F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Amcehdod.exe

Path C:\Windows\SysWOW64\Amcehdod.exe
Size 320KB
SHA256 2d92f83eac11c5e7d6802bb0cfc6d3d12f4173c6cb4c93d25b0e1ff7741cbafb
MD5 f6cec50f7b044b92576ef874107636df
SHA1 9be6e18e980a7552576d4f0030eeb0f4cce0c299
SHA512 f539863fcbbc525418ad81046e18b91b46572094db6d01aec7efcf3b3e5e1086161d19ae8e7e10a15fd362b4c3f3a3b19fcd0eb92147401f03973f1e02ae5047
SSDEEP 3072:Djc3Di3doMSwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Djc3GtoMSV/Ah1G/AcQ///NR5fn
TLSH
T1446441192A3019EADDFD2BBAAC1249DC5141E9F014F1E13E6163DFDCE9E4DA2D825F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Amqhbe32.exe

Path C:\Windows\SysWOW64\Amqhbe32.exe
Size 320KB
SHA256 37bb13f86e2010c569ca3f9a8f6e04b4669867b895b70be87c42a761e7456fce
MD5 a1951c72d0969b6b02fc5725dcec60b3
SHA1 336338d7bcfb5c34d912bf995d91eb4f8c01b33b
SHA512 745a75dd0d0c7d2ea50afa132f1a6932bac0818aff42e618c9ee9362e69a06be1e3ae00594810e1dd98591e1ba42fe6f5985ae5ccb9751e1129d9a95706bcadb
SSDEEP 6144:aXR4MUaWwvsJaxjV/Ah1G/AcQ///NR5fn:uR4baWNJX/Nv
TLSH
T1366420192A3409EACDFD1BB5AC124AD89181E9F014F1E23E6123DFDDD8E4DA2D915FC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Aogbfi32.exe

Path C:\Windows\SysWOW64\Aogbfi32.exe
Size 320KB
SHA256 789d3fc1a758e24deef8a45876b3727ce6e57d01bdccc3465a0daa8b7872f366
MD5 ef7d437a997d7edd73df24cc720f6d20
SHA1 766552061c42d4eb210b25242024506f5e82dcce
SHA512 d6e508c8fdc0ebe64ed1bf1ef71fc6ea34c6ab5359b00d7c342cbc949d8c5ab8526abaea1dc4608793112126a86f50d3f7bbac97cdfcf209d303c994b4208cc1
SSDEEP 3072:kI1+s20hdllkVrW4wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:vmaDOVrW4V/Ah1G/AcQ///NR5fn
TLSH
T1FF64DA192A3009EACDFD1BB6AC1649D89141E9F214F1E13E6123DFDCD8F6DA2D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bgbpaipl.exe

Path C:\Windows\SysWOW64\Bgbpaipl.exe
Size 320KB
SHA256 d3d664f561ff0fe256bc447e6487e89ac68be89532bbf7510860873228a074af
MD5 49c787f5f4cd6461f37ea4bba20506d7
SHA1 7205fe2165863ff4d1592301086281aa00221228
SHA512 6cd69025726a6ab72a8718f4cd59faee60a7879aa4d3af237df1c2de8d98657b098b6d2daf2dbb1223d039d9854c95281a00b37008b46c6fb2bedf1dcb79ad4f
SSDEEP 3072:PhSyCpHQr7MMVZsH2mBJwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:IBpwr7MMgHdJV/Ah1G/AcQ///NR5fn
TLSH
T10364C9193A340DEACDEE1FB5AC1649D89181E5B018F1E13E65A3DFDCD8E4DA6C805F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bhkfkmmg.exe

Path C:\Windows\SysWOW64\Bhkfkmmg.exe
Size 320KB
SHA256 7b38270bd1405efff99d8105d78737c9596cf51d2d9460c04f510d3f77b1aa9e
MD5 2e13a4a750bf5854bb8c363eff35e6c2
SHA1 f3f8a185f470dd3f12414575968d26e785db1f12
SHA512 040a343d656e746c36d2a05444529fee1c46a317e1737a4a7c7406fd7fb02d5cb9dc951448ed513aa66f0bc76dbf79dd4faf56b59c499dedcc6190c64fa04733
SSDEEP 3072:7BPEF4TXN0kFi8kRwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:9m47698kRV/Ah1G/AcQ///NR5fn
TLSH
T16564302A2A3409EBCDED1BB5AC1259D89542E9F024F1F13E6523DFDCC8E4DA6C815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bkibgh32.exe

Path C:\Windows\SysWOW64\Bkibgh32.exe
Size 320KB
SHA256 020ff2e984d2c71bd7b755b828af25b1925146cee165e8d87cb0b46b1e13d39d
MD5 5042b019b69b59b515ab05d09a3ad579
SHA1 98896dfb2885ee4bf9816560de5a6a70bb601ba5
SHA512 e19c59b45ec850fb4447a939fd75a1b17849a755a3259c2ed9599080f3e7b38cdca4276a787e0394600888bfd25f6c5ea5429662f0e88301f1dfb4e3f5a4b175
SSDEEP 3072:tH4R7A0fR6Q/Uknhkp4wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:tYJokhkp4V/Ah1G/AcQ///NR5fn
TLSH
T1DD64D91A2A3009EACEED1BB6AC1249DD9141E9F014F1E13EA1239FDCD8F5DB6D805F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Boihcf32.exe

Path C:\Windows\SysWOW64\Boihcf32.exe
Size 320KB
SHA256 4c67630eda27d1f98d674110946aa5ec88b1a65e5a79a942560212f2803a9428
MD5 ff3ba8f401cac669c6b8094c1af10c54
SHA1 d190f2344fb68812503ef28019241ebbe263fe3f
SHA512 5de1187d6d06cd49e9a9e739e1e91b4bece756f46d9f92c5ce7bd64f0e33179ba9dce6adb02f2d13c8b995c6971948239b09e98eef559e0564593f7fc940b63a
SSDEEP 3072:RtotKn+U9TrdMwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:RGg+U9pMV/Ah1G/AcQ///NR5fn
TLSH
T12D64FD1926340DEACEED1BB5AC024AD85181E5F114F1E93E6223DFECD8E4DA6DC25F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bphgeo32.exe

Path C:\Windows\SysWOW64\Bphgeo32.exe
Size 320KB
SHA256 08700c08942cb5b2a65a65f29d6aff6b6c4756bb81707f56f7f7fd663e779084
MD5 ac7b30e4227d90631ffd7946eb18df1c
SHA1 b78d0feadc4c363d19d47bc10e5da450f8c0aafc
SHA512 0b25c93c7d572df8969bc614532c088ea8cf45557fc352a8ce296de59ff83d7871922c2649a7d81e2c72ae171f7384d880eb486f187bf806ac143721b3e374ac
SSDEEP 3072:SNvyGaj7r8DMOpihQIwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:8yGaj7rlhQIV/Ah1G/AcQ///NR5fn
TLSH
T13664DB1926340DEACDED1BB6AD1249D89141E9F014F1E23E6223DFDCD8E8DA6DC16F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ckebcg32.exe

Path C:\Windows\SysWOW64\Ckebcg32.exe
Size 320KB
SHA256 1d02e2bb8345bc7374a4325c5857783ec2526c5f26748fcb5fedea810a5c33ce
MD5 a544d3688763e9837124a98db6e74a9a
SHA1 8df4abfbfc5753148534aa7e98a1f16d4f8c3fea
SHA512 06d709ea4692108b83fe8284872da72aeb9dff2bd0fa383090a2d353bbc4a68744988c022b5db0dcc6b7e6c1e77ee7d2739e38d354b7187248f4fff7f4fd827f
SSDEEP 3072:ySt2r9y7pw0VpKItMkwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:y9KdV/Ah1G/AcQ///NR5fn
TLSH
T1D664621A163009EADDED1FB5AC2259D88141EAF016F5E13E2123DFDEE8E4DA2CC54F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cklhcfle.exe

Path C:\Windows\SysWOW64\Cklhcfle.exe
Size 320KB
SHA256 28f2b21bcc76954f2fd472b258ffa0dc21ec399feb1f4cefe2f4514b1397ab08
MD5 7f2f09dbb96d4434c144c42ae8e93a76
SHA1 f3bdbd7ff801771adb43d54bca8a9349b85ecc26
SHA512 f4e8cf040783f3effa71914c8b6bb074481e22e1ece70575712a117ee631c64c02513d3eeb97dc971ebd7494a5284a586ddba023bfdf55501be736b876f986b9
SSDEEP 3072:275Xju4lkJ8wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:yjuakJ8V/Ah1G/AcQ///NR5fn
TLSH
T15164DA19663009EACEFD2BB5AC128DD89541E9F014F2E13EA523DFDCD8E4DA2D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cnaaib32.exe

Path C:\Windows\SysWOW64\Cnaaib32.exe
Size 320KB
SHA256 2553aa9352a0c57f0add95c4e608f5ab134b4b9e36d5aea840e1771073fed31e
MD5 216e0149af4496be63c7f6e7c5c6d6f9
SHA1 1060b15ccda3c0ebca7d3d6e17604bcacd55d2a8
SHA512 86fcc24874cf422a18fe7bdce23aef18281c9cbbad4c3989ad4badba2c4affeab2bc25aae12b5d0b3bddfa52327925a5a533874ec59dbb640a8ac795d5b15d82
SSDEEP 3072:nxPXaeqPP1/KNwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:nxXaeqV/KNV/Ah1G/AcQ///NR5fn
TLSH
T1CF641C1A6A3109EACEED9BB5AC0249D89141E8F014F5E53E6163DFDCD8E4DA2CD18FC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cncnob32.exe

Path C:\Windows\SysWOW64\Cncnob32.exe
Size 320KB
SHA256 86765f4f23eea6585954acab105932265a88e3478733f8d4ee3ea7135fbb51f3
MD5 09b168ca0a2383df06e4735375e2e822
SHA1 86e322b888044495359a808ddbf1a165fc4a228c
SHA512 ddd1af2d5669f723b7dd3f0f34f6b5a8d2a9bc58bfa6ace702df91a44d6663f4cfb46042a1aac468c5e20615bc6260b3d9c4f54b6c311569f1783d6c15b25bef
SSDEEP 3072:3ED+ATi6nUEiI5wj+jJmgwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:2RLnY+jJmgV/Ah1G/AcQ///NR5fn
TLSH
T160640E192A7409EACFED1BB5AC1249D89141E9F014F9E13E6133DFDCD8E4EA2D825F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cnhgjaml.exe

Path C:\Windows\SysWOW64\Cnhgjaml.exe
Size 320KB
SHA256 b8a5baa5805ef73259ee86b924ae6f1e4e39f05039eaadb81aa0f5e0b20ef487
MD5 7a63cd2fcda8998f6a5620c36068319e
SHA1 fdddb55b9af81581bf1f2ba031f9ec22d9e2e16d
SHA512 5725b69d4ea26afb8c009ab82ab2bccc3a1ac3efa0125bb72ec21a520ebb1c2f93cc288ab3f7a9686839c452bc4e6aee43a2509750f8edf30ff32410839242ed
SSDEEP 3072:r5+BbUE1j6aAaREwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:V+BYQ0mEV/Ah1G/AcQ///NR5fn
TLSH
T18264FF1A2A3409EACDED1BBDAC1249D89142E5F114F1E13F6123DFDDD8E4EA2C819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cnjdpaki.exe

Path C:\Windows\SysWOW64\Cnjdpaki.exe
Size 320KB
SHA256 95021203be52d63baf456ddbf216574eb8399dd2d419cf48fac506daa66421a8
MD5 759b0a8b23edaf3d2c13ec03c8e38d8f
SHA1 6787e27ec1d85fa6912ed89928f723a3dbf01985
SHA512 2a4ad64cf9b676fbd49449b143e6c3ce7736b9fb9bddaaf5a80e5fa60bd1b545a1b774913e13e6369e4f2342fcfc0e7ef5d7137b944b89f4439ce70a0edef6ac
SSDEEP 3072:fKeleTUCb8cZZ51Uwo3ewS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:fhITbb8cZZQwieV/Ah1G/AcQ///NR5fn
TLSH
T181642F19277409EACEED6FB6AC1249D89541E9F214F1E23E6123DFDCC8E4DA2C815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Coqncejg.exe

Path C:\Windows\SysWOW64\Coqncejg.exe
Size 320KB
SHA256 8c89198f46ac3fd0af354d3d8866ddac3da2f4ded815591844f20272d63d26d3
MD5 0cabf867766fbed53b957a94a5ec018f
SHA1 6394e8e0f19e6e2183e95f5eefd89a8ee78f8f40
SHA512 7baf4f281153a62e5d4886610094c5c9660ab6839ebef4fda8cb906f51da07734ed44e7f58c14fda73e0d54900655c7fb645ac4062bd6660bb4433e17e6672f1
SSDEEP 3072:Rijiosybr5wEsVnawS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:2s4sdaV/Ah1G/AcQ///NR5fn
TLSH
T1056420192A300DEACEED5FB6AC1249D89141EAF024F1E17E6523DFDCD8E4DA6D814F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dkqaoe32.exe

Path C:\Windows\SysWOW64\Dkqaoe32.exe
Size 320KB
SHA256 a51588a4a3bfe0f02b686318292e64063ddc3f4d05e0c347de0361d33875ed33
MD5 563d2ea873802ecb41f54a992f8d7750
SHA1 d7b3cdb0be9eae6904def06ac4602834864f5dab
SHA512 24f437e3e85293c7a5085346fb5b3cb0ff52fabe04d4086de23c090a23d9d719a7fa39bc883cb58b491e8bdddcaa4b7ca5c720d22c3db55fb3fd795957703f52
SSDEEP 3072:3LQNjT8+Q/SiZZZZZZZTQwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:3h/3ZZZZZZZTQV/Ah1G/AcQ///NR5fn
TLSH
T182641F19663449EACDED1BB6AC1249D86141E9F06CF2E13EA123DFDCD8E4DA2C815FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qacameaj.exe

Path C:\Windows\SysWOW64\Qacameaj.exe
Size 320KB
SHA256 17ebe0bfa84d9f14c794f451be45d5723547624a0e58cc4a2745ca7f34703b68
MD5 08b8358088373f542bc57b43c942e93b
SHA1 9c60cc3a38f4d11810aecdd5d5a75ea1f11805df
SHA512 a55d56ec3511c93700440bddc14584a292657fea2313efa8cdb99ebbdd4e8f574104f7772c82401095aa81a5ebb6d118e2c08a44bd573f9f2c89a3f1db135c32
SSDEEP 3072:45VofSb5lwwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:45SfywV/Ah1G/AcQ///NR5fn
TLSH
T16D6430191A340AEACEED1FB6BC5249D89541E9F018F1E13E6123DFDCD9E4EA2D805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qaqegecm.exe

Path C:\Windows\SysWOW64\Qaqegecm.exe
Size 320KB
SHA256 73b93e307c854e66e206037dfcdc445c608140fccdc58ef095d9b73e313ab010
MD5 f539d8ec5e74275a27c7db0f5b5ebcba
SHA1 ad029e0a1e754bfe7de596af1c0330bc979b12f0
SHA512 42e39b79d3b75de0106d391587ac50187074d28466af43841fd07c35f9771eca4ec372e29c48508550eb257c7977fd158efc9160f159f0ff4d34a9cbff6de126
SSDEEP 3072:87lj9VYUwXzal0gewS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:87lj96Uz0geV/Ah1G/AcQ///NR5fn
TLSH
T1EB64D7192A3009EACEFD1BB6AC124AD89585F9B114F1E13E6123DFDCD8E4DA2DC15F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qdaniq32.exe

Path C:\Windows\SysWOW64\Qdaniq32.exe
Size 320KB
SHA256 4ca838ad95b3bc77c1b3de545406d9373f9dabfcad80863796f70b11f3c185b6
MD5 1c06d09e87966556f87588a44bba9b38
SHA1 cf9107010e53115c8aeb02e11aec51218f6dbc43
SHA512 9ef1bb4ddcd3b3666c9fc5c98a0030edb8605c6533c485bc9410e549046d8365ce7e734888d1477030358f444141f0e79787e35ce337d9b5f3e3c06189cb2508
SSDEEP 3072:5ScN17uyCXVO+Js+OSwmwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:5t17uNXVruvZmV/Ah1G/AcQ///NR5fn
TLSH
T14B640E29167109EADDED1BB6AC2289D85141E9F014F1F13E6523EFDCE8E4DA2D818FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/368-176-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/368-174-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/812-62-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/812-205-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/916-180-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/916-163-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1180-195-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1180-100-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1520-220-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1852-8-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1852-217-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2120-30-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2120-213-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2252-132-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2252-188-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2832-197-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2832-93-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3020-178-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3300-199-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3684-65-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3684-203-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4116-108-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4116-193-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4624-215-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4624-22-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4744-190-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4744-124-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4788-184-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4788-143-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4792-77-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4792-201-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5196-158-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5196-182-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5204-41-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5204-209-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5224-53-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5224-207-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5384-186-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5384-139-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5556-219-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5556-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5556-1-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/6064-211-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6064-38-0x0000000000400000-0x000000000046D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads