34599ce71a9262f070a833a85b940c7e8b3140699a82bb72ebd76c8efd904e47

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 22:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_122c547dd3e6952c124c4db4a42ecb8d_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry.exe
Size 2.0MB
Sample260810-2xjwsaba98
SHA256 34599ce71a9262f070a833a85b940c7e8b3140699a82bb72ebd76c8efd904e47
MD5 122c547dd3e6952c124c4db4a42ecb8d
SHA1 1d87b26e3aad5fa137c4f9f71cd669cf167115bf
SHA512 589c8f10d692c3627bee0c280028854cccbe0e39992543a63fe46ce9cdda4df9cc9d2e12963846e6f6b86d54766f566a7ca2e1527d0aca42a65f92a02760e9de
SSDEEP 49152:5KUOr1bTChxKCnFnQXBbrtgb/iQvu0UHOb:m16hxvWbrtUTrUHOb
TLSH
T17BA5EF016771CDA0F61FC43203D12EB576B72C223723DD46AB49B63A2BF2D9AE789511
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

credential_access discovery execution persistence spyware stealer

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Executes dropped EXE 12 IoCs

pid	Process
5620	@AED54.tmp.exe
5852	2026-08-10_122c547dd3e6952c124c4db4a42ecb8d_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry.exe
5552	2026-08-10_122c547dd3e6952c124c4db4a42ecb8d_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry.exe
1076	wmimgmt.exe
2596	wmimgmt.exe
236	WdExt.exe
4476	launch.exe
1392	launch.exe
1156	wtmps.exe
1996	mscaps.exe
4936	wmimgmt.exe
52	wmimgmt.exe

Loads dropped DLL 2 IoCs

pid	Process
5620	@AED54.tmp.exe
236	WdExt.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Defender Extension = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Defender\\launch.exe\""	launch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\wmi32 = "\"C:\\ProgramData\\Application Data\\wmimgmt.exe\""	wmimgmt.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	wmimgmt.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4600	ARP.EXE

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3388	tasklist.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mscaps.exe	wtmps.exe
File opened for modification	C:\Windows\SysWOW64\mscaps.exe	wtmps.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 5852 set thread context of 5552	5852	2026-08-10_122c547dd3e6952c124c4db4a42ecb8d_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry.exe	92
PID 1076 set thread context of 2596	1076	wmimgmt.exe	95
PID 4936 set thread context of 52	4936	wmimgmt.exe	147

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5312	cmd.exe
4720	cmd.exe
1268	cmd.exe
2924	cmd.exe
764	cmd.exe
4372	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 59 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_122c547dd3e6952c124c4db4a42ecb8d_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	launch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ROUTE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@AED54.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmimgmt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_122c547dd3e6952c124c4db4a42ecb8d_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmimgmt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmimgmt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtmps.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	launch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NETSTAT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_122c547dd3e6952c124c4db4a42ecb8d_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ARP.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WdExt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NETSTAT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
4900	NETSTAT.EXE

Discovers systems in the same network 1 TTPs 1 IoCs

discovery

Remote System Discovery

T1018

pid	Process
3364	net.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3908	ipconfig.exe
4900	NETSTAT.EXE
4924	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5584	systeminfo.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
5620	@AED54.tmp.exe
5620	@AED54.tmp.exe
5852	2026-08-10_122c547dd3e6952c124c4db4a42ecb8d_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry.exe
5852	2026-08-10_122c547dd3e6952c124c4db4a42ecb8d_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry.exe
1076	wmimgmt.exe
1076	wmimgmt.exe
236	WdExt.exe
236	WdExt.exe
4476	launch.exe
4476	launch.exe
4476	launch.exe
4476	launch.exe
4476	launch.exe
4476	launch.exe
4476	launch.exe
4476	launch.exe
4476	launch.exe
4476	launch.exe
1392	launch.exe
1392	launch.exe
1392	launch.exe
1392	launch.exe
1392	launch.exe
1392	launch.exe
1392	launch.exe
1392	launch.exe
1392	launch.exe
1392	launch.exe
1392	launch.exe
1392	launch.exe
4476	launch.exe
4476	launch.exe
4936	wmimgmt.exe
4936	wmimgmt.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeBackupPrivilege	5552	2026-08-10_122c547dd3e6952c124c4db4a42ecb8d_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry.exe
Token: SeBackupPrivilege	5552	2026-08-10_122c547dd3e6952c124c4db4a42ecb8d_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry.exe
Token: SeBackupPrivilege	5552	2026-08-10_122c547dd3e6952c124c4db4a42ecb8d_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry.exe
Token: SeRestorePrivilege	5552	2026-08-10_122c547dd3e6952c124c4db4a42ecb8d_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry.exe
Token: SeBackupPrivilege	5552	2026-08-10_122c547dd3e6952c124c4db4a42ecb8d_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry.exe
Token: SeBackupPrivilege	5552	2026-08-10_122c547dd3e6952c124c4db4a42ecb8d_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry.exe
Token: SeBackupPrivilege	5552	2026-08-10_122c547dd3e6952c124c4db4a42ecb8d_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry.exe
Token: SeRestorePrivilege	5552	2026-08-10_122c547dd3e6952c124c4db4a42ecb8d_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry.exe
Token: SeBackupPrivilege	5552	2026-08-10_122c547dd3e6952c124c4db4a42ecb8d_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry.exe
Token: SeRestorePrivilege	5552	2026-08-10_122c547dd3e6952c124c4db4a42ecb8d_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry.exe
Token: SeBackupPrivilege	5552	2026-08-10_122c547dd3e6952c124c4db4a42ecb8d_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry.exe
Token: SeRestorePrivilege	5552	2026-08-10_122c547dd3e6952c124c4db4a42ecb8d_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry.exe
Token: SeBackupPrivilege	2596	wmimgmt.exe
Token: SeBackupPrivilege	2596	wmimgmt.exe
Token: SeBackupPrivilege	2596	wmimgmt.exe
Token: SeRestorePrivilege	2596	wmimgmt.exe
Token: SeBackupPrivilege	2596	wmimgmt.exe
Token: SeDebugPrivilege	3388	tasklist.exe
Token: SeDebugPrivilege	4900	NETSTAT.EXE
Token: SeBackupPrivilege	52	wmimgmt.exe
Token: SeBackupPrivilege	52	wmimgmt.exe
Token: SeBackupPrivilege	52	wmimgmt.exe
Token: SeRestorePrivilege	52	wmimgmt.exe
Token: SeBackupPrivilege	52	wmimgmt.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
5852	2026-08-10_122c547dd3e6952c124c4db4a42ecb8d_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry.exe
5852	2026-08-10_122c547dd3e6952c124c4db4a42ecb8d_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry.exe
1076	wmimgmt.exe
1076	wmimgmt.exe
4936	wmimgmt.exe
4936	wmimgmt.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 4260	3880	2026-08-10_122c547dd3e6952c124c4db4a42ecb8d_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry.exe	89
PID 3880 wrote to memory of 4260	3880	2026-08-10_122c547dd3e6952c124c4db4a42ecb8d_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry.exe	89
PID 3880 wrote to memory of 4260	3880	2026-08-10_122c547dd3e6952c124c4db4a42ecb8d_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry.exe	89
PID 4260 wrote to memory of 5620	4260	explorer.exe	90
PID 4260 wrote to memory of 5852	4260	explorer.exe	91
PID 5852 wrote to memory of 5552	5852	2026-08-10_122c547dd3e6952c124c4db4a42ecb8d_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry.exe	92
PID 5852 wrote to memory of 5552	5852	2026-08-10_122c547dd3e6952c124c4db4a42ecb8d_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry.exe	92
PID 5552 wrote to memory of 1076	5552	2026-08-10_122c547dd3e6952c124c4db4a42ecb8d_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry.exe	94
PID 1076 wrote to memory of 2596	1076	wmimgmt.exe	95
PID 1076 wrote to memory of 2596	1076	wmimgmt.exe	95
PID 5620 wrote to memory of 4720	5620	@AED54.tmp.exe	96
PID 5620 wrote to memory of 1268	5620	@AED54.tmp.exe	98
PID 4720 wrote to memory of 236	4720	cmd.exe	100
PID 236 wrote to memory of 2924	236	WdExt.exe	101
PID 2924 wrote to memory of 4476	2924	cmd.exe	103
PID 2596 wrote to memory of 764	2596	wmimgmt.exe	106
PID 4476 wrote to memory of 4372	4476	launch.exe	108
PID 4372 wrote to memory of 1156	4372	cmd.exe	110
PID 764 wrote to memory of 1988	764	cmd.exe	111
PID 1156 wrote to memory of 1996	1156	wtmps.exe	112
PID 764 wrote to memory of 2340	764	cmd.exe	113
PID 764 wrote to memory of 5544	764	cmd.exe	114
PID 5544 wrote to memory of 1224	5544	net.exe	115
PID 764 wrote to memory of 5128	764	cmd.exe	116
PID 5128 wrote to memory of 5520	5128	net.exe	117
PID 764 wrote to memory of 3388	764	cmd.exe	118
PID 764 wrote to memory of 5584	764	cmd.exe	120
PID 764 wrote to memory of 2004	764	cmd.exe	122
PID 764 wrote to memory of 1364	764	cmd.exe	123
PID 764 wrote to memory of 1188	764	cmd.exe	124
PID 764 wrote to memory of 2072	764	cmd.exe	125
PID 764 wrote to memory of 3420	764	cmd.exe	126
PID 764 wrote to memory of 4348	764	cmd.exe	127
PID 764 wrote to memory of 2156	764	cmd.exe	128
PID 764 wrote to memory of 2816	764	cmd.exe	129
PID 764 wrote to memory of 1768	764	cmd.exe	130
PID 764 wrote to memory of 3908	764	cmd.exe	131
PID 764 wrote to memory of 4900	764	cmd.exe	132
PID 764 wrote to memory of 4600	764	cmd.exe	133
PID 764 wrote to memory of 4924	764	cmd.exe	134
PID 4924 wrote to memory of 5312	4924	NETSTAT.EXE	135
PID 5312 wrote to memory of 4972	5312	cmd.exe	136
PID 764 wrote to memory of 3084	764	cmd.exe	137
PID 3084 wrote to memory of 2320	3084	net.exe	138
PID 764 wrote to memory of 1320	764	cmd.exe	139
PID 764 wrote to memory of 4300	764	cmd.exe	140
PID 764 wrote to memory of 2748	764	cmd.exe	141
PID 2748 wrote to memory of 3032	2748	net.exe	142
PID 764 wrote to memory of 3364	764	cmd.exe	143
PID 4936 wrote to memory of 52	4936	wmimgmt.exe	147
PID 4936 wrote to memory of 52	4936	wmimgmt.exe	147
PID 764 wrote to memory of 4072	764	cmd.exe	149
PID 764 wrote to memory of 6136	764	cmd.exe	150
PID 764 wrote to memory of 4792	764	cmd.exe	151
PID 764 wrote to memory of 3200	764	cmd.exe	152
PID 764 wrote to memory of 2224	764	cmd.exe	153
PID 764 wrote to memory of 4408	764	cmd.exe	154
PID 764 wrote to memory of 1752	764	cmd.exe	155
PID 764 wrote to memory of 2532	764	cmd.exe	156
PID 764 wrote to memory of 5988	764	cmd.exe	157
PID 764 wrote to memory of 1268	764	cmd.exe	158
PID 764 wrote to memory of 3252	764	cmd.exe	159
PID 764 wrote to memory of 4752	764	cmd.exe	160

C:\Users\Admin\AppData\Local\Temp\2026-08-10_122c547dd3e6952c124c4db4a42ecb8d_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_122c547dd3e6952c124c4db4a42ecb8d_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Users\Admin\AppData\Local\Temp\@AED54.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\@AED54.tmp.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5620
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4720
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:236
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2924
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe" /i 236
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4476
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat" "
        8⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\wtmps.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wtmps.exe"
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1156
        
        C:\Windows\SysWOW64\mscaps.exe
        
        "C:\Windows\system32\mscaps.exe" /C:\Users\Admin\AppData\Local\Temp\wtmps.exe
        10⤵
        Executes dropped EXE
        
        PID:1996
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:1268
- - C:\Users\Admin\AppData\Local\Temp\2026-08-10_122c547dd3e6952c124c4db4a42ecb8d_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_122c547dd3e6952c124c4db4a42ecb8d_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5852
  - - C:\Users\Admin\AppData\Local\Temp\2026-08-10_122c547dd3e6952c124c4db4a42ecb8d_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry.exe
      C:\Users\Admin\AppData\Local\Temp\2026-08-10_122c547dd3e6952c124c4db4a42ecb8d_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5552
    - - C:\ProgramData\Application Data\wmimgmt.exe
        
        "C:\ProgramData\Application Data\wmimgmt.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1076
      - C:\ProgramData\Application Data\wmimgmt.exe
        
        "C:\ProgramData\Application Data\wmimgmt.exe"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2596
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /v:on /c "C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\ghi.bat"
        7⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:764
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /s "YM.CGP_" "C:\Users\Admin"\..\*.txt
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1988
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2340
        
        C:\Windows\SysWOW64\net.exe
        
        net user
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5544
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:1224
        
        C:\Windows\SysWOW64\net.exe
        
        net localgroup administrators
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5128
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5520
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3388
        
        C:\Windows\SysWOW64\systeminfo.exe
        
        systeminfo
        8⤵
        System Location Discovery: System Language Discovery
        Gathers system information
        
        PID:5584
        
        C:\Windows\SysWOW64\reg.exe
        
        reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2004
        
        C:\Windows\SysWOW64\find.exe
        
        find "REG_"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1364
        
        C:\Windows\SysWOW64\reg.exe
        
        reg query HKEY_CURRENT_USER\Software\Microsoft\Office
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1188
        
        C:\Windows\SysWOW64\reg.exe
        
        reg query HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Common\UserInfo
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2072
        
        C:\Windows\SysWOW64\reg.exe
        
        reg query HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Common\UserInfo
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3420
        
        C:\Windows\SysWOW64\reg.exe
        
        reg query HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Common\UserInfo
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4348
        
        C:\Windows\SysWOW64\reg.exe
        
        reg query HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Common\UserInfo
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2156
        
        C:\Windows\SysWOW64\reg.exe
        
        reg query HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\UserInfo
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2816
        
        C:\Windows\SysWOW64\reg.exe
        
        reg query HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Common\UserInfo
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1768
        
        C:\Windows\SysWOW64\ipconfig.exe
        
        ipconfig /all
        8⤵
        System Location Discovery: System Language Discovery
        Gathers network information
        
        PID:3908
        
        C:\Windows\SysWOW64\NETSTAT.EXE
        
        netstat -ano
        8⤵
        System Location Discovery: System Language Discovery
        System Network Connections Discovery
        Gathers network information
        Suspicious use of AdjustPrivilegeToken
        
        PID:4900
        
        C:\Windows\SysWOW64\ARP.EXE
        
        arp -a
        8⤵
        Network Service Discovery
        System Location Discovery: System Language Discovery
        
        PID:4600
        
        C:\Windows\SysWOW64\NETSTAT.EXE
        
        netstat -r
        8⤵
        System Location Discovery: System Language Discovery
        Gathers network information
        Suspicious use of WriteProcessMemory
        
        PID:4924
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
        9⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5312
        
        C:\Windows\SysWOW64\ROUTE.EXE
        
        C:\Windows\system32\route.exe print
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:4972
        
        C:\Windows\SysWOW64\net.exe
        
        net start
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3084
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2320
        
        C:\Windows\SysWOW64\net.exe
        
        net use
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo n"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4300
        
        C:\Windows\SysWOW64\net.exe
        
        net share
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2748
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 share
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3032
        
        C:\Windows\SysWOW64\net.exe
        
        net view /domain
        8⤵
        System Location Discovery: System Language Discovery
        Discovers systems in the same network
        
        PID:3364
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\s.log "
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4072
        
        C:\Windows\SysWOW64\find.exe
        
        find /i /v "------"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6136
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\t.log "
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4792
        
        C:\Windows\SysWOW64\find.exe
        
        find /i /v "domain"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3200
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\s.log "
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2224
        
        C:\Windows\SysWOW64\find.exe
        
        find /i /v "¬A╛╣"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4408
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\t.log "
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1752
        
        C:\Windows\SysWOW64\find.exe
        
        find /i /v "░⌡ªµª¿"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2532
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\s.log "
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5988
        
        C:\Windows\SysWOW64\find.exe
        
        find /i /v "├ⁿ┴ε"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1268
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\t.log "
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3252
        
        C:\Windows\SysWOW64\find.exe
        
        find /i /v "completed successfully"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4752

C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1392

C:\ProgramData\Application Data\wmimgmt.exe
"C:\ProgramData\Application Data\wmimgmt.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4936
- C:\ProgramData\Application Data\wmimgmt.exe
  "C:\ProgramData\Application Data\wmimgmt.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:52

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

INFO.TXT

Path C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\INFO.TXT
Size 13KB
SHA256 27c430fb2b043952be0065f96fd90fdd096065b3363ad284abcee153881799ce
MD5 abf71c05cf0cc630eba6e482517cb3c8
SHA1 7b292d76127fb4fe1b4e6a52e4125f1b7a721ed9
SHA512 212e02c81babe3e5828be59521ce2f1a78c77c180546824ac913d860a2badcb5570327c83f73fcf41f6b9ba2ed78eeec8b05f4b511b4a222110329222ac17b38
SSDEEP 384:0QV95KK9CiLo6/Zd25iwZJBLunvRWloeWNY7iDGNShh9FzNs8o0H1GdrRKBecS30:VgK9CiLo6/Zd25iwZJBLunvRWloeWNYK
TLSH
T1FD52EE408C9FC1B8A42DE3993A134002F79A654531A9AEE936CD459C7BE4F1CD3EF9B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INFO.TXT

Path C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\INFO.TXT
Size 34.2MB
SHA256 88eb0094b4e014bc002344600642898e676f70b13b87514566e439412924bcc0
MD5 d8fa07858d38767f39e71903c59e9940
SHA1 b07582dea77d1a81134b6686ef49bc6d5fdd278e
SHA512 a23c72c32b8945fa53d40c55800339b000a98eda56964f9a0ea483116c58768cfe237999a9851e45f2725ea80c68fc8279730b57f6ed259b16f93c2a2c9f8e2a
SSDEEP 49152:EuKZG87/IXZg0mA0NxFY8oAPJn8ZgvOkRlz0mSwkTo2HnA5vRkPcjByeUWkByXR5:SjBL
TLSH
T123771F0BCAEAC9D98913E51213354DF3D29E2963620E8D1877EC134A0BF3167779D9B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.p

Path C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\drivers.p
Size 15B
SHA256 d8a21e76d208e48198b4afa4a54157044255e074acd5c25f99d9894ad70fbde2
MD5 48290ef0f324cf793b4f7ef936ddf34a
SHA1 ff77d5f263909066a61c89ead0764f6167dc3b16
SHA512 e32bd98f8ca5ceb6d90fde670c8a8a02d841745083040ced0dc5492ed0cdb7eb0bda3cd0a0a101e374a25ba0227991e545be7d41a114c591a7c5f6025d2f6eac
MD5 SHA1 SHA512

Submit Download

ghi.bat

Path C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\ghi.bat
Size 3KB
SHA256 1ebd7eae014cf21830a64f251bf768e2935fa3de5223dcb86f3e69dc88c384c8
MD5 58a64905608130d77188e612e3972897
SHA1 fd2c205c16330cbd77bf3c4ffa8db0e0f245db49
SHA512 288968fbce883e1ec8ba764ed9e82aa9712d1390a8aa98c9f4c7a45247be59825b981c3236e309c5bbff5d075998b406e0a1c049ecb035b58668a1f3354020fe
TLSH
T1AE6100077C5C080B0D75015ADB89B85532EDC2C3D24E26A7254ED2B6F6A935883B4ECE
MD5 SHA1 SHA512 TLSH

Submit Download

INFO.TXT

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\INFO.TXT
Size 43B
SHA256 242aeea876bf8221706f13ecf5f5252353531252a857387e1fc5ad088d3b3b06
MD5 7f8814a441c90d4ab440802e596051a9
SHA1 356d433ad16752ba1231c7e8c2e8c2fa32cfb05f
SHA512 8a3d2e5a7dec193f2103a143e07619f044b7f37b4d857fa8e4341ce8cc417651f0bc2948a129d3c3b016824cd6afbe6c9c008a4b2e4781d2ad5ea3af5301b931
MD5 SHA1 SHA512

Submit Download

2026-08-10_122c547dd3e6952c124c4db4a42ecb8d_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-10_122c547dd3e6952c124c4db4a42ecb8d_coinminer_darpapox_elex_jaku_nymaim_rhadamanthys_wannacry.exe
Size 252KB
SHA256 4b27f4ce2a55b0be3b7cd1c4edf7fd7e98347a0df8cbc19c082e8a1ae1782157
MD5 700e72b73ccd4d0f629488dfaaa7922e
SHA1 3d4fb217aaea75b47cccc2cbe47edd2bcb175471
SHA512 228e590d72895a1e104ccd2e7479fa53082d51da4cc896fa18ea39cf84245bc284829c36fdbf5707038b6de91781c3bf36ab1e48b417e55486746ef5f88d84e5
SSDEEP 3072:hOXQ2G+IpQZQneFAMx3qe8UzT+nWwXjDRJWwXjDRgjDRbL7SC3:CvGlpQEQAMtqNUzCa
TLSH
T18F443A42967A5AD1D818CD3005A634F557EF2C1338079E57E36BFF1F28BADD0AA0E612
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3261.tmp

Path C:\Users\Admin\AppData\Local\Temp\3261.tmp
Size 406B
SHA256 27e678bf5dc82219d6edd744f0b82567a26e40f8a9dcd6487205e13058e3ed1f
MD5 37512bcc96b2c0c0cf0ad1ed8cfae5cd
SHA1 edf7f17ce28e1c4c82207cab8ca77f2056ea545c
SHA512 6d4252ab5aa441a76ce2127224fefcb221259ab4d39f06437b269bd6bfdaae009c8f34e9603ec734159553bc9f1359bdd70316cd426d73b171a9f17c41077641
TLSH
T1C5E0A238F30DCC2AE1D032092011CE86F23C128AE6A1FBA82AB421A3B00350CC2346E3
MD5 SHA1 SHA512 TLSH

Submit Download

@AED54.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\@AED54.tmp.exe
Size 1.7MB
SHA256 73d5e1fbb1f174d8c42371f232baf1b1355aa71a39d5bfef5029930575e0f0e2
MD5 d97d799650ad0817b5a98fc377e03dad
SHA1 93976265bff5dd4e8ca0aaaaefac5f199a1a6636
SHA512 dcd0cc4f9f7359371e0ddd7be11e6b590eccc11fee4f933e8863301c5ab54c1dd41bd59ac57164df2b15bc6431165ad69b31394730c48f4044037511fa1d858c
SSDEEP 24576:OXdVtTj2i64T+jdxQCfgOFD3WSwd2QtBBw6xxhVxQtmibjOhZaiRu/4oMaop0UNY:mbTChxKCnFnQXBbrtgb/iQvu0UHOd
TLSH
T1B685DD152790CCA1F36FC07683E56E79B5B329213733D8966E4891316BF2E2FE381196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp1566.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp1566.tmp
Size 779B
SHA256 418e383158c29b03e7aec7e85ae18e017953c298ca575167b5aca6d691d72beb
MD5 b50c211b76095dd642c9a787133dc1ea
SHA1 fa67a7909afeae016836802914dd55e469e4d96d
SHA512 66624536bc78a70d5638a3f638a951a1e04d3146294c9830fb62216918db75f87c3e8eabc121ec05d4a9dc09439861fbbe9725b82383052330a4778efa787d10
TLSH
T1480175EBA508C16D84FD045EE134ACCA07A7532EF22713B28F7E710D2E4EC20443E466
MD5 SHA1 SHA512 TLSH

Submit Download

tmp1E3D.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp1E3D.tmp
Size 229KB
SHA256 0782265ec2d7bedd56fa562080baca0599c5aadc9ac77dec5bc6ccaa1d6b7516
MD5 d3e3e45275d7710d343a324e197aa2b0
SHA1 750f4b81d2f25ad7fff7ec51772883150bdea25c
SHA512 804ea7c3dc12370947f01e92febc832df2812f8380306167a9767befd3b5e05aac0f71fceb16fa1ad222dd09cd8a366bee8f9a1bdbdfaa1bb47bf5115c1e9ecb
SSDEEP 768:QI3kyWAOEyLlwfeKwOQQA1b3r/JAqdmUAwBNIMEaEgja9YIT/eKsJZx7SX6nWHiq:JUA2kRwOA97r3TqByIT/e9ZxEsJbWl
TLSH
T1F8343E089DD2CA1A4F4A8391E8EF87B7BD769F02199EB74373885F1AB6D25F2C00510D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp1E7D.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp1E7D.tmp
Size 120KB
SHA256 b0c0c49eed934e6d2ed990913d4c71108f6104352d23f72d3ef0a3ef4074d92e
MD5 1fcc5b3ed6bc76d70cfa49d051e0dff6
SHA1 3ffa43efdc893a57dcad3d45c9b14980dd52eb58
SHA512 8769438aacc26f0a720926f419a2564813dee2f526b2dbb7a3f57d587dc385612bf5780f4e39ce2149de5fb4c1af839dcc099f3d77387989e16d2bc76c6de929
SSDEEP 3072:PWFWnu/0NPlE+qoytTBf+28aVytl34iQA:PW8nlQ+RytTBV2J
TLSH
T1A0C39E1376D085F7E1B2843099E99F3DEBFBB5318A618AC3574857681E31A50EE123CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp1E7D.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp1E7D.tmp
Size 120KB
SHA256 01631353726dc51bcea311dbc012572cf96775e516b1c79a2de572ef15954b7a
MD5 f558c76b0376af9273717fa24d99ebbf
SHA1 f84bcece5c6138b62ef94e9d668cf26178ee14cc
SHA512 2092d1e126d0420fec5fc0311d6b99762506563f4890e4049e48e2d87dde5ac3e2e2ecc986ab305de2c6ceb619f18879a69a815d3241ccf8140bc5ea00c6768d
SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy:u
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp1ECC.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp1ECC.tmp
Size 126KB
SHA256 ae5697f849fa48db6d3d13455c224fcf6ceb0602a1e8ac443e211dd0f32d50f4
MD5 02ae22335713a8f6d6adf80bf418202b
SHA1 4c40c11f43df761b92a5745f85a799db7b389215
SHA512 727d16102bfc768535b52a37e4e7b5d894f5daa268d220df108382c36dcce063afdbc31fd495a7a61305263ec4cd7e92713d894faa35b585c0b379217a1d929c
SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyK:u
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp1EDD.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp1EDD.tmp
Size 89KB
SHA256 63149ad45db380f5dd15f65d9ceb2611d53a0a66e022483bee4ce2ff7d2610e2
MD5 09203a9741b91f3a9ed01c82dcb8778d
SHA1 13e6f3fb169cd6aa5e4d450417a7e15665a2e140
SHA512 9e9e6fe0dd713417d0e28ba787cf862d55ecda9ee9f3df1eada144657f6a3b6ada1984fd05a3fffcd597a9715383225a8e40b6e5d0d8d39ec0d3a64b8dea9846
SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyS:O
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp1EFD.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp1EFD.tmp
Size 99KB
SHA256 5ec8093ef5939d1abce1c576097b584fb600b94ad767c1da897f7cb7f0063d26
MD5 9a27bfb55dd768ae81ca8716db2da343
SHA1 55da0f4282bd838f72f435a5d4d24ac15b04482b
SHA512 d9bb49d2f282ed09c351a1d8eb2540781e6a7fb39265473fd59d146bfc162f27a4ab1405301ed7395c12929a80551a399437d7d794d7ac48650e9037b60eb69c
SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyq:u
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp1F0D.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp1F0D.tmp
Size 172KB
SHA256 27c945ccb84aa024f1f063701327e829a7ef3a7ede4a43b2febbb1dddbdf8740
MD5 2634fa3a332c297711cb59d43f54ffce
SHA1 8e2b68d0ee4e792efb1945ba86eceb87f07087d2
SHA512 84e4799b9b18a7cc7be685c793a9b4fb135ea331d1d235fe823e1d7091130f131ab2fbad1da4dea795e82547aa16b00f4e2a9faaa96cb522d795f9abfda2fc53
SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyK:u
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp1F1E.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp1F1E.tmp
Size 276KB
SHA256 a188a969de50b46195088581c04db89ecb3ae129a1d48f92a6f0278b69e12a27
MD5 727d249fde8c7eaf5c6edb7e1a66a132
SHA1 1edf420c80c5ee1997e4a2c1f42a7be1b259799c
SHA512 e9837bd462fcdb18ad54acf0982c3fe5e8f1acc6f90f92e632c58ee3df8063cc861655e14477713a4b8febb9f5f79bf069ae2bb788be401af3b2b15692ab621b
SSDEEP 1536:VFHDdToM+32yzefXoTvMeQVWBytFz1zHUXLh+mBCw:Xaz/zePJWMtFzFECw
TLSH
T11D54D2199CD3C617CF5B83B0A8EA87B6FD379B12099EE35377884F0EA6D20F29414149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtmps.exe

Path C:\Users\Admin\AppData\Local\Temp\wtmps.exe
Size 276KB
SHA256 3b20c853d4ca23240cd338b8cab16f1027c540ddfe9c4ffdca1624d2f923b373
MD5 75c1467042b38332d1ea0298f29fb592
SHA1 f92ea770c2ddb04cf0d20914578e4c482328f0f8
SHA512 5c47c59ad222e2597ccdf2c100853c48f022e933f44c279154346eacf9e7e6f54214ada541d43a10424035f160b56131aab206c11512a9fd6ea614fbd3160aa0
SSDEEP 6144:Xaz/zwzFEN3MmUGvSQagFwDeSv3BU9T4/XGOUYM/mVz:Iz8qamFVa1D69T4RMmVz
TLSH
T16354121B18B78123F4665570A9E107C18F7E5A0732A58B2FCF61CC3E46E09698967EF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usd.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\Caches\Files\usd.dll
Size 99KB
SHA256 d3a46f71aa7467920b16b64c9d17eaf6c4e147f41cd1390dccff01e4a81f8dfa
MD5 f1c9f4a1f92588aeb82be5d2d4c2c730
SHA1 3dc5a017b15ba74fae2342937380905bf7e8fbd5
SHA512 6171e740ce318d8fc35c92663684f2c35e7b5374c9a8ce6f4dc1c28c9ae62064f9cf44116266c650089bd5a3d328e87f9bdbd63ac1123e0a33ce52a1d21cffad
SSDEEP 1536:AfVMTLl0+j+R3S6CVaTqifclr7MB3tY0ZHp8FkK4+3IOqFnToIfwCBztSoRa6A:Fl67CVgBbNEfZqtTBfwCptSw/A
TLSH
T16FA3AD0276E0C977C0B2407488DA5F3DAFBF765147359D839B4C976D2E70B60EA1A2CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launch.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe
Size 172KB
SHA256 6a7093440420306cf7de53421a67af8a1094771e0aab9535acbd748d08ed766c
MD5 daac1781c9d22f5743ade0cb41feaebf
SHA1 e2549eeeea42a6892b89d354498fcaa8ffd9cac4
SHA512 190a7d5291e20002f996edf1e04456bfdff8b7b2f4ef113178bd42a9e5fd89fe6d410ae2c505de0358c4f53f9654ac1caaa8634665afa6d9691640dd4ee86160
SSDEEP 3072:ng2TyMj3tEcWMkc5tTBfZOVxtDH2g3zd3jceABCODJRCyA:n7xqcWxc5tTBsJWKFGUOfCl
TLSH
T10E04BE193A9089B2C0BFD0B7C0D5BB28F77732321322D94B679C96750D62776F6122DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arc.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\Identities\Admin\arc.dll
Size 1.0MB
SHA256 126593b3672e6985fe4e4903d656040e16a69264faf91b1a416ef00565e17e7c
MD5 2d9df706d1857434fcaa014df70d1c66
SHA1 75a65dd394941cd78234ee100d68c8d2f53f77c6
SHA512 bc476a3aaf54323f1e77bb5effc05c407a1034a42b495da3a374f2253002ba948929ebaaaf52a5204095aa0d66c740f5a2828e2fd3c46749544580966024cacc
SSDEEP 24576:XitBcqPTSNCs8Fm6nQbkkcCZIkj3tTkgbGqt/dKcMM1Wy/:SIqriCsmm6nYqkjdTkgSqNdKcMs/
TLSH
T15925CF1139E0C5B8C1A74233CA1D7BB5F1F9D3644E3588476B8C0B6C6F79A8AD216E1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WdExt.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
Size 1.7MB
SHA256 66b222c6784e59812e9d24a779a4eb1f1e7fadef2437406fc99d50cd70acb127
MD5 55d49c49ecdeb9b9c601a4768add26b3
SHA1 50aca97e2e0fef5dd9109b0db32433fff5aeb7e4
SHA512 681c90d531f73dfaf4fb5d28f5fc4793b03ffe9e4435b754704dd56350220cd0e19ff113e90a09ef73360340399e4ae73700951893cb4f381f2ee69148de864b
SSDEEP 24576:OXdVtTj2i64T+jdxQCfgOFD3WSwd2QtBBw6xxhVxQtmibjOhZaiRu/4oMaop0UNY:mbTChxKCnFnQXBbrtgb/iQvu0UHOD
TLSH
T15A85DD152790CCA1F36FC07683E56E79B5B329213733D8966E4895312BF2E2FE381196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sha.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\Repairs\sha.dll
Size 89KB
SHA256 0b059565160c180df60470349770a6dd225981a8051639385bb49d33d2a73632
MD5 6a9461f260ebb2556b8ae1d0ba93858a
SHA1 01e14b87b69dce8272d84669f44f81d685dcf7c5
SHA512 263041e149a2e7cd95c16a614175179b5e1fea8eca137aac02d903b45f107ad1c9467a3e790408caca7250b0cb83da77aa73887239f25b7b93b221cffc02772b
SSDEEP 1536:h5QmUNtCKcKcyR2zh5Te2D6grD5Z3MIOKFnToIf+VHutHaA:hItC42zhlGgrXCKtTBf+VOtHaA
TLSH
T1CF939D22B2D08577C0B2843A44D65B3DEFBB362243355D935F4C6A691D71AA0EB273CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fil.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\Shared\Modules\fil.dll
Size 126KB
SHA256 ad01ab517cf1c9f5d30b3ea749c91c5c8fc613e771d25287483023d2066e1523
MD5 d0c9ada173da923efabb53d5a9b28d54
SHA1 0cefe568d2a06bd44fe9dfab65b1e27bd34def11
SHA512 6919ca6d0eb94402b470ef131362aa1fd35be994161b857fabf4a7aca7710a757bf490ad6e2f8b5618b53e9bf3390638a9340642035e6a71ea4eedc94e403e27
SSDEEP 3072:h3Qj8Ajn/VzK9fmfiCunng05hlOytTBfitzImtw+FU16DA:h3Qjtz/qf1Cung05hlOytTBN+Fqb
TLSH
T1AEC39E1236D0C473D1B5013848E95B3EABBB7D318B7A4983D748BA582D74AA0EF167C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

att.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Addins\att.dll
Size 229KB
SHA256 41a712fd2111c5ddec6fe58a29c80f19923cc72e88b4508d5a3daeb236ddf1b8
MD5 fffa05401511ad2a89283c52d0c86472
SHA1 99a9fbcac39b9522d1d628620b69c4cd7cc110f1
SHA512 468b9b50b342d0debbf81e37983c600e171bd35ab38680f495a8f52d8476735876e2329228d009f2631356e99770371740f97d77235383db3e00f7ecd12db6b3
SSDEEP 6144:/fbIMsWVgui7vKbeDb2J1dZSbgOtTBpkFqAcURC:X3xu7vKiDb2nnegOtTnkFDC
TLSH
T18C34BF33B680C637C0721539DCEA87A9267E79202F2528C7BFE85F4C6F7129196192D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Admin0.bat

Path C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat
Size 129B
SHA256 b3c704b1a728004fc5e25899d72930a7466d7628dd6ddd795b3000897dfa4020
MD5 d1073c9b34d1bbd570928734aacff6a5
SHA1 78714e24e88d50e0da8da9d303bec65b2ee6d903
SHA512 4f2b9330e30fcc55245dc5d12311e105b2b2b9d607fbfc4a203c69a740006f0af58d6a01e2da284575a897528da71a2e61a7321034755b78feb646c8dd12347f
TLSH
T1B6B09B1243C8C70E7C67B1974B75544C517446C57B447509DB45C48D325191CFCDD556
MD5 SHA1 SHA512 TLSH

Submit Download

Admin1.bat

Path C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat
Size 125B
SHA256 b473734afd97062729f49a1a88af4bbfe17458b67a390e797460220b97809f3b
MD5 7cac7cc23804d658d5c8effbc3ecc5fc
SHA1 e04d1fbc94861f654c17697ec3238256a3d1fdc6
SHA512 92d77aaa04c0085963e2633060160ad178126fb3009ad9705cfea1a5d4b0f0f3b6a15f2ae8215235fedb53f52abdc52c8791f19e89656d0af2eccbbe66905d57
TLSH
T1C6B09B5603C9D70E745260570779555D50B84AC63E947615C611848C314580CFC57546
MD5 SHA1 SHA512 TLSH

Submit Download

Admin1.bat

Path C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat
Size 194B
SHA256 129e8751d8bbe0d563b7fc954ae5e440ede54b463d9c4032b704cf7d811ab494
MD5 020a467b4e1b678299c6e9dbbe65e1e2
SHA1 88ae2c0a10b82492f39f78831086478d99c5326d
SHA512 7581d685886d10d0aa8c26c683f42a8f4d2e23c4a97fd3e1e789b6b1f501569d0530655bd9b627422b72a12e9b5b3c7d55b5a08e330f1ee313033f98047d98bd
TLSH
T1F9C0120A4AC6C7DD6444A0570B7551DDD1B85AE93F893716C612C55E218150DB993712
MD5 SHA1 SHA512 TLSH

Submit Download

Admin2.bat

Path C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat
Size 102B
SHA256 4e7d460b8dc9f2c01b4c5a16fb956aced10127bc940e8039a80c6455901ea1f0
MD5 3ca08f080a7a28416774d80552d4aa08
SHA1 0b5f0ba641204b27adac4140fd45dce4390dbf24
SHA512 0c64aa462ff70473ef763ec392296fe0ea59b5340c26978531a416732bc3845adf9ca7b673cb7b4ba40cc45674351206096995c43600fccbbbe64e51b6019f01
TLSH
T114B0121243CBCF0D148060D70775A1CCC0740C983F947714DF11C84C314080DFDC6A41
MD5 SHA1 SHA512 TLSH

Submit Download

mydll.dll

Path C:\Users\Admin\AppData\Roaming\Temp\mydll.dll
Size 382KB
SHA256 f0a24c3d4e5f5948dd84a9db1206e07b904c6c12ff9e20de2a2ad7d6b04c6946
MD5 311930917a26dd0cc3754133b6ffc342
SHA1 3c6baf292592dc733d71c2b984a7b75070b43aff
SHA512 b8401339f12ebf39f9ec6ffad3d6db7188387d9fe997d74f11a0d324389758b777b14f4f4a732879259955c428db6d01644f541c9f21db90e2c7eb94b15ca2f0
SSDEEP 6144:ED1coZXbdacDWZyehpRHy9H4dIBXCN2x/DMVP1tF+jBSVJ6:EDhZLdN9eNXdIlCNuorJ6
TLSH
T106842942AAE95420D2F357306A7DBB39212E78785BA0ECDFB24057FDA420AC19F75353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mscaps.exe

Path C:\Windows\SysWOW64\mscaps.exe
Size 200KB
SHA256 2c4c9ec8e9291ba5c73f641af2e0c3e1bbd257ac40d9fb9d3faab7cebc978905
MD5 78d3c8705f8baf7d34e6a6737d1cfa18
SHA1 9f09e248a29311dbeefae9d85937b13da042a010
SHA512 9a3c3175276da58f1bc8d1138e63238c8d8ccfbfa1a8a1338e88525eca47f8d745158bb34396b7c3f25e4296be5f45a71781da33ad0bbdf7ad88a9c305b85609
SSDEEP 3072:34LGpbMkFAIk2GOytDDE1wYa+6NjQYryupFsjzuoAxWhZWkZu4pUBRrwCP8T:FbnDk2HcMZYQYcSovhc7AAcCPe
TLSH
T15114F15B2CB38933F462497542E046FA4FFDAD1332F664EFCF2849C11DA09659528AF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1076-53-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2596-214-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2596-238-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2596-227-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2596-210-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2596-229-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2596-191-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2596-228-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2596-222-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2596-223-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2596-224-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2596-225-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2596-226-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4936-217-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5552-47-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5620-20-0x0000000010000000-0x0000000010015000-memory.dmp

Download

memory/5852-19-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5852-32-0x0000000000400000-0x000000000043F000-memory.dmp

Download