Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/09/2026, 13:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-30_126846506832cddc1a229c883e4ee583_coinminer_darpapox_elex_glassworm_jaku_nymaim_rhadamanthys_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-30_126846506832cddc1a229c883e4ee583_coinminer_darpapox_elex_glassworm_jaku_nymaim_rhadamanthys_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
22 signatures
150 seconds
General
- Target 2026-09-30_126846506832cddc1a229c883e4ee583_coinminer_darpapox_elex_glassworm_jaku_nymaim_rhadamanthys_wannacry.exe
- Size 2.1MB
- Sample260930-q4q3wsshle
- SHA256 bf89857adcb7843779a6af340294dccf940fc23ea5a288a71929155544d8c81a
- MD5 126846506832cddc1a229c883e4ee583
- SHA1 48b3221275246c1f5d291c9f772b2a38b660ecd0
- SHA512 14f8ba13b7294f2e4952cd5570ec431a702145d61dd4692db203276a56f85bbb08dd76afcc8bae392120f9f1489c2aaf0d5fac82790f1e6bb8663897380c9814
- SSDEEP 49152:GZpB+kbTCwMrtxKCnFnQXBbrtgb/iQvu0UHOaYm2:GZpEk6ZxvWbrtUTrUHO22
- TLSH T1B1A5F0122380DC32F39FC27243D51E7236B369702B37DA969B4416751AF0E9FE7A5286
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" @AEF21B.tmp.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" @AEF21B.tmp.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" WdExt.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" WdExt.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" @AEF21B.tmp.exe - UAC bypass 3 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" @AEF21B.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WdExt.exe - Windows security bypass 2 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" @AEF21B.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" @AEF21B.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" @AEF21B.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" @AEF21B.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" @AEF21B.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" @AEF21B.tmp.exe - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 26 IoCs
resource yara_rule behavioral1/memory/628-24-0x00000000021F0000-0x00000000032AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/628-394-0x00000000021F0000-0x00000000032AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/628-392-0x00000000021F0000-0x00000000032AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/628-461-0x00000000021F0000-0x00000000032AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/628-545-0x00000000021F0000-0x00000000032AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/628-578-0x00000000021F0000-0x00000000032AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/628-546-0x00000000021F0000-0x00000000032AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/628-579-0x00000000021F0000-0x00000000032AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/628-581-0x00000000021F0000-0x00000000032AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/628-603-0x00000000021F0000-0x00000000032AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/628-580-0x00000000021F0000-0x00000000032AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3516-621-0x00000000021C0000-0x000000000327A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3516-623-0x00000000021C0000-0x000000000327A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3516-624-0x00000000021C0000-0x000000000327A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3516-625-0x00000000021C0000-0x000000000327A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3516-632-0x00000000021C0000-0x000000000327A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3516-633-0x00000000021C0000-0x000000000327A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3516-639-0x00000000021C0000-0x000000000327A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3516-643-0x00000000021C0000-0x000000000327A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3516-642-0x00000000021C0000-0x000000000327A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3516-640-0x00000000021C0000-0x000000000327A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3516-644-0x00000000021C0000-0x000000000327A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3516-645-0x00000000021C0000-0x000000000327A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3516-1424-0x00000000021C0000-0x000000000327A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3516-1598-0x00000000021C0000-0x000000000327A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3516-1599-0x00000000021C0000-0x000000000327A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 29 IoCs
resource yara_rule behavioral1/memory/628-24-0x00000000021F0000-0x00000000032AA000-memory.dmp UPX behavioral1/memory/628-390-0x00000000021F0000-0x00000000032AA000-memory.dmp UPX behavioral1/memory/628-394-0x00000000021F0000-0x00000000032AA000-memory.dmp UPX behavioral1/memory/628-392-0x00000000021F0000-0x00000000032AA000-memory.dmp UPX behavioral1/memory/628-461-0x00000000021F0000-0x00000000032AA000-memory.dmp UPX behavioral1/memory/628-545-0x00000000021F0000-0x00000000032AA000-memory.dmp UPX behavioral1/memory/628-578-0x00000000021F0000-0x00000000032AA000-memory.dmp UPX behavioral1/memory/628-546-0x00000000021F0000-0x00000000032AA000-memory.dmp UPX behavioral1/memory/628-579-0x00000000021F0000-0x00000000032AA000-memory.dmp UPX behavioral1/memory/628-581-0x00000000021F0000-0x00000000032AA000-memory.dmp UPX behavioral1/memory/628-603-0x00000000021F0000-0x00000000032AA000-memory.dmp UPX behavioral1/memory/628-580-0x00000000021F0000-0x00000000032AA000-memory.dmp UPX behavioral1/memory/628-615-0x0000000000400000-0x000000000044B000-memory.dmp UPX behavioral1/memory/3516-621-0x00000000021C0000-0x000000000327A000-memory.dmp UPX behavioral1/memory/3516-623-0x00000000021C0000-0x000000000327A000-memory.dmp UPX behavioral1/memory/3516-624-0x00000000021C0000-0x000000000327A000-memory.dmp UPX behavioral1/memory/3516-625-0x00000000021C0000-0x000000000327A000-memory.dmp UPX behavioral1/memory/3516-632-0x00000000021C0000-0x000000000327A000-memory.dmp UPX behavioral1/memory/3516-633-0x00000000021C0000-0x000000000327A000-memory.dmp UPX behavioral1/memory/3516-639-0x00000000021C0000-0x000000000327A000-memory.dmp UPX behavioral1/memory/3516-643-0x00000000021C0000-0x000000000327A000-memory.dmp UPX behavioral1/memory/3516-642-0x00000000021C0000-0x000000000327A000-memory.dmp UPX behavioral1/memory/3516-640-0x00000000021C0000-0x000000000327A000-memory.dmp UPX behavioral1/memory/3516-644-0x00000000021C0000-0x000000000327A000-memory.dmp UPX behavioral1/memory/3516-645-0x00000000021C0000-0x000000000327A000-memory.dmp UPX behavioral1/memory/3516-1424-0x00000000021C0000-0x000000000327A000-memory.dmp UPX behavioral1/memory/3516-1598-0x00000000021C0000-0x000000000327A000-memory.dmp UPX behavioral1/memory/3516-1599-0x00000000021C0000-0x000000000327A000-memory.dmp UPX behavioral1/memory/3516-1629-0x0000000000400000-0x000000000044B000-memory.dmp UPX - Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation @AEF21B.tmp.exe Key value queried \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation WdExt.exe Key value queried \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation launch.exe - Executes dropped EXE 7 IoCs
pid Process 628 @AEF21B.tmp.exe 1644 2026-09-30_126846506832cddc1a229c883e4ee583_coinminer_darpapox_elex_glassworm_jaku_nymaim_rhadamanthys_wannacry.exe 3516 WdExt.exe 4212 launch.exe 3084 launch.exe 1324 wtmps.exe 3492 mscaps.exe - Loads dropped DLL 2 IoCs
pid Process 628 @AEF21B.tmp.exe 3516 WdExt.exe - Windows security modification 2 TTPs 14 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" WdExt.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" @AEF21B.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" @AEF21B.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" @AEF21B.tmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc @AEF21B.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" @AEF21B.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" @AEF21B.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" @AEF21B.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" WdExt.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defender Extension = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Defender\\launch.exe\"" launch.exe - Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" @AEF21B.tmp.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: WdExt.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\mscaps.exe wtmps.exe File opened for modification C:\Windows\SysWOW64\mscaps.exe wtmps.exe -
resource yara_rule behavioral1/memory/628-24-0x00000000021F0000-0x00000000032AA000-memory.dmp upx behavioral1/memory/628-390-0x00000000021F0000-0x00000000032AA000-memory.dmp upx behavioral1/memory/628-394-0x00000000021F0000-0x00000000032AA000-memory.dmp upx behavioral1/memory/628-392-0x00000000021F0000-0x00000000032AA000-memory.dmp upx behavioral1/memory/628-461-0x00000000021F0000-0x00000000032AA000-memory.dmp upx behavioral1/memory/628-545-0x00000000021F0000-0x00000000032AA000-memory.dmp upx behavioral1/memory/628-578-0x00000000021F0000-0x00000000032AA000-memory.dmp upx behavioral1/memory/628-546-0x00000000021F0000-0x00000000032AA000-memory.dmp upx behavioral1/memory/628-579-0x00000000021F0000-0x00000000032AA000-memory.dmp upx behavioral1/memory/628-581-0x00000000021F0000-0x00000000032AA000-memory.dmp upx behavioral1/memory/628-603-0x00000000021F0000-0x00000000032AA000-memory.dmp upx behavioral1/memory/628-580-0x00000000021F0000-0x00000000032AA000-memory.dmp upx behavioral1/memory/3516-621-0x00000000021C0000-0x000000000327A000-memory.dmp upx behavioral1/memory/3516-623-0x00000000021C0000-0x000000000327A000-memory.dmp upx behavioral1/memory/3516-624-0x00000000021C0000-0x000000000327A000-memory.dmp upx behavioral1/memory/3516-625-0x00000000021C0000-0x000000000327A000-memory.dmp upx behavioral1/memory/3516-632-0x00000000021C0000-0x000000000327A000-memory.dmp upx behavioral1/memory/3516-633-0x00000000021C0000-0x000000000327A000-memory.dmp upx behavioral1/memory/3516-639-0x00000000021C0000-0x000000000327A000-memory.dmp upx behavioral1/memory/3516-643-0x00000000021C0000-0x000000000327A000-memory.dmp upx behavioral1/memory/3516-642-0x00000000021C0000-0x000000000327A000-memory.dmp upx behavioral1/memory/3516-640-0x00000000021C0000-0x000000000327A000-memory.dmp upx behavioral1/memory/3516-644-0x00000000021C0000-0x000000000327A000-memory.dmp upx behavioral1/memory/3516-645-0x00000000021C0000-0x000000000327A000-memory.dmp upx behavioral1/memory/3516-1424-0x00000000021C0000-0x000000000327A000-memory.dmp upx behavioral1/memory/3516-1598-0x00000000021C0000-0x000000000327A000-memory.dmp upx behavioral1/memory/3516-1599-0x00000000021C0000-0x000000000327A000-memory.dmp upx - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e58f671 @AEF21B.tmp.exe File opened for modification C:\Windows\SYSTEM.INI @AEF21B.tmp.exe File created C:\Windows\e59018d WdExt.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1652 cmd.exe 4340 cmd.exe 3272 cmd.exe 3820 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname @AEF21B.tmp.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain @AEF21B.tmp.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WdExt.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WdExt.exe - System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-30_126846506832cddc1a229c883e4ee583_coinminer_darpapox_elex_glassworm_jaku_nymaim_rhadamanthys_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-30_126846506832cddc1a229c883e4ee583_coinminer_darpapox_elex_glassworm_jaku_nymaim_rhadamanthys_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WdExt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language launch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language launch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @AEF21B.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wtmps.exe - Suspicious behavior: EnumeratesProcesses 34 IoCs
pid Process 628 @AEF21B.tmp.exe 628 @AEF21B.tmp.exe 628 @AEF21B.tmp.exe 628 @AEF21B.tmp.exe 3516 WdExt.exe 3516 WdExt.exe 3516 WdExt.exe 3516 WdExt.exe 3516 WdExt.exe 3516 WdExt.exe 4212 launch.exe 4212 launch.exe 4212 launch.exe 4212 launch.exe 4212 launch.exe 4212 launch.exe 4212 launch.exe 4212 launch.exe 4212 launch.exe 4212 launch.exe 3084 launch.exe 3084 launch.exe 3084 launch.exe 3084 launch.exe 3084 launch.exe 3084 launch.exe 3084 launch.exe 3084 launch.exe 3084 launch.exe 3084 launch.exe 3084 launch.exe 3084 launch.exe 4212 launch.exe 4212 launch.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe Token: SeDebugPrivilege 628 @AEF21B.tmp.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2004 wrote to memory of 2496 2004 2026-09-30_126846506832cddc1a229c883e4ee583_coinminer_darpapox_elex_glassworm_jaku_nymaim_rhadamanthys_wannacry.exe 87 PID 2004 wrote to memory of 2496 2004 2026-09-30_126846506832cddc1a229c883e4ee583_coinminer_darpapox_elex_glassworm_jaku_nymaim_rhadamanthys_wannacry.exe 87 PID 2004 wrote to memory of 2496 2004 2026-09-30_126846506832cddc1a229c883e4ee583_coinminer_darpapox_elex_glassworm_jaku_nymaim_rhadamanthys_wannacry.exe 87 PID 2496 wrote to memory of 628 2496 explorer.exe 90 PID 2496 wrote to memory of 1644 2496 explorer.exe 91 PID 628 wrote to memory of 784 628 @AEF21B.tmp.exe 8 PID 628 wrote to memory of 792 628 @AEF21B.tmp.exe 9 PID 628 wrote to memory of 540 628 @AEF21B.tmp.exe 14 PID 628 wrote to memory of 2884 628 @AEF21B.tmp.exe 50 PID 628 wrote to memory of 2912 628 @AEF21B.tmp.exe 51 PID 628 wrote to memory of 2880 628 @AEF21B.tmp.exe 52 PID 628 wrote to memory of 3284 628 @AEF21B.tmp.exe 56 PID 628 wrote to memory of 3408 628 @AEF21B.tmp.exe 57 PID 628 wrote to memory of 3604 628 @AEF21B.tmp.exe 58 PID 628 wrote to memory of 3712 628 @AEF21B.tmp.exe 59 PID 628 wrote to memory of 3776 628 @AEF21B.tmp.exe 60 PID 628 wrote to memory of 3860 628 @AEF21B.tmp.exe 61 PID 628 wrote to memory of 3452 628 @AEF21B.tmp.exe 62 PID 628 wrote to memory of 4752 628 @AEF21B.tmp.exe 65 PID 628 wrote to memory of 4468 628 @AEF21B.tmp.exe 77 PID 628 wrote to memory of 1668 628 @AEF21B.tmp.exe 84 PID 628 wrote to memory of 1268 628 @AEF21B.tmp.exe 85 PID 628 wrote to memory of 2496 628 @AEF21B.tmp.exe 87 PID 628 wrote to memory of 1296 628 @AEF21B.tmp.exe 88 PID 628 wrote to memory of 3104 628 @AEF21B.tmp.exe 89 PID 628 wrote to memory of 1644 628 @AEF21B.tmp.exe 91 PID 628 wrote to memory of 1644 628 @AEF21B.tmp.exe 91 PID 628 wrote to memory of 3272 628 @AEF21B.tmp.exe 92 PID 628 wrote to memory of 4340 628 @AEF21B.tmp.exe 93 PID 3272 wrote to memory of 3516 3272 cmd.exe 98 PID 3516 wrote to memory of 784 3516 WdExt.exe 8 PID 3516 wrote to memory of 792 3516 WdExt.exe 9 PID 3516 wrote to memory of 540 3516 WdExt.exe 14 PID 3516 wrote to memory of 2884 3516 WdExt.exe 50 PID 3516 wrote to memory of 2912 3516 WdExt.exe 51 PID 3516 wrote to memory of 2880 3516 WdExt.exe 52 PID 3516 wrote to memory of 3284 3516 WdExt.exe 56 PID 3516 wrote to memory of 3408 3516 WdExt.exe 57 PID 3516 wrote to memory of 3604 3516 WdExt.exe 58 PID 3516 wrote to memory of 3712 3516 WdExt.exe 59 PID 3516 wrote to memory of 3776 3516 WdExt.exe 60 PID 3516 wrote to memory of 3860 3516 WdExt.exe 61 PID 3516 wrote to memory of 3452 3516 WdExt.exe 62 PID 3516 wrote to memory of 4752 3516 WdExt.exe 65 PID 3516 wrote to memory of 4468 3516 WdExt.exe 77 PID 3516 wrote to memory of 1668 3516 WdExt.exe 84 PID 3516 wrote to memory of 1268 3516 WdExt.exe 85 PID 3516 wrote to memory of 1296 3516 WdExt.exe 88 PID 3516 wrote to memory of 3104 3516 WdExt.exe 89 PID 3516 wrote to memory of 1644 3516 WdExt.exe 91 PID 3516 wrote to memory of 1644 3516 WdExt.exe 91 PID 3516 wrote to memory of 3272 3516 WdExt.exe 92 PID 3516 wrote to memory of 3272 3516 WdExt.exe 92 PID 3516 wrote to memory of 4340 3516 WdExt.exe 93 PID 3516 wrote to memory of 1716 3516 WdExt.exe 94 PID 3516 wrote to memory of 2508 3516 WdExt.exe 95 PID 3516 wrote to memory of 784 3516 WdExt.exe 8 PID 3516 wrote to memory of 792 3516 WdExt.exe 9 PID 3516 wrote to memory of 540 3516 WdExt.exe 14 PID 3516 wrote to memory of 2884 3516 WdExt.exe 50 PID 3516 wrote to memory of 2912 3516 WdExt.exe 51 PID 3516 wrote to memory of 2880 3516 WdExt.exe 52 PID 3516 wrote to memory of 3284 3516 WdExt.exe 56 PID 3516 wrote to memory of 3408 3516 WdExt.exe 57 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" @AEF21B.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WdExt.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:540
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2884
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2912
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2880
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_126846506832cddc1a229c883e4ee583_coinminer_darpapox_elex_glassworm_jaku_nymaim_rhadamanthys_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_126846506832cddc1a229c883e4ee583_coinminer_darpapox_elex_glassworm_jaku_nymaim_rhadamanthys_wannacry.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\@AEF21B.tmp.exe"C:\Users\Admin\AppData\Local\Temp\@AEF21B.tmp.exe"4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat" "5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵PID:1716
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"6⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3820 -
C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe" /i 35168⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat" "9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\wtmps.exe"C:\Users\Admin\AppData\Local\Temp\wtmps.exe"10⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1324 -
C:\Windows\SysWOW64\mscaps.exe"C:\Windows\system32\mscaps.exe" /C:\Users\Admin\AppData\Local\Temp\wtmps.exe11⤵
- Executes dropped EXE
PID:3492
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4340 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵PID:2508
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_126846506832cddc1a229c883e4ee583_coinminer_darpapox_elex_glassworm_jaku_nymaim_rhadamanthys_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_126846506832cddc1a229c883e4ee583_coinminer_darpapox_elex_glassworm_jaku_nymaim_rhadamanthys_wannacry.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1644
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3408
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3604
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3712
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3776
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3860
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3452
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4752
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4468
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:1668
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:1268
-
C:\Windows\system32\BackgroundTaskHost.exe"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider1⤵PID:1296
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3104
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4556
-
C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3084
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\0E58F690_Rar\@AEF21B.tmp.exe
- Size 1.7MB
- SHA256 445138ae86b88bfc312344aff461a9910594d9872b74ec4ecde0c7aa379656c5
- MD5 d77c5adb9faf7d53b1dace1c1a5226ba
- SHA1 a209af9fbd5d607a19c94dab60606842991e556f
- SHA512 030d4d0dfbd08ed4beb7a45a3b9bf3afd8c2b737f4be663b9a8f98656ba7f1cf11758d2273d93ce1e657224e7f85a403ac1436345514e0d727e4d253cab50b53
- SSDEEP 24576:OXdVtTj2i64T+jdxQCfgOFD3WSwd2QtBBw6xxhVxQtmibjOhZaiRu/4oMaop0UNW:mbTChxKCnFnQXBbrtgb/iQvu0UHOaYmE
- TLSH T1DE85EF252790CD61F36FC07683D16E79B9B329213B33D886AE4855316BF2E2FE381195
- MD5 SHA1 SHA512 SSDEEP TLSH
2026-09-30_126846506832cddc1a229c883e4ee583_coinminer_darpapox_elex_glassworm_jaku_nymaim_rhadamanthys_wannacry.exe
- Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_126846506832cddc1a229c883e4ee583_coinminer_darpapox_elex_glassworm_jaku_nymaim_rhadamanthys_wannacry.exe
- Size 287KB
- SHA256 88453471e2625e39524cb006afe3571e422558dd078e1451fc18ad82ab7f4074
- MD5 d02f2d820c2225373084fbc34f43c834
- SHA1 69f8b8627caa5e69ee409aed5ed1e9648afdf6e5
- SHA512 4fb7a3e06a928831f731817be2ae154095a9617066d911d48d0606ed1b7fb6f834449f85f59f25bfc6c3d7c1f5d6a0370861194008b452f16742f14055f20ce8
- SSDEEP 6144:H/26kJC3oghja3DpYGaYxKrNV0eSGHeMQT2/:uC4gNobaYoN2eSGWC/
- TLSH T121544B1353D4343AD8A313B052EA23732BB46DB40B2D53E7C3865B9958A47E5B93D38B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\81D8.tmp
- Size 406B
- SHA256 27e678bf5dc82219d6edd744f0b82567a26e40f8a9dcd6487205e13058e3ed1f
- MD5 37512bcc96b2c0c0cf0ad1ed8cfae5cd
- SHA1 edf7f17ce28e1c4c82207cab8ca77f2056ea545c
- SHA512 6d4252ab5aa441a76ce2127224fefcb221259ab4d39f06437b269bd6bfdaae009c8f34e9603ec734159553bc9f1359bdd70316cd426d73b171a9f17c41077641
- TLSH T1C5E0A238F30DCC2AE1D032092011CE86F23C128AE6A1FBA82AB421A3B00350CC2346E3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\@AEF21B.tmp.exe
- Size 1.8MB
- SHA256 5464a9ba9b20e0f322fab398b7508b192dfa243632553a2388f37119680dc313
- MD5 4f72c4ad306998d35ec494f5b04e1205
- SHA1 e88ff9f9c72f915fe102ee94bff074fe64cb35c1
- SHA512 b629756f9a08bde63d4832804461519de29f08adb708ff3350d603dcbc04b64dcf3faaccaff13e7b55fe2eae079c79bafe690250939ac066525009c073137477
- SSDEEP 49152:7bTCwMrtxKCnFnQXBbrtgb/iQvu0UHOaYmE:76ZxvWbrtUTrUHO2E
- TLSH T1EC95EF152790CD61F36FC07683E16E79B6B329213B33D986AE8855312BF2E1FE381195
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp6410.tmp
- Size 229KB
- SHA256 70a392389aecd0f58251e72c3fd7e9159f481061d14209ff8708a0fd9ff584dc
- MD5 6f90e1169d19dfde14d6f753f06c862b
- SHA1 e9bca93c68d7df73d000f4a6e6eb73a343682ac5
- SHA512 f0c898222e9578c01ebe1befac27a3fb68d8fb6e76c7d1dec7a8572c1aa3201bacf1e69aa63859e95606790cf09962bcf7dc33b770a6846bed5bd7ded957b0b3
- SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyq:u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmp6421.tmp
- Size 120KB
- SHA256 01631353726dc51bcea311dbc012572cf96775e516b1c79a2de572ef15954b7a
- MD5 f558c76b0376af9273717fa24d99ebbf
- SHA1 f84bcece5c6138b62ef94e9d668cf26178ee14cc
- SHA512 2092d1e126d0420fec5fc0311d6b99762506563f4890e4049e48e2d87dde5ac3e2e2ecc986ab305de2c6ceb619f18879a69a815d3241ccf8140bc5ea00c6768d
- SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy:u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmp6432.tmp
- Size 126KB
- SHA256 ae5697f849fa48db6d3d13455c224fcf6ceb0602a1e8ac443e211dd0f32d50f4
- MD5 02ae22335713a8f6d6adf80bf418202b
- SHA1 4c40c11f43df761b92a5745f85a799db7b389215
- SHA512 727d16102bfc768535b52a37e4e7b5d894f5daa268d220df108382c36dcce063afdbc31fd495a7a61305263ec4cd7e92713d894faa35b585c0b379217a1d929c
- SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyK:u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmp6442.tmp
- Size 89KB
- SHA256 63149ad45db380f5dd15f65d9ceb2611d53a0a66e022483bee4ce2ff7d2610e2
- MD5 09203a9741b91f3a9ed01c82dcb8778d
- SHA1 13e6f3fb169cd6aa5e4d450417a7e15665a2e140
- SHA512 9e9e6fe0dd713417d0e28ba787cf862d55ecda9ee9f3df1eada144657f6a3b6ada1984fd05a3fffcd597a9715383225a8e40b6e5d0d8d39ec0d3a64b8dea9846
- SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyS:O
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmp6453.tmp
- Size 99KB
- SHA256 5ec8093ef5939d1abce1c576097b584fb600b94ad767c1da897f7cb7f0063d26
- MD5 9a27bfb55dd768ae81ca8716db2da343
- SHA1 55da0f4282bd838f72f435a5d4d24ac15b04482b
- SHA512 d9bb49d2f282ed09c351a1d8eb2540781e6a7fb39265473fd59d146bfc162f27a4ab1405301ed7395c12929a80551a399437d7d794d7ac48650e9037b60eb69c
- SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyq:u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmp6463.tmp
- Size 172KB
- SHA256 27c945ccb84aa024f1f063701327e829a7ef3a7ede4a43b2febbb1dddbdf8740
- MD5 2634fa3a332c297711cb59d43f54ffce
- SHA1 8e2b68d0ee4e792efb1945ba86eceb87f07087d2
- SHA512 84e4799b9b18a7cc7be685c793a9b4fb135ea331d1d235fe823e1d7091130f131ab2fbad1da4dea795e82547aa16b00f4e2a9faaa96cb522d795f9abfda2fc53
- SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyK:u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmp6474.tmp
- Size 276KB
- SHA256 d2fa6f9686386a92253a9c5ea25ace702a111483540b60c1300789235cea7fdc
- MD5 e07c6a9e595f045fadc463dfda44ab16
- SHA1 e6b199272ade02613f2003c365a4cb1487431e23
- SHA512 f3c630ae8381b99519aeeadbc2918810e7fb09a909f73ee6c46f4e9d3cf8c5051a5cf763db6a775d6cd8713ccf95a63b18df9ed756fa28276e8d7ab6a47f2cbf
- SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyX:T
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\wtmps.exe
- Size 276KB
- SHA256 3b20c853d4ca23240cd338b8cab16f1027c540ddfe9c4ffdca1624d2f923b373
- MD5 75c1467042b38332d1ea0298f29fb592
- SHA1 f92ea770c2ddb04cf0d20914578e4c482328f0f8
- SHA512 5c47c59ad222e2597ccdf2c100853c48f022e933f44c279154346eacf9e7e6f54214ada541d43a10424035f160b56131aab206c11512a9fd6ea614fbd3160aa0
- SSDEEP 6144:Xaz/zwzFEN3MmUGvSQagFwDeSv3BU9T4/XGOUYM/mVz:Iz8qamFVa1D69T4RMmVz
- TLSH T16354121B18B78123F4665570A9E107C18F7E5A0732A58B2FCF61CC3E46E09698967EF3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe
- Size 172KB
- SHA256 6a7093440420306cf7de53421a67af8a1094771e0aab9535acbd748d08ed766c
- MD5 daac1781c9d22f5743ade0cb41feaebf
- SHA1 e2549eeeea42a6892b89d354498fcaa8ffd9cac4
- SHA512 190a7d5291e20002f996edf1e04456bfdff8b7b2f4ef113178bd42a9e5fd89fe6d410ae2c505de0358c4f53f9654ac1caaa8634665afa6d9691640dd4ee86160
- SSDEEP 3072:ng2TyMj3tEcWMkc5tTBfZOVxtDH2g3zd3jceABCODJRCyA:n7xqcWxc5tTBsJWKFGUOfCl
- TLSH T10E04BE193A9089B2C0BFD0B7C0D5BB28F77732321322D94B679C96750D62776F6122DA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
- Size 1.8MB
- SHA256 340581b0a1dd7f48f369431e658f0f9f91af7fa8a0b5d50848c00478610798e8
- MD5 423671d28e703ae82ab29e2446b07fcf
- SHA1 b3ffd19079e13b90358c153d02da4a29cdc7fe44
- SHA512 377d8983cf9985ef4c2ac5ed5e022877fbe98ee2d4ee6c3690d42fb4117695a46a7f055cbfd6b243dee42d7202c8356dc4c015c7bee8f3446eb6caaeaae8284e
- SSDEEP 49152:7bTCwMrtxKCnFnQXBbrtgb/iQvu0UHOaYms:76ZxvWbrtUTrUHO2s
- TLSH T1F195EF152790CD61F36FC07683E16E79B6B329213B33D986AE8855312BF2E1FE381195
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat
- Size 129B
- SHA256 b3c704b1a728004fc5e25899d72930a7466d7628dd6ddd795b3000897dfa4020
- MD5 d1073c9b34d1bbd570928734aacff6a5
- SHA1 78714e24e88d50e0da8da9d303bec65b2ee6d903
- SHA512 4f2b9330e30fcc55245dc5d12311e105b2b2b9d607fbfc4a203c69a740006f0af58d6a01e2da284575a897528da71a2e61a7321034755b78feb646c8dd12347f
- TLSH T1B6B09B1243C8C70E7C67B1974B75544C517446C57B447509DB45C48D325191CFCDD556
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat
- Size 126B
- SHA256 9dbdbb70e62678b2fc336d42a9655fb839724abd534552cf4db5667c2f1e1817
- MD5 a5241a5883bc961c9d4216505ddcbcd8
- SHA1 94d27cbffa5f85d21e31dae450c089f66eab8263
- SHA512 9b63d421e6501018885e4332c0fd48f8d0039fcaaeabbf20ea3bf9fef36f8ce3ce7c5f11d0b1f57c0b5abce720f745c157c1128e31eaf3122c0285ab5cdd1bed
- TLSH T1D5B0922603C9DB4EB8626097077A94AD90788AD23E98BA05CA118588324680CFDAA94A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat
- Size 196B
- SHA256 62cdc6b9e338ffb472f63618ceff4d02016d562838c966de9acd74873585b971
- MD5 daedf541cec6edbfcc4450ecd943a72e
- SHA1 a2cb86a90005498083d88a57333407dfc253e8e1
- SHA512 44a38a3613017104de083958f8842d46315995415b8fc91c7bd72cec6fb810c6a1e6d24f4c01ee64317d94d3ee1bb49c62ef89e4527c31acfb092bd04620c601
- TLSH T11ED0220602C2C78D6804609B0B3250ACC2BC5AE83FC933028A12C46C208341CB987600
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat
- Size 102B
- SHA256 4e7d460b8dc9f2c01b4c5a16fb956aced10127bc940e8039a80c6455901ea1f0
- MD5 3ca08f080a7a28416774d80552d4aa08
- SHA1 0b5f0ba641204b27adac4140fd45dce4390dbf24
- SHA512 0c64aa462ff70473ef763ec392296fe0ea59b5340c26978531a416732bc3845adf9ca7b673cb7b4ba40cc45674351206096995c43600fccbbbe64e51b6019f01
- TLSH T114B0121243CBCF0D148060D70775A1CCC0740C983F947714DF11C84C314080DFDC6A41
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\mydll.dll
- Size 388KB
- SHA256 93db7c9699594caa19490280842fbebec3877278c92128b92e63d75fcd01397a
- MD5 8d7db101a7211fe3309dc4dc8cf2dd0a
- SHA1 6c2781eadf53b3742d16dab2f164baf813f7ac85
- SHA512 8b139d447068519997f7bbc2c7c2fe3846b89ae1fba847258277c9ab92a93583b28fae7ffa444768929ed5852cc914c0270446cbf0bd20aca49bde6b6f809c83
- SSDEEP 12288:PDCOy/psISIHbl9f/mnmO/5Se71RpNJmq3CrP:RyRznmnp5SedNJBCL
- TLSH T1E3843A12B7A98025D6F30A74263DB536A4397C750F50EEEB73250B6DA830FC1DB79A12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 8eb41bfbe04cb8188d2136cf1081be19fee8b4c84c61bd770a24be6aa5c9b449
- MD5 bbfe5c2b49b080e42c83c3ba4c2520b0
- SHA1 3f2afb4456be2cdf91ab9b02bad22678d709e16f
- SHA512 74b4e4b649001b19c10c0964765730ddd25841caf10e0c2d95219d3808beef72ab2fd2b0c7335b85681a752351c4e63a67d3328b1b5abe9498d69292eb096dda
- TLSH T15FD05E0E4BDD21AD9052002F3178D0C2723A9F11D8320F4C5039678168287D9FFBE2AE
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\mscaps.exe
- Size 200KB
- SHA256 2c4c9ec8e9291ba5c73f641af2e0c3e1bbd257ac40d9fb9d3faab7cebc978905
- MD5 78d3c8705f8baf7d34e6a6737d1cfa18
- SHA1 9f09e248a29311dbeefae9d85937b13da042a010
- SHA512 9a3c3175276da58f1bc8d1138e63238c8d8ccfbfa1a8a1338e88525eca47f8d745158bb34396b7c3f25e4296be5f45a71781da33ad0bbdf7ad88a9c305b85609
- SSDEEP 3072:34LGpbMkFAIk2GOytDDE1wYa+6NjQYryupFsjzuoAxWhZWkZu4pUBRrwCP8T:FbnDk2HcMZYQYcSovhc7AAcCPe
- TLSH T15114F15B2CB38933F462497542E046FA4FFDAD1332F664EFCF2849C11DA09659528AF2
- MD5 SHA1 SHA512 SSDEEP TLSH