berbew | 8734859c475fae3a1f86f837089c7cac4c955bdf401518e5a634b720bd79acdf

Analysis

max time kernel
148s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/11/2026, 22:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-08_a1c5191d0c9c7d296ae5e2e553c8e5ab_elex_wannacry.exe
Size 320KB
Sample261108-2g6qlsvsbs
SHA256 8734859c475fae3a1f86f837089c7cac4c955bdf401518e5a634b720bd79acdf
MD5 a1c5191d0c9c7d296ae5e2e553c8e5ab
SHA1 b5aa9b32a4904547a208af4f436ad350fc725d76
SHA512 c91d31099f68f5d8d41afa561207961f6d29faac15564ebb0522db866e9fdad5348acd7f8b90eb1422dbaac42d6bc0d0901becc1c8848c9c5b92bc7e9baf4436
SSDEEP 3072:bpQ/gx1dxjrhdxwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:bnBrhdxV/Ah1G/AcQ///NR5fn
TLSH
T1A0642F1A263409EACEED9BB5EC124DD85181E9F015F1E13E6123EFDCD8E5DA2C819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 42 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	2026-11-08_a1c5191d0c9c7d296ae5e2e553c8e5ab_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dpgbgpbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dbfoclai.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgdgijhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmnpfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dinjjf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmifkecb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbfoclai.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmkcpdao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dlqpaafg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpgbgpbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dipgpf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Defheg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmnpfd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Debnjgcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmifkecb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dipgpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmkcpdao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddekmo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbhlikpf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dibdeegc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpjompqc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dgdgijhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dpllbp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddhhbngi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddhhbngi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dedkogqm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dedkogqm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dpjompqc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddekmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Defheg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dlqpaafg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dinjjf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dibdeegc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpllbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Debnjgcp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddcogo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddcogo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfakcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfakcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dbhlikpf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	2026-11-08_a1c5191d0c9c7d296ae5e2e553c8e5ab_elex_wannacry.exe

Executes dropped EXE 21 IoCs

pid	Process
4716	Debnjgcp.exe
4172	Dinjjf32.exe
1852	Dmifkecb.exe
4756	Dpgbgpbe.exe
4600	Ddcogo32.exe
4240	Dbfoclai.exe
4312	Dfakcj32.exe
5116	Dedkogqm.exe
3128	Dipgpf32.exe
1280	Dmkcpdao.exe
3496	Dpjompqc.exe
1436	Ddekmo32.exe
2064	Dbhlikpf.exe
2852	Dgdgijhp.exe
4012	Defheg32.exe
2768	Dibdeegc.exe
2256	Dmnpfd32.exe
3364	Dlqpaafg.exe
2840	Dpllbp32.exe
4176	Ddhhbngi.exe
2504	Dbkhnk32.exe

Drops file in System32 directory 63 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ddekmo32.exe	Dpjompqc.exe
File opened for modification	C:\Windows\SysWOW64\Ddekmo32.exe	Dpjompqc.exe
File created	C:\Windows\SysWOW64\Ddhhbngi.exe	Dpllbp32.exe
File created	C:\Windows\SysWOW64\Dmifkecb.exe	Dinjjf32.exe
File opened for modification	C:\Windows\SysWOW64\Dgdgijhp.exe	Dbhlikpf.exe
File created	C:\Windows\SysWOW64\Defheg32.exe	Dgdgijhp.exe
File created	C:\Windows\SysWOW64\Naefjl32.dll	Ddhhbngi.exe
File opened for modification	C:\Windows\SysWOW64\Dipgpf32.exe	Dedkogqm.exe
File created	C:\Windows\SysWOW64\Ddcogo32.exe	Dpgbgpbe.exe
File opened for modification	C:\Windows\SysWOW64\Ddcogo32.exe	Dpgbgpbe.exe
File created	C:\Windows\SysWOW64\Dedkogqm.exe	Dfakcj32.exe
File created	C:\Windows\SysWOW64\Dibdeegc.exe	Defheg32.exe
File created	C:\Windows\SysWOW64\Debnjgcp.exe	2026-11-08_a1c5191d0c9c7d296ae5e2e553c8e5ab_elex_wannacry.exe
File created	C:\Windows\SysWOW64\Gpngef32.dll	2026-11-08_a1c5191d0c9c7d296ae5e2e553c8e5ab_elex_wannacry.exe
File created	C:\Windows\SysWOW64\Nfmcle32.dll	Dbfoclai.exe
File opened for modification	C:\Windows\SysWOW64\Dmkcpdao.exe	Dipgpf32.exe
File created	C:\Windows\SysWOW64\Dpjompqc.exe	Dmkcpdao.exe
File created	C:\Windows\SysWOW64\Fiinbn32.dll	Dmkcpdao.exe
File opened for modification	C:\Windows\SysWOW64\Dmnpfd32.exe	Dibdeegc.exe
File created	C:\Windows\SysWOW64\Cmonod32.dll	Dpllbp32.exe
File created	C:\Windows\SysWOW64\Hlhkja32.dll	Ddcogo32.exe
File opened for modification	C:\Windows\SysWOW64\Dpjompqc.exe	Dmkcpdao.exe
File opened for modification	C:\Windows\SysWOW64\Dbhlikpf.exe	Ddekmo32.exe
File created	C:\Windows\SysWOW64\Fgpoahbe.dll	Dbhlikpf.exe
File opened for modification	C:\Windows\SysWOW64\Dibdeegc.exe	Defheg32.exe
File created	C:\Windows\SysWOW64\Dmkcpdao.exe	Dipgpf32.exe
File created	C:\Windows\SysWOW64\Dinjjf32.exe	Debnjgcp.exe
File opened for modification	C:\Windows\SysWOW64\Dpgbgpbe.exe	Dmifkecb.exe
File created	C:\Windows\SysWOW64\Dfakcj32.exe	Dbfoclai.exe
File created	C:\Windows\SysWOW64\Ioeiam32.dll	Ddekmo32.exe
File opened for modification	C:\Windows\SysWOW64\Dlqpaafg.exe	Dmnpfd32.exe
File opened for modification	C:\Windows\SysWOW64\Ddhhbngi.exe	Dpllbp32.exe
File opened for modification	C:\Windows\SysWOW64\Dfakcj32.exe	Dbfoclai.exe
File opened for modification	C:\Windows\SysWOW64\Dedkogqm.exe	Dfakcj32.exe
File created	C:\Windows\SysWOW64\Nffopp32.dll	Defheg32.exe
File created	C:\Windows\SysWOW64\Abbbel32.dll	Dinjjf32.exe
File opened for modification	C:\Windows\SysWOW64\Dbkhnk32.exe	Ddhhbngi.exe
File created	C:\Windows\SysWOW64\Dlqpaafg.exe	Dmnpfd32.exe
File created	C:\Windows\SysWOW64\Imdnon32.dll	Dedkogqm.exe
File opened for modification	C:\Windows\SysWOW64\Dinjjf32.exe	Debnjgcp.exe
File opened for modification	C:\Windows\SysWOW64\Dmifkecb.exe	Dinjjf32.exe
File created	C:\Windows\SysWOW64\Dbfoclai.exe	Ddcogo32.exe
File created	C:\Windows\SysWOW64\Jgfdkj32.dll	Dfakcj32.exe
File created	C:\Windows\SysWOW64\Cbccbiml.dll	Dpjompqc.exe
File opened for modification	C:\Windows\SysWOW64\Defheg32.exe	Dgdgijhp.exe
File created	C:\Windows\SysWOW64\Oihlnd32.dll	Dmifkecb.exe
File opened for modification	C:\Windows\SysWOW64\Dbfoclai.exe	Ddcogo32.exe
File created	C:\Windows\SysWOW64\Dgdgijhp.exe	Dbhlikpf.exe
File created	C:\Windows\SysWOW64\Dmnpfd32.exe	Dibdeegc.exe
File created	C:\Windows\SysWOW64\Dbkhnk32.exe	Ddhhbngi.exe
File created	C:\Windows\SysWOW64\Mckfmq32.dll	Dlqpaafg.exe
File created	C:\Windows\SysWOW64\Dpkgac32.dll	Dibdeegc.exe
File created	C:\Windows\SysWOW64\Dpllbp32.exe	Dlqpaafg.exe
File created	C:\Windows\SysWOW64\Dpgbgpbe.exe	Dmifkecb.exe
File created	C:\Windows\SysWOW64\Ebldoh32.dll	Dpgbgpbe.exe
File created	C:\Windows\SysWOW64\Dbhlikpf.exe	Ddekmo32.exe
File created	C:\Windows\SysWOW64\Fjgnln32.dll	Dmnpfd32.exe
File opened for modification	C:\Windows\SysWOW64\Dpllbp32.exe	Dlqpaafg.exe
File created	C:\Windows\SysWOW64\Dipgpf32.exe	Dedkogqm.exe
File created	C:\Windows\SysWOW64\Idbgcb32.dll	Dipgpf32.exe
File created	C:\Windows\SysWOW64\Ldbeqlcg.dll	Dgdgijhp.exe
File opened for modification	C:\Windows\SysWOW64\Debnjgcp.exe	2026-11-08_a1c5191d0c9c7d296ae5e2e553c8e5ab_elex_wannacry.exe
File created	C:\Windows\SysWOW64\Dihmeahp.dll	Debnjgcp.exe

Program crash 1 IoCs

pid	pid_target	Process
5004	2504	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dipgpf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmkcpdao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbhlikpf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpgbgpbe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddcogo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmnpfd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpllbp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbkhnk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Defheg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dibdeegc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddhhbngi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddekmo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-08_a1c5191d0c9c7d296ae5e2e553c8e5ab_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Debnjgcp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dinjjf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmifkecb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbfoclai.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfakcj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dlqpaafg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dedkogqm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpjompqc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgdgijhp.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dbfoclai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mckfmq32.dll"	Dlqpaafg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	2026-11-08_a1c5191d0c9c7d296ae5e2e553c8e5ab_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlhkja32.dll"	Ddcogo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imdnon32.dll"	Dedkogqm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddekmo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	2026-11-08_a1c5191d0c9c7d296ae5e2e553c8e5ab_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abbbel32.dll"	Dinjjf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nfmcle32.dll"	Dbfoclai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ioeiam32.dll"	Ddekmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dlqpaafg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	2026-11-08_a1c5191d0c9c7d296ae5e2e553c8e5ab_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dibdeegc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpkgac32.dll"	Dibdeegc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dpllbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpngef32.dll"	2026-11-08_a1c5191d0c9c7d296ae5e2e553c8e5ab_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dbfoclai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dgdgijhp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ddhhbngi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dinjjf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmifkecb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ddcogo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmkcpdao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dbhlikpf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	2026-11-08_a1c5191d0c9c7d296ae5e2e553c8e5ab_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Debnjgcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddcogo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dedkogqm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmnpfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dibdeegc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dfakcj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Debnjgcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oihlnd32.dll"	Dmifkecb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ddekmo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dgdgijhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nffopp32.dll"	Defheg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dpllbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dinjjf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dedkogqm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naefjl32.dll"	Ddhhbngi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebldoh32.dll"	Dpgbgpbe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dipgpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fiinbn32.dll"	Dmkcpdao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Defheg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmonod32.dll"	Dpllbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dihmeahp.dll"	Debnjgcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgfdkj32.dll"	Dfakcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldbeqlcg.dll"	Dgdgijhp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmnpfd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dlqpaafg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddhhbngi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	2026-11-08_a1c5191d0c9c7d296ae5e2e553c8e5ab_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dfakcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dipgpf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dpjompqc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dbhlikpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgpoahbe.dll"	Dbhlikpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Defheg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmifkecb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dpgbgpbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dpgbgpbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idbgcb32.dll"	Dipgpf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmkcpdao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cbccbiml.dll"	Dpjompqc.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 4716	948	2026-11-08_a1c5191d0c9c7d296ae5e2e553c8e5ab_elex_wannacry.exe	86
PID 4716 wrote to memory of 4172	4716	Debnjgcp.exe	87
PID 4172 wrote to memory of 1852	4172	Dinjjf32.exe	88
PID 1852 wrote to memory of 4756	1852	Dmifkecb.exe	89
PID 4756 wrote to memory of 4600	4756	Dpgbgpbe.exe	90
PID 4600 wrote to memory of 4240	4600	Ddcogo32.exe	91
PID 4240 wrote to memory of 4312	4240	Dbfoclai.exe	92
PID 4312 wrote to memory of 5116	4312	Dfakcj32.exe	93
PID 5116 wrote to memory of 3128	5116	Dedkogqm.exe	94
PID 3128 wrote to memory of 1280	3128	Dipgpf32.exe	95
PID 1280 wrote to memory of 3496	1280	Dmkcpdao.exe	96
PID 3496 wrote to memory of 1436	3496	Dpjompqc.exe	97
PID 1436 wrote to memory of 2064	1436	Ddekmo32.exe	98
PID 2064 wrote to memory of 2852	2064	Dbhlikpf.exe	99
PID 2852 wrote to memory of 4012	2852	Dgdgijhp.exe	100
PID 4012 wrote to memory of 2768	4012	Defheg32.exe	101
PID 2768 wrote to memory of 2256	2768	Dibdeegc.exe	102
PID 2256 wrote to memory of 3364	2256	Dmnpfd32.exe	103
PID 3364 wrote to memory of 2840	3364	Dlqpaafg.exe	104
PID 2840 wrote to memory of 4176	2840	Dpllbp32.exe	105
PID 4176 wrote to memory of 2504	4176	Ddhhbngi.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-11-08_a1c5191d0c9c7d296ae5e2e553c8e5ab_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-08_a1c5191d0c9c7d296ae5e2e553c8e5ab_elex_wannacry.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\SysWOW64\Debnjgcp.exe
  C:\Windows\system32\Debnjgcp.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Windows\SysWOW64\Dinjjf32.exe
    C:\Windows\system32\Dinjjf32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4172
  - - C:\Windows\SysWOW64\Dmifkecb.exe
      C:\Windows\system32\Dmifkecb.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1852
    - - C:\Windows\SysWOW64\Dpgbgpbe.exe
        
        C:\Windows\system32\Dpgbgpbe.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4756
      - C:\Windows\SysWOW64\Ddcogo32.exe
        
        C:\Windows\system32\Ddcogo32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4600
        
        C:\Windows\SysWOW64\Dbfoclai.exe
        
        C:\Windows\system32\Dbfoclai.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4240
        
        C:\Windows\SysWOW64\Dfakcj32.exe
        
        C:\Windows\system32\Dfakcj32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4312
        
        C:\Windows\SysWOW64\Dedkogqm.exe
        
        C:\Windows\system32\Dedkogqm.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5116
        
        C:\Windows\SysWOW64\Dipgpf32.exe
        
        C:\Windows\system32\Dipgpf32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3128
        
        C:\Windows\SysWOW64\Dmkcpdao.exe
        
        C:\Windows\system32\Dmkcpdao.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1280
        
        C:\Windows\SysWOW64\Dpjompqc.exe
        
        C:\Windows\system32\Dpjompqc.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3496
        
        C:\Windows\SysWOW64\Ddekmo32.exe
        
        C:\Windows\system32\Ddekmo32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1436
        
        C:\Windows\SysWOW64\Dbhlikpf.exe
        
        C:\Windows\system32\Dbhlikpf.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2064
        
        C:\Windows\SysWOW64\Dgdgijhp.exe
        
        C:\Windows\system32\Dgdgijhp.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2852
        
        C:\Windows\SysWOW64\Defheg32.exe
        
        C:\Windows\system32\Defheg32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4012
        
        C:\Windows\SysWOW64\Dibdeegc.exe
        
        C:\Windows\system32\Dibdeegc.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2768
        
        C:\Windows\SysWOW64\Dmnpfd32.exe
        
        C:\Windows\system32\Dmnpfd32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2256
        
        C:\Windows\SysWOW64\Dlqpaafg.exe
        
        C:\Windows\system32\Dlqpaafg.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3364
        
        C:\Windows\SysWOW64\Dpllbp32.exe
        
        C:\Windows\system32\Dpllbp32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2840
        
        C:\Windows\SysWOW64\Ddhhbngi.exe
        
        C:\Windows\system32\Ddhhbngi.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4176
        
        C:\Windows\SysWOW64\Dbkhnk32.exe
        
        C:\Windows\system32\Dbkhnk32.exe
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2504
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 400
        23⤵
        Program crash
        
        PID:5004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2504 -ip 2504
1⤵
PID:700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Dbfoclai.exe

Path C:\Windows\SysWOW64\Dbfoclai.exe
Size 320KB
SHA256 9684aa259bf2dad71565690a07aff5c1b166d573c2c1a6e09b40d33895f69ac4
MD5 b1665fd596ae386ec9b6fd338962aaca
SHA1 047096f48adcf6896be6e9178b1a972ee26b6242
SHA512 5aacdbbc8ad5910d06cec111963d7a96b260e1a93987dbf85d3d0750ac05fb4765d07e1a7c65314174e1b27148eda1be1aee1d4f1bbde3c4dddf7021323b2ded
SSDEEP 3072:4OgCJWPLpMUb4nkQHwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:xgCJapMUb4kQHV/Ah1G/AcQ///NR5fn
TLSH
T19064EA1A66340AEACEED1BB5EC0249D89181ECF114F1E13F6527AFDCD8E4DA2D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dbhlikpf.exe

Path C:\Windows\SysWOW64\Dbhlikpf.exe
Size 320KB
SHA256 81a17829b9738b71fae7ebb7e3e6d696a32e92404afc5c0e2e7eb0b1753b8667
MD5 09a4d444cc857f42cc6ebb486a1250c9
SHA1 c1aff573aec74aafa4e12c333e974cbb73790fcb
SHA512 3e9564aa9b6a3c98542b15e3dd00c707bd547c6ed79ea12a9feda4884f7df5657d2fa427000ab4150b9a2b854ebd0379a87adefe2f8cece4719b2339ae48f1f4
SSDEEP 3072:wHySqr/ZI4SpAgUNE/XwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:wyD+4S3UNE/XV/Ah1G/AcQ///NR5fn
TLSH
T1D76431192A7909EACDED2BB5AC5249D86141EAF114F1E13E9933DFDCD9E4DA2CC04F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dbkhnk32.exe

Path C:\Windows\SysWOW64\Dbkhnk32.exe
Size 320KB
SHA256 4d32f8385dc9225ade6430d13d59c808f7891120dbe2cdae6f31bdc588f561e2
MD5 8c1a66b1843a4c73e1c1aee5c8a3cfe0
SHA1 653911f494b76ef4dc7b7ef71f56eddf2b21781e
SHA512 f62e2aa83c093f43515855b5e412bb2d485bca089b2a925c6aa7dd17717b0ea916ec287fb1c9c9203525f58e8d503692cb7a863935b4b60e90fbe5ca6edc2b6c
SSDEEP 3072:Qndz/jy46wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:w/e46V/Ah1G/AcQ///NR5fn
TLSH
T1F9641E292A3409EACDFD1BB9AC0259DC5141E8F115F1E13EA923DFECD8E4DA6C815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ddcogo32.exe

Path C:\Windows\SysWOW64\Ddcogo32.exe
Size 320KB
SHA256 89ebe746239e1b71b99d44c4a1378b84530e6ea54dd30ca757c1f40abe031b9f
MD5 8cbeeb580a8f0da7d0c82cae006b7ff0
SHA1 7867c40301dde9475e09404c53b4bea71d7dcaef
SHA512 33dc95425f35e122f03e7cd1c9f8f271c2450f292d0f098469ca68bffcb3fdc2b66cd7be64acde98d37235137641da5ecde7815b809682dde08f9956a3c8f6c6
SSDEEP 3072:UD9aFAgsY9so6w/GwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:UONpsY/GV/Ah1G/AcQ///NR5fn
TLSH
T145642F1A2A3409EADDED1BB5AC1259D89141E8F01CF1E23E6133DFDCD8E4DA2E855F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ddekmo32.exe

Path C:\Windows\SysWOW64\Ddekmo32.exe
Size 320KB
SHA256 5b2a79e39ff97d2fa64747a394b357776323f5f16002f8d75333e3eb20061259
MD5 440d321d084689f8ac461e161aebef1e
SHA1 1c17a5c613cd8676033c057d812f021e0444823b
SHA512 07d2195b5b8f8ace1722ab568a2a6534fd26ecfd98234fe95c0cf560551f351c9292cab933da3811783c784280b539d40eac40112de38566e302ac52a56a0f82
SSDEEP 3072:6ruxJp5e7lgwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:6al50gV/Ah1G/AcQ///NR5fn
TLSH
T18F642E196A3009EACDFD1BB6AE1249D89191E9F014F1E13E6523DFDDD8E4DA2CC09F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ddhhbngi.exe

Path C:\Windows\SysWOW64\Ddhhbngi.exe
Size 320KB
SHA256 8271ec93b1d15d9d1eba12302ff06ddac8fba608350f319d9383c256eceb8d7d
MD5 5b5a383a5ceec67a3448aeb264fe192a
SHA1 ae9b79c60f296d0513c201957d472f8134d49896
SHA512 d2334cff10b4fe1d37107417edd9edea450773436a440018e00bbbb63f4db245670aeba4ef1057f35c86a7454073bde824ae726105cf24e58ceba593922581a0
SSDEEP 3072:wC7eaIQnMD7p/olK7LwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:rWQnIpEeLV/Ah1G/AcQ///NR5fn
TLSH
T122640E192A3009FADEED1BBAAC1249DD9141E9F014F1E13E6523DFDCD8E4DA6C819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Debnjgcp.exe

Path C:\Windows\SysWOW64\Debnjgcp.exe
Size 320KB
SHA256 795c003804318b775986daecf34bea735d99583634f4c73b67aaf823478bfdd0
MD5 5a261004ff85c8c748f50869e9b4c8e7
SHA1 778a7e5910fe0282e1f6a88ce220ef80d2f26d9f
SHA512 824d571b979848077a3b63917a1db7227d036ae1f7108a6a3802f1c1231be1112dc506bdc889fa92f54e0b814cd84aeb35ebeb1a40c8dfe1da5fdf1b1ae678e9
SSDEEP 3072:wbxS1zLxBSwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:wbxGNBSV/Ah1G/AcQ///NR5fn
TLSH
T1246431196A3409EACDFD5BB9AC1249D89241E8F015F2E13F6523DFDDE8E4DA2C805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dedkogqm.exe

Path C:\Windows\SysWOW64\Dedkogqm.exe
Size 320KB
SHA256 987b04eeb9ca2ed0f0a1e62eed71c220b8199bb496c7d615976152dd4865c07a
MD5 978e6d27fa1e5463f833eeae2c776ca1
SHA1 85a26810797c63c0363f13b3f12b28eb80eecbe9
SHA512 07b0244e5d52d44ea0b553c4269332b73240396c6f246313365d6844713c263728b7969bd34003d061e14f8305db26be6fa3f1c15ba283f60819f7d2b89993d0
SSDEEP 3072:X885v/xIa2O6GXoqGQwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Z6OoQV/Ah1G/AcQ///NR5fn
TLSH
T192644119263409EACDED1FB5AD0289D9A182E9F014F5E13E6163DFDCE8E4DA2CC15F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Defheg32.exe

Path C:\Windows\SysWOW64\Defheg32.exe
Size 320KB
SHA256 bc4065f7ced715910b25d3a5fb2e330b973bdce94d63a54da7517d09c5613bb8
MD5 a3be540f2869a0325f2c2f9e77b92ba9
SHA1 1b003cc857f89b2eefd0856e997d76b3fa774397
SHA512 59ef26f864323cf8325414e3c5ae9964618cb5d0dad588ec5767c413057adf9be8beda3d4ce01808f18fd7061757781c4b8f4a35afa91bca6a79cb7c8e961b1f
SSDEEP 3072:IauLf6m4QwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:I56m4QV/Ah1G/AcQ///NR5fn
TLSH
T1DF64301A663009EACEFD1FB5AC1249DA5151E8F214F1E23E5523DFDDC8E4EA2C916F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dfakcj32.exe

Path C:\Windows\SysWOW64\Dfakcj32.exe
Size 320KB
SHA256 e9d446ea83e894602c42526606275f6ba0cd8c23c96c0affa5c204532f0eca72
MD5 d042070b60cd8cd1eabd9ee019a9539a
SHA1 0683925372a73ce23debe4abda7e4682dedb7023
SHA512 ef6043368e4a0d0c0ae0d67ef2f32b8cb502086d36069b1144964fc38fee8e85d7ea3ad83b65656f7c937e32500c981043115523d4bf8c4c59093f9ec1347ebc
SSDEEP 3072:56sEkE3+LEgRjPwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:f7EOLEg1PV/Ah1G/AcQ///NR5fn
TLSH
T166642F1966341DEACEEE1BB5AC0249D85241E4F054F1E13E61A3DFDCE8E4DA6CC29F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dgdgijhp.exe

Path C:\Windows\SysWOW64\Dgdgijhp.exe
Size 320KB
SHA256 d3366f7d098ca7f8891487529f3952c8b888199cf86723fa23f29e8fb1895ecb
MD5 9b99283de81df9af4f8807fa3cff507e
SHA1 3081f7094159c25d6d58930f9deaf69a9cc9582e
SHA512 b185d8823f7fbb4a1e7708c0fd8c34789fdfa9e335518358a81abf8e191c0c631d434e9551caa28083c474c47d904885e8eff77814437f0f95a0e7a3b0e53095
SSDEEP 3072:Q5FdeJw9wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Qbdx9V/Ah1G/AcQ///NR5fn
TLSH
T171642F5A6A3409EACEED1BB6AC0289D85145E4F014F1E13E6923DFDCD8E4DA6DC14FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dibdeegc.exe

Path C:\Windows\SysWOW64\Dibdeegc.exe
Size 320KB
SHA256 30064e0cf79eb6c20c5b886bbdfb0cdbb236b1e051677c13f9a2e115af5bfd9e
MD5 6007a5787a0c23eb7f0b45f5c6a70fe2
SHA1 ac43a516d95f7e95288550e48aecb778306de48c
SHA512 f62342664b9febd3c277176e9f591bdff670c656e0d10cc20fe2aaf9d1cabaae620ab3698a2af2f1de3a088aa90f0b6899869212eb68ce1f02bae878aaa640a1
SSDEEP 3072:flWhOB7kiJbwTwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:flWMBdMTV/Ah1G/AcQ///NR5fn
TLSH
T13064505A2A3009EACDED1FB6AC0259D89181E9F055F1E17E6123DFDCD8E4DA2DC09F90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dinjjf32.exe

Path C:\Windows\SysWOW64\Dinjjf32.exe
Size 320KB
SHA256 8822b021223307c517a309648c15c1bf425c468ab830149411ffdb09e1a6df4c
MD5 68eaf7eac5d04fa57a849e85ab6bb7d0
SHA1 c848db2394cd92e6bdd4256bf18bdf99d6c33647
SHA512 b654308f6fed3f93cc04f940572e9549c678d13d65f17c8a2a5dd236956766cb3630f1ec930beaac5ad669eae8e84320ec7e77504008ad73b1490ccf7124a04c
SSDEEP 3072:cHdNwItvQusZa7wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:cH1tYba7V/Ah1G/AcQ///NR5fn
TLSH
T186642F19263409EACDED5FB5AC0289D89182E5F419F2E13E6123DFDDD8F4DA2D818F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dipgpf32.exe

Path C:\Windows\SysWOW64\Dipgpf32.exe
Size 320KB
SHA256 82700fbfaf344a238f1d453da6f32c0ddb54842ad9148349e3433f6aa4044d8c
MD5 d19411bf07a5b249e554709cc5c11b57
SHA1 dc99b6ef87f463f8b3fe966be60ccf068a76b859
SHA512 016edcbba5fcedaa5491e1a67edf8c225d931106b088d8d039612b2329ee5067d5596c5ac6a0b32a406ea225f37887185c27e8e321c20bad80b428636580d541
SSDEEP 3072:H4SjNXPVZx6LXwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:zjb6LXV/Ah1G/AcQ///NR5fn
TLSH
T1FB642E192A340AFACDED1BB5AC0249D89145E9F024F1E23E6933DFDCD8E4DA6D845F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dlqpaafg.exe

Path C:\Windows\SysWOW64\Dlqpaafg.exe
Size 320KB
SHA256 7a960159c52b5361b353b95833ce755592f035489ec73ac9819768fb408f9f0c
MD5 89a3cdb261dac5e4670963755cd9694b
SHA1 a17e028b1f9695ce2326fbc6619b0bc37d20fb4f
SHA512 f75c9b10d0d00274d97342835ed294ee834b1f73859d3b9463a5d92f10f799193a58ae830665e5953a35858f23f8534033435affcff44d620b8f8800d6d42e65
SSDEEP 6144:R6Htq7CPGGGGGGGGGGGGGGjaV/Ah1G/AcQ///NR5fn:RMtqAGGGGGGGGGGGGGGD/Nv
TLSH
T1DA644219263449EACEED1FB6AC125AD85141E8F014F1E13E6923DFDCD8E5EA3D818F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dmifkecb.exe

Path C:\Windows\SysWOW64\Dmifkecb.exe
Size 320KB
SHA256 3410f38fe9dc50ca1a5aa374cbbda078d80db858396b3de4918decdff99a7e23
MD5 862a1e8a8e6c14289a212544a2689b55
SHA1 024fc7f6a69be1dbb5864ace7806253dc7469ebf
SHA512 5b69f5cf3cf8c88c90d89273400d782b775f6da1bdba862ffd0afd458ded3473cd295b97cf0b7484f485bd3144c6a992912a4e761549ee2f69cfb1eaef579842
SSDEEP 3072:e+Cet5TUo4hwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:BUhV/Ah1G/AcQ///NR5fn
TLSH
T1BB643E192A3409EACEED1BB5AC1249D89141E8F414F1E23E6523DFDCD8E4DA6D80EFC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dmkcpdao.exe

Path C:\Windows\SysWOW64\Dmkcpdao.exe
Size 320KB
SHA256 6b22edd0c41f5affe759619fac4daf668e4080f012b5a39cdb7907b7f480a220
MD5 bfdff7f296a501b66c39a8f9ed168ecf
SHA1 f61817505e12e0435dbde75022601ed4a3ed197a
SHA512 93f70667c15176042fc3f7dad73077fef8db9da2727503772b3dc5207a7126ac73bf1ab2423c93f2af88c398d56c4c289e46e16d0dec3df998f7833ddec73144
SSDEEP 3072:ZUOSYwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:a9YV/Ah1G/AcQ///NR5fn
TLSH
T1796430192A741DEACEED1BB5AC0249D85141F5F058F1E23E6123DFDCD8E8DA2C869F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dmnpfd32.exe

Path C:\Windows\SysWOW64\Dmnpfd32.exe
Size 320KB
SHA256 392eb7187acbf00ec63103bb85af1fd60d9b70fa406f01ebf3995b68560acb8d
MD5 900bb02a287ed4be3a829a68f50c2c81
SHA1 53a8865d135e9908edea8371d5b680fa302033c3
SHA512 9cad242583d52f9f8d0785ff98bba0d0226b9d0522a341158aade28519ebdf35c8f2fe9894a1e9821265294269834603ed66621fd1cec75423f1d8e6c2100fcc
SSDEEP 3072:jzXmWd99QzYv8F4hvzs1wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:jaYmzq7ZY1V/Ah1G/AcQ///NR5fn
TLSH
T1C8644119263419EACDED1FB5ED0249D89281E8F014F1E23EA523DFDDE8E4DA2C815F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dpgbgpbe.exe

Path C:\Windows\SysWOW64\Dpgbgpbe.exe
Size 320KB
SHA256 2cb4e4d05b361f32eabaa7ffc0a16524c5e7c58703aa566030f23d8a0c661357
MD5 942ea7d5f2c8303b3c7648abff8f4451
SHA1 6c93643cd862c4d573ddb4659e4f00c49dbbd668
SHA512 6b151a1015637d414b5e1ae6047ca80ab81805cc2589f87ff206c7a897d19c624a7f6f722f7ae1e0434b09d1fe313bbbef1a4416d49af1f20fdd6d24da493e0e
SSDEEP 3072:jCsj8kRHe5uYwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:jB8kk5uYV/Ah1G/AcQ///NR5fn
TLSH
T19564411A263409EACEED9FB9AC1259D89141F8F114F1E13E6523EFDCD8E4DA2D805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dpjompqc.exe

Path C:\Windows\SysWOW64\Dpjompqc.exe
Size 320KB
SHA256 655c50992cfc1eef956311f262d3160065c3251b242abe08b113bbe3a3ed3b19
MD5 834b43de3afff57dc011fbc11b9083cd
SHA1 7213c2df6dc60a5347a8b25f7dfe6e1770aca459
SHA512 dad53a0425f6d2d685792dc933cd4367bc7e7cabdda40409cc5c26962fdc771a36aed14c0db43f612982212625919147d419a7ca6a695a4fdfa918101d5608af
SSDEEP 3072:iU7gtVavQ34yK8o8bnwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:V7gtVOQW8/nV/Ah1G/AcQ///NR5fn
TLSH
T1BD64DB1A2A3409EACEFD1FB6AC1249D89181E9F014F1E13E6523DFDDD8E4DA2D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dpllbp32.exe

Path C:\Windows\SysWOW64\Dpllbp32.exe
Size 320KB
SHA256 e57247e1cf6281e70e4c0db871a2ba44059e17257c2aacc78b903583b2c2d8eb
MD5 6b95e3ab36de56a83762a8cba387e630
SHA1 548fbfb3758d3ea01cf8c0a8a2c9f189001f664e
SHA512 f74c6534aeb767593a2c1182d7d7566577cb443b4907fee99a8d4427c14658235d15cf6d48eeb3f0d351229a4d0e126ffe2be4a9ed6112b854061bdb1d6e754e
SSDEEP 3072:FILY/PI7rfyyyyyyyyyyyyyyZyyyyyya/yyyyyyn0uwuqxwS/A4MK0FzJG/AMBx6:FILePIC0duqxV/Ah1G/AcQ///NR5fn
TLSH
T1C2642F19263409EACEED1BB6EC125AD89141E8F514F1E17E6123DFDCC8E4EE2D818F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/948-1-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/948-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/948-193-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1280-174-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1436-170-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1852-194-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1852-195-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2064-168-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2256-160-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2504-152-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2768-162-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2840-156-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2852-166-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3128-176-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3364-158-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3496-172-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4012-164-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4172-189-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4172-21-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4176-154-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4240-182-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4312-180-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4600-184-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4716-191-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4716-9-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4756-186-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5116-178-0x0000000000400000-0x000000000046D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads