8115fecba76b58f239a8d146c8f2a617edddc0c4c224e3143a27bc91589f6f1d

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 13:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_ba32833674eea39ae3b546461226cc43_elex_smoke-loader_stop.exe
Size 1.7MB
Sample260522-qcxrcset5x
SHA256 8115fecba76b58f239a8d146c8f2a617edddc0c4c224e3143a27bc91589f6f1d
MD5 ba32833674eea39ae3b546461226cc43
SHA1 f301d490072d0e204a485701ea32ba2e2e157743
SHA512 76ff7d1321dc3daaa75084ded17d1d9c1871562979c6f061aeae80b506a3fe48d348f3c86a4aed0e4c0a5486a788bb0ef745529f62027aa39bd41f31c60fe6a9
SSDEEP 49152:mS1YTuq9qE0S/IfLYmjfAko2Lj6kxs0rdhTlo:JIq0cZfAko23PK
TLSH
T19C857C21A780C537FAE304B4D969456D1D7A3E329F25E1CBA3C8BE4F1AB15C2A631713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wocualts.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wocualts.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wocualts.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2026-05-22_ba32833674eea39ae3b546461226cc43_elex_smoke-loader_stop.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2026-05-22_ba32833674eea39ae3b546461226cc43_elex_smoke-loader_stop.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wocualts.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	2026-05-22_ba32833674eea39ae3b546461226cc43_elex_smoke-loader_stop.exe

Executes dropped EXE 2 IoCs

pid	Process
3300	wocualts.exe
1700	wocualts.exe

Loads dropped DLL 8 IoCs

pid	Process
3344	regsvr32.exe
4504	regsvr32.exe
4712	regsvr32.exe
4892	regsvr32.exe
3944	regsvr32.exe
1076	regsvr32.exe
808	regsvr32.exe
4116	regsvr32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\win = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wocualts.exe"	wocualts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wocualts.exe"	wocualts.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\vbzip11.dll	wocualts.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-22_ba32833674eea39ae3b546461226cc43_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wocualts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wocualts.exe

Modifies registry class 33 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2B6338C-B058-0B00-519D-3D2BB0638159}\InprocServer32\15.0.0.0\Class = "Microsoft.Vbe.Interop.CodePaneClass"	2026-05-22_ba32833674eea39ae3b546461226cc43_elex_smoke-loader_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2B6338C-B058-0B00-519D-3D2BB0638159}\bejqYmmdbjiA = "uptgWqcPv\\pAOm\\B"	wocualts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2B6338C-B058-0B00-519D-3D2BB0638159}\aogm = "nMAWQFUfPmjotJr~yo[EQ~sGKc"	wocualts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2B6338C-B058-0B00-519D-3D2BB0638159}\xkZtdtodhFjKi = "QMrKgmYbH]GgMQg\x7f[OycPMBK[@Tnwlx"	wocualts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2B6338C-B058-0B00-519D-3D2BB0638159}\iMWhsRXhQ = "H}`sRlEghKcVoJPV"	wocualts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2B6338C-B058-0B00-519D-3D2BB0638159}\aogm = "mMAWQFUfSmjotJr~yo[EQ~sGKc"	wocualts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2B6338C-B058-0B00-519D-3D2BB0638159}\qmniiiaPulw = "eWtcpqL"	wocualts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2B6338C-B058-0B00-519D-3D2BB0638159}\InprocServer32\Class = "Microsoft.Vbe.Interop.CodePaneClass"	2026-05-22_ba32833674eea39ae3b546461226cc43_elex_smoke-loader_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2B6338C-B058-0B00-519D-3D2BB0638159}\InprocServer32\15.0.0.0\Assembly = "Microsoft.Vbe.Interop, Version=15.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C"	2026-05-22_ba32833674eea39ae3b546461226cc43_elex_smoke-loader_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2B6338C-B058-0B00-519D-3D2BB0638159}\ykxcmubDQ = "DvGbWCPIp}spwjTjfRxQrJO[jfoU"	wocualts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2B6338C-B058-0B00-519D-3D2BB0638159}\xkZtdtodhFjKi = "QMrKgmYbH]GgMQg\x7f[OycPMBK[@Unwlx"	wocualts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2B6338C-B058-0B00-519D-3D2BB0638159}\xkZtdtodhFjKi = "QMrKgmYbH]GgMQg\x7f[OycPMBK[@Znwlx"	wocualts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2B6338C-B058-0B00-519D-3D2BB0638159}\qmniiiaPulw = "eRv_H\x7f@"	wocualts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2B6338C-B058-0B00-519D-3D2BB0638159}\qmniiiaPulw = "eTwLxxh"	wocualts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2B6338C-B058-0B00-519D-3D2BB0638159}\huvmcUQ = "w~iKR{QwsFNS^UIUkuwJwAnFMue"	wocualts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2B6338C-B058-0B00-519D-3D2BB0638159}\aogm = "lMAWQFUfRmjotJr~yo[EQ~sGKc"	wocualts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2B6338C-B058-0B00-519D-3D2BB0638159}\qmniiiaPulw = "eYvvP\|t"	wocualts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2B6338C-B058-0B00-519D-3D2BB0638159}\xkZtdtodhFjKi = "QMrKgmYbH]GgMQg\x7f[OycPMBK[@Xnwlx"	wocualts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2B6338C-B058-0B00-519D-3D2BB0638159}\InprocServer32\Assembly = "Microsoft.Vbe.Interop, Version=15.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C"	2026-05-22_ba32833674eea39ae3b546461226cc43_elex_smoke-loader_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2B6338C-B058-0B00-519D-3D2BB0638159}\InprocServer32\RuntimeVersion = "v2.0.50727"	2026-05-22_ba32833674eea39ae3b546461226cc43_elex_smoke-loader_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2B6338C-B058-0B00-519D-3D2BB0638159}\xkZtdtodhFjKi = "QMrKgmYbH]GgMQg\x7f[OycPMBK[@Qnwlx"	wocualts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2B6338C-B058-0B00-519D-3D2BB0638159}\huvmcUQ = "w~iKR{QwsFNS^UIUkuwJwAnFMue"	wocualts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2B6338C-B058-0B00-519D-3D2BB0638159}\ykxcmubDQ = "DvGbWCPIp}spwjTjfRxQrJO[jfoU"	wocualts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2B6338C-B058-0B00-519D-3D2BB0638159}\bejqYmmdbjiA = "uptgWqcPv\\pAOm\\B"	wocualts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2B6338C-B058-0B00-519D-3D2BB0638159}\qmniiiaPulw = "eWsMt}T"	wocualts.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2B6338C-B058-0B00-519D-3D2BB0638159}	2026-05-22_ba32833674eea39ae3b546461226cc43_elex_smoke-loader_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2B6338C-B058-0B00-519D-3D2BB0638159}\InprocServer32\15.0.0.0	2026-05-22_ba32833674eea39ae3b546461226cc43_elex_smoke-loader_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2B6338C-B058-0B00-519D-3D2BB0638159}\InprocServer32\15.0.0.0\RuntimeVersion = "v2.0.50727"	2026-05-22_ba32833674eea39ae3b546461226cc43_elex_smoke-loader_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2B6338C-B058-0B00-519D-3D2BB0638159}\iMWhsRXhQ = "H}`sRlEghKcVoJPV"	wocualts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2B6338C-B058-0B00-519D-3D2BB0638159}\aogm = "mMAWQFUfSmjotJr~yo[EQ~sGKc"	wocualts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2B6338C-B058-0B00-519D-3D2BB0638159}\qmniiiaPulw = "e\\sdl~`"	wocualts.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2B6338C-B058-0B00-519D-3D2BB0638159}\InprocServer32	2026-05-22_ba32833674eea39ae3b546461226cc43_elex_smoke-loader_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2B6338C-B058-0B00-519D-3D2BB0638159}\xkZtdtodhFjKi = "QMrKgmYbH]GgMQg\x7f[OycPMBK[@[nwlx"	wocualts.exe

NTFS ADS 3 IoCs

description	ioc	Process
File created	C:\ProgramData\TEMP:C9C13817	wocualts.exe
File opened for modification	C:\ProgramData\TEMP:C9C13817	wocualts.exe
File opened for modification	C:\ProgramData\TEMP:C9C13817	wocualts.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: 33	3788	2026-05-22_ba32833674eea39ae3b546461226cc43_elex_smoke-loader_stop.exe
Token: SeIncBasePriorityPrivilege	3788	2026-05-22_ba32833674eea39ae3b546461226cc43_elex_smoke-loader_stop.exe
Token: 33	3300	wocualts.exe
Token: SeIncBasePriorityPrivilege	3300	wocualts.exe
Token: 33	1700	wocualts.exe
Token: SeIncBasePriorityPrivilege	1700	wocualts.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3788	2026-05-22_ba32833674eea39ae3b546461226cc43_elex_smoke-loader_stop.exe
3300	wocualts.exe
1700	wocualts.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3788 wrote to memory of 3300	3788	2026-05-22_ba32833674eea39ae3b546461226cc43_elex_smoke-loader_stop.exe	95
PID 3300 wrote to memory of 3344	3300	wocualts.exe	96
PID 3300 wrote to memory of 4504	3300	wocualts.exe	97
PID 3300 wrote to memory of 4712	3300	wocualts.exe	98
PID 3300 wrote to memory of 4892	3300	wocualts.exe	99
PID 3300 wrote to memory of 3944	3300	wocualts.exe	100
PID 3300 wrote to memory of 1076	3300	wocualts.exe	101
PID 3300 wrote to memory of 808	3300	wocualts.exe	102
PID 3300 wrote to memory of 4116	3300	wocualts.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-05-22_ba32833674eea39ae3b546461226cc43_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_ba32833674eea39ae3b546461226cc43_elex_smoke-loader_stop.exe"
1⤵
- Checks BIOS information in registry
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3788
- C:\Users\Admin\AppData\Local\Temp\wocualts.exe
  "C:\Users\Admin\AppData\Local\Temp\wocualts.exe"
  2⤵
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3300
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Windows\system32\vbzip11.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3344
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Windows\system32\vbzip11.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4504
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Windows\system32\vbzip11.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4712
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Windows\system32\vbzip11.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4892
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\vbzip11.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3944
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\vbzip11.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1076
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\vbzip11.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:808
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\vbzip11.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4116

C:\Users\Admin\AppData\Local\Temp\wocualts.exe
C:\Users\Admin\AppData\Local\Temp\wocualts.exe
1⤵
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

TEMP:C9C13817

Path C:\ProgramData\TEMP:C9C13817
Size 112B
SHA256 e9f8e3835de77b6d4dcefc3934af545f12560cb6c0bedd1bf38a057a92805b06
MD5 005fe4b49f5699b4e8a6dfe7a274cabb
SHA1 9cf80cc8b85bffc301ec05e19b2446dacfe1a749
SHA512 82d64615987a4ee78f71bc1f9336d68f1ce5773bbf36d821958a2f71ed15a32db6bf6d14e8b556daac9b0d0704590779ebee12a9a78363a314ab1a7f98e5e1e6
TLSH
T1D0B01260B4BF264E98C97FE5155594352D28EA702B18553711923D21BCC1F2C50476B3
MD5 SHA1 SHA512 TLSH

Submit Download

TEMP:C9C13817

Path C:\ProgramData\TEMP:C9C13817
Size 112B
SHA256 7b74474f87665e114b9ec1f1fcea79539dfff0a202c7c793ad081b17527711da
MD5 91abaf134a36fa4d61d0ab7eb4dffe0a
SHA1 5cb9d70b0ca0e921ed6c3ee0540c99dd1e687b73
SHA512 a18c6bd06d0afd9b557b5ba28aa6e1a64ead3e1ec3ed09850298f65f853a308a4b80bef09bdd977a44191b7215fc0796b5c7756d08c69a15f1e2b328566d9860
TLSH
T1A9B012A4B4BF324E98817FE92618D0352228FA746F18663310533E127CC5F2850072B3
MD5 SHA1 SHA512 TLSH

Submit Download

micka.exe

Path C:\Users\Admin\AppData\Local\Temp\micka.exe
Size 128B
SHA256 38723a2e5e8a17aa7950dc008209944e898f69a7bd10a23c839d341e935fd5ca
MD5 f09f35a5637839458e462e6350ecbce4
SHA1 0ae4f711ef5d6e9d26c611fd2c8c8ac45ecbf9e7
SHA512 ab942f526272e456ed68a979f50202905ca903a141ed98443567b11ef0bf25a552d639051a01be58558122c58e3de07d749ee59ded36acf0c55cd91924d6ba11
MD5 SHA1 SHA512

Submit Download

wocualts.exe

Path C:\Users\Admin\AppData\Local\Temp\wocualts.exe
Size 1.7MB
SHA256 8115fecba76b58f239a8d146c8f2a617edddc0c4c224e3143a27bc91589f6f1d
MD5 ba32833674eea39ae3b546461226cc43
SHA1 f301d490072d0e204a485701ea32ba2e2e157743
SHA512 76ff7d1321dc3daaa75084ded17d1d9c1871562979c6f061aeae80b506a3fe48d348f3c86a4aed0e4c0a5486a788bb0ef745529f62027aa39bd41f31c60fe6a9
SSDEEP 49152:mS1YTuq9qE0S/IfLYmjfAko2Lj6kxs0rdhTlo:JIq0cZfAko23PK
TLSH
T19C857C21A780C537FAE304B4D969456D1D7A3E329F25E1CBA3C8BE4F1AB15C2A631713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vbzip11.dll

Path C:\Windows\SysWOW64\vbzip11.dll
Size 144KB
SHA256 d13f6334c4cb124052d658e687a0394fb431447e5239a4f8be576c9c416705ca
MD5 abee1079ea3f3e74c933915bf10a7b9b
SHA1 b3de541c524f46fd0c95dcefd3f7765114107910
SHA512 f046e5a1d2fb01b9999743b36a43a2a2699bff1c0cddd2351fb1a6979725634d235ab415b4784cc4aeaa6a9bd982ac88f89f82ef27cb9de7e1da5d6f4f6542d7
SSDEEP 3072:hCMWTS9Jr3xg/XeT2v/a3/E7NoMrOjFb3AQe:hEoJrBSua/aNQR
TLSH
T170E3BE833466C073F1D8033C14A1AF379F7FA5665625CD939795CAE21C690A2E62F38B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1700-107-0x0000000000400000-0x0000000000620000-memory.dmp

Download

memory/1700-111-0x00000000021A0000-0x0000000002288000-memory.dmp

Download

memory/1700-109-0x0000000000400000-0x0000000000620000-memory.dmp

Download

memory/1700-110-0x0000000000400000-0x0000000000620000-memory.dmp

Download

memory/1700-108-0x0000000000400000-0x0000000000620000-memory.dmp

Download

memory/1700-103-0x00000000021A0000-0x0000000002288000-memory.dmp

Download

memory/1700-102-0x00000000021A0000-0x0000000002288000-memory.dmp

Download

memory/1700-100-0x00000000021A0000-0x0000000002288000-memory.dmp

Download

memory/1700-95-0x00000000021A0000-0x0000000002288000-memory.dmp

Download

memory/1700-116-0x00000000021A0000-0x0000000002288000-memory.dmp

Download

memory/1700-118-0x0000000000400000-0x0000000000620000-memory.dmp

Download

memory/3300-54-0x0000000000400000-0x0000000000620000-memory.dmp

Download

memory/3300-91-0x00000000021B0000-0x0000000002298000-memory.dmp

Download

memory/3300-46-0x00000000021B0000-0x0000000002298000-memory.dmp

Download

memory/3300-47-0x00000000021B0000-0x0000000002298000-memory.dmp

Download

memory/3300-44-0x00000000021B0000-0x0000000002298000-memory.dmp

Download

memory/3300-119-0x0000000000400000-0x0000000000620000-memory.dmp

Download

memory/3300-39-0x0000000000400000-0x0000000000620000-memory.dmp

Download

memory/3300-58-0x00000000021B0000-0x0000000002298000-memory.dmp

Download

memory/3300-56-0x0000000000400000-0x0000000000620000-memory.dmp

Download

memory/3300-38-0x00000000021B0000-0x0000000002298000-memory.dmp

Download

memory/3300-55-0x0000000000400000-0x0000000000620000-memory.dmp

Download

memory/3300-53-0x0000000000400000-0x0000000000620000-memory.dmp

Download

memory/3788-14-0x0000000000400000-0x0000000000620000-memory.dmp

Download

memory/3788-13-0x0000000002240000-0x0000000002328000-memory.dmp

Download

memory/3788-23-0x0000000000400000-0x0000000000620000-memory.dmp

Download

memory/3788-21-0x0000000002240000-0x0000000002328000-memory.dmp

Download

memory/3788-16-0x0000000000400000-0x0000000000620000-memory.dmp

Download

memory/3788-17-0x0000000000400000-0x0000000000620000-memory.dmp

Download

memory/3788-1-0x0000000000400000-0x0000000000620000-memory.dmp

Download

memory/3788-18-0x0000000002240000-0x0000000002328000-memory.dmp

Download

memory/3788-57-0x0000000000400000-0x0000000000620000-memory.dmp

Download

memory/3788-15-0x0000000000400000-0x0000000000620000-memory.dmp

Download

memory/3788-11-0x0000000002240000-0x0000000002328000-memory.dmp

Download

memory/3788-10-0x0000000002240000-0x0000000002328000-memory.dmp

Download

memory/3788-8-0x0000000002240000-0x0000000002328000-memory.dmp

Download

memory/3788-3-0x0000000002240000-0x0000000002328000-memory.dmp

Download

memory/3788-50-0x0000000002240000-0x0000000002328000-memory.dmp

Download

memory/3788-2-0x0000000000495000-0x0000000000496000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads