74cac152a79e8b51bd175d46a3e9280498483a7ac183099f5dee548786f16c4c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_b2e96fba73479458593cffe3e3b428d1_elex_wannacry.exe
Size 64KB
Sample260805-dcf3dswgrb
SHA256 74cac152a79e8b51bd175d46a3e9280498483a7ac183099f5dee548786f16c4c
MD5 b2e96fba73479458593cffe3e3b428d1
SHA1 88a4a999f4709b814945f16e91c312c826da1754
SHA512 d4e7866cca48f84f2150df667d53bc61e362021e6fab481b084f8c169e866d97400939e32452d39e85ccceffa348f08901f606974433d8eec127f10780108d24
SSDEEP 192:ObOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwZ404/ClxyNhoyK+r1M:ObLwOs8AHsc4sMfwhKQLroL4/Clsr/e
TLSH
T1C35319435BDD5CF2FB950231187C8BB9927B99D4560EBEEFAB90CD644037292E43A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3384	kCCDEAB3Al143Di4b8768C7Fw22338797619El.exe
4516	k01F05AA9l96DDi46836B610w54A7CD004CBFl.exe
1492	kE3104E46l590Ai4c5669176w3DC5112D58B9l.exe
3972	kB5F02155l9827i406a6A84EwFECC3EFEEDE2l.exe
204	kF16AF574l205Di4b986A7E3w46E41DE6370Al.exe
1128	k4A3CE09Bl785Di42106AF40w498F769B71C1l.exe
312	kBCE14922l80A3i4724697FEw96E94D013B95l.exe
4568	k621C98EDlED0Bi4e0a6B69Ew06B1BC8664D1l.exe
2036	k35A58564lC2ECi404a68C14w3E976939F26Bl.exe
2240	k4252CD06lC501i491969827w99E7A1192C84l.exe
656	kBAD028D9l47ADi45dd697D7wBBB8D84A7201l.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\kCCDEAB3Al143Di4b8768C7Fw22338797619El.exe	2026-08-05_b2e96fba73479458593cffe3e3b428d1_elex_wannacry.exe
File created	C:\Windows\kB5F02155l9827i406a6A84EwFECC3EFEEDE2l.exe	kE3104E46l590Ai4c5669176w3DC5112D58B9l.exe
File created	C:\Windows\kBCE14922l80A3i4724697FEw96E94D013B95l.exe	k4A3CE09Bl785Di42106AF40w498F769B71C1l.exe
File created	C:\Windows\k35A58564lC2ECi404a68C14w3E976939F26Bl.exe	k621C98EDlED0Bi4e0a6B69Ew06B1BC8664D1l.exe
File created	C:\Windows\k4252CD06lC501i491969827w99E7A1192C84l.exe	k35A58564lC2ECi404a68C14w3E976939F26Bl.exe
File created	C:\Windows\kBAD028D9l47ADi45dd697D7wBBB8D84A7201l.exe	k4252CD06lC501i491969827w99E7A1192C84l.exe
File created	C:\Windows\k01F05AA9l96DDi46836B610w54A7CD004CBFl.exe	kCCDEAB3Al143Di4b8768C7Fw22338797619El.exe
File created	C:\Windows\kE3104E46l590Ai4c5669176w3DC5112D58B9l.exe	k01F05AA9l96DDi46836B610w54A7CD004CBFl.exe
File created	C:\Windows\kF16AF574l205Di4b986A7E3w46E41DE6370Al.exe	kB5F02155l9827i406a6A84EwFECC3EFEEDE2l.exe
File created	C:\Windows\k4A3CE09Bl785Di42106AF40w498F769B71C1l.exe	kF16AF574l205Di4b986A7E3w46E41DE6370Al.exe
File created	C:\Windows\k621C98EDlED0Bi4e0a6B69Ew06B1BC8664D1l.exe	kBCE14922l80A3i4724697FEw96E94D013B95l.exe

Executes a command shell one-liner 1 TTPs 11 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4704	cmd.exe
928	cmd.exe
888	cmd.exe
436	cmd.exe
5048	cmd.exe
4300	cmd.exe
1612	cmd.exe
1084	cmd.exe
1556	cmd.exe
3616	cmd.exe
3752	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k621C98EDlED0Bi4e0a6B69Ew06B1BC8664D1l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_b2e96fba73479458593cffe3e3b428d1_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kF16AF574l205Di4b986A7E3w46E41DE6370Al.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kBCE14922l80A3i4724697FEw96E94D013B95l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kBAD028D9l47ADi45dd697D7wBBB8D84A7201l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kE3104E46l590Ai4c5669176w3DC5112D58B9l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k35A58564lC2ECi404a68C14w3E976939F26Bl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k01F05AA9l96DDi46836B610w54A7CD004CBFl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kB5F02155l9827i406a6A84EwFECC3EFEEDE2l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k4A3CE09Bl785Di42106AF40w498F769B71C1l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k4252CD06lC501i491969827w99E7A1192C84l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kCCDEAB3Al143Di4b8768C7Fw22338797619El.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2768	2026-08-05_b2e96fba73479458593cffe3e3b428d1_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	3384	kCCDEAB3Al143Di4b8768C7Fw22338797619El.exe
Token: SeIncBasePriorityPrivilege	4516	k01F05AA9l96DDi46836B610w54A7CD004CBFl.exe
Token: SeIncBasePriorityPrivilege	1492	kE3104E46l590Ai4c5669176w3DC5112D58B9l.exe
Token: SeIncBasePriorityPrivilege	3972	kB5F02155l9827i406a6A84EwFECC3EFEEDE2l.exe
Token: SeIncBasePriorityPrivilege	204	kF16AF574l205Di4b986A7E3w46E41DE6370Al.exe
Token: SeIncBasePriorityPrivilege	1128	k4A3CE09Bl785Di42106AF40w498F769B71C1l.exe
Token: SeIncBasePriorityPrivilege	312	kBCE14922l80A3i4724697FEw96E94D013B95l.exe
Token: SeIncBasePriorityPrivilege	4568	k621C98EDlED0Bi4e0a6B69Ew06B1BC8664D1l.exe
Token: SeIncBasePriorityPrivilege	2036	k35A58564lC2ECi404a68C14w3E976939F26Bl.exe
Token: SeIncBasePriorityPrivilege	2240	k4252CD06lC501i491969827w99E7A1192C84l.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 3384	2768	2026-08-05_b2e96fba73479458593cffe3e3b428d1_elex_wannacry.exe	94
PID 2768 wrote to memory of 3616	2768	2026-08-05_b2e96fba73479458593cffe3e3b428d1_elex_wannacry.exe	95
PID 3384 wrote to memory of 4516	3384	kCCDEAB3Al143Di4b8768C7Fw22338797619El.exe	96
PID 3384 wrote to memory of 436	3384	kCCDEAB3Al143Di4b8768C7Fw22338797619El.exe	97
PID 4516 wrote to memory of 1492	4516	k01F05AA9l96DDi46836B610w54A7CD004CBFl.exe	100
PID 4516 wrote to memory of 3752	4516	k01F05AA9l96DDi46836B610w54A7CD004CBFl.exe	101
PID 1492 wrote to memory of 3972	1492	kE3104E46l590Ai4c5669176w3DC5112D58B9l.exe	102
PID 1492 wrote to memory of 5048	1492	kE3104E46l590Ai4c5669176w3DC5112D58B9l.exe	103
PID 3972 wrote to memory of 204	3972	kB5F02155l9827i406a6A84EwFECC3EFEEDE2l.exe	104
PID 3972 wrote to memory of 4300	3972	kB5F02155l9827i406a6A84EwFECC3EFEEDE2l.exe	105
PID 204 wrote to memory of 1128	204	kF16AF574l205Di4b986A7E3w46E41DE6370Al.exe	107
PID 204 wrote to memory of 1612	204	kF16AF574l205Di4b986A7E3w46E41DE6370Al.exe	108
PID 1128 wrote to memory of 312	1128	k4A3CE09Bl785Di42106AF40w498F769B71C1l.exe	109
PID 1128 wrote to memory of 4704	1128	k4A3CE09Bl785Di42106AF40w498F769B71C1l.exe	110
PID 312 wrote to memory of 4568	312	kBCE14922l80A3i4724697FEw96E94D013B95l.exe	114
PID 312 wrote to memory of 1084	312	kBCE14922l80A3i4724697FEw96E94D013B95l.exe	115
PID 4568 wrote to memory of 2036	4568	k621C98EDlED0Bi4e0a6B69Ew06B1BC8664D1l.exe	116
PID 4568 wrote to memory of 1556	4568	k621C98EDlED0Bi4e0a6B69Ew06B1BC8664D1l.exe	117
PID 2036 wrote to memory of 2240	2036	k35A58564lC2ECi404a68C14w3E976939F26Bl.exe	119
PID 2036 wrote to memory of 928	2036	k35A58564lC2ECi404a68C14w3E976939F26Bl.exe	120
PID 2240 wrote to memory of 656	2240	k4252CD06lC501i491969827w99E7A1192C84l.exe	121
PID 2240 wrote to memory of 888	2240	k4252CD06lC501i491969827w99E7A1192C84l.exe	122

C:\Users\Admin\AppData\Local\Temp\2026-08-05_b2e96fba73479458593cffe3e3b428d1_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_b2e96fba73479458593cffe3e3b428d1_elex_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\kCCDEAB3Al143Di4b8768C7Fw22338797619El.exe
  C:\Windows\kCCDEAB3Al143Di4b8768C7Fw22338797619El.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3384
- - C:\Windows\k01F05AA9l96DDi46836B610w54A7CD004CBFl.exe
    C:\Windows\k01F05AA9l96DDi46836B610w54A7CD004CBFl.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4516
  - - C:\Windows\kE3104E46l590Ai4c5669176w3DC5112D58B9l.exe
      C:\Windows\kE3104E46l590Ai4c5669176w3DC5112D58B9l.exe
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1492
    - - C:\Windows\kB5F02155l9827i406a6A84EwFECC3EFEEDE2l.exe
        
        C:\Windows\kB5F02155l9827i406a6A84EwFECC3EFEEDE2l.exe
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3972
      - C:\Windows\kF16AF574l205Di4b986A7E3w46E41DE6370Al.exe
        
        C:\Windows\kF16AF574l205Di4b986A7E3w46E41DE6370Al.exe
        6⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:204
        
        C:\Windows\k4A3CE09Bl785Di42106AF40w498F769B71C1l.exe
        
        C:\Windows\k4A3CE09Bl785Di42106AF40w498F769B71C1l.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1128
        
        C:\Windows\kBCE14922l80A3i4724697FEw96E94D013B95l.exe
        
        C:\Windows\kBCE14922l80A3i4724697FEw96E94D013B95l.exe
        8⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:312
        
        C:\Windows\k621C98EDlED0Bi4e0a6B69Ew06B1BC8664D1l.exe
        
        C:\Windows\k621C98EDlED0Bi4e0a6B69Ew06B1BC8664D1l.exe
        9⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4568
        
        C:\Windows\k35A58564lC2ECi404a68C14w3E976939F26Bl.exe
        
        C:\Windows\k35A58564lC2ECi404a68C14w3E976939F26Bl.exe
        10⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2036
        
        C:\Windows\k4252CD06lC501i491969827w99E7A1192C84l.exe
        
        C:\Windows\k4252CD06lC501i491969827w99E7A1192C84l.exe
        11⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2240
        
        C:\Windows\kBAD028D9l47ADi45dd697D7wBBB8D84A7201l.exe
        
        C:\Windows\kBAD028D9l47ADi45dd697D7wBBB8D84A7201l.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:656
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\K4252C~1.EXE > nul
        12⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:888
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\K35A58~1.EXE > nul
        11⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:928
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\K621C9~1.EXE > nul
        10⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1556
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\KBCE14~1.EXE > nul
        9⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1084
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\K4A3CE~1.EXE > nul
        8⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4704
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\KF16AF~1.EXE > nul
        7⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1612
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\KB5F02~1.EXE > nul
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4300
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\KE3104~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:5048
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\K01F05~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:3752
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\KCCDEA~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:436
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

k01F05AA9l96DDi46836B610w54A7CD004CBFl.exe

Path C:\Windows\k01F05AA9l96DDi46836B610w54A7CD004CBFl.exe
Size 64KB
SHA256 e313ee2b779efacd8305896969099342e1657b5bc6d218b521e602ad372827ea
MD5 818204d46773af09c4d13c7bf874d808
SHA1 e5b7460cc883a370ce6c583116f1f3978f2b70e1
SHA512 0cef0cd7a4c8688d37c3a1b0de06cb8b3aede02c237c5f4bc639d812f71249e03ed1c7235e19085e376c5ee290e08b73a78b441de8a83ff3cc975460169ae2f1
SSDEEP 192:ObOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwu404/ClxyNhoyK+r1M:ObLwOs8AHsc4sMfwhKQLro04/Clsr/e
TLSH
T1F6531A435BDD5CF2FB950231187C8BB9927B99D4560EBEDFAB50CD64403B292E83A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

k35A58564lC2ECi404a68C14w3E976939F26Bl.exe

Path C:\Windows\k35A58564lC2ECi404a68C14w3E976939F26Bl.exe
Size 64KB
SHA256 92d48332a9e45a1df5e9481ab68037b1ef5d5ce5f75400a36fe7a23ae9ff3c8c
MD5 b3b5070338da76e47ab2753bf0ff3e1c
SHA1 a514175f13c66cea394c80b7df87b514d7d4603a
SHA512 b592917eacbbb9b85277b0d8663ca2048d8099fad647d19b9dcf1e625d8abd46fc0bad869abec2dffd1fd6854fe64cfa2afe3115a89ad153a74b71c9bbebea48
SSDEEP 192:ObOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwF404/ClxyNhoyK+r1M:ObLwOs8AHsc4sMfwhKQLroX4/Clsr/e
TLSH
T1835309435BED5CF2FB950231187C8BB9927B99D4560EBEEFAB50CD644037292E43A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

k4252CD06lC501i491969827w99E7A1192C84l.exe

Path C:\Windows\k4252CD06lC501i491969827w99E7A1192C84l.exe
Size 64KB
SHA256 d797865ba039e3dd3fbc114cc918934e277a882d439f884cd874522f8d03962f
MD5 86b2790bc200b0e08b7b66865304644e
SHA1 965dd0800c794a7d595bed0d496e939a38704e1a
SHA512 5fe8eea4c7463bee66293e9fa2a4ff661e4d7ead8be260810f37d7ef588362fda07372df77d2d0e824ce98cb7eb8f66fab552a223802ae7fb86a3a66741c162d
SSDEEP 384:ObLwOs8AHsc4sMfwhKQLroEh4/Clsr/e:Ovw9816vhKQLroA4/QQ
TLSH
T1155319435BDD9CF2F7950231187C8BB9927B99D4560EBEEFAB90CD144037292E43A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

k4A3CE09Bl785Di42106AF40w498F769B71C1l.exe

Path C:\Windows\k4A3CE09Bl785Di42106AF40w498F769B71C1l.exe
Size 64KB
SHA256 c0adf842c843a99aa50b28e4b6db2ab5605c7dc69cee100f4ad228cc612405a3
MD5 b308983cebdf1919f4597beac7a5a022
SHA1 8a869b20d10992a2d7988f2ef18786fe3efee0fe
SHA512 9ee25474a54f600bd8861d54da5a75f638aceeadb1db3b0c4d427650a7b00c33a40ac77254f22bfe5b11ed784d7c840f5f74a9200d961b42a3f5a2aa0f9e104c
SSDEEP 192:ObOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwz404/ClxyNhoyK+r1M:ObLwOs8AHsc4sMfwhKQLro14/Clsr/e
TLSH
T162531A435BDD5CF2F7950231187C8BB9927B99D4550EBEEFAB50CD54403B292E43A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

k621C98EDlED0Bi4e0a6B69Ew06B1BC8664D1l.exe

Path C:\Windows\k621C98EDlED0Bi4e0a6B69Ew06B1BC8664D1l.exe
Size 64KB
SHA256 10b0b12bbd3e2f962aa4cace9084aefe21b510570e01ad34930081db352c77cf
MD5 fff31bc938ffa4c95b75a9fb36a355ff
SHA1 ed531d586936dc6bb44647f084a986547fa613a2
SHA512 294a145abdf75816386c08b85f79669874d170e452adfd8066e4f06a033d13de32ddff62893c563193a5e60eb130791553f32416f53ad295e0e0e1c253f487f9
SSDEEP 192:ObOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwn404/ClxyNhoyK+r1M:ObLwOs8AHsc4sMfwhKQLro54/Clsr/e
TLSH
T1D75319435BDD9CF2F7950231187C8BB9927B99D4560EBEDFAB90CD24403B292E43A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kB5F02155l9827i406a6A84EwFECC3EFEEDE2l.exe

Path C:\Windows\kB5F02155l9827i406a6A84EwFECC3EFEEDE2l.exe
Size 64KB
SHA256 6c0e990c725619ff35d0f94e89ec21de2a9ba18f20f97622b045d12d58798184
MD5 ef72e7839b55fefa5c2b05a0a3044749
SHA1 427a558c6ad74b5113d62fefc30d47148bd65199
SHA512 65ee4459ee71c8fc6294320aedc7616092b5bec8a794b61fcf20397460e5bc3adeb2b38d5a96b1fbef145e08378fe123d01205c4dd86297044eb3a596d575fe4
SSDEEP 192:ObOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwI404/ClxyNhoyK+r1M:ObLwOs8AHsc4sMfwhKQLro24/Clsr/e
TLSH
T1FE5309435BDD9CF2F7950231187C8BB9927B99D4560EBEEFAB50CD544037292E43A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kBAD028D9l47ADi45dd697D7wBBB8D84A7201l.exe

Path C:\Windows\kBAD028D9l47ADi45dd697D7wBBB8D84A7201l.exe
Size 64KB
SHA256 ffc86af85cefb968f54fc47ed615e6b4c92ed3281b20907a3393fc1e0d0d2eeb
MD5 643b988bbfa666f47354fbd53c5e125a
SHA1 6775804845c2fd596a112d19c89d0a4db3a70c77
SHA512 4adebc41168ab8dd7a1dbcb51a47432f487c9f8d2e0bd8cfc06fb526556cd7088f51f07f1752f0ecd9c115b0450d945860ba5c4521e20726236a61d31b1405b6
SSDEEP 192:ObOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqw2404/ClxyNhoyK+r1M:ObLwOs8AHsc4sMfwhKQLroc4/Clsr/e
TLSH
T1345319835BED5CF2F7950231187C8BB9927B99D4550EBEEFAB50CD644037292E43A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kBCE14922l80A3i4724697FEw96E94D013B95l.exe

Path C:\Windows\kBCE14922l80A3i4724697FEw96E94D013B95l.exe
Size 64KB
SHA256 aef9d7a0e4e561af4f6535c2ee8df2c4a801bfdf9c2c57ff854fb2a216242346
MD5 1ec3177e3a5700f758518355e8ecd7dc
SHA1 3e7115e9c71a97b516fbc72c49af563c9e0cc8be
SHA512 da81644b7a78a30977e5c2a9c86fcdcc23b59bd066d9060a5698c8405a6eda16503eda465ca9b99361affec40eac63632b0737bb4b35ac9eebe6ad0090cef6ea
SSDEEP 192:ObOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqweZ404/ClxyNhoyK+r1M:ObLwOs8AHsc4sMfwhKQLrow4/Clsr/e
TLSH
T19D5319435BDD9CF2F7950231187C8BB9927B99D4560EBEEFAB50CD244037292E43A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kCCDEAB3Al143Di4b8768C7Fw22338797619El.exe

Path C:\Windows\kCCDEAB3Al143Di4b8768C7Fw22338797619El.exe
Size 64KB
SHA256 a6089d9300a89d612afebef20e29bd06a9bdd2540d88aa8368f805f2334dfa65
MD5 fe0802d85a096bd5edeae5a7ee38f9cf
SHA1 0b6aeee8afdd9f9f80027fb62c3ceb03211d30d0
SHA512 55b6471ba699011d5b99efdaaeae7dfe2149fe455de94c71fd422a6842886f4342508ec180539df2ed35c947b7277f15bc1f2bcf1b70e0ec3c1679cabfab146f
SSDEEP 192:ObOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwO404/ClxyNhoyK+r1M:ObLwOs8AHsc4sMfwhKQLroU4/Clsr/e
TLSH
T198531A435BDD5CF2F7950231187C8BB9927B99D4550EBEEFAB50CD544037292E43A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kE3104E46l590Ai4c5669176w3DC5112D58B9l.exe

Path C:\Windows\kE3104E46l590Ai4c5669176w3DC5112D58B9l.exe
Size 64KB
SHA256 eaa4e13ef616545d96f36f47f900139475a066b1f8304b5e4eb4882aa8668884
MD5 ac99febf2bc2722975de78f1763d9964
SHA1 87180b585238360196c008b252240623db578071
SHA512 3bfebeed61ec3e66ce116b13403f7112a06a36a732bd1cdb676c62961b6f4c7176c8c2cba85b824b0a6657e124c6a42a8370a736d0fd1c66afae5ba8234c3042
SSDEEP 192:ObOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwe404/ClxyNhoyK+r1M:ObLwOs8AHsc4sMfwhKQLroE4/Clsr/e
TLSH
T1545319435BDD9CF2F7950231187C8BB9927B99D4960EBEDFAB50CD14403B292E43A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kF16AF574l205Di4b986A7E3w46E41DE6370Al.exe

Path C:\Windows\kF16AF574l205Di4b986A7E3w46E41DE6370Al.exe
Size 64KB
SHA256 078d4e14a3bd3374f1d04a83897b94005975db6a4ca73935f771d8397da2395e
MD5 e115dee38041c232f17708263529a62e
SHA1 bb61bd0574c939981c91b496583c2a61a337d259
SHA512 ab1a06afca052bed38867d47e175d0d3e86b6ff8e5749b3bf72ca9f423a9c79378bf298a729907951acc0cfc9f004b8e89417548a6ef17c637e92c0e0311a6ba
SSDEEP 192:ObOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwn404/ClxyNhoyK+r1M:ObLwOs8AHsc4sMfwhKQLro54/Clsr/e
TLSH
T19F5309435BDD5CF2F7950231187C8BB9927B99D4560EBEDFAB90CD544037292E43A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads