Analysis
- max time kernel
149s - max time network
143s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/06/2026, 12:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-04_062fecf04d60bd4f63a587c09410e9e1_elex_floxif_rhadamanthys_stop_tofsee.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
19 signatures
150 seconds
General
- Target 2026-06-04_062fecf04d60bd4f63a587c09410e9e1_elex_floxif_rhadamanthys_stop_tofsee.exe
- Size 2.6MB
- Sample260604-pza1faey7s
- SHA256 b469cb1dbcac68cccd9e60551c42583bf9b96641c053051a4c01e3a36e19bd35
- MD5 062fecf04d60bd4f63a587c09410e9e1
- SHA1 5ce6763b19e82044bba970fcd3261dbb58fdb388
- SHA512 bb4a353895b336d1e8721ce7b7246647abd167bee10a9b003cfc1342ae6c4ab51696e7401c57c3026eba7ace26a8bb4c301bfd9c2751a2f14fbab1330cc5403f
- SSDEEP 49152:QTRR0i90cyIw/wj3ka4NSV9dvLWqbURdk/qy3pvY2dPLUBIIOpyZP1QpA:+0i90TIc4UJSpvLWdQZ3pvtdPw2IOpyf
- TLSH T1B3C5236336C4D7FAD825613068554526AAB4BC3F0B6486DFF328772E0F7D2969D3830A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Floxif payload 1 IoCs
resource yara_rule behavioral2/files/0x001700000002601f-1.dat floxif - Custom signatureUPX dump on OEP (original entry point) 6 IoCs
resource yara_rule behavioral2/files/0x001700000002601f-1.dat UPX behavioral2/memory/2108-3-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral2/memory/2108-85-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral2/memory/2108-90-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral2/memory/2108-94-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral2/memory/2108-99-0x0000000010000000-0x0000000010030000-memory.dmp UPX - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x001700000002601f-1.dat acprotect - Executes dropped EXE 3 IoCs
pid Process 2764 usb-redirector-customer-module-gui.exe 4124 usbredirectortechcsrv.exe 4984 ttechpnptls.sys - Loads dropped DLL 1 IoCs
pid Process 2108 2026-06-04_062fecf04d60bd4f63a587c09410e9e1_elex_floxif_rhadamanthys_stop_tofsee.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: 2026-06-04_062fecf04d60bd4f63a587c09410e9e1_elex_floxif_rhadamanthys_stop_tofsee.exe - Drops file in System32 directory 16 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\Temp\{1096098c-96fb-904b-bd38-fed695ca89af}\SET53A9.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1096098c-96fb-904b-bd38-fed695ca89af}\amd64 DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{1096098c-96fb-904b-bd38-fed695ca89af}\SET53A9.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1096098c-96fb-904b-bd38-fed695ca89af}\SET53AA.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{1096098c-96fb-904b-bd38-fed695ca89af}\SET53AA.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1096098c-96fb-904b-bd38-fed695ca89af}\amd64\ttechusbd.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ttechusbd.inf_amd64_883118eaf0a296fc\ttechusbd.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1096098c-96fb-904b-bd38-fed695ca89af}\amd64\SET53BB.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ttechusbd.inf_amd64_883118eaf0a296fc\ttechusbd.inf DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1096098c-96fb-904b-bd38-fed695ca89af} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1096098c-96fb-904b-bd38-fed695ca89af}\ttechusbd.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1096098c-96fb-904b-bd38-fed695ca89af}\ttechusbd.inf DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{1096098c-96fb-904b-bd38-fed695ca89af}\amd64\SET53BB.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ttechusbd.inf_amd64_883118eaf0a296fc\amd64\ttechusbd.sys DrvInst.exe -
resource yara_rule behavioral2/files/0x001700000002601f-1.dat upx behavioral2/memory/2108-3-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/2108-85-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/2108-90-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/2108-94-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/2108-99-0x0000000010000000-0x0000000010030000-memory.dmp upx - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\System\symsrv.dll 2026-06-04_062fecf04d60bd4f63a587c09410e9e1_elex_floxif_rhadamanthys_stop_tofsee.exe File created \??\c:\program files\common files\system\symsrv.dll.000 2026-06-04_062fecf04d60bd4f63a587c09410e9e1_elex_floxif_rhadamanthys_stop_tofsee.exe - Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log usb-redirector-customer-module-gui.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\inf\oem3.inf DrvInst.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-04_062fecf04d60bd4f63a587c09410e9e1_elex_floxif_rhadamanthys_stop_tofsee.exe - Checks SCSI registry key(s) 3 TTPs 26 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags svchost.exe - Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2108 2026-06-04_062fecf04d60bd4f63a587c09410e9e1_elex_floxif_rhadamanthys_stop_tofsee.exe 2108 2026-06-04_062fecf04d60bd4f63a587c09410e9e1_elex_floxif_rhadamanthys_stop_tofsee.exe 2108 2026-06-04_062fecf04d60bd4f63a587c09410e9e1_elex_floxif_rhadamanthys_stop_tofsee.exe 2108 2026-06-04_062fecf04d60bd4f63a587c09410e9e1_elex_floxif_rhadamanthys_stop_tofsee.exe 2108 2026-06-04_062fecf04d60bd4f63a587c09410e9e1_elex_floxif_rhadamanthys_stop_tofsee.exe 2108 2026-06-04_062fecf04d60bd4f63a587c09410e9e1_elex_floxif_rhadamanthys_stop_tofsee.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 680 Process not Found - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2108 2026-06-04_062fecf04d60bd4f63a587c09410e9e1_elex_floxif_rhadamanthys_stop_tofsee.exe Token: SeAuditPrivilege 2652 svchost.exe Token: SeSecurityPrivilege 2652 svchost.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2764 usb-redirector-customer-module-gui.exe 2764 usb-redirector-customer-module-gui.exe 2764 usb-redirector-customer-module-gui.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2108 wrote to memory of 2764 2108 2026-06-04_062fecf04d60bd4f63a587c09410e9e1_elex_floxif_rhadamanthys_stop_tofsee.exe 80 PID 2652 wrote to memory of 2976 2652 svchost.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_062fecf04d60bd4f63a587c09410e9e1_elex_floxif_rhadamanthys_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_062fecf04d60bd4f63a587c09410e9e1_elex_floxif_rhadamanthys_stop_tofsee.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\e4284b2b481c74321c3be2aaf23218d4\usb-redirector-customer-module-gui.exe"C:\Users\Admin\AppData\Local\Temp\e4284b2b481c74321c3be2aaf23218d4\usb-redirector-customer-module-gui.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2764
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{08845a71-aebb-5f46-8cc1-097e0b19dce9}\ttechusbd.inf" "9" "4d511a66f" "0000000000000140" "WinSta0\Default" "0000000000000160" "208" "C:\Users\Admin\AppData\Local\Temp\e4284b2b481c74321c3be2aaf23218d4"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2976
-
-
C:\Users\Admin\AppData\Local\Temp\e4284b2b481c74321c3be2aaf23218d4\usbredirectortechcsrv.exeC:\Users\Admin\AppData\Local\Temp\e4284b2b481c74321c3be2aaf23218d4\usbredirectortechcsrv.exe1⤵
- Executes dropped EXE
PID:4124
-
C:\Users\Admin\AppData\Local\Temp\e4284b2b481c74321c3be2aaf23218d4\amd64\ttechpnptls.sysC:\Users\Admin\AppData\Local\Temp\e4284b2b481c74321c3be2aaf23218d4\amd64\ttechpnptls.sys1⤵
- Executes dropped EXE
PID:4984
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\System\symsrv.dll
- Size 67KB
- SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
- MD5 7574cf2c64f35161ab1292e2f532aabf
- SHA1 14ba3fa927a06224dfe587014299e834def4644f
- SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
- SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
- TLSH T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\System\symsrv.dll.000
- Size 114B
- SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
- MD5 e609411db8aa6775d0344c75c23ae79b
- SHA1 1d2ff6194bf159ce36cd0461cd3da29486d1e97d
- SHA512 6884ff5c07bc687132c965a59cb8c5a898a25da74c6c846c1d6089ddca8007cb7e4d2f8520bdce9fbcf6e2f9c9e5c28d8c8d6d049d3522470bdc7d38bbfa0ad0
- TLSH T1FFB09262AA2791EAE1AA224505A0248C1ED0B62AB48638002EBA5A4E93256A85916147
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\E4284B~1\TTECHU~1.CAT
- Size 11KB
- SHA256 6e9ee89f3528fac6343e12dd172db8be6fc075f595e5f47cd208ecc8700683c8
- MD5 54e55f7fa5338fcedcd4f7ad582a53b2
- SHA1 e64aa6853d19b0b6f2117d1944f660a82dd387ae
- SHA512 7377e956710378c43fbf4cb4e03b1e1dceb285c4968c3b6682c65168e14dd541319080c6e42877dcbe97ae7086697c4562056ea08d51161af0e675b5beae3c23
- SSDEEP 192:ICMYCKyfJCYi39JnxrEwJqKkhYCcIhNMmuSdXqnajoy:SL4JxXxkh3c7gXlsy
- TLSH T1063208A288A80087EA637C7057E8F9577D3E73CB685001AD256FF7AA1C967C1F70422D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\E4284B~1\amd64\ttechusbd.sys
- Size 48KB
- SHA256 1373d3d69644d95c16cf2f1f17cb637a9bf9f6eb1b681e37913f69b15bb46680
- MD5 5f0645bec453f758d2899142a7901826
- SHA1 3fb96e79b57074ee9f518fdacf25debf359ee4d4
- SHA512 dcb375faea6c41432ef055e8c15b82cb422125e6a54dae1c8011abb33d8200e87549ad7ef5f2c7604a7012560889474032c4fc90af2ea607ba4216d0c1fd596c
- SSDEEP 768:E+yRcHOi5gcgnpXlt2MP7u83pso4CLk9yPnagjjTBP2DGloewnCQd8i7YzEX4ZXJ:E+xZgnHikqCT3BP6ewnCQV8QX0Ov61
- TLSH T147336B9653F8144AF5E3D479EAA5DA47EBB17482174147CF0260D3891F23BE1DA3A334
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\e4284b2b481c74321c3be2aaf23218d4\amd64\ttechpnptls.sys
- Size 56KB
- SHA256 0f4e0f179692911469d2c390feb5e7e83da4d318689688f9d532b718ae952f0d
- MD5 026b8f00614d208f2d3d4f6cffbc4631
- SHA1 8aca4bd5d03de64624f5f5dfd89c5ab710282add
- SHA512 4a1abe2292ca92ade2454d4380e40657c4ad1868dabef393a73795d0314e9472d78aa0d87e5e46ead942d678571ced6cb6ef21dee370ad91a9c512d914293465
- SSDEEP 768:ZLY9miwoyUs7UWJNjm0zJ3fxzG1b3NF/XQwtInaGAzEy9ZbBKUBe3frd7dAsbyKo:ZLum5oyMyGB1qWKljdxX3v6kY
- TLSH T17B435BEA93B9108CE876D6B8C7F8DA17EEB2B8055B1416DF0364D6552F137E0A338364
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\e4284b2b481c74321c3be2aaf23218d4\ttechusbd.inf
- Size 2KB
- SHA256 793e8e83b4d363c6336f663733f80be980c7051b7c7c18a984afc12ce1f92903
- MD5 34a0faa3da3bf4ee2e21632098cdfadf
- SHA1 701814a1b91d941e5f5aeff15b87772d259198b2
- SHA512 e93f9edd29dceb2ec6a232a83e4125bde5c351f1f7fc7bc80a348f96785361a69915c89b041fb8a957bd1143defae8723a7902a76106baea48832988422d4b0f
- TLSH T18F41DD217DC3FBB4CC57E1EB1AD64C92E92BD17000AC1908B0A1F8C259DEEA5532F06E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\e4284b2b481c74321c3be2aaf23218d4\usb-redirector-customer-module-gui.exe
- Size 1.6MB
- SHA256 130db293d102235ce86d68c5d987be2e4d937ed0fecde928bf913f7fd570801d
- MD5 16687b591dbd936314c1eb20d61b76c4
- SHA1 80005e4b41733df5e580e1b34c3d20f9ee6e2f4c
- SHA512 137902cbb22b0985ce9a300cc6edb5a0d4079b0fdf0c2794146b84d03ad4458442b01638212232c526414d031eefeec4b272ff0b680c0dd5fa70817e3c202dd6
- SSDEEP 24576:IL6ekIsS9Nx9T6kok1ZZFr9Ha8q5GQQpfnmcUsRxPW:IL66XTP95QQnRw
- TLSH T136759D75F2958CA0E1B594348463DAC2D2207CB19B6487DF520ABEB62E7F7D11E3A703
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\e4284b2b481c74321c3be2aaf23218d4\usbredirectortechcsrv.exe
- Size 848KB
- SHA256 77d4f1f024e936401d9f48a2612bd1f2d8de6042c7399dec64405e1ea4b9f7e9
- MD5 70498399217e10ca91819b1e4c409bc0
- SHA1 314dc0eefeb6e356573c69f89d58fea111526e9f
- SHA512 4276c7de8e338d056367f75910c3594ac4f45ae34370255798f60f968160c1e54780ecacad32e31a314b16e2c22cb5f58b88568818ffa0db63719f00a5da5c60
- SSDEEP 24576:Mqn9hxqmfNWNCd047bG3fZzvMl330mzv4vTaer:Mqn9emfM0y3RzvMl330gHE
- TLSH T143058D1AFA6583F2D096C03D86A29617F5707849D734CADB0781AB772FA37D0963A730
- MD5 SHA1 SHA512 SSDEEP TLSH