Overview

overview

10

Static

static

3

2026-06-30...ry.exe

windows10-2004-x64

10

2026-06-30...ry.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    43s
  • max time network
    138s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260630-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/07/2026, 03:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-30_ae0cd870d56c824ec58ed421edae6d3e_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe
  • Size 2.1MB
  • Sample260701-dwdflsdv4l
  • SHA256 522d93c5aa656e69b6fbe82dbf9f523f8177967ae1514bce48e1f07aa765ff69
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarebackdoordefense_evasiondiscoverysalitypersistencespywaretrojanupx

Malware Config

Extracted

Family

  • sality

C2

  • http://89.119.67.154/testo5/

  • http://kukutrustnet777.info/home.gif

  • http://kukutrustnet888.info/home.gif

  • http://kukutrustnet987.info/home.gif

Signatures

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies firewall policy service 3 TTPs 9 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 3 IoCs
    defense_evasiontrojan
  • Windows security bypass 2 TTPs 18 IoCs
    defense_evasiontrojan
  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 39 IoCs
  • UPX dump on OEP (original entry point) 46 IoCs
  • Disables RegEdit via registry modification 1 IoCs
    defense_evasion
  • Disables Task Manager via registry modification
    defense_evasion
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 2 IoCs
  • Windows security modification 2 TTPs 21 IoCs
    defense_evasiontrojan
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
    defense_evasiontrojan
  • Drops desktop.ini file(s) 3 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • AutoIT Executable 4 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 6 IoCs
  • UPX packed file 40 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 24 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 3 IoCs
    defense_evasion

Processes

  • C:\Windows\system32\dwm.exe
    "dwm.exe"
    1⤵
      PID:1164
    • C:\Windows\system32\sihost.exe
      sihost.exe
      1⤵
        PID:3160
        • C:\Windows\System32\ShellHost.exe
          "C:\Windows\System32\ShellHost.exe"
          2⤵
            PID:3556
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
          1⤵
            PID:3188
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
            1⤵
              PID:3264
            • C:\Windows\Explorer.EXE
              C:\Windows\Explorer.EXE
              1⤵
                PID:3596
                • C:\Windows\System32\SecurityHealthSystray.exe
                  "C:\Windows\System32\SecurityHealthSystray.exe"
                  2⤵
                    PID:5252
                  • C:\Users\Admin\AppData\Local\Temp\2026-06-30_ae0cd870d56c824ec58ed421edae6d3e_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-06-30_ae0cd870d56c824ec58ed421edae6d3e_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe"
                    2⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:5104
                    • C:\Windows\SysWOW64\explorer.exe
                      explorer.exe
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:3792
                      • C:\Users\Admin\AppData\Local\Temp\@AEB2C1.tmp.exe
                        "C:\Users\Admin\AppData\Local\Temp\@AEB2C1.tmp.exe"
                        4⤵
                        • Modifies firewall policy service
                        • UAC bypass
                        • Windows security bypass
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Windows security modification
                        • Checks whether UAC is enabled
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        • System policy modification
                        PID:4896
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat" "
                          5⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:4212
                          • C:\Windows\System32\Conhost.exe
                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            6⤵
                              PID:4804
                            • C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe
                              "C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe"
                              6⤵
                              • Modifies firewall policy service
                              • UAC bypass
                              • Windows security bypass
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Windows security modification
                              • Checks whether UAC is enabled
                              • Drops file in Windows directory
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of WriteProcessMemory
                              • System policy modification
                              PID:4180
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat" "
                                7⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:3452
                                • C:\Users\Admin\AppData\Roaming\Admin\module_launcher.exe
                                  "C:\Users\Admin\AppData\Roaming\Admin\module_launcher.exe" /i 4180
                                  8⤵
                                  • Executes dropped EXE
                                  • Adds Run key to start application
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of WriteProcessMemory
                                  PID:5004
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin3.bat" "
                                    9⤵
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:964
                                    • C:\Users\Admin\AppData\Roaming\Admin\kb50145.exe
                                      "C:\Users\Admin\AppData\Roaming\Admin\kb50145.exe"
                                      10⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:5504
                                      • C:\Users\Admin\AppData\Roaming\injector_s.exe
                                        "C:\Users\Admin\AppData\Roaming\injector_s.exe"
                                        11⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:5724
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\a0x.bat" "C:\Users\Admin\AppData\Roaming\Admin\kb50145.exe" "C:\Users\Admin\AppData\Local\Temp\a0x.bat""
                                        11⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:2504
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "
                            5⤵
                            • System Location Discovery: System Language Discovery
                            PID:1240
                            • C:\Windows\System32\Conhost.exe
                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              6⤵
                                PID:4572
                          • C:\Users\Admin\AppData\Local\Temp\2026-06-30_ae0cd870d56c824ec58ed421edae6d3e_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-06-30_ae0cd870d56c824ec58ed421edae6d3e_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe"
                            4⤵
                            • Modifies WinLogon for persistence
                            • Modifies firewall policy service
                            • UAC bypass
                            • Windows security bypass
                            • Disables RegEdit via registry modification
                            • Executes dropped EXE
                            • Windows security modification
                            • Adds Run key to start application
                            • Checks whether UAC is enabled
                            • Enumerates connected drives
                            • Drops file in System32 directory
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            • System policy modification
                            PID:1652
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /C AT /delete /yes
                              5⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:3772
                              • C:\Windows\SysWOW64\at.exe
                                AT /delete /yes
                                6⤵
                                • System Location Discovery: System Language Discovery
                                PID:4568
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\svchost .exe
                              5⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:4880
                              • C:\Windows\System32\Conhost.exe
                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                6⤵
                                  PID:3140
                                • C:\Windows\SysWOW64\at.exe
                                  AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\svchost .exe
                                  6⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2012
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                        1⤵
                          PID:3732
                        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                          1⤵
                            PID:4260
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:4268
                            • C:\Windows\System32\RuntimeBroker.exe
                              C:\Windows\System32\RuntimeBroker.exe -Embedding
                              1⤵
                                PID:4364
                              • C:\Windows\System32\RuntimeBroker.exe
                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                1⤵
                                  PID:4408
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
                                  1⤵
                                    PID:4448
                                  • C:\Windows\system32\DllHost.exe
                                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                    1⤵
                                      PID:4668
                                    • C:\Windows\system32\ctfmon.exe
                                      /QuitInfo:0000000000000268;000000000000026C;
                                      1⤵
                                        PID:4700
                                      • C:\Windows\system32\DllHost.exe
                                        C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
                                        1⤵
                                          PID:5144
                                        • C:\Windows\System32\smartscreen.exe
                                          C:\Windows\System32\smartscreen.exe -Embedding
                                          1⤵
                                            PID:5212
                                          • C:\Windows\explorer.exe
                                            Explorer.exe regsvr.exe
                                            1⤵
                                            • Modifies registry class
                                            PID:3028
                                          • C:\Windows\explorer.exe
                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                            1⤵
                                            • Drops desktop.ini file(s)
                                            • Modifies Internet Explorer settings
                                            • Modifies registry class
                                            • Suspicious behavior: AddClipboardFormatListener
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SetWindowsHookEx
                                            PID:5968
                                          • C:\Windows\System32\rundll32.exe
                                            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                            1⤵
                                              PID:1640
                                            • C:\Users\Admin\AppData\Roaming\Admin\module_launcher.exe
                                              "C:\Users\Admin\AppData\Roaming\Admin\module_launcher.exe"
                                              1⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:5660

                                            Network

                                                  MITRE ATT&CK Enterprise v16

                                                  Reconnaissance

                                                  Resource Development

                                                  Initial Access

                                                  Execution

                                                  Persistence

                                                  Boot or Logon Autostart Execution

                                                  2
                                                  T1547

                                                  Registry Run Keys / Startup Folder

                                                  1
                                                  T1547.001

                                                  Winlogon Helper DLL

                                                  1
                                                  T1547.004

                                                  Create or Modify System Process

                                                  1
                                                  T1543

                                                  Windows Service

                                                  1
                                                  T1543.003

                                                  Privilege Escalation

                                                  Abuse Elevation Control Mechanism

                                                  1
                                                  T1548

                                                  Bypass User Account Control

                                                  1
                                                  T1548.002

                                                  Boot or Logon Autostart Execution

                                                  2
                                                  T1547

                                                  Registry Run Keys / Startup Folder

                                                  1
                                                  T1547.001

                                                  Winlogon Helper DLL

                                                  1
                                                  T1547.004

                                                  Create or Modify System Process

                                                  1
                                                  T1543

                                                  Windows Service

                                                  1
                                                  T1543.003

                                                  Defense Evasion

                                                  Abuse Elevation Control Mechanism

                                                  1
                                                  T1548

                                                  Bypass User Account Control

                                                  1
                                                  T1548.002

                                                  Impair Defenses

                                                  4
                                                  T1562

                                                  Disable or Modify System Firewall

                                                  1
                                                  T1562.004

                                                  Disable or Modify Tools

                                                  3
                                                  T1562.001

                                                  Modify Registry

                                                  8
                                                  T1112

                                                  Credential Access

                                                  Discovery

                                                  Peripheral Device Discovery

                                                  1
                                                  T1120

                                                  Query Registry

                                                  1
                                                  T1012

                                                  System Information Discovery

                                                  3
                                                  T1082

                                                  System Location Discovery

                                                  1
                                                  T1614

                                                  System Language Discovery

                                                  1
                                                  T1614.001

                                                  Lateral Movement

                                                  Collection

                                                  Command and Control

                                                  Exfiltration

                                                  Impact

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  2026-06-30_ae0cd870d56c824ec58ed421edae6d3e_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-06-30_ae0cd870d56c824ec58ed421edae6d3e_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe
                                                  • Size 1.1MB
                                                  • SHA256 32bc6c1e20df68204fc95a7941b29eff61d0f97eb51e2f6bbee5e2f365761c5c
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  @AEB2C1.tmp.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\@AEB2C1.tmp.exe
                                                  • Size 1.0MB
                                                  • SHA256 26348624236d395b09eaf21ba8246ef86c77fdeacfbccf82d6358b08791e02ec
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  a0x.bat
                                                  • Path C:\Users\Admin\AppData\Local\Temp\a0x.bat
                                                  • Size 44B
                                                  • SHA256 b1e4990bf84c402594a53a2a98011b8880239e790872de1f6c7b8b9cd1005cf5
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  tmpF2E8.tmp
                                                  • Path C:\Users\Admin\AppData\Local\Temp\tmpF2E8.tmp
                                                  • Size 121KB
                                                  • SHA256 e1a25be30164e6aca9bf97454be217f2b49e6f65fa4d3ac710637f6ef8a213a0
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  tmpF2F8.tmp
                                                  • Path C:\Users\Admin\AppData\Local\Temp\tmpF2F8.tmp
                                                  • Size 131KB
                                                  • SHA256 ba6a7655e3860d01201ffbce06398dff71fd97acff99e95ac8cd2a3e3161d1c0
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  tmpF309.tmp
                                                  • Path C:\Users\Admin\AppData\Local\Temp\tmpF309.tmp
                                                  • Size 99KB
                                                  • SHA256 4a8ea33966592b337d31802f55ea7f901caec037b5b1bf18a9e2b6b044915781
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  tmpF329.tmp
                                                  • Path C:\Users\Admin\AppData\Local\Temp\tmpF329.tmp
                                                  • Size 172KB
                                                  • SHA256 015caba690febdd5403ad86a04bb9763db7408a3b3f0be85f9c364580dac4649
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  tmpF33A.tmp
                                                  • Path C:\Users\Admin\AppData\Local\Temp\tmpF33A.tmp
                                                  • Size 76KB
                                                  • SHA256 a1d30db63fcb26cfcc1e128f4b840ac1c822267a8f17de45cc2e2fc19147e41f
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  winlfeg.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\winlfeg.exe
                                                  • Size 65KB
                                                  • SHA256 26169e196e8241b46037c0e847289a15492abef548136e5707f0f6076e16b927
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  WdExt.exe
                                                  • Path C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe
                                                  • Size 1.0MB
                                                  • SHA256 a5545d51104906cf0e6aa6929946fa4fcfd07111658c44257908d0654e436c8a
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  kb50145.exe
                                                  • Path C:\Users\Admin\AppData\Roaming\Admin\kb50145.exe
                                                  • Size 76KB
                                                  • SHA256 048655d212b269073107e4636125ceeea262acce1d364fc512a0cc8f4783dcf7
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  module_launcher.exe
                                                  • Path C:\Users\Admin\AppData\Roaming\Admin\module_launcher.exe
                                                  • Size 172KB
                                                  • SHA256 b4febd6c6fc42b7d86b575f6c44f0d49fbe9ec02e98d3be00cb26b3e32a3a6d1
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Admin0.bat
                                                  • Path C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat
                                                  • Size 105B
                                                  • SHA256 ff5e923c453d3d61a7989b2b0f978b0bba924a7052667311c9eed54852a20cfd
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  Admin1.bat
                                                  • Path C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat
                                                  • Size 196B
                                                  • SHA256 8871a58444f3123b050d28d634b8b873c83d5deee2616795d42e3519785b1cca
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  Admin2.bat
                                                  • Path C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat
                                                  • Size 122B
                                                  • SHA256 1345dc459c52937666e53f65a986d3026d6a5491df1335cb57c0a5be7fd37e9e
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  Admin3.bat
                                                  • Path C:\Users\Admin\AppData\Roaming\Temp\Admin3.bat
                                                  • Size 107B
                                                  • SHA256 09a6b99c58761a241ba79522972d0dca37ec903dd9e57e7206f092b5112631e1
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  mydll.dll
                                                  • Path C:\Users\Admin\AppData\Roaming\Temp\mydll.dll
                                                  • Size 382KB
                                                  • SHA256 f0a24c3d4e5f5948dd84a9db1206e07b904c6c12ff9e20de2a2ad7d6b04c6946
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  injector_s.exe
                                                  • Path C:\Users\Admin\AppData\Roaming\injector_s.exe
                                                  • Size 188KB
                                                  • SHA256 22c5c5bcb256c1dcaead463c92a70107ba1bac40564fe1e7d46594c6a3936778
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  SYSTEM.INI
                                                  • Path C:\Windows\SYSTEM.INI
                                                  • Size 257B
                                                  • SHA256 eac2c6462a3cb6998816494581c13f489ca263a8942eb96bee9b932b187df787
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  lwlrvj.pif
                                                  • Path F:\lwlrvj.pif
                                                  • Size 97KB
                                                  • SHA256 e0c36d2a63df4f3adcda9850315fb2372e193883eeed10f8eae3788fe96ab104
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  memory/1240-239-0x0000000003180000-0x0000000003182000-memory.dmp
                                                  Download

                                                  memory/1240-174-0x0000000003180000-0x0000000003182000-memory.dmp
                                                  Download

                                                  memory/1240-125-0x00000000031D0000-0x00000000031D1000-memory.dmp
                                                  Download

                                                  memory/1652-242-0x0000000000400000-0x0000000000527000-memory.dmp
                                                  Download

                                                  memory/1652-22-0x0000000000400000-0x0000000000527000-memory.dmp
                                                  Download

                                                  memory/1652-343-0x0000000000400000-0x0000000000527000-memory.dmp
                                                  Download

                                                  memory/1652-270-0x0000000005990000-0x0000000006A4A000-memory.dmp
                                                  Download

                                                  memory/1652-268-0x0000000005990000-0x0000000006A4A000-memory.dmp
                                                  Download

                                                  memory/1652-97-0x0000000000400000-0x0000000000527000-memory.dmp
                                                  Download

                                                  memory/1652-267-0x0000000005990000-0x0000000006A4A000-memory.dmp
                                                  Download

                                                  memory/1652-51-0x0000000002930000-0x0000000002931000-memory.dmp
                                                  Download

                                                  memory/1652-266-0x0000000005990000-0x0000000006A4A000-memory.dmp
                                                  Download

                                                  memory/1652-52-0x00000000028F0000-0x00000000028F2000-memory.dmp
                                                  Download

                                                  memory/1652-264-0x0000000005990000-0x0000000006A4A000-memory.dmp
                                                  Download

                                                  memory/1652-263-0x0000000005990000-0x0000000006A4A000-memory.dmp
                                                  Download

                                                  memory/1652-262-0x0000000005990000-0x0000000006A4A000-memory.dmp
                                                  Download

                                                  memory/1652-261-0x0000000000400000-0x0000000000527000-memory.dmp
                                                  Download

                                                  memory/1652-257-0x0000000005990000-0x0000000006A4A000-memory.dmp
                                                  Download

                                                  memory/1652-256-0x0000000005990000-0x0000000006A4A000-memory.dmp
                                                  Download

                                                  memory/1652-255-0x0000000005990000-0x0000000006A4A000-memory.dmp
                                                  Download

                                                  memory/1652-254-0x0000000005990000-0x0000000006A4A000-memory.dmp
                                                  Download

                                                  memory/1652-253-0x0000000005990000-0x0000000006A4A000-memory.dmp
                                                  Download

                                                  memory/1652-248-0x0000000005990000-0x0000000006A4A000-memory.dmp
                                                  Download

                                                  memory/1652-247-0x0000000005990000-0x0000000006A4A000-memory.dmp
                                                  Download

                                                  memory/1652-245-0x0000000005990000-0x0000000006A4A000-memory.dmp
                                                  Download

                                                  memory/1652-246-0x0000000005990000-0x0000000006A4A000-memory.dmp
                                                  Download

                                                  memory/1652-244-0x0000000005990000-0x0000000006A4A000-memory.dmp
                                                  Download

                                                  memory/4180-117-0x0000000002370000-0x000000000342A000-memory.dmp
                                                  Download

                                                  memory/4180-113-0x0000000002370000-0x000000000342A000-memory.dmp
                                                  Download

                                                  memory/4180-103-0x0000000002370000-0x000000000342A000-memory.dmp
                                                  Download

                                                  memory/4180-210-0x0000000000400000-0x000000000044C000-memory.dmp
                                                  Download

                                                  memory/4180-109-0x0000000002370000-0x000000000342A000-memory.dmp
                                                  Download

                                                  memory/4180-194-0x0000000000940000-0x0000000000942000-memory.dmp
                                                  Download

                                                  memory/4180-110-0x0000000002370000-0x000000000342A000-memory.dmp
                                                  Download

                                                  memory/4180-197-0x0000000002370000-0x000000000342A000-memory.dmp
                                                  Download

                                                  memory/4180-115-0x0000000002370000-0x000000000342A000-memory.dmp
                                                  Download

                                                  memory/4180-140-0x0000000000940000-0x0000000000942000-memory.dmp
                                                  Download

                                                  memory/4180-111-0x0000000002370000-0x000000000342A000-memory.dmp
                                                  Download

                                                  memory/4180-116-0x0000000002370000-0x000000000342A000-memory.dmp
                                                  Download

                                                  memory/4180-129-0x0000000002140000-0x0000000002141000-memory.dmp
                                                  Download

                                                  memory/4180-114-0x0000000002370000-0x000000000342A000-memory.dmp
                                                  Download

                                                  memory/4180-112-0x0000000002370000-0x000000000342A000-memory.dmp
                                                  Download

                                                  memory/4212-123-0x0000000002610000-0x0000000002611000-memory.dmp
                                                  Download

                                                  memory/4212-150-0x00000000025C0000-0x00000000025C2000-memory.dmp
                                                  Download

                                                  memory/4212-236-0x00000000025C0000-0x00000000025C2000-memory.dmp
                                                  Download

                                                  memory/4880-127-0x00000000008C0000-0x00000000008C1000-memory.dmp
                                                  Download

                                                  memory/4880-176-0x00000000008B0000-0x00000000008B2000-memory.dmp
                                                  Download

                                                  memory/4880-187-0x00000000008B0000-0x00000000008B2000-memory.dmp
                                                  Download

                                                  memory/4896-33-0x00000000023C0000-0x000000000347A000-memory.dmp
                                                  Download

                                                  memory/4896-35-0x00000000023C0000-0x000000000347A000-memory.dmp
                                                  Download

                                                  memory/4896-38-0x00000000023C0000-0x000000000347A000-memory.dmp
                                                  Download

                                                  memory/4896-39-0x00000000023C0000-0x000000000347A000-memory.dmp
                                                  Download

                                                  memory/4896-53-0x00000000009D0000-0x00000000009D2000-memory.dmp
                                                  Download

                                                  memory/4896-37-0x00000000023C0000-0x000000000347A000-memory.dmp
                                                  Download

                                                  memory/4896-10-0x0000000000400000-0x000000000044C000-memory.dmp
                                                  Download

                                                  memory/4896-48-0x00000000009D0000-0x00000000009D2000-memory.dmp
                                                  Download

                                                  memory/4896-36-0x00000000023C0000-0x000000000347A000-memory.dmp
                                                  Download

                                                  memory/4896-23-0x00000000023C0000-0x000000000347A000-memory.dmp
                                                  Download

                                                  memory/4896-24-0x0000000010000000-0x0000000010015000-memory.dmp
                                                  Download

                                                  memory/4896-85-0x00000000009D0000-0x00000000009D2000-memory.dmp
                                                  Download

                                                  memory/4896-88-0x00000000023C0000-0x000000000347A000-memory.dmp
                                                  Download

                                                  memory/4896-28-0x00000000023C0000-0x000000000347A000-memory.dmp
                                                  Download

                                                  memory/4896-31-0x00000000023C0000-0x000000000347A000-memory.dmp
                                                  Download

                                                  memory/4896-32-0x00000000023C0000-0x000000000347A000-memory.dmp
                                                  Download

                                                  memory/4896-49-0x00000000009E0000-0x00000000009E1000-memory.dmp
                                                  Download

                                                  memory/4896-99-0x0000000000400000-0x000000000044C000-memory.dmp
                                                  Download

                                                  memory/4896-34-0x00000000023C0000-0x000000000347A000-memory.dmp
                                                  Download

                                                  memory/5004-190-0x0000000010000000-0x0000000010015000-memory.dmp
                                                  Download

                                                  memory/5104-0-0x0000000000400000-0x0000000000527000-memory.dmp
                                                  Download

                                                  memory/5104-1-0x0000000000400000-0x0000000000527000-memory.dmp
                                                  Download

                                                  memory/5724-259-0x0000000000700000-0x0000000000702000-memory.dmp
                                                  Download

                                                  memory/5724-260-0x0000000000710000-0x0000000000711000-memory.dmp
                                                  Download