65f9f018d3e08a22264e134bdf0af5ae7262ff89762a8505f520a90eec8ab4cc

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 01:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_ddae4b12a087b3b4958a8429d351fbb1_elex_mimic_pay2key_wannacry.exe
Size 14.3MB
Sample260522-cc17wsfs3w
SHA256 65f9f018d3e08a22264e134bdf0af5ae7262ff89762a8505f520a90eec8ab4cc
MD5 ddae4b12a087b3b4958a8429d351fbb1
SHA1 b6a4a0dcd83375ae71ed33e896789a1c4d41387b
SHA512 e7400cb8360e0c306e10326be54a9dde7c0bb1cfcafd2e999b9529a839bb09ba6543df1ea98a14620e863948228f01a380eefea19f49253e1b1086bb870a503e
SSDEEP 98304:D658fYSyXwrDb6ecrR95rOFrBS1lmNrKS5SibTuATf5Cw1ru:D6sYuD2R9tOFL+wX9/1
TLSH
T1C1E623552D8BCCA5C3111EB750D6A76E85BCFF421E70F89331B097CAAA29F8CD51234A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery

Malware Config

Signatures

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs

resource	yara_rule
behavioral2/files/0x001900000002b454-90.dat	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/564-91-0x0000028734EA0000-0x0000028734FB2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Executes dropped EXE 13 IoCs

pid	Process
3064	7z.exe
5084	7z.exe
2900	7z.exe
1180	7z.exe
2524	7z.exe
2176	7z.exe
3348	7z.exe
4960	7z.exe
644	7z.exe
3964	7z.exe
3684	7z.exe
1400	7z.exe
564	Updater.exe

Loads dropped DLL 12 IoCs

pid	Process
3064	7z.exe
5084	7z.exe
2900	7z.exe
1180	7z.exe
2524	7z.exe
2176	7z.exe
3348	7z.exe
4960	7z.exe
644	7z.exe
3964	7z.exe
3684	7z.exe
1400	7z.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
564	Updater.exe
564	Updater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-22_ddae4b12a087b3b4958a8429d351fbb1_elex_mimic_pay2key_wannacry.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
564	Updater.exe
564	Updater.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeRestorePrivilege	3064	7z.exe
Token: 35	3064	7z.exe
Token: SeSecurityPrivilege	3064	7z.exe
Token: SeSecurityPrivilege	3064	7z.exe
Token: SeRestorePrivilege	5084	7z.exe
Token: 35	5084	7z.exe
Token: SeSecurityPrivilege	5084	7z.exe
Token: SeSecurityPrivilege	5084	7z.exe
Token: SeRestorePrivilege	2900	7z.exe
Token: 35	2900	7z.exe
Token: SeSecurityPrivilege	2900	7z.exe
Token: SeSecurityPrivilege	2900	7z.exe
Token: SeRestorePrivilege	1180	7z.exe
Token: 35	1180	7z.exe
Token: SeSecurityPrivilege	1180	7z.exe
Token: SeSecurityPrivilege	1180	7z.exe
Token: SeRestorePrivilege	2524	7z.exe
Token: 35	2524	7z.exe
Token: SeSecurityPrivilege	2524	7z.exe
Token: SeSecurityPrivilege	2524	7z.exe
Token: SeRestorePrivilege	2176	7z.exe
Token: 35	2176	7z.exe
Token: SeSecurityPrivilege	2176	7z.exe
Token: SeSecurityPrivilege	2176	7z.exe
Token: SeRestorePrivilege	3348	7z.exe
Token: 35	3348	7z.exe
Token: SeSecurityPrivilege	3348	7z.exe
Token: SeSecurityPrivilege	3348	7z.exe
Token: SeRestorePrivilege	4960	7z.exe
Token: 35	4960	7z.exe
Token: SeSecurityPrivilege	4960	7z.exe
Token: SeSecurityPrivilege	4960	7z.exe
Token: SeRestorePrivilege	644	7z.exe
Token: 35	644	7z.exe
Token: SeSecurityPrivilege	644	7z.exe
Token: SeSecurityPrivilege	644	7z.exe
Token: SeRestorePrivilege	3964	7z.exe
Token: 35	3964	7z.exe
Token: SeSecurityPrivilege	3964	7z.exe
Token: SeSecurityPrivilege	3964	7z.exe
Token: SeRestorePrivilege	3684	7z.exe
Token: 35	3684	7z.exe
Token: SeSecurityPrivilege	3684	7z.exe
Token: SeSecurityPrivilege	3684	7z.exe
Token: SeRestorePrivilege	1400	7z.exe
Token: 35	1400	7z.exe
Token: SeSecurityPrivilege	1400	7z.exe
Token: SeSecurityPrivilege	1400	7z.exe
Token: SeDebugPrivilege	564	Updater.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2052	1760	2026-05-22_ddae4b12a087b3b4958a8429d351fbb1_elex_mimic_pay2key_wannacry.exe	81
PID 2052 wrote to memory of 1704	2052	cmd.exe	83
PID 2052 wrote to memory of 3064	2052	cmd.exe	84
PID 2052 wrote to memory of 5084	2052	cmd.exe	85
PID 2052 wrote to memory of 2900	2052	cmd.exe	86
PID 2052 wrote to memory of 1180	2052	cmd.exe	87
PID 2052 wrote to memory of 2524	2052	cmd.exe	88
PID 2052 wrote to memory of 2176	2052	cmd.exe	89
PID 2052 wrote to memory of 3348	2052	cmd.exe	90
PID 2052 wrote to memory of 4960	2052	cmd.exe	91
PID 2052 wrote to memory of 644	2052	cmd.exe	92
PID 2052 wrote to memory of 3964	2052	cmd.exe	93
PID 2052 wrote to memory of 3684	2052	cmd.exe	94
PID 2052 wrote to memory of 1400	2052	cmd.exe	95
PID 2052 wrote to memory of 5024	2052	cmd.exe	96
PID 2052 wrote to memory of 564	2052	cmd.exe	97

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5024	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-22_ddae4b12a087b3b4958a8429d351fbb1_elex_mimic_pay2key_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_ddae4b12a087b3b4958a8429d351fbb1_elex_mimic_pay2key_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Windows\system32\mode.com
    mode 65,10
    3⤵
    PID:1704
- - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
    7z.exe e file.zip -p1949629305280442903922684610 -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:3064
- - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
    7z.exe e extracted/file_11.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:5084
- - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
    7z.exe e extracted/file_10.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:2900
- - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
    7z.exe e extracted/file_9.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:1180
- - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
    7z.exe e extracted/file_8.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:2524
- - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
    7z.exe e extracted/file_7.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:2176
- - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
    7z.exe e extracted/file_6.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:3348
- - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
    7z.exe e extracted/file_5.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:4960
- - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
    7z.exe e extracted/file_4.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:644
- - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
    7z.exe e extracted/file_3.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:3964
- - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
    7z.exe e extracted/file_2.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:3684
- - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
    7z.exe e extracted/file_1.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:1400
- - C:\Windows\system32\attrib.exe
    attrib +H "Updater.exe"
    3⤵
    - Views/modifies file attributes
    PID:5024
- - C:\Users\Admin\AppData\Local\Temp\main\Updater.exe
    "Updater.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.dll

Path C:\Users\Admin\AppData\Local\Temp\main\7z.dll
Size 1.6MB
SHA256 34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
MD5 72491c7b87a7c2dd350b727444f13bb4
SHA1 1e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA512 583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
SSDEEP 24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYgR+zypEqxr2VSlLP:jclmJSVARa86xzW3xRoyqqxrT
TLSH
T148754B6BF6748260D0B7C075C5D2AB96EEB134868B3096C752859B3D2F17BF6C939320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Users\Admin\AppData\Local\Temp\main\7z.exe
Size 458KB
SHA256 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
MD5 619f7135621b50fd1900ff24aade1524
SHA1 6c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA512 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
SSDEEP 6144:fz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCV7+DHV:r1gL5pRTcAkS/3hzN8qE43fm78V
TLSH
T10BA40815F6748631D073D0BAC5D3AA9AEE3230855B308ACB1286D7782F277E6C936731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Updater.exe

Path C:\Users\Admin\AppData\Local\Temp\main\Updater.exe
Size 1.0MB
SHA256 5ee6fed00396fe948eda7f4832b97c733293ae5f8dc7055ebd71d3579ce28648
MD5 ca02ea13491ac3689f5a96ad93da139d
SHA1 efe4394602775ad4242cac5b781ab0ebfaee4c2b
SHA512 3abbbe099ce3a652026c99985b8c859664e0fdf8777af0714846406c88ff667be63ae09e2a06c7b6a4055dd8677543618d7392081ec7512c43c855d25d9beccc
SSDEEP 24576:9OsOX6eCJILT9WNUrLyP4e3jaBZkmKt6laMedFRr:9fCp3kNUrLyPaBGmKt6GB
TLSH
T16735CF062BA6AF41E2BA777550B106C443F8E9059E8ECF97A3D439E32ECE751670704B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ANTIAV~1.DAT

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\ANTIAV~1.DAT
Size 2.3MB
SHA256 b44917152003d8523b42b242cb46aaf178e0c5b98067a33c117d60ebba9a74ce
MD5 0c52bde777ace45fc4c327c322c883cd
SHA1 e62eeba3d994c02bb811c42a4f2e2da1abbf6708
SHA512 b20e5562742ee03748836f53c0eeae86d4b95f9aeb1e82dc003b2b47ef39bbc4a3b7a31ee4be73ebc16e86c448089bd4690da792af0b53b36470250a88876414
SSDEEP 24576:5yZBPkpRrP9pxC+XvoflcYy36s3vb0EecYy37n92k8GtGAQZ67hR7krC/Cyf0/x3:R9kqGu7okoZscCnf0/Zs9W
TLSH
T1DFB501E4B7C8BCC68B9E93D7A1518EAE133311FB9993548C0586BBC91E1B785DF1C884
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_1.zip

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\file_1.zip
Size 773KB
SHA256 e5535b5542df26f41ea165fd0cfce510d4a3d88009eb85facab32fb35f3f5e36
MD5 55fb3443598df8894d88cc8dc83a443a
SHA1 54d59411325c3d505d7babc8ec8ba67628ab25d6
SHA512 d00a9a785d26a1ad9e53206bb4d9d924f5cdef887bdeb557e2796f9b254cc3a3d26d7c5dfd3f533d54baf1a89c6d96c6fefca73b00d57d4912d5a65f26b882dc
SSDEEP 24576:aFEEZOXmeosdEDv+jGXyxGSmN8q9FIr9oMSh3:9CCMWED2GCx1mNF9FIGMg3
TLSH
T1D0F433FA28A8A236D308F875D24BBAD47B3E3211D71ED501E43AD14A1174D94D3FBE68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_10.zip

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\file_10.zip
Size 774KB
SHA256 f439e79476d26bcedf3693b4cea01144b855a15b032cfc8abd55526df37dd5ef
MD5 9cd759cd128b29dbfb90d62f3669c64f
SHA1 c9388b3d957098dcc073b5c1096be69c9def2211
SHA512 966fbf04469e3aa1b273fd3ba49bebc502247f344ccfd7f1b0eb4cb1cd1bde7e1ad7fe18166d66fa1d931e5308a910dfc0e5f4a9f89f582eabc662cf50872dcb
SSDEEP 24576:kScZSXG0kIFUNvwNKXsVsmmv44lFq5FSM6pkNG:3Kmc+UZ4KcV1mvJlFqaMSkg
TLSH
T1E4F433BA68A8B236D304F871D207A9E4BB3D3315E71DC951E03AE1451478D98D3FAE78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_11.zip

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\file_11.zip
Size 2.4MB
SHA256 33cf300083e491e1d3eba866620ef7399b40344705c96ca2587d66bef50dc29b
MD5 e07b1c0ad50fd16d464237c0e9d8c74f
SHA1 9e18c33d30cc164cfadf03cf3026ccf51e456fdb
SHA512 0f0955db4614ed094bcf004eec7ce035d1b2a976cf78f78ec1dd4a0920990fccb0f85d139656e4987fc754bd1c74be8ec752826b26d5c4ea31d32060b3d7d022
SSDEEP 49152:mujCK3D0AC/l5mwbBkDWYb1ZN4UJ9oYfKmc+UZ4KcV1mvJlFqaMSkX:maR3D0Ae5mwdkDWm1XoN5+wHFqaCX
TLSH
T1D1C5336C44B8E779EE24B830464BC5A0AE3732F1A71F85F47889B104117B9ACAD9E53D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_2.zip

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\file_2.zip
Size 773KB
SHA256 a299b311b35fd75e3f564fd1c5df2c71d7704ac7bee8ca70901926b8699cbb5e
MD5 87a7217c2fc3f9e1dfe1bcbd1c0b18e2
SHA1 ec17aa9426a7fd2a02dcd4d17025d621579fdffd
SHA512 688cd4d89c55050611894fb3c409853749f4092eb2512a72e58467056c8c9b1fe3121b6ef0a2db418cbdab556693901c8165bfb73266af33564bd118045308ef
SSDEEP 24576:2FEEZOXmeosdEDv+jGXyxGSmN8q9FIr9oMSh1:RCCMWED2GCx1mNF9FIGMg1
TLSH
T187F433FA28A8A236D308F875D24BBAD47B3E3211D71ED501E43AD14A1174D94D3FBE68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_3.zip

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\file_3.zip
Size 773KB
SHA256 c4ed997f025ab2b4d3365f9c49aefb51ef37fd2c0538ec6dab59d03cdd1df94f
MD5 f55db174e1ee9c236e90161bea19eb0e
SHA1 2dcdd35aa7ddbd199ab1d3273f685ae46c9b92ca
SHA512 3049b3adec53fc752c43a2d9f8407b5e585c187eb51ee714659017d9f628ecdc6c6f106fe22f128e2a366acf3285af6fd80759e07cdabd671aaebcfabc9b071f
SSDEEP 24576:2FEEZOXmeosdEDv+jGXyxGSmN8q9FIr9oMShr:RCCMWED2GCx1mNF9FIGMgr
TLSH
T1D0F433F628A8A236D308F875D24BBAD47B3E3211D71ED501E43AD14A1178D94D3FBE68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_4.zip

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\file_4.zip
Size 773KB
SHA256 bd7c0bb0e8ce3e7e44405826ba70f78b6c72680ba3dbd279c5f93b70535ee700
MD5 12a8a4625cf0f653aa6b2feff933b1ee
SHA1 89eeb675c37a9b8cfbf87ecb78d8f6a1f15a69f2
SHA512 407c744a29b714e96027cab911baea2fb39de7f79b7ebf0f1dbb96b437cdda919a2a44fe701e881c811b7fcc5e0846ec012bf87e305d1c87b12f34f70277fcc4
SSDEEP 24576:yFEEZOXmeosdEDv+jGXyxGSmN8q9FIr9oMSh/:lCCMWED2GCx1mNF9FIGMg/
TLSH
T120F433FA28A8A236D308F875D24BBAD47B3E3211D71ED501E43AD1491178D94D3FBE68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_5.zip

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\file_5.zip
Size 773KB
SHA256 d5155fb2e0b32e98043fd61f2a8b2a49a894982798a090ad131cae757e5de7e4
MD5 2a530791e59ece646186db781d2c599d
SHA1 1aca634604b5cb4f501310749e423c73ccc42c5e
SHA512 04d4ea34c2cec6c45b67f8302a1b9ec830f10df14c00a9780ab0886206b09b3990f795eab0c354b19db568a3faaeaec7ccf742dfb409b911b66a739b7101fa97
SSDEEP 24576:5FEEZOXmeosdEDv+jGXyxGSmN8q9FIr9oMShh:YCCMWED2GCx1mNF9FIGMgh
TLSH
T1A6F433FA28A8A136D308F875D24BAAD47F3E2211D71ED501E43AD14A1178D54D3FBE68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_6.zip

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\file_6.zip
Size 773KB
SHA256 74ac05371910569a38bf86771938464c18d0dee4b08658254d6c108a884bff33
MD5 f839d29bab813ed35122511a2bb96d31
SHA1 fa5b5e627c53cb7fe85df32e872207afe7c5f6d6
SHA512 174fab34eae755292fbc19b3853e951be2b461ccf28a3403c301166c38da717bd82a41200dfcd64790dd8a1dd77c66363160175338357a04c6fbc328111b2f59
SSDEEP 24576:PFEEZOXmeosdEDv+jGXyxGSmN8q9FIr9oMShp:6CCMWED2GCx1mNF9FIGMgp
TLSH
T177F433FA28A8A136D308F875D24BAAD47F3E2211D71ED501E43AD14A2178D54D3FBE68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_7.zip

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\file_7.zip
Size 774KB
SHA256 d6ad1a79c01b1fae052b229f52aaf79a042bad8c3e790d00b5f646aff1a8c1da
MD5 49ccf87a029437d55b544fb4966a36bc
SHA1 ff1cc189fbe03bdba49855bc6cdf82c921b5675d
SHA512 604871dc36e631cbaa3481c65b6f9731414f62a96ec4ac548253654f915edef367da940878f1aab7fc6f94b6165f822ac1574f6a7c192a49c891cdabc3b9a1db
SSDEEP 24576:bScZSXG0kIFUNvwNKXsVsmmv44lFq5FSM6pkNg:OKmc+UZ4KcV1mvJlFqaMSki
TLSH
T15EF433FA68A8B236D304F871D207A9E4BB393311E71DC951E43AE1451478D98D3FAE78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_8.zip

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\file_8.zip
Size 774KB
SHA256 e5c5ca0d1580de28ef0f85abf2b55ae0ddc526498693c08097f3ddee88f8f2d7
MD5 d8650448085535ae85ebf50b731dfb41
SHA1 8b024831c74cc6290092da4fb02fa2adac7d885f
SHA512 f49db21cd29dc1ded8f1b0493a1420ed8a1886e0d754edb033b9932172e155a2f8a128868e997b0c0a8de4404ef1b140f2c07b75ae6d8779521c23d992c956bf
SSDEEP 24576:mScZSXG0kIFUNvwNKXsVsmmv44lFq5FSM6pkNs:dKmc+UZ4KcV1mvJlFqaMSkq
TLSH
T1BFF433BA68A8B226D304F871D207A9E4BB3D3315E71DC951E03AE1451478D98D3FAE78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_9.zip

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\file_9.zip
Size 774KB
SHA256 400d8395b60573fabf5b7f95a118039b58c2a0c3483c43b969ee90ca5d7399b7
MD5 cd200cf68e71fcaa23e1ab6625d0ead1
SHA1 41ca6a081dcbf1de4d291c56bfe0a378f98edbdb
SHA512 e1ed2c4251fc49f1e639522e67c00571f07510ab2bd363b7da46ad162e61a74648d000a2cc489b4427c5ef2ec5da6f207293de1093c8a11c944658664b44bfcc
SSDEEP 24576:uScZSXG0kIFUNvwNKXsVsmmv44lFq5FSM6pkNz:lKmc+UZ4KcV1mvJlFqaMSkd
TLSH
T171F433BA68A8B236D304F871D207A9E4BB3D3315E71DC951E03AE1451478D98D3FAE78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file.bin

Path C:\Users\Admin\AppData\Local\Temp\main\file.bin
Size 2.4MB
SHA256 b0001687214440928007bc697097d2a57a7f7e6821e6872e534d6a88a1942593
MD5 69f8eaabe05893f908504bfdb6ef4cd8
SHA1 1b87a8f14a7533c7d0a20a78c8c9195df785b387
SHA512 479448c51f9a4d6954639ae8c41eff873fdf211c03ead29bef822bd7ececb04d06e89e14312e56f67134e7fc5059dee571d4a10ccd73e604870348a49e07a0b7
SSDEEP 49152:xB8m1AcB3Ox9O6KBOQSg5naE19dqO+ipSYbjO+wpr3Dhcu3z:xNlB3694cQSC19dtpba+w9zhcsz
TLSH
T10DC5339F117CFA78E4537F2A31CD472AABDC05F5964B881EC042E4296EFE23539EA051
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.bat

Path C:\Users\Admin\AppData\Local\Temp\main\main.bat
Size 465B
SHA256 75efaf4474a6d66907440dc716b1c75fe6174a243962c709b7fb3e227e30b38a
MD5 2ef076d1b148ae87d885b8da0ea753ef
SHA1 b20434bf203cdd733aa2ffec92bb1f24923e768a
SHA512 9883951dc7fcb21a5fdae52a8e3ea66350de2187e89e5d77ea00577dc0c06a9ece936b0b2921f9119cc7b69974a9352302195901174568204f7d455b6f26f82d
TLSH
T15DF0274124DBC9B24CC52A8A079C2DCA7127988AC11F4F4029D440EE64198DCD4CFF6B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/564-92-0x00000287353C0000-0x00000287353C1000-memory.dmp

Download

memory/564-93-0x000002874F710000-0x000002874F8D2000-memory.dmp

Download

memory/564-94-0x0000028736D90000-0x0000028736E06000-memory.dmp

Download

memory/564-91-0x0000028734EA0000-0x0000028734FB2000-memory.dmp

Download

memory/564-95-0x0000028750EC0000-0x00000287513E8000-memory.dmp

Download