bdaejec | aef55b204ce10383ffd0ac4a3530fa68de09b27c0226a9b3743c0a4e5bca538a

Analysis

max time kernel
149s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 15:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_33adc68082c10538009a4fbdc87619fd_elex_smoke-loader_wannacry_wapomi.exe
Size 280KB
Sample260825-s93d8avera
SHA256 aef55b204ce10383ffd0ac4a3530fa68de09b27c0226a9b3743c0a4e5bca538a
MD5 33adc68082c10538009a4fbdc87619fd
SHA1 dd75ce2503f06f6afe1aebc712c9e25e8a130df8
SHA512 0b88cad5e2fa3fdc592961e23e3b3de9f04e43915370b14e49a9dd9e1692f0659ba09fa33ee60c0d52945015298d20c732a17ebd4e027def32b983edca629458
SSDEEP 3072:4OXQ2G+IpQZQneFAMx3qe8UzT+nWwXjDRJWwXjDRgjDRbL7SC7tTGCH:XvGlpQEQAMtqNUzCCtK
TLSH
T108544A82967A59D1D818CD3005A634E557EF2C1338079E57F36BFF1F28BADD0AA0E612
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

aspackv2 backdoor credential_access discovery execution bdaejec persistence spyware stealer

Malware Config

Extracted

Family

bdaejec

ddos.dnsnb8.net

Signatures

Family: Bdaejec
Bdaejec is a backdoor written in C++.
backdoor bdaejec

Detects Bdaejec Backdoor. 1 IoCs

Bdaejec is backdoor written in C++.

resource	yara_rule
behavioral2/memory/1684-28-0x0000000000CC0000-0x0000000000CC9000-memory.dmp	family_bdaejec_backdoor

Detects executables packed with ASPack 3 IoCs

resource	yara_rule
behavioral2/files/0x000b000000011377-4.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1684-5-0x0000000000CC0000-0x0000000000CC9000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1684-28-0x0000000000CC0000-0x0000000000CC9000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000b000000011377-4.dat	aspack_v212_v242

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Executes dropped EXE 5 IoCs

pid	Process
1684	ojICsc.exe
3484	wmimgmt.exe
5500	wmimgmt.exe
3760	wmimgmt.exe
5908	wmimgmt.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\wmi32 = "\"C:\\ProgramData\\Application Data\\wmimgmt.exe\""	wmimgmt.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	wmimgmt.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4760	ARP.EXE

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2420	tasklist.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3184 set thread context of 5032	3184	2026-08-24_33adc68082c10538009a4fbdc87619fd_elex_smoke-loader_wannacry_wapomi.exe	90
PID 3484 set thread context of 5500	3484	wmimgmt.exe	93
PID 3760 set thread context of 5908	3760	wmimgmt.exe	143

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	ojICsc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	ojICsc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	ojICsc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	ojICsc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	ojICsc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	ojICsc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	ojICsc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	ojICsc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	ojICsc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	ojICsc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	ojICsc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	ojICsc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	ojICsc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	ojICsc.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe	ojICsc.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	ojICsc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	ojICsc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	ojICsc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	ojICsc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	ojICsc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	ojICsc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	ojICsc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	ojICsc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	ojICsc.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe	ojICsc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	ojICsc.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	ojICsc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	ojICsc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	ojICsc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	ojICsc.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	ojICsc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	ojICsc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	ojICsc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	ojICsc.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	ojICsc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	ojICsc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	ojICsc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	ojICsc.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	ojICsc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	ojICsc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	ojICsc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	ojICsc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	ojICsc.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	ojICsc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	ojICsc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	ojICsc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	ojICsc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe	ojICsc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	ojICsc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	ojICsc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	ojICsc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	ojICsc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	ojICsc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	ojICsc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	ojICsc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	ojICsc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	ojICsc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	ojICsc.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	ojICsc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	ojICsc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	ojICsc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	ojICsc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	ojICsc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	ojICsc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4128	cmd.exe
2276	cmd.exe
3548	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 50 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmimgmt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmimgmt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-24_33adc68082c10538009a4fbdc87619fd_elex_smoke-loader_wannacry_wapomi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ROUTE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmimgmt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NETSTAT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojICsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NETSTAT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-24_33adc68082c10538009a4fbdc87619fd_elex_smoke-loader_wannacry_wapomi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ARP.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
3032	NETSTAT.EXE

Discovers systems in the same network 1 TTPs 1 IoCs

discovery

Remote System Discovery

T1018

pid	Process
5936	net.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2828	ipconfig.exe
3032	NETSTAT.EXE
3400	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4960	systeminfo.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3184	2026-08-24_33adc68082c10538009a4fbdc87619fd_elex_smoke-loader_wannacry_wapomi.exe
3184	2026-08-24_33adc68082c10538009a4fbdc87619fd_elex_smoke-loader_wannacry_wapomi.exe
3484	wmimgmt.exe
3484	wmimgmt.exe
3760	wmimgmt.exe
3760	wmimgmt.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeBackupPrivilege	5032	2026-08-24_33adc68082c10538009a4fbdc87619fd_elex_smoke-loader_wannacry_wapomi.exe
Token: SeBackupPrivilege	5032	2026-08-24_33adc68082c10538009a4fbdc87619fd_elex_smoke-loader_wannacry_wapomi.exe
Token: SeBackupPrivilege	5032	2026-08-24_33adc68082c10538009a4fbdc87619fd_elex_smoke-loader_wannacry_wapomi.exe
Token: SeRestorePrivilege	5032	2026-08-24_33adc68082c10538009a4fbdc87619fd_elex_smoke-loader_wannacry_wapomi.exe
Token: SeBackupPrivilege	5032	2026-08-24_33adc68082c10538009a4fbdc87619fd_elex_smoke-loader_wannacry_wapomi.exe
Token: SeBackupPrivilege	5032	2026-08-24_33adc68082c10538009a4fbdc87619fd_elex_smoke-loader_wannacry_wapomi.exe
Token: SeBackupPrivilege	5032	2026-08-24_33adc68082c10538009a4fbdc87619fd_elex_smoke-loader_wannacry_wapomi.exe
Token: SeRestorePrivilege	5032	2026-08-24_33adc68082c10538009a4fbdc87619fd_elex_smoke-loader_wannacry_wapomi.exe
Token: SeBackupPrivilege	5032	2026-08-24_33adc68082c10538009a4fbdc87619fd_elex_smoke-loader_wannacry_wapomi.exe
Token: SeRestorePrivilege	5032	2026-08-24_33adc68082c10538009a4fbdc87619fd_elex_smoke-loader_wannacry_wapomi.exe
Token: SeBackupPrivilege	5032	2026-08-24_33adc68082c10538009a4fbdc87619fd_elex_smoke-loader_wannacry_wapomi.exe
Token: SeRestorePrivilege	5032	2026-08-24_33adc68082c10538009a4fbdc87619fd_elex_smoke-loader_wannacry_wapomi.exe
Token: SeBackupPrivilege	5500	wmimgmt.exe
Token: SeBackupPrivilege	5500	wmimgmt.exe
Token: SeBackupPrivilege	5500	wmimgmt.exe
Token: SeRestorePrivilege	5500	wmimgmt.exe
Token: SeBackupPrivilege	5500	wmimgmt.exe
Token: SeDebugPrivilege	2420	tasklist.exe
Token: SeDebugPrivilege	3032	NETSTAT.EXE
Token: SeBackupPrivilege	5908	wmimgmt.exe
Token: SeBackupPrivilege	5908	wmimgmt.exe
Token: SeBackupPrivilege	5908	wmimgmt.exe
Token: SeRestorePrivilege	5908	wmimgmt.exe
Token: SeBackupPrivilege	5908	wmimgmt.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3184	2026-08-24_33adc68082c10538009a4fbdc87619fd_elex_smoke-loader_wannacry_wapomi.exe
3184	2026-08-24_33adc68082c10538009a4fbdc87619fd_elex_smoke-loader_wannacry_wapomi.exe
3484	wmimgmt.exe
3484	wmimgmt.exe
3760	wmimgmt.exe
3760	wmimgmt.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 1684	3184	2026-08-24_33adc68082c10538009a4fbdc87619fd_elex_smoke-loader_wannacry_wapomi.exe	88
PID 3184 wrote to memory of 5032	3184	2026-08-24_33adc68082c10538009a4fbdc87619fd_elex_smoke-loader_wannacry_wapomi.exe	90
PID 3184 wrote to memory of 5032	3184	2026-08-24_33adc68082c10538009a4fbdc87619fd_elex_smoke-loader_wannacry_wapomi.exe	90
PID 5032 wrote to memory of 3484	5032	2026-08-24_33adc68082c10538009a4fbdc87619fd_elex_smoke-loader_wannacry_wapomi.exe	92
PID 3484 wrote to memory of 5500	3484	wmimgmt.exe	93
PID 3484 wrote to memory of 5500	3484	wmimgmt.exe	93
PID 5500 wrote to memory of 4128	5500	wmimgmt.exe	94
PID 4128 wrote to memory of 4888	4128	cmd.exe	96
PID 4128 wrote to memory of 124	4128	cmd.exe	97
PID 4128 wrote to memory of 260	4128	cmd.exe	98
PID 260 wrote to memory of 5308	260	net.exe	99
PID 4128 wrote to memory of 5168	4128	cmd.exe	100
PID 5168 wrote to memory of 3264	5168	net.exe	101
PID 4128 wrote to memory of 2420	4128	cmd.exe	102
PID 4128 wrote to memory of 4960	4128	cmd.exe	104
PID 4128 wrote to memory of 4712	4128	cmd.exe	106
PID 4128 wrote to memory of 3280	4128	cmd.exe	107
PID 4128 wrote to memory of 2464	4128	cmd.exe	108
PID 4128 wrote to memory of 5404	4128	cmd.exe	109
PID 4128 wrote to memory of 4080	4128	cmd.exe	110
PID 4128 wrote to memory of 2604	4128	cmd.exe	111
PID 4128 wrote to memory of 6068	4128	cmd.exe	112
PID 4128 wrote to memory of 4212	4128	cmd.exe	113
PID 4128 wrote to memory of 5472	4128	cmd.exe	114
PID 4128 wrote to memory of 2828	4128	cmd.exe	115
PID 4128 wrote to memory of 3032	4128	cmd.exe	116
PID 4128 wrote to memory of 4760	4128	cmd.exe	117
PID 4128 wrote to memory of 3400	4128	cmd.exe	118
PID 3400 wrote to memory of 2276	3400	NETSTAT.EXE	119
PID 2276 wrote to memory of 2536	2276	cmd.exe	120
PID 4128 wrote to memory of 464	4128	cmd.exe	121
PID 464 wrote to memory of 2432	464	net.exe	122
PID 4128 wrote to memory of 4664	4128	cmd.exe	123
PID 4128 wrote to memory of 4084	4128	cmd.exe	124
PID 4128 wrote to memory of 3232	4128	cmd.exe	125
PID 3232 wrote to memory of 5376	3232	net.exe	126
PID 4128 wrote to memory of 5936	4128	cmd.exe	127
PID 4128 wrote to memory of 4916	4128	cmd.exe	128
PID 4128 wrote to memory of 3244	4128	cmd.exe	129
PID 4128 wrote to memory of 4072	4128	cmd.exe	130
PID 4128 wrote to memory of 1772	4128	cmd.exe	131
PID 4128 wrote to memory of 2424	4128	cmd.exe	132
PID 4128 wrote to memory of 1004	4128	cmd.exe	133
PID 4128 wrote to memory of 2384	4128	cmd.exe	134
PID 4128 wrote to memory of 2596	4128	cmd.exe	135
PID 4128 wrote to memory of 4728	4128	cmd.exe	136
PID 4128 wrote to memory of 1444	4128	cmd.exe	137
PID 4128 wrote to memory of 5380	4128	cmd.exe	138
PID 4128 wrote to memory of 2592	4128	cmd.exe	139
PID 3760 wrote to memory of 5908	3760	wmimgmt.exe	143
PID 3760 wrote to memory of 5908	3760	wmimgmt.exe	143
PID 1684 wrote to memory of 3548	1684	ojICsc.exe	145

C:\Users\Admin\AppData\Local\Temp\2026-08-24_33adc68082c10538009a4fbdc87619fd_elex_smoke-loader_wannacry_wapomi.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_33adc68082c10538009a4fbdc87619fd_elex_smoke-loader_wannacry_wapomi.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Users\Admin\AppData\Local\Temp\ojICsc.exe
  C:\Users\Admin\AppData\Local\Temp\ojICsc.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4ee51e6b.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3548
- C:\Users\Admin\AppData\Local\Temp\2026-08-24_33adc68082c10538009a4fbdc87619fd_elex_smoke-loader_wannacry_wapomi.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-24_33adc68082c10538009a4fbdc87619fd_elex_smoke-loader_wannacry_wapomi.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\ProgramData\Application Data\wmimgmt.exe
    "C:\ProgramData\Application Data\wmimgmt.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3484
  - - C:\ProgramData\Application Data\wmimgmt.exe
      "C:\ProgramData\Application Data\wmimgmt.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5500
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /v:on /c "C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\ghi.bat"
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4128
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /s "YM.CGP_" "C:\Users\Admin"\..\*.txt
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4888
      - C:\Windows\SysWOW64\chcp.com
        
        chcp
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:124
      - C:\Windows\SysWOW64\net.exe
        
        net user
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:260
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5308
      - C:\Windows\SysWOW64\net.exe
        
        net localgroup administrators
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5168
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3264
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2420
      - C:\Windows\SysWOW64\systeminfo.exe
        
        systeminfo
        6⤵
        System Location Discovery: System Language Discovery
        Gathers system information
        
        PID:4960
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4712
      - C:\Windows\SysWOW64\find.exe
        
        find "REG_"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3280
      - C:\Windows\SysWOW64\reg.exe
        
        reg query HKEY_CURRENT_USER\Software\Microsoft\Office
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2464
      - C:\Windows\SysWOW64\reg.exe
        
        reg query HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Common\UserInfo
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5404
      - C:\Windows\SysWOW64\reg.exe
        
        reg query HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Common\UserInfo
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4080
      - C:\Windows\SysWOW64\reg.exe
        
        reg query HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Common\UserInfo
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2604
      - C:\Windows\SysWOW64\reg.exe
        
        reg query HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Common\UserInfo
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6068
      - C:\Windows\SysWOW64\reg.exe
        
        reg query HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\UserInfo
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4212
      - C:\Windows\SysWOW64\reg.exe
        
        reg query HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Common\UserInfo
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5472
      - C:\Windows\SysWOW64\ipconfig.exe
        
        ipconfig /all
        6⤵
        System Location Discovery: System Language Discovery
        Gathers network information
        
        PID:2828
      - C:\Windows\SysWOW64\NETSTAT.EXE
        
        netstat -ano
        6⤵
        System Location Discovery: System Language Discovery
        System Network Connections Discovery
        Gathers network information
        Suspicious use of AdjustPrivilegeToken
        
        PID:3032
      - C:\Windows\SysWOW64\ARP.EXE
        
        arp -a
        6⤵
        Network Service Discovery
        System Location Discovery: System Language Discovery
        
        PID:4760
      - C:\Windows\SysWOW64\NETSTAT.EXE
        
        netstat -r
        6⤵
        System Location Discovery: System Language Discovery
        Gathers network information
        Suspicious use of WriteProcessMemory
        
        PID:3400
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
        7⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2276
        
        C:\Windows\SysWOW64\ROUTE.EXE
        
        C:\Windows\system32\route.exe print
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2536
      - C:\Windows\SysWOW64\net.exe
        
        net start
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:464
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2432
      - C:\Windows\SysWOW64\net.exe
        
        net use
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4664
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo n"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4084
      - C:\Windows\SysWOW64\net.exe
        
        net share
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3232
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 share
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5376
      - C:\Windows\SysWOW64\net.exe
        
        net view /domain
        6⤵
        System Location Discovery: System Language Discovery
        Discovers systems in the same network
        
        PID:5936
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\s.log "
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4916
      - C:\Windows\SysWOW64\find.exe
        
        find /i /v "------"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3244
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\t.log "
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4072
      - C:\Windows\SysWOW64\find.exe
        
        find /i /v "domain"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1772
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\s.log "
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2424
      - C:\Windows\SysWOW64\find.exe
        
        find /i /v "¬A╛╣"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1004
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\t.log "
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2384
      - C:\Windows\SysWOW64\find.exe
        
        find /i /v "░⌡ªµª¿"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2596
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\s.log "
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4728
      - C:\Windows\SysWOW64\find.exe
        
        find /i /v "├ⁿ┴ε"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1444
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\t.log "
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5380
      - C:\Windows\SysWOW64\find.exe
        
        find /i /v "completed successfully"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2592

C:\ProgramData\Application Data\wmimgmt.exe
"C:\ProgramData\Application Data\wmimgmt.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3760
- C:\ProgramData\Application Data\wmimgmt.exe
  "C:\ProgramData\Application Data\wmimgmt.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 31KB
SHA256 1528aa866aa37591714e2fff8108aa89f19920c6e933b0b7bcafe01311fb6db1
MD5 b663d2fa83a2b91e2e3b99eecc9fdd1c
SHA1 9bce42a53a8d8ed7f3cf87af7678a145679b9cdd
SHA512 318750c79bac1ff7d54afced07ceb8c6fc614703d8fb255161dadf56ac6b676ae6cde397fb796d0bae39352772468a92bd44f2e2d18b81056bf7e6142b96f0fb
SSDEEP 768:6WQ3655Kv1KjqY1MNHhTQGPL4vzZq2o9W7GsxBbPr:6HqaN6qHhEGCq2iW7z
TLSH
T16BE28D53CF9054F6F7EF253160FA3A478AB7AD2089A4EE5F83707A9D1C34600E866257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmimgmt.exe

Path C:\ProgramData\wmimgmt.exe
Size 280KB
SHA256 aef55b204ce10383ffd0ac4a3530fa68de09b27c0226a9b3743c0a4e5bca538a
MD5 33adc68082c10538009a4fbdc87619fd
SHA1 dd75ce2503f06f6afe1aebc712c9e25e8a130df8
SHA512 0b88cad5e2fa3fdc592961e23e3b3de9f04e43915370b14e49a9dd9e1692f0659ba09fa33ee60c0d52945015298d20c732a17ebd4e027def32b983edca629458
SSDEEP 3072:4OXQ2G+IpQZQneFAMx3qe8UzT+nWwXjDRJWwXjDRgjDRbL7SC7tTGCH:XvGlpQEQAMtqNUzCCtK
TLSH
T108544A82967A59D1D818CD3005A634E557EF2C1338079E57F36BFF1F28BADD0AA0E612
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INFO.TXT

Path C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\INFO.TXT
Size 13KB
SHA256 6653d45301c34e0a5cab4cab0500a4c1a8653f31a0a86e3d7e475ccbc9a20932
MD5 5ff9c59b7da5e51e5af64e403be86de6
SHA1 a3c29c95801c9e5cca730178bca3ab91f5bd2a17
SHA512 474389d7e54dfa33ca6ce3284886c085eed5c446288d2f03ac7eef39960950ee66cc0c63107185d97dba75804570304cd1f1d262e5fca4a93762006a7661a88a
SSDEEP 384:nDQVhyUeCccnWLxrcOhr3p0ff0PfFEfw/PbLPVOCNqSOk0KSafzYxjDTWKXMXJVz:8jeCccnWLxrcOhr3p0ff0PfFEfw/TLPR
TLSH
T1A952DE408C9F81F8A51DE3993A134002F79A614631AA6EE936CD459C7BE1F1CD3EF9B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INFO.TXT

Path C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\INFO.TXT
Size 34.2MB
SHA256 66ea68249861ccf26ed062558de04455c7b4cb03df12e7da0bb05786e9303499
MD5 6fd8cb6d27d245f35dbd778d7965d964
SHA1 e77df52e6454b230d2ee42193c9e4f6015c7e254
SHA512 0642183024365cb709b67f81defd40544a23a4f4a6ba48f0cf2551ca1fe5a503bbcad981dc3a7f09b881c74c01fbbc270e3e12db179df6232fcf3fda0581dd5f
SSDEEP 49152:yb6qvlisgZgvmVfNxFYEaVPL1iZg/OVylzImSwkToyHnAI+RkIPjBy/nWkByPtsm:ajBz
TLSH
T1EA771F0BCAEAC9D58913E51213354DF3E29E2963620E8D1877EC134A0BF3167779D9B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.p

Path C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\drivers.p
Size 15B
SHA256 d8a21e76d208e48198b4afa4a54157044255e074acd5c25f99d9894ad70fbde2
MD5 48290ef0f324cf793b4f7ef936ddf34a
SHA1 ff77d5f263909066a61c89ead0764f6167dc3b16
SHA512 e32bd98f8ca5ceb6d90fde670c8a8a02d841745083040ced0dc5492ed0cdb7eb0bda3cd0a0a101e374a25ba0227991e545be7d41a114c591a7c5f6025d2f6eac
MD5 SHA1 SHA512

Submit Download

ghi.bat

Path C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\ghi.bat
Size 3KB
SHA256 1ebd7eae014cf21830a64f251bf768e2935fa3de5223dcb86f3e69dc88c384c8
MD5 58a64905608130d77188e612e3972897
SHA1 fd2c205c16330cbd77bf3c4ffa8db0e0f245db49
SHA512 288968fbce883e1ec8ba764ed9e82aa9712d1390a8aa98c9f4c7a45247be59825b981c3236e309c5bbff5d075998b406e0a1c049ecb035b58668a1f3354020fe
TLSH
T1AE6100077C5C080B0D75015ADB89B85532EDC2C3D24E26A7254ED2B6F6A935883B4ECE
MD5 SHA1 SHA512 TLSH

Submit Download

k2[1].rar

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7IWVBK5J\k2[1].rar
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

INFO.TXT

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\INFO.TXT
Size 43B
SHA256 b2840ff0d2b05f1e154219c908fe3d03b0c2e540ad35e353a9d043c3261236bf
MD5 ab1eb4d67f1ceb88e99fe327d58989f3
SHA1 40e381dadf147ec1d8cdb1bb4af404299f4286a3
SHA512 04a7610914e9df6cf3bf79e99b5172dbb1cfeacc0b212010b4cb5add285a727f63ecc12459dbae08b1c71ff3c1a9bd0e0057988fcbe2d88aaad759c85c2d4958
MD5 SHA1 SHA512

Submit Download

16932136.exe

Path C:\Users\Admin\AppData\Local\Temp\16932136.exe
Size 1B
SHA256 08f271887ce94707da822d5263bae19d5519cb3614e0daedc4c7ce5dab7473f1
MD5 69691c7bdcc3ce6d5d8a1361f22d04ac
SHA1 c63ae6dd4fc9f9dda66970e827d13f7c73fe841c
SHA512 253405e03b91441a6dd354a9b72e040068b1bfe10e83eb1a64a086c05525d8ccae2bf09130c624af50d55c3522a4fbb7c18cfc8dd843e5f4801d9ad2b5164b12
MD5 SHA1 SHA512

Submit Download

4ee51e6b.bat

Path C:\Users\Admin\AppData\Local\Temp\4ee51e6b.bat
Size 187B
SHA256 b28b049ca26b48b9c6666e5786dc0e7255394d17937c172de09221ac991bd3b5
MD5 21e0292a629f1abffab49c3e9bcea587
SHA1 52bb29704dd785d4111080d00a4fea4227dc5faf
SHA512 7be4b64547d35d767ecb956dd711d38f945fe5a8d6e1bf4e3079563e4eb1c15c28f9655e6e5bce6f36987e330f835852ced34fc33b363fba17b0c454c770fe05
TLSH
T158C0126282D7DBB99455502B16E5628DD07508693F492B266B20845C61D680DF5C3701
MD5 SHA1 SHA512 TLSH

Submit Download

ojICsc.exe

Path C:\Users\Admin\AppData\Local\Temp\ojICsc.exe
Size 15KB
SHA256 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
MD5 56b2c3810dba2e939a8bb9fa36d3cf96
SHA1 99ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA512 27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
SSDEEP 384:7XZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:1QGPL4vzZq2o9W7GsxBbPr
TLSH
T10B62BFB34EC098FFC4CD353340823687CB7B4670DABA617F826288372895E19AC55595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1684-28-0x0000000000CC0000-0x0000000000CC9000-memory.dmp

Download

memory/1684-5-0x0000000000CC0000-0x0000000000CC9000-memory.dmp

Download

memory/3184-8-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/3184-0-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/3484-12-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/3760-46-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/5032-10-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5500-43-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5500-49-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5500-67-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5500-69-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5500-71-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5500-38-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5500-79-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5500-84-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5500-90-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5500-36-0x0000000000400000-0x0000000000424000-memory.dmp

Download