Overview

overview

10

Static

static

3

2026-04-25...ry.exe

windows10-2004-x64

10

2026-04-25...ry.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    33s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    25/04/2026, 13:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-25_c2977e79c271b993f328268000d6f73c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe
  • Size 2.1MB
  • Sample260425-qh5ddsav5x
  • SHA256 c5daa22f73910f90fb5e9e3ce0d4f127fc11ace295e791c5d2c44ab19cce4000
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarebackdoordefense_evasiondiscoverysalitypersistencespywaretrojanupx

Malware Config

Extracted

Family

  • sality

C2

  • http://89.119.67.154/testo5/

  • http://kukutrustnet777.info/home.gif

  • http://kukutrustnet888.info/home.gif

  • http://kukutrustnet987.info/home.gif

Signatures

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies firewall policy service 3 TTPs 9 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 3 IoCs
    defense_evasiontrojan
  • Windows security bypass 2 TTPs 18 IoCs
    defense_evasiontrojan
  • Custom signature
    Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 34 IoCs
  • Custom signature
    UPX dump on OEP (original entry point) 40 IoCs
  • Disables RegEdit via registry modification 1 IoCs
    defense_evasion
  • Disables Task Manager via registry modification
    defense_evasion
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 2 IoCs
  • Windows security modification 2 TTPs 21 IoCs
    defense_evasiontrojan
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 6 IoCs
  • UPX packed file 35 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 3 IoCs
    defense_evasion

Processes

  • C:\Windows\system32\fontdrvhost.exe
    "fontdrvhost.exe"
    1⤵
      PID:780
    • C:\Windows\system32\fontdrvhost.exe
      "fontdrvhost.exe"
      1⤵
        PID:788
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        1⤵
          PID:448
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
            PID:2956
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
            1⤵
              PID:3020
            • C:\Windows\system32\taskhostw.exe
              taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
              1⤵
                PID:2876
              • C:\Windows\Explorer.EXE
                C:\Windows\Explorer.EXE
                1⤵
                  PID:3232
                  • C:\Users\Admin\AppData\Local\Temp\2026-04-25_c2977e79c271b993f328268000d6f73c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-04-25_c2977e79c271b993f328268000d6f73c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe"
                    2⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:4940
                    • C:\Windows\SysWOW64\explorer.exe
                      explorer.exe
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:1768
                      • C:\Users\Admin\AppData\Local\Temp\@AE78D.tmp.exe
                        "C:\Users\Admin\AppData\Local\Temp\@AE78D.tmp.exe"
                        4⤵
                        • Modifies firewall policy service
                        • UAC bypass
                        • Windows security bypass
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Windows security modification
                        • Checks whether UAC is enabled
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        • System policy modification
                        PID:4800
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat" "
                          5⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:4596
                          • C:\Windows\System32\Conhost.exe
                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            6⤵
                              PID:1452
                            • C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe
                              "C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe"
                              6⤵
                              • Modifies firewall policy service
                              • UAC bypass
                              • Windows security bypass
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Windows security modification
                              • Checks whether UAC is enabled
                              • Drops file in Windows directory
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of WriteProcessMemory
                              • System policy modification
                              PID:4604
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "
                                7⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:1628
                                • C:\Windows\System32\Conhost.exe
                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                  8⤵
                                    PID:4804
                                  • C:\Users\Admin\AppData\Roaming\Admin\module_launcher.exe
                                    "C:\Users\Admin\AppData\Roaming\Admin\module_launcher.exe" /i 4604
                                    8⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:4656
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat" "
                                      9⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:3184
                                      • C:\Users\Admin\AppData\Roaming\Admin\kb50145.exe
                                        "C:\Users\Admin\AppData\Roaming\Admin\kb50145.exe"
                                        10⤵
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:1652
                                        • C:\Users\Admin\AppData\Roaming\injector_s.exe
                                          "C:\Users\Admin\AppData\Roaming\injector_s.exe"
                                          11⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          PID:4992
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\a0x.bat" "C:\Users\Admin\AppData\Roaming\Admin\kb50145.exe" "C:\Users\Admin\AppData\Local\Temp\a0x.bat""
                                          11⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:4072
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "
                              5⤵
                              • System Location Discovery: System Language Discovery
                              PID:1732
                          • C:\Users\Admin\AppData\Local\Temp\2026-04-25_c2977e79c271b993f328268000d6f73c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-04-25_c2977e79c271b993f328268000d6f73c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe"
                            4⤵
                            • Modifies WinLogon for persistence
                            • Modifies firewall policy service
                            • UAC bypass
                            • Windows security bypass
                            • Disables RegEdit via registry modification
                            • Executes dropped EXE
                            • Windows security modification
                            • Adds Run key to start application
                            • Checks whether UAC is enabled
                            • Enumerates connected drives
                            • Drops file in System32 directory
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            • System policy modification
                            PID:3344
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /C AT /delete /yes
                              5⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:4984
                              • C:\Windows\SysWOW64\at.exe
                                AT /delete /yes
                                6⤵
                                • System Location Discovery: System Language Discovery
                                PID:4396
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\svchost .exe
                              5⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:4936
                              • C:\Windows\System32\Conhost.exe
                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                6⤵
                                  PID:4324
                                • C:\Windows\SysWOW64\at.exe
                                  AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\svchost .exe
                                  6⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:3424
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                        1⤵
                          PID:3372
                        • C:\Windows\system32\DllHost.exe
                          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                          1⤵
                            PID:3564
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:3656
                            • C:\Windows\System32\RuntimeBroker.exe
                              C:\Windows\System32\RuntimeBroker.exe -Embedding
                              1⤵
                                PID:3724
                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                1⤵
                                  PID:3812
                                • C:\Windows\System32\RuntimeBroker.exe
                                  C:\Windows\System32\RuntimeBroker.exe -Embedding
                                  1⤵
                                    PID:3996
                                  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
                                    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
                                    1⤵
                                      PID:3736
                                    • C:\Windows\explorer.exe
                                      Explorer.exe regsvr.exe
                                      1⤵
                                        PID:1176
                                      • C:\Windows\explorer.exe
                                        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                        1⤵
                                        • Modifies Internet Explorer settings
                                        • Modifies registry class
                                        • Suspicious behavior: AddClipboardFormatListener
                                        • Suspicious use of SetWindowsHookEx
                                        PID:2032
                                      • C:\Users\Admin\AppData\Roaming\Admin\module_launcher.exe
                                        "C:\Users\Admin\AppData\Roaming\Admin\module_launcher.exe"
                                        1⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:2252
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                        1⤵
                                          PID:3424

                                        Network

                                              MITRE ATT&CK Enterprise v16

                                              Reconnaissance

                                              Resource Development

                                              Initial Access

                                              Execution

                                              Persistence

                                              Boot or Logon Autostart Execution

                                              2
                                              T1547

                                              Registry Run Keys / Startup Folder

                                              1
                                              T1547.001

                                              Winlogon Helper DLL

                                              1
                                              T1547.004

                                              Create or Modify System Process

                                              1
                                              T1543

                                              Windows Service

                                              1
                                              T1543.003

                                              Privilege Escalation

                                              Abuse Elevation Control Mechanism

                                              1
                                              T1548

                                              Bypass User Account Control

                                              1
                                              T1548.002

                                              Boot or Logon Autostart Execution

                                              2
                                              T1547

                                              Registry Run Keys / Startup Folder

                                              1
                                              T1547.001

                                              Winlogon Helper DLL

                                              1
                                              T1547.004

                                              Create or Modify System Process

                                              1
                                              T1543

                                              Windows Service

                                              1
                                              T1543.003

                                              Defense Evasion

                                              Abuse Elevation Control Mechanism

                                              1
                                              T1548

                                              Bypass User Account Control

                                              1
                                              T1548.002

                                              Impair Defenses

                                              4
                                              T1562

                                              Disable or Modify System Firewall

                                              1
                                              T1562.004

                                              Disable or Modify Tools

                                              3
                                              T1562.001

                                              Modify Registry

                                              8
                                              T1112

                                              Credential Access

                                              Discovery

                                              Peripheral Device Discovery

                                              1
                                              T1120

                                              Query Registry

                                              2
                                              T1012

                                              System Information Discovery

                                              4
                                              T1082

                                              System Location Discovery

                                              1
                                              T1614

                                              System Language Discovery

                                              1
                                              T1614.001

                                              Lateral Movement

                                              Collection

                                              Command and Control

                                              Exfiltration

                                              Impact

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              @AE78D.tmp.exe
                                              • Path C:\Users\Admin\AppData\Local\Temp\0E580A5B_Rar\@AE78D.tmp.exe
                                              • Size 980KB
                                              • SHA256 200fb24764de7237bb71a4b8b63c407788a7e9d4220d8c4b794d070234f1d8b7
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              WdExt.exe
                                              • Path C:\Users\Admin\AppData\Local\Temp\0E582B51_Rar\WdExt.exe
                                              • Size 980KB
                                              • SHA256 30074a34ebe37ebc102a85203607cecba9393af500a03da5bb8ad0c68d1fcac5
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              2026-04-25_c2977e79c271b993f328268000d6f73c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe
                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-04-25_c2977e79c271b993f328268000d6f73c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe
                                              • Size 1.1MB
                                              • SHA256 32bc6c1e20df68204fc95a7941b29eff61d0f97eb51e2f6bbee5e2f365761c5c
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              @AE78D.tmp.exe
                                              • Path C:\Users\Admin\AppData\Local\Temp\@AE78D.tmp.exe
                                              • Size 1.0MB
                                              • SHA256 26348624236d395b09eaf21ba8246ef86c77fdeacfbccf82d6358b08791e02ec
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              a0x.bat
                                              • Path C:\Users\Admin\AppData\Local\Temp\a0x.bat
                                              • Size 44B
                                              • SHA256 b1e4990bf84c402594a53a2a98011b8880239e790872de1f6c7b8b9cd1005cf5
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              gtgefx.exe
                                              • Path C:\Users\Admin\AppData\Local\Temp\gtgefx.exe
                                              • Size 65KB
                                              • SHA256 811773c1a3582aa9cd1fe56db0f044c7515afe6351370c1d91304d17149d5f1b
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              tmp2BFE.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\tmp2BFE.tmp
                                              • Size 121KB
                                              • SHA256 e1a25be30164e6aca9bf97454be217f2b49e6f65fa4d3ac710637f6ef8a213a0
                                              • MD5 SHA1 SHA512 SSDEEP
                                              Submit Download

                                              tmp2C0E.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\tmp2C0E.tmp
                                              • Size 131KB
                                              • SHA256 ba6a7655e3860d01201ffbce06398dff71fd97acff99e95ac8cd2a3e3161d1c0
                                              • MD5 SHA1 SHA512 SSDEEP
                                              Submit Download

                                              tmp2C0F.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\tmp2C0F.tmp
                                              • Size 99KB
                                              • SHA256 4a8ea33966592b337d31802f55ea7f901caec037b5b1bf18a9e2b6b044915781
                                              • MD5 SHA1 SHA512 SSDEEP
                                              Submit Download

                                              tmp2C20.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\tmp2C20.tmp
                                              • Size 172KB
                                              • SHA256 015caba690febdd5403ad86a04bb9763db7408a3b3f0be85f9c364580dac4649
                                              • MD5 SHA1 SHA512 SSDEEP
                                              Submit Download

                                              tmp2C31.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\tmp2C31.tmp
                                              • Size 76KB
                                              • SHA256 a1d30db63fcb26cfcc1e128f4b840ac1c822267a8f17de45cc2e2fc19147e41f
                                              • MD5 SHA1 SHA512 SSDEEP
                                              Submit Download

                                              WdExt.exe
                                              • Path C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe
                                              • Size 1.0MB
                                              • SHA256 ceffd92241b84d37164581dc6d82ebd7c218479a99d78ca25b8a07fb2024c78a
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              kb50145.exe
                                              • Path C:\Users\Admin\AppData\Roaming\Admin\kb50145.exe
                                              • Size 76KB
                                              • SHA256 048655d212b269073107e4636125ceeea262acce1d364fc512a0cc8f4783dcf7
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              module_launcher.exe
                                              • Path C:\Users\Admin\AppData\Roaming\Admin\module_launcher.exe
                                              • Size 172KB
                                              • SHA256 b4febd6c6fc42b7d86b575f6c44f0d49fbe9ec02e98d3be00cb26b3e32a3a6d1
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              Admin0.bat
                                              • Path C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat
                                              • Size 105B
                                              • SHA256 ff5e923c453d3d61a7989b2b0f978b0bba924a7052667311c9eed54852a20cfd
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              Admin1.bat
                                              • Path C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat
                                              • Size 122B
                                              • SHA256 09dab2dc8106cfb4f8eb6f5790b9bbb6dc5dc04dcc105b9f5ecb69fe6b29bf6d
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              Admin1.bat
                                              • Path C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat
                                              • Size 194B
                                              • SHA256 188be5693c884165d9721303c8be3f10d92cd0750feae3fa2f42c5dbb68f3a83
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              Admin2.bat
                                              • Path C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat
                                              • Size 107B
                                              • SHA256 bf1b95975082845d3d9d8948999d69d666dfe50d741a36cdf81fa180fa4c777b
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              mydll.dll
                                              • Path C:\Users\Admin\AppData\Roaming\Temp\mydll.dll
                                              • Size 388KB
                                              • SHA256 93db7c9699594caa19490280842fbebec3877278c92128b92e63d75fcd01397a
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              mydll.dll
                                              • Path C:\Users\Admin\AppData\Roaming\Temp\mydll.dll
                                              • Size 388KB
                                              • SHA256 9b3b260eafe7de948e020510694b1c45538e4003c5c6e72ff334e676a56c1c6b
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              mydll.dll
                                              • Path C:\Users\Admin\AppData\Roaming\Temp\mydll.dll
                                              • Size 388KB
                                              • SHA256 89940446e66d5dad8f577e4011eea4b7a794de2e0d4b21eb1e4b3304e3746e1f
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              injector_s.exe
                                              • Path C:\Users\Admin\AppData\Roaming\injector_s.exe
                                              • Size 188KB
                                              • SHA256 22c5c5bcb256c1dcaead463c92a70107ba1bac40564fe1e7d46594c6a3936778
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              SYSTEM.INI
                                              • Path C:\Windows\SYSTEM.INI
                                              • Size 257B
                                              • SHA256 e6a9c92eafff0a7204e8941892ed99e1f92fbc197f8ab0a27b2b4ad5b2a022be
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              enxi.exe
                                              • Path F:\enxi.exe
                                              • Size 97KB
                                              • SHA256 177819e42e5974e2e689b7d491f397094f444a1d5492fa9ed6f9a152a7d81705
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              memory/1176-387-0x0000000000EC0000-0x0000000000F2B000-memory.dmp
                                              Download

                                              memory/1628-1034-0x0000000000670000-0x0000000000672000-memory.dmp
                                              Download

                                              memory/1628-1022-0x00000000007E0000-0x00000000007E1000-memory.dmp
                                              Download

                                              memory/1768-311-0x0000000000F80000-0x0000000000F8D000-memory.dmp
                                              Download

                                              memory/1768-309-0x0000000000780000-0x000000000078B000-memory.dmp
                                              Download

                                              memory/1768-310-0x0000000000F40000-0x0000000000F64000-memory.dmp
                                              Download

                                              memory/2032-1037-0x0000000001160000-0x00000000011CB000-memory.dmp
                                              Download

                                              memory/3184-1047-0x0000000000D80000-0x0000000000D81000-memory.dmp
                                              Download

                                              memory/3344-1031-0x0000000004B00000-0x0000000005BBA000-memory.dmp
                                              Download

                                              memory/3344-1040-0x0000000004B00000-0x0000000005BBA000-memory.dmp
                                              Download

                                              memory/3344-1029-0x0000000004B00000-0x0000000005BBA000-memory.dmp
                                              Download

                                              memory/3344-1032-0x0000000004B00000-0x0000000005BBA000-memory.dmp
                                              Download

                                              memory/3344-1019-0x0000000004B00000-0x0000000005BBA000-memory.dmp
                                              Download

                                              memory/3344-1018-0x0000000004B00000-0x0000000005BBA000-memory.dmp
                                              Download

                                              memory/3344-1017-0x0000000004B00000-0x0000000005BBA000-memory.dmp
                                              Download

                                              memory/3344-1015-0x0000000004B00000-0x0000000005BBA000-memory.dmp
                                              Download

                                              memory/3344-1016-0x0000000004B00000-0x0000000005BBA000-memory.dmp
                                              Download

                                              memory/3344-1208-0x0000000000400000-0x0000000000527000-memory.dmp
                                              Download

                                              memory/3344-1010-0x0000000000400000-0x0000000000527000-memory.dmp
                                              Download

                                              memory/3344-27-0x0000000000400000-0x0000000000527000-memory.dmp
                                              Download

                                              memory/3344-1033-0x0000000004B00000-0x0000000005BBA000-memory.dmp
                                              Download

                                              memory/3344-1036-0x0000000000400000-0x0000000000527000-memory.dmp
                                              Download

                                              memory/3344-1039-0x0000000004B00000-0x0000000005BBA000-memory.dmp
                                              Download

                                              memory/3344-306-0x0000000000A00000-0x0000000000A01000-memory.dmp
                                              Download

                                              memory/3344-1020-0x0000000004B00000-0x0000000005BBA000-memory.dmp
                                              Download

                                              memory/3344-340-0x00000000009A0000-0x00000000009A2000-memory.dmp
                                              Download

                                              memory/4596-694-0x0000000001070000-0x0000000001072000-memory.dmp
                                              Download

                                              memory/4596-640-0x0000000001080000-0x0000000001081000-memory.dmp
                                              Download

                                              memory/4596-1012-0x0000000001070000-0x0000000001072000-memory.dmp
                                              Download

                                              memory/4604-412-0x0000000002250000-0x000000000330A000-memory.dmp
                                              Download

                                              memory/4604-407-0x0000000002250000-0x000000000330A000-memory.dmp
                                              Download

                                              memory/4604-994-0x0000000000590000-0x0000000000592000-memory.dmp
                                              Download

                                              memory/4604-398-0x0000000002250000-0x000000000330A000-memory.dmp
                                              Download

                                              memory/4604-401-0x0000000002250000-0x000000000330A000-memory.dmp
                                              Download

                                              memory/4604-644-0x0000000000630000-0x0000000000631000-memory.dmp
                                              Download

                                              memory/4604-402-0x0000000002250000-0x000000000330A000-memory.dmp
                                              Download

                                              memory/4604-403-0x0000000002250000-0x000000000330A000-memory.dmp
                                              Download

                                              memory/4604-693-0x0000000000590000-0x0000000000592000-memory.dmp
                                              Download

                                              memory/4604-400-0x0000000002250000-0x000000000330A000-memory.dmp
                                              Download

                                              memory/4604-997-0x0000000002250000-0x000000000330A000-memory.dmp
                                              Download

                                              memory/4604-406-0x0000000002250000-0x000000000330A000-memory.dmp
                                              Download

                                              memory/4604-405-0x0000000002250000-0x000000000330A000-memory.dmp
                                              Download

                                              memory/4604-1011-0x0000000000400000-0x000000000044C000-memory.dmp
                                              Download

                                              memory/4604-404-0x0000000002250000-0x000000000330A000-memory.dmp
                                              Download

                                              memory/4656-1024-0x0000000002A30000-0x0000000002A31000-memory.dmp
                                              Download

                                              memory/4656-1030-0x0000000002130000-0x0000000002132000-memory.dmp
                                              Download

                                              memory/4656-990-0x0000000010000000-0x0000000010015000-memory.dmp
                                              Download

                                              memory/4656-1048-0x0000000002130000-0x0000000002132000-memory.dmp
                                              Download

                                              memory/4800-384-0x00000000008D0000-0x00000000008D2000-memory.dmp
                                              Download

                                              memory/4800-354-0x00000000021D0000-0x000000000328A000-memory.dmp
                                              Download

                                              memory/4800-12-0x0000000000400000-0x000000000044C000-memory.dmp
                                              Download

                                              memory/4800-21-0x00000000021D0000-0x000000000328A000-memory.dmp
                                              Download

                                              memory/4800-379-0x00000000021D0000-0x000000000328A000-memory.dmp
                                              Download

                                              memory/4800-357-0x00000000021D0000-0x000000000328A000-memory.dmp
                                              Download

                                              memory/4800-392-0x0000000000400000-0x000000000044C000-memory.dmp
                                              Download

                                              memory/4800-356-0x00000000021D0000-0x000000000328A000-memory.dmp
                                              Download

                                              memory/4800-355-0x00000000021D0000-0x000000000328A000-memory.dmp
                                              Download

                                              memory/4800-29-0x0000000010000000-0x0000000010015000-memory.dmp
                                              Download

                                              memory/4800-346-0x00000000021D0000-0x000000000328A000-memory.dmp
                                              Download

                                              memory/4800-307-0x00000000021D0000-0x000000000328A000-memory.dmp
                                              Download

                                              memory/4800-303-0x00000000008D0000-0x00000000008D2000-memory.dmp
                                              Download

                                              memory/4800-308-0x00000000021D0000-0x000000000328A000-memory.dmp
                                              Download

                                              memory/4800-339-0x00000000008D0000-0x00000000008D2000-memory.dmp
                                              Download

                                              memory/4800-28-0x00000000021D0000-0x000000000328A000-memory.dmp
                                              Download

                                              memory/4800-25-0x00000000021D0000-0x000000000328A000-memory.dmp
                                              Download

                                              memory/4800-304-0x0000000003690000-0x0000000003691000-memory.dmp
                                              Download

                                              memory/4800-26-0x00000000021D0000-0x000000000328A000-memory.dmp
                                              Download

                                              memory/4936-695-0x0000000001340000-0x0000000001342000-memory.dmp
                                              Download

                                              memory/4936-726-0x0000000001340000-0x0000000001342000-memory.dmp
                                              Download

                                              memory/4936-642-0x0000000001350000-0x0000000001351000-memory.dmp
                                              Download

                                              memory/4940-0-0x0000000000400000-0x0000000000527000-memory.dmp
                                              Download

                                              memory/4940-1-0x0000000000400000-0x0000000000527000-memory.dmp
                                              Download