6997f39a54aeb79163df675624b494c8da05dc64bfac0be8d0fdb627044dd455

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-25_dc3578809789c0d727a5eaeb490bc993_elex_rhadamanthys_stop.exe
Size 2.3MB
Sample260925-xecbrstgna
SHA256 6997f39a54aeb79163df675624b494c8da05dc64bfac0be8d0fdb627044dd455
MD5 dc3578809789c0d727a5eaeb490bc993
SHA1 8e0ab0f07ed9792b6d81fe98c21d251b056e432e
SHA512 cd2d9907e6aa475ce0fac94541ae1dcec8310965162bdb1af09a4aed4df3429ce60256a80f2b00e2799073ad8ca7587adda7edd049a7650f0386eaef1f1e39c5
SSDEEP 3072:2xh0oLKfdAkFDHj+nStkJOh+p3ZSNwG0qE/6GcX:Ah0XSOqnvohPa16
TLSH
T192B5CF0076D0FCBBE5B5467148B69B319B3AFD365B2ACC83B358564A0932184B7763CB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

adware defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024669-10.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables referencing many email and collaboration clients. Observed in information steale 1 IoCs

resource	yara_rule
behavioral1/files/0x000700000002466e-21.dat	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	2026-09-25_dc3578809789c0d727a5eaeb490bc993_elex_rhadamanthys_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\recovery = "C:\\Windows\\system32\\ctffwcpptp.exe"	2026-09-25_dc3578809789c0d727a5eaeb490bc993_elex_rhadamanthys_stop.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}\Version = "1,1,1,2"	2026-09-25_dc3578809789c0d727a5eaeb490bc993_elex_rhadamanthys_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}\ComponentID = "DOTNETFRAMEWORKS"	2026-09-25_dc3578809789c0d727a5eaeb490bc993_elex_rhadamanthys_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}\DontAsk = "2"	2026-09-25_dc3578809789c0d727a5eaeb490bc993_elex_rhadamanthys_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}\IsInstalled = "1"	2026-09-25_dc3578809789c0d727a5eaeb490bc993_elex_rhadamanthys_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}\ = "Themes Setup"	2026-09-25_dc3578809789c0d727a5eaeb490bc993_elex_rhadamanthys_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}	2026-09-25_dc3578809789c0d727a5eaeb490bc993_elex_rhadamanthys_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}\StubPath = "rundll32.exe C:\\Windows\\system32\\themeuichk.dll,ThemesSetupInstallCheck"	2026-09-25_dc3578809789c0d727a5eaeb490bc993_elex_rhadamanthys_stop.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}\IconsBinary = 43003a005c00570069006e0064006f00770073005c00730079007300740065006d00330032005c006e006500740069006e0066006f006600770063002e006500780065000000	2026-09-25_dc3578809789c0d727a5eaeb490bc993_elex_rhadamanthys_stop.exe

Executes dropped EXE 36 IoCs

pid	Process
6040	srvdhcphost.exe
772	smss.exe
5476	smss.exe
4720	smss.exe
440	smss.exe
204	smss.exe
4300	smss.exe
5104	smss.exe
4396	smss.exe
2676	smss.exe
4792	smss.exe
1044	smss.exe
3408	smss.exe
812	smss.exe
3760	smss.exe
5976	smss.exe
1780	smss.exe
5536	smss.exe
876	smss.exe
2572	smss.exe
5900	smss.exe
2172	smss.exe
2056	smss.exe
1796	smss.exe
312	smss.exe
2984	smss.exe
2144	smss.exe
4608	smss.exe
4412	smss.exe
5600	smss.exe
3228	smss.exe
5088	smss.exe
3892	smss.exe
1520	smss.exe
1044	smss.exe
1480	smss.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\recovery = "C:\\Windows\\system32\\ctffwcpptp.exe"	2026-09-25_dc3578809789c0d727a5eaeb490bc993_elex_rhadamanthys_stop.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\D:\	srvdhcphost.exe
\??\F:\	srvdhcphost.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\ = "AcroIEHelperStub"	2026-09-25_dc3578809789c0d727a5eaeb490bc993_elex_rhadamanthys_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\NoExplorer = "1"	2026-09-25_dc3578809789c0d727a5eaeb490bc993_elex_rhadamanthys_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}	2026-09-25_dc3578809789c0d727a5eaeb490bc993_elex_rhadamanthys_stop.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\pptpobjdisp.exe	2026-09-25_dc3578809789c0d727a5eaeb490bc993_elex_rhadamanthys_stop.exe
File created	C:\Windows\SysWOW64\ctffwcpptp.exe	2026-09-25_dc3578809789c0d727a5eaeb490bc993_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\SysWOW64\ctffwcpptp.exe	2026-09-25_dc3578809789c0d727a5eaeb490bc993_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\SysWOW64\pptplsasvc.ocx	2026-09-25_dc3578809789c0d727a5eaeb490bc993_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\SysWOW64\hostdnsobj.exe	2026-09-25_dc3578809789c0d727a5eaeb490bc993_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\SysWOW64\netinfofwc.exe	2026-09-25_dc3578809789c0d727a5eaeb490bc993_elex_rhadamanthys_stop.exe
File created	C:\Windows\SysWOW64\pptpobjdisp.exe	2026-09-25_dc3578809789c0d727a5eaeb490bc993_elex_rhadamanthys_stop.exe
File created	C:\Windows\SysWOW64\pptplsasvc.ocx	2026-09-25_dc3578809789c0d727a5eaeb490bc993_elex_rhadamanthys_stop.exe
File created	C:\Windows\SysWOW64\dhcppptplsa.exe	2026-09-25_dc3578809789c0d727a5eaeb490bc993_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\SysWOW64\dhcppptplsa.exe	2026-09-25_dc3578809789c0d727a5eaeb490bc993_elex_rhadamanthys_stop.exe
File created	C:\Windows\SysWOW64\hostdnsobj.exe	2026-09-25_dc3578809789c0d727a5eaeb490bc993_elex_rhadamanthys_stop.exe
File created	C:\Windows\SysWOW64\netinfofwc.exe	2026-09-25_dc3578809789c0d727a5eaeb490bc993_elex_rhadamanthys_stop.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1376	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5076	6040	WerFault.exe	91

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	srvdhcphost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	srvdhcphost.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-25_dc3578809789c0d727a5eaeb490bc993_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	srvdhcphost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ielowutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe

Modifies Internet Explorer settings 1 TTPs 44 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1039bf90264ddd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b314b4e102993c4aba5dfc9fd3ab008a000000000200000000001066000000010000200000001501cb156cd69890163e2bfbe1bb8d67a80cb37b8c258b9c634e80f9b77cb511000000000e80000000020000200000006c3440f120b384b6f75a8628d9fbf96024c41422f9abd06f945d6c3769469134200000007372dc9c2b6455af2f55ab4efa1fe0c1e9092e279758e4c93820ece335e650db40000000a4090d27e390682f15eb9c65ba0ea3d7a9a702b66fbd0300be7ef3ccdceac501f4912996fe5e7f0cbaa1ab85aab544c230513b00877ee252a549e99247895722	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0082b93264ddd01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60f8fb94264ddd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "873661334"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 005f2097264ddd01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60935c99264ddd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Main	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b093808e264ddd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b314b4e102993c4aba5dfc9fd3ab008a000000000200000000001066000000010000200000001d34226bd448ce13229972bab6eca2439cc67ebe37bda0cf9bfa3f0fcfe136d1000000000e80000000020000200000002aaaff0669fc09237bdf7962fb9437626530116e08321745936b31ec91ddab0f200000006cc2e0444cad4b9635a26cb541b587ae60217b36ec21f7a236934b22b6df45ab40000000e42ca90f340bae0f11608c522bcd60bc99b4a015efca2519ce547a2ae7e17f2d84bcdf78255e0619bc06dd944164c9f03f7945d392a6efc6d875389b2d3e1000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 701eed9a264ddd01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b314b4e102993c4aba5dfc9fd3ab008a00000000020000000000106600000001000020000000ec3f806a97d1aa7dab1a83b03cb7cdea1a7ec58e7f437833dedf0c9b828cb673000000000e8000000002000020000000dbcd49ee467cfc822d17b9e8ffe0675c3948783a0ec5b928c7b8dc8f900d806520000000452cb16d3bd9971fbb077514eaea564d217673d12ff035ad4778f5038905f4c4400000004c2e859e9e6e2ef08730502faf69db5d9598026e8681fb602ffee704711fb7922d72ed692d56151b7b451facaf6ac9796e2e4795ec356cdd2c698e365ac1e002	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "677"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b314b4e102993c4aba5dfc9fd3ab008a00000000020000000000106600000001000020000000d1199c5b6fa894a28bbfa767ed163366f5ffd7424906da7ea5ff9673a1119089000000000e8000000002000020000000d9587d0312e583df54816f1c162adf57f438545ce0a6736bf4bbf6eecdf7c63820000000a42ab5d49f93d9b2fe7f8434ed1d1c08f85e957764d4389c36529a9c44f756f5400000002457e4855927a068610b3ff876df3bff8711288ca05296235087a6053cec7083ab136ff91285bd4952a8c3386975ae52a764fa71a4c9798f183fb66d0a6e9f0e	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b314b4e102993c4aba5dfc9fd3ab008a00000000020000000000106600000001000020000000419a16f5be4f17ec7d814fe68da8a6ade494b8800cbccf941cbf657895b3f87c000000000e80000000020000200000003222ee7ad85e3898f67c9fe0dee5c5b21889d379faed438c7c51e7f4218c998320000000727760306fbd43ba92e6c50f41e40f297ef5375cec32ef4b4fe639a3a3e11ad640000000571e24a87833e3c55be07bf1793d4a458ee0ebbef8d4eaae93574040e32e935eba4a2b7b1ee728db43afeee414e0a7485663e82ea3a69c4556b7f6a117225a31	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b314b4e102993c4aba5dfc9fd3ab008a000000000200000000001066000000010000200000009fb2bffc32fdbd4d9c9077a3485dd5e82da38e77eed2655aa575e87475233a1b000000000e8000000002000020000000926f9df479594581ef0c63436fbe45f0076b0b17dfda495a1bfcb2483c41f5dc20000000b0686f646a4d2bdf2b6bb1074cf7d3e17c8e2da24ea20083111ea38742cc7fb840000000daa20546fc39c739e4a6271fd83392219492cf162b46d6c41258466cb0e1b10ba309a32c58da3748c52c44720cbaed07d6fa5a7331949e53b0e9c970da88e634	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70eee89c264ddd01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31280414"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "874130130"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31280414"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b314b4e102993c4aba5dfc9fd3ab008a00000000020000000000106600000001000020000000797b6d3817754e7d1d96ad1851220e0768328e681da51651e585bf46babedbac000000000e800000000200002000000088e4a0aa23fa0155d4316e4912121842b9c6fbf07b3d45b18a8726c36f30ffb020000000bf7f27bfa307d6fd54ac988bf951efe35add69a13b359f1aa3ac7e5ecb951b47400000005b75fa9d33f2cc301fd2ed5994a33aebc524a6e865540e80abdc57fc0e740d6e5330ed08f122f6492108bed7dbe26db421480bdbbcca5844d1fa6d0ce096e297	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b314b4e102993c4aba5dfc9fd3ab008a0000000002000000000010660000000100002000000037f5d7d4777b2dbb74311bd439c395b3d2ab949290905694ee2e241d2400e615000000000e80000000020000200000002ac378fcb8054d53c21d2504e4730ae4e63ebf80068ba5376dd4001460ca6db6200000008fb40f8f87c2757170241d37ba6401e42ffb61e7e3814494a5a91f603ed7e26c400000008217cec50ecb00f600e9980778c0765d6799288c198f2c93c0beb2194dd30e6b5ec356b1ea6c992a9e0bb787f3273858258c4cf0088f49fba4fe36f20dbea488	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b04d029e264ddd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b314b4e102993c4aba5dfc9fd3ab008a0000000002000000000010660000000100002000000057554b2f3f4a2d89b16da909df883896887df030b6ea67a93d2b474aab62a723000000000e80000000020000200000002523c121a2682fdacac2f9fc8363b33dbb6e2a8d4207d69e2131d2808d963c0b20000000ee34aa9f7b42c648918cd669a135eb720eb331c2e9b99d876c35d760decedc8d400000000998794c67dd535c6c1e745389772333cee0cb82f70d8dae51809b7ecab0595122824d7ad0f1daf7750fd7e2cf63d3d0927ea888900fe4bf2ba553c99d9c400e	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00089191264ddd01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b314b4e102993c4aba5dfc9fd3ab008a000000000200000000001066000000010000200000000e7d21aa41c18b70682b11654995cffddad3c9254ac12feacbe744f52457f515000000000e80000000020000200000009958b84d044e9b83fefc13422e915d79249a175c9967283d2cd11f2c67ac5f87200000008fe5d6424387bb12622bfe64aba4155c237b4dfa1aba2ae8006c656015c01f264000000089dd707c888c854ae984c55bb63fba2ac36f69507784f08f6025fa803dd672a61f3287830f595c5f03e8506e9ff629c44e1c1879ccc72498db4669bac0ab63fc	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Check_Associations = "no"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{5F645447-B911-11F1-8FDF-7AAFC66160C5} = "0"	iexplore.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}	2026-09-25_dc3578809789c0d727a5eaeb490bc993_elex_rhadamanthys_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\ = "Adobe PDF Link Helper"	2026-09-25_dc3578809789c0d727a5eaeb490bc993_elex_rhadamanthys_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\InprocServer32	2026-09-25_dc3578809789c0d727a5eaeb490bc993_elex_rhadamanthys_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\InprocServer32\ = "C:\\Windows\\SysWow64\\pptplsasvc.ocx"	2026-09-25_dc3578809789c0d727a5eaeb490bc993_elex_rhadamanthys_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\InprocServer32\ThreadingModel = "Apartment"	2026-09-25_dc3578809789c0d727a5eaeb490bc993_elex_rhadamanthys_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\ProgID	2026-09-25_dc3578809789c0d727a5eaeb490bc993_elex_rhadamanthys_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\ProgID\ = "AcroIEHelperShim.AcroIEHelperShimObj.1"	2026-09-25_dc3578809789c0d727a5eaeb490bc993_elex_rhadamanthys_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\VersionIndependentProgID	2026-09-25_dc3578809789c0d727a5eaeb490bc993_elex_rhadamanthys_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\VersionIndependentProgID\ = "AcroIEHelperShim.AcroIEHelperShimObj"	2026-09-25_dc3578809789c0d727a5eaeb490bc993_elex_rhadamanthys_stop.exe

Runs regedit.exe 1 IoCs

pid	Process
5940	regedit.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3320	2026-09-25_dc3578809789c0d727a5eaeb490bc993_elex_rhadamanthys_stop.exe
3320	2026-09-25_dc3578809789c0d727a5eaeb490bc993_elex_rhadamanthys_stop.exe
6040	srvdhcphost.exe
6040	srvdhcphost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3320	2026-09-25_dc3578809789c0d727a5eaeb490bc993_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	6040	srvdhcphost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1768	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1768	iexplore.exe
1768	iexplore.exe
6000	IEXPLORE.EXE
6000	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3320 wrote to memory of 6040	3320	2026-09-25_dc3578809789c0d727a5eaeb490bc993_elex_rhadamanthys_stop.exe	91
PID 6040 wrote to memory of 1376	6040	srvdhcphost.exe	96
PID 1376 wrote to memory of 772	1376	cmd.exe	98
PID 1376 wrote to memory of 5232	1376	cmd.exe	100
PID 1376 wrote to memory of 5476	1376	cmd.exe	101
PID 1376 wrote to memory of 5856	1376	cmd.exe	108
PID 1376 wrote to memory of 4720	1376	cmd.exe	109
PID 1376 wrote to memory of 4332	1376	cmd.exe	111
PID 1376 wrote to memory of 440	1376	cmd.exe	112
PID 1376 wrote to memory of 5916	1376	cmd.exe	113
PID 1376 wrote to memory of 204	1376	cmd.exe	114
PID 1376 wrote to memory of 4180	1376	cmd.exe	115
PID 1376 wrote to memory of 4300	1376	cmd.exe	116
PID 1376 wrote to memory of 4452	1376	cmd.exe	121
PID 1376 wrote to memory of 5104	1376	cmd.exe	122
PID 6040 wrote to memory of 5940	6040	srvdhcphost.exe	123
PID 1768 wrote to memory of 6000	1768	iexplore.exe	127
PID 1376 wrote to memory of 1672	1376	cmd.exe	130
PID 1376 wrote to memory of 4396	1376	cmd.exe	131
PID 1376 wrote to memory of 3856	1376	cmd.exe	135
PID 1376 wrote to memory of 2676	1376	cmd.exe	136
PID 1376 wrote to memory of 5252	1376	cmd.exe	137
PID 1376 wrote to memory of 4792	1376	cmd.exe	138
PID 1376 wrote to memory of 5412	1376	cmd.exe	139
PID 1376 wrote to memory of 1044	1376	cmd.exe	140
PID 1376 wrote to memory of 2092	1376	cmd.exe	141
PID 1376 wrote to memory of 3408	1376	cmd.exe	142
PID 1376 wrote to memory of 4336	1376	cmd.exe	143
PID 1376 wrote to memory of 812	1376	cmd.exe	144
PID 1376 wrote to memory of 748	1376	cmd.exe	145
PID 1376 wrote to memory of 3760	1376	cmd.exe	146
PID 1376 wrote to memory of 5816	1376	cmd.exe	148
PID 1376 wrote to memory of 5976	1376	cmd.exe	149
PID 1376 wrote to memory of 1952	1376	cmd.exe	150
PID 1376 wrote to memory of 1780	1376	cmd.exe	151
PID 1376 wrote to memory of 5068	1376	cmd.exe	153
PID 1376 wrote to memory of 5536	1376	cmd.exe	154
PID 1376 wrote to memory of 4944	1376	cmd.exe	155
PID 1376 wrote to memory of 876	1376	cmd.exe	156
PID 1376 wrote to memory of 5936	1376	cmd.exe	157
PID 1376 wrote to memory of 2572	1376	cmd.exe	158
PID 1376 wrote to memory of 4352	1376	cmd.exe	159
PID 1376 wrote to memory of 5900	1376	cmd.exe	160
PID 1376 wrote to memory of 1276	1376	cmd.exe	161
PID 1376 wrote to memory of 2172	1376	cmd.exe	162
PID 1376 wrote to memory of 2988	1376	cmd.exe	163
PID 1376 wrote to memory of 2056	1376	cmd.exe	164
PID 1376 wrote to memory of 952	1376	cmd.exe	165
PID 1376 wrote to memory of 1796	1376	cmd.exe	166
PID 1376 wrote to memory of 4380	1376	cmd.exe	167
PID 1376 wrote to memory of 312	1376	cmd.exe	168
PID 1376 wrote to memory of 2396	1376	cmd.exe	170
PID 1376 wrote to memory of 2984	1376	cmd.exe	171
PID 1376 wrote to memory of 1056	1376	cmd.exe	172
PID 1376 wrote to memory of 2144	1376	cmd.exe	173
PID 1376 wrote to memory of 4392	1376	cmd.exe	174
PID 1376 wrote to memory of 4608	1376	cmd.exe	175
PID 1376 wrote to memory of 3292	1376	cmd.exe	176
PID 1376 wrote to memory of 4412	1376	cmd.exe	177
PID 1376 wrote to memory of 4712	1376	cmd.exe	178
PID 1376 wrote to memory of 5600	1376	cmd.exe	179
PID 1376 wrote to memory of 3068	1376	cmd.exe	180
PID 1376 wrote to memory of 3228	1376	cmd.exe	181
PID 1376 wrote to memory of 3888	1376	cmd.exe	182

Views/modifies file attributes 1 TTPs 34 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4336	attrib.exe
4944	attrib.exe
3068	attrib.exe
4196	attrib.exe
5856	attrib.exe
4332	attrib.exe
3756	attrib.exe
4380	attrib.exe
2396	attrib.exe
6016	attrib.exe
5916	attrib.exe
3856	attrib.exe
5412	attrib.exe
952	attrib.exe
4180	attrib.exe
5068	attrib.exe
5936	attrib.exe
4352	attrib.exe
1276	attrib.exe
4392	attrib.exe
2092	attrib.exe
2988	attrib.exe
4712	attrib.exe
748	attrib.exe
5816	attrib.exe
1056	attrib.exe
5252	attrib.exe
1952	attrib.exe
3292	attrib.exe
3888	attrib.exe
3340	attrib.exe
5232	attrib.exe
4452	attrib.exe
1672	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-25_dc3578809789c0d727a5eaeb490bc993_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-25_dc3578809789c0d727a5eaeb490bc993_elex_rhadamanthys_stop.exe"
1⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3320
- C:\Users\Admin\AppData\Local\Temp\srvdhcphost.exe
  "C:\Users\Admin\AppData\Local\Temp\srvdhcphost.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6040
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1.tmp.cmd "C:\Users\Admin\AppData\Local\Temp\SRVDHC~1.EXE""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1376
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:772
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\SRVDHC~1.EXE"
      4⤵
      Views/modifies file attributes
      PID:5232
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5476
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\SRVDHC~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:5856
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4720
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\SRVDHC~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4332
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      PID:440
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\SRVDHC~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:5916
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:204
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\SRVDHC~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4180
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4300
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\SRVDHC~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4452
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5104
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\SRVDHC~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:1672
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4396
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\SRVDHC~1.EXE"
      4⤵
      Views/modifies file attributes
      PID:3856
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2676
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\SRVDHC~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:5252
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4792
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\SRVDHC~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:5412
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1044
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\SRVDHC~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2092
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      PID:3408
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\SRVDHC~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4336
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      PID:812
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\SRVDHC~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:748
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3760
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\SRVDHC~1.EXE"
      4⤵
      Views/modifies file attributes
      PID:5816
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5976
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\SRVDHC~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:1952
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      PID:1780
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\SRVDHC~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:5068
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5536
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\SRVDHC~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4944
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:876
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\SRVDHC~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:5936
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2572
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\SRVDHC~1.EXE"
      4⤵
      Views/modifies file attributes
      PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5900
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\SRVDHC~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:1276
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2172
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\SRVDHC~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2988
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2056
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\SRVDHC~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:952
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      PID:1796
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\SRVDHC~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4380
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:312
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\SRVDHC~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2396
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2984
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\SRVDHC~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:1056
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2144
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\SRVDHC~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4392
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4608
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\SRVDHC~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3292
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4412
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\SRVDHC~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4712
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5600
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\SRVDHC~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3068
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      PID:3228
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\SRVDHC~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3888
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5088
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\SRVDHC~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:6016
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3892
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\SRVDHC~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4196
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1520
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\SRVDHC~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3340
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1044
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\SRVDHC~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3756
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1480
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6040 -s 596
    3⤵
    - Program crash
    PID:5076
- - C:\Windows\SysWOW64\regedit.exe
    regedit.exe /s C:\Users\Admin\AppData\Local\Temp\win5.tmp
    3⤵
    - Modifies Internet Explorer settings
    - Runs regedit.exe
    PID:5940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 6040 -ip 6040
1⤵
PID:5132

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:4000

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1768 CREDAT:17410 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:6000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 8f5ef418109cb2dfe12e0069395efad2d71b6dfbe60ffd06cbcd1b01c6aae8b6
MD5 5e1089528f73474550931f4537c16b96
SHA1 46cb9555bff567e95686144d594393078f191488
SHA512 d60a2f8357acb41f3f0ad8c0e38df61a2aaa9b4a885267a2e0e6fa80c66aba5de404a5e53541f16e441b5b212ce3adba40c6e9958c4ccb48b41e94183d05dbc7
TLSH
T1B7F0DC95A47BA8A03E52AADC1ABDC33D3530E1FA406226667038D9E1062666C730F02A
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 2bd84ea47b7d03b52a510359c7ac26fbda44c924f3885aa0023fc68b4cefe0e2
MD5 ded6245837e55b16af1355210914c684
SHA1 fb0472a5ce0ac027fd5081ed5f7f75240f0b1455
SHA512 f8698858e58f64cabb0098b2161825da08f1d7fec5333379d0db02f7e9256212b78d9333ff0d658122670df6ae4962f9e4536d83fc21970ec1063c8638a1a409
TLSH
T1A5E0C03811F6411EE5F4D0355BC6B4314559F033042993B829C46B08B703E00AC53A25
MD5 SHA1 SHA512 TLSH

Submit Download

down[1]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GPBSYQOV\down[1]
Size 748B
SHA256 39e7de847c9f731eaa72338ad9053217b957859de27b50b6474ec42971530781
MD5 c4f558c4c8b56858f15c09037cd6625a
SHA1 ee497cc061d6a7a59bb66defea65f9a8145ba240
SHA512 d60353d3fbea2992d96795ba30b20727b022b9164b2094b922921d33ca7ce1634713693ac191f8f5708954544f7648f4840bcd5b62cb6a032ef292a8b0e52a44
TLSH
T14F0199B5859E790C591F1F65D83E483EBC412FFD8C6071977396DA13179518C88CE1C8
MD5 SHA1 SHA512 TLSH

Submit Download

httpErrorPagesScripts[1]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GPBSYQOV\httpErrorPagesScripts[1]
Size 11KB
SHA256 65cc039890c7ceb927ce40f6f199d74e49b8058c3f8a6e22e8f916ad90ea8649
MD5 9234071287e637f85d721463c488704c
SHA1 cca09b1e0fba38ba29d3972ed8dcecefdef8c152
SHA512 87d691987e7a2f69ad8605f35f94241ab7e68ad4f55ad384f1f0d40dc59ffd1432c758123661ee39443d624c881b01dcd228a67afb8700fe5e66fc794a6c0384
SSDEEP 192:x20iniOciwd1BtvjrG8tAGGGVWnvyJVUrUiki3ayimi5ezLCvJG1gwm3z:xPini/i+1Btvjy815ZVUwiki3ayimi5f
TLSH
T14E4220ED3512067687CF182B2A2B934CBC7904551E22EDA0846C88D1B5F5FDDF5ABBC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NewErrorPageTemplate[1]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UN11FRGI\NewErrorPageTemplate[1]
Size 1KB
SHA256 77b138ab5d0a90ff04648c26addd5e414cc178165e3b54a4cb3739da0f58e075
MD5 dfeabde84792228093a5a270352395b6
SHA1 e41258c9576721025926326f76063c2305586f76
SHA512 e256f603e67335151bb709294749794e2e3085f4063c623461a0b3decbcca8e620807b707ec9bcbe36dcd7d639c55753da0495be85b4ae5fb6bfc52ab4b284fd
TLSH
T1DD31678DDA02D053F3BB1C2A37A22711EA28454759569B387BE47704CFFA43D6211F8D
MD5 SHA1 SHA512 TLSH

Submit Download

errorPageStrings[1]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UN11FRGI\errorPageStrings[1]
Size 4KB
SHA256 a1270e90cea31b46432ec44731bf4400d22b38eb2855326bf934fe8f1b169a4f
MD5 d65ec06f21c379c87040b83cc1abac6b
SHA1 208d0a0bb775661758394be7e4afb18357e46c8b
SHA512 8a166d26b49a5d95aea49bc649e5ea58786a2191f4d2adac6f5fbb7523940ce4482d6a2502aa870a931224f215cb2010a8c9b99a2c1820150e4d365cab28299e
SSDEEP 96:z9UUiqRxqH211CUIRgRLnRynjZbRXkRPRk6C87Apsat/5/+mhPcF+5g+mOQb7A9o:JsUOG1yNlX6ZzWpHOWLia16Cb7bk
TLSH
T1DAA1536D95DA1A22254245B3060FD2E6AAC50D949320D3B8770CD37F378C6ECD2FA7C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dnserror[1]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W8OSE262\dnserror[1]
Size 2KB
SHA256 acdeb4966289b6ce46ecc879531f85e9c6f94b718aab521d38e2e00f7f7f7993
MD5 2dc61eb461da1436f5d22bce51425660
SHA1 e1b79bcab0f073868079d807faec669596dc46c1
SHA512 a88becb4fbddc5afc55e4dc0135af714a3eec4a63810ae5a989f2cecb824a686165d3cedb8cbd8f35c7e5b9f4136c29dea32736aabb451fe8088b978b493ac6d
TLSH
T197515121ACF499131132D585ACF6FE14FDF28153C305A888B0AD12AB6FBAF898D07129
MD5 SHA1 SHA512 TLSH

Submit Download

1.tmp.cmd

Path C:\Users\Admin\AppData\Local\Temp\1.tmp.cmd
Size 168B
SHA256 624acac79fdcfe30592f5321b4ab73d360f393dbcdbe8daa50fcce63c710f5dc
MD5 e7efc2c945a798b4dab3fe50f1524592
SHA1 0bb937ccd89e40c91c0e58b376873ef909fe805b
SHA512 e75840979404587aa15fd4d1e46707c33e32dca086ca72c7666045e14191e29857d06dc8ba737e69925c71b2e2d6a5ee3b63c36ecd2f32ae515f85a985d8f257
TLSH
T1E4C08CCF5A9C0C75AC650AB8BE29100A226EF0B7CA380146B4E22084D20A388CA94193
MD5 SHA1 SHA512 TLSH

Submit Download

advsec32.dll

Path C:\Users\Admin\AppData\Local\Temp\advsec32.dll
Size 4KB
SHA256 c9f5a19c7b11fd866483adc93aa5bc4bd3515bd995ca79297b227e3e5ef1a665
MD5 3adea70969f52d365c119b3d25619de9
SHA1 d303a6ddd63ce993a8432f4daab5132732748843
SHA512 c4d836fcbdab4c859a6fc0f849d1e41e98c7e23fc0fe0fe0a09cb68e9a57d60b2ae9ad46762d7a5e05db28d6179bd431ef179ee1f9ff016db74cc3b1d74ed7f8
TLSH
T1DA81333393E40573F07E4BB7189686E7BBA45620835048199667250A66256F7FC2DF12
MD5 SHA1 SHA512 TLSH

Submit Download

smss.exe

Path C:\Users\Admin\AppData\Local\Temp\smss.exe
Size 18KB
SHA256 4aaa74f294c15aeb37ada8185d0dead58bd87276a01a814abc0c4b40545bf2ef
MD5 b3624dd758ccecf93a1226cef252ca12
SHA1 fcf4dad8c4ad101504b1bf47cbbddbac36b558a7
SHA512 c613d18511b00fa25fc7b1bdde10d96debb42a99b5aaab9e9826538d0e229085bb371f0197f6b1086c4f9c605f01e71287ffc5442f701a95d67c232a5f031838
SSDEEP 384:PVhNH/TqNcx+5tTAjtn3bPcPwoeGULZbiWBlWjVw:PVhZXx+5tTetLVohULZJgw
TLSH
T102826B43B685807AF7A6273506332F365F39F9222F04A1E76F51491AAD34AC0D8B671F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

srvdhcphost.exe

Path C:\Users\Admin\AppData\Local\Temp\srvdhcphost.exe
Size 104KB
SHA256 0eed6a5aae487a9347e8d0d6fed315797738d3698fc6d4eaac6ebeb233415f00
MD5 180a1a3524965914eb4fc557c4d05cda
SHA1 9ea9eec6e3244b377e3917f688ab9b01fb8012de
SHA512 1dbcd0a5181cdd37b20e486116a90fc59b5fb6fc8b863e29ff80ff9db8f7b1e8c36140dff17182b3b847f7dc5a97f2e19ad89626d5d2e1b07f159ce3b126df61
SSDEEP 1536:8wCKiKcgbtFF8d1eXyngejX81sc7/vyvigrqrii/y9QXON7dm5SYw0:3SgF8reXynlj81GSiiKCON5mIt0
TLSH
T110A32656BC605461F884003A223CEAABA6BDEC31B614FF72D7454D825D6C4B7C7E4EA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win5.tmp

Path C:\Users\Admin\AppData\Local\Temp\win5.tmp
Size 240B
SHA256 21ffecc0427652278f3d5384f0a7099f719a7e7e30e6ce29811838d5ebde966f
MD5 47a18e857017cc9fe9121a99587a6da8
SHA1 aacfc68fcb5971f0c86bd2b882f9b5ad78c2cf3b
SHA512 5511c10c10f3c5f0a3be9bc2e9c7cbee9c50e16a4d0521d479fbdae953615746b65b4eb598a2a8786bfe869722bda92c2bcfff1b8e5c06b89ec28cbfc1f07aa8
TLSH
T19FD05E446955822BE2E237182A4566903BE073DF78D58AEC8C890350684AF40D26E2DA
MD5 SHA1 SHA512 TLSH

Submit Download

dhcppptplsa.exe

Path C:\Windows\SysWOW64\dhcppptplsa.exe
Size 2.3MB
SHA256 cd57691cec242fe0a1566573a1269e5c7f024a780ebb9b06b1bc138537536cf8
MD5 ad811d75c06235b582a1aea77cfa7595
SHA1 acaf6374d4c8e0a255e462c152931c45e3999024
SHA512 51b418e0c8460e29d21dd495bf35f1090df51b7efb58a8306a6be18fcc372b41eb2dd4b8dcc22ca95c4ed3d0c13921fbb6e39c1d2438cc48206ab2142c42d6d8
SSDEEP 3072:2xh0oLKfdAkFDHj+nStkJOh+p3ZSNwG0qE/6GcX:Ah0XSOqnvohPa16
TLSH
T1CBB5CF0076D0FCBBE5B5467148B69B319B3AFD365B2ACC83B358564A0932184B7763CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download