Analysis
- max time kernel
122s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/10/2026, 14:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
25 signatures
150 seconds
General
- Target 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe
- Size 2.3MB
- Sample261020-rl4fyaex7q
- SHA256 9c160f2e2b5b473e45bb306138d4e0252f90d326baec605be7a7a41b8266c2da
- MD5 879d58d24c3061cdf765b505d892a011
- SHA1 c6b7cadbbba0d926acc2c914cec00c567763e5b9
- SHA512 48d1633aa5116d04c291abee6a4dd5f08e15b73d4f5bfe8b7be16a629dfdca124f3742184f4b62d4926ddc34db9f62cfba546b4343c9e5775d492a91b416c439
- SSDEEP 49152:9+MLUlD9LaZqOkqB85Bn6iOPHLRSwHuXlD9bh6Lad42:99e0qBrjOPHlP66+d42
- TLSH T1D9B533A17683E0F2D5420173588B839867BBAE2571CF998FFEC5B1CE89F7041E266057
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe - UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe - Windows security bypass 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 42 IoCs
resource yara_rule behavioral2/memory/2896-1-0x0000000002540000-0x00000000035FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2896-101-0x0000000002540000-0x00000000035FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2896-100-0x0000000002540000-0x00000000035FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2896-97-0x0000000002540000-0x00000000035FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2896-104-0x0000000002540000-0x00000000035FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2896-103-0x0000000002540000-0x00000000035FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2896-95-0x0000000002540000-0x00000000035FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2896-102-0x0000000002540000-0x00000000035FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2896-70-0x0000000002540000-0x00000000035FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2896-99-0x0000000002540000-0x00000000035FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2896-96-0x0000000002540000-0x00000000035FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2896-210-0x0000000002540000-0x00000000035FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2896-209-0x0000000002540000-0x00000000035FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2896-211-0x0000000002540000-0x00000000035FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2896-264-0x0000000002540000-0x00000000035FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2896-315-0x0000000002540000-0x00000000035FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2896-316-0x0000000002540000-0x00000000035FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2896-322-0x0000000002540000-0x00000000035FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2896-325-0x0000000002540000-0x00000000035FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2896-326-0x0000000002540000-0x00000000035FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2896-327-0x0000000002540000-0x00000000035FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2896-333-0x0000000002540000-0x00000000035FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2896-335-0x0000000002540000-0x00000000035FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2896-338-0x0000000002540000-0x00000000035FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2896-340-0x0000000002540000-0x00000000035FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2896-341-0x0000000002540000-0x00000000035FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2896-343-0x0000000002540000-0x00000000035FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2896-346-0x0000000002540000-0x00000000035FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2896-344-0x0000000002540000-0x00000000035FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2896-347-0x0000000002540000-0x00000000035FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2896-348-0x0000000002540000-0x00000000035FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2896-350-0x0000000002540000-0x00000000035FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2896-352-0x0000000002540000-0x00000000035FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2896-354-0x0000000002540000-0x00000000035FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2896-357-0x0000000002540000-0x00000000035FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2896-359-0x0000000002540000-0x00000000035FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2896-360-0x0000000002540000-0x00000000035FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2896-370-0x0000000002540000-0x00000000035FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2896-373-0x0000000002540000-0x00000000035FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2896-374-0x0000000002540000-0x00000000035FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2896-377-0x0000000002540000-0x00000000035FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2896-378-0x0000000002540000-0x00000000035FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 43 IoCs
resource yara_rule behavioral2/memory/2896-1-0x0000000002540000-0x00000000035FA000-memory.dmp UPX behavioral2/memory/2896-101-0x0000000002540000-0x00000000035FA000-memory.dmp UPX behavioral2/memory/2896-100-0x0000000002540000-0x00000000035FA000-memory.dmp UPX behavioral2/memory/2896-97-0x0000000002540000-0x00000000035FA000-memory.dmp UPX behavioral2/memory/2896-104-0x0000000002540000-0x00000000035FA000-memory.dmp UPX behavioral2/memory/2896-103-0x0000000002540000-0x00000000035FA000-memory.dmp UPX behavioral2/memory/2896-95-0x0000000002540000-0x00000000035FA000-memory.dmp UPX behavioral2/memory/2896-102-0x0000000002540000-0x00000000035FA000-memory.dmp UPX behavioral2/memory/2896-70-0x0000000002540000-0x00000000035FA000-memory.dmp UPX behavioral2/memory/2896-99-0x0000000002540000-0x00000000035FA000-memory.dmp UPX behavioral2/memory/2896-96-0x0000000002540000-0x00000000035FA000-memory.dmp UPX behavioral2/memory/2896-210-0x0000000002540000-0x00000000035FA000-memory.dmp UPX behavioral2/memory/2896-209-0x0000000002540000-0x00000000035FA000-memory.dmp UPX behavioral2/memory/2896-211-0x0000000002540000-0x00000000035FA000-memory.dmp UPX behavioral2/memory/2896-264-0x0000000002540000-0x00000000035FA000-memory.dmp UPX behavioral2/memory/2896-315-0x0000000002540000-0x00000000035FA000-memory.dmp UPX behavioral2/memory/2896-316-0x0000000002540000-0x00000000035FA000-memory.dmp UPX behavioral2/memory/2896-322-0x0000000002540000-0x00000000035FA000-memory.dmp UPX behavioral2/memory/2896-325-0x0000000002540000-0x00000000035FA000-memory.dmp UPX behavioral2/memory/2896-326-0x0000000002540000-0x00000000035FA000-memory.dmp UPX behavioral2/memory/2896-327-0x0000000002540000-0x00000000035FA000-memory.dmp UPX behavioral2/memory/2896-333-0x0000000002540000-0x00000000035FA000-memory.dmp UPX behavioral2/memory/2896-335-0x0000000002540000-0x00000000035FA000-memory.dmp UPX behavioral2/memory/2896-338-0x0000000002540000-0x00000000035FA000-memory.dmp UPX behavioral2/memory/2896-340-0x0000000002540000-0x00000000035FA000-memory.dmp UPX behavioral2/memory/2896-341-0x0000000002540000-0x00000000035FA000-memory.dmp UPX behavioral2/memory/2896-343-0x0000000002540000-0x00000000035FA000-memory.dmp UPX behavioral2/memory/2896-346-0x0000000002540000-0x00000000035FA000-memory.dmp UPX behavioral2/memory/2896-344-0x0000000002540000-0x00000000035FA000-memory.dmp UPX behavioral2/memory/2896-347-0x0000000002540000-0x00000000035FA000-memory.dmp UPX behavioral2/memory/2896-348-0x0000000002540000-0x00000000035FA000-memory.dmp UPX behavioral2/memory/2896-350-0x0000000002540000-0x00000000035FA000-memory.dmp UPX behavioral2/memory/2896-352-0x0000000002540000-0x00000000035FA000-memory.dmp UPX behavioral2/memory/2896-354-0x0000000002540000-0x00000000035FA000-memory.dmp UPX behavioral2/memory/2896-357-0x0000000002540000-0x00000000035FA000-memory.dmp UPX behavioral2/memory/2896-359-0x0000000002540000-0x00000000035FA000-memory.dmp UPX behavioral2/memory/2896-360-0x0000000002540000-0x00000000035FA000-memory.dmp UPX behavioral2/memory/2896-370-0x0000000002540000-0x00000000035FA000-memory.dmp UPX behavioral2/memory/2896-373-0x0000000002540000-0x00000000035FA000-memory.dmp UPX behavioral2/memory/2896-374-0x0000000002540000-0x00000000035FA000-memory.dmp UPX behavioral2/memory/2896-377-0x0000000002540000-0x00000000035FA000-memory.dmp UPX behavioral2/memory/2896-378-0x0000000002540000-0x00000000035FA000-memory.dmp UPX behavioral2/memory/2896-379-0x0000000000400000-0x0000000000648000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 5680 SmartPlayer.exe - Loads dropped DLL 8 IoCs
pid Process 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe - Windows security modification 2 TTPs 7 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe File opened (read-only) \??\K: 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe File opened (read-only) \??\L: 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe File opened (read-only) \??\Q: 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe File opened (read-only) \??\T: 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe File opened (read-only) \??\W: 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe File opened (read-only) \??\G: 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe File opened (read-only) \??\O: 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe File opened (read-only) \??\P: 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe File opened (read-only) \??\U: 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe File opened (read-only) \??\D: 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe File opened (read-only) \??\M: 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe File opened (read-only) \??\N: 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe File opened (read-only) \??\R: 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe File opened (read-only) \??\X: 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe File opened (read-only) \??\I: 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe File opened (read-only) \??\S: 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe File opened (read-only) \??\V: 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe File opened (read-only) \??\Y: 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe File opened (read-only) \??\Z: 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe File opened (read-only) \??\H: 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe File opened for modification F:\autorun.inf 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe -
resource yara_rule behavioral2/memory/2896-1-0x0000000002540000-0x00000000035FA000-memory.dmp upx behavioral2/memory/2896-101-0x0000000002540000-0x00000000035FA000-memory.dmp upx behavioral2/memory/2896-100-0x0000000002540000-0x00000000035FA000-memory.dmp upx behavioral2/memory/2896-97-0x0000000002540000-0x00000000035FA000-memory.dmp upx behavioral2/memory/2896-104-0x0000000002540000-0x00000000035FA000-memory.dmp upx behavioral2/memory/2896-103-0x0000000002540000-0x00000000035FA000-memory.dmp upx behavioral2/memory/2896-95-0x0000000002540000-0x00000000035FA000-memory.dmp upx behavioral2/memory/2896-102-0x0000000002540000-0x00000000035FA000-memory.dmp upx behavioral2/memory/2896-70-0x0000000002540000-0x00000000035FA000-memory.dmp upx behavioral2/memory/2896-99-0x0000000002540000-0x00000000035FA000-memory.dmp upx behavioral2/memory/2896-96-0x0000000002540000-0x00000000035FA000-memory.dmp upx behavioral2/memory/2896-210-0x0000000002540000-0x00000000035FA000-memory.dmp upx behavioral2/memory/2896-209-0x0000000002540000-0x00000000035FA000-memory.dmp upx behavioral2/memory/2896-211-0x0000000002540000-0x00000000035FA000-memory.dmp upx behavioral2/memory/2896-264-0x0000000002540000-0x00000000035FA000-memory.dmp upx behavioral2/memory/2896-315-0x0000000002540000-0x00000000035FA000-memory.dmp upx behavioral2/memory/2896-316-0x0000000002540000-0x00000000035FA000-memory.dmp upx behavioral2/memory/2896-322-0x0000000002540000-0x00000000035FA000-memory.dmp upx behavioral2/memory/2896-325-0x0000000002540000-0x00000000035FA000-memory.dmp upx behavioral2/memory/2896-326-0x0000000002540000-0x00000000035FA000-memory.dmp upx behavioral2/memory/2896-327-0x0000000002540000-0x00000000035FA000-memory.dmp upx behavioral2/memory/2896-333-0x0000000002540000-0x00000000035FA000-memory.dmp upx behavioral2/memory/2896-335-0x0000000002540000-0x00000000035FA000-memory.dmp upx behavioral2/memory/2896-338-0x0000000002540000-0x00000000035FA000-memory.dmp upx behavioral2/memory/2896-340-0x0000000002540000-0x00000000035FA000-memory.dmp upx behavioral2/memory/2896-341-0x0000000002540000-0x00000000035FA000-memory.dmp upx behavioral2/memory/2896-343-0x0000000002540000-0x00000000035FA000-memory.dmp upx behavioral2/memory/2896-346-0x0000000002540000-0x00000000035FA000-memory.dmp upx behavioral2/memory/2896-344-0x0000000002540000-0x00000000035FA000-memory.dmp upx behavioral2/memory/2896-347-0x0000000002540000-0x00000000035FA000-memory.dmp upx behavioral2/memory/2896-348-0x0000000002540000-0x00000000035FA000-memory.dmp upx behavioral2/memory/2896-350-0x0000000002540000-0x00000000035FA000-memory.dmp upx behavioral2/memory/2896-352-0x0000000002540000-0x00000000035FA000-memory.dmp upx behavioral2/memory/2896-354-0x0000000002540000-0x00000000035FA000-memory.dmp upx behavioral2/memory/2896-357-0x0000000002540000-0x00000000035FA000-memory.dmp upx behavioral2/memory/2896-359-0x0000000002540000-0x00000000035FA000-memory.dmp upx behavioral2/memory/2896-360-0x0000000002540000-0x00000000035FA000-memory.dmp upx behavioral2/memory/2896-370-0x0000000002540000-0x00000000035FA000-memory.dmp upx behavioral2/memory/2896-373-0x0000000002540000-0x00000000035FA000-memory.dmp upx behavioral2/memory/2896-374-0x0000000002540000-0x00000000035FA000-memory.dmp upx behavioral2/memory/2896-377-0x0000000002540000-0x00000000035FA000-memory.dmp upx behavioral2/memory/2896-378-0x0000000002540000-0x00000000035FA000-memory.dmp upx - Drops file in Program Files directory 12 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\e5a7e59 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe File opened for modification C:\Windows\SYSTEM.INI 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SmartPlayer.exe - Modifies registry class 11 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SmartPlayer.Files\shell SmartPlayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.dav SmartPlayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SmartPlayer.Files\shell\open\command SmartPlayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SmartPlayer.Files\shell\open SmartPlayer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SmartPlayer.Files\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\SPTemp\\SmartPlayer.exe\" \"%1\"" SmartPlayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SmartPlayer.Files\DefaultIcon SmartPlayer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SmartPlayer.Files\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\SPTemp\\SmartPlayer.exe,0" SmartPlayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mp4 SmartPlayer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mp4\ = "SmartPlayer.Files" SmartPlayer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.dav\ = "SmartPlayer.Files" SmartPlayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SmartPlayer.Files SmartPlayer.exe - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5680 SmartPlayer.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe 5680 SmartPlayer.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2896 wrote to memory of 1164 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 14 PID 2896 wrote to memory of 2540 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 45 PID 2896 wrote to memory of 3184 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 48 PID 2896 wrote to memory of 3468 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 50 PID 2896 wrote to memory of 3292 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 57 PID 2896 wrote to memory of 4376 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 59 PID 2896 wrote to memory of 4428 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 60 PID 2896 wrote to memory of 4500 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 61 PID 2896 wrote to memory of 4756 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 63 PID 2896 wrote to memory of 5080 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 64 PID 2896 wrote to memory of 5104 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 65 PID 2896 wrote to memory of 5184 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 66 PID 2896 wrote to memory of 3852 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 80 PID 2896 wrote to memory of 2512 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 81 PID 2896 wrote to memory of 2604 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 82 PID 2896 wrote to memory of 5508 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 83 PID 2896 wrote to memory of 3324 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 84 PID 2896 wrote to memory of 1164 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 14 PID 2896 wrote to memory of 2540 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 45 PID 2896 wrote to memory of 3184 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 48 PID 2896 wrote to memory of 3468 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 50 PID 2896 wrote to memory of 3292 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 57 PID 2896 wrote to memory of 4376 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 59 PID 2896 wrote to memory of 4428 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 60 PID 2896 wrote to memory of 4500 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 61 PID 2896 wrote to memory of 4756 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 63 PID 2896 wrote to memory of 5080 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 64 PID 2896 wrote to memory of 5104 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 65 PID 2896 wrote to memory of 5184 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 66 PID 2896 wrote to memory of 3852 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 80 PID 2896 wrote to memory of 2512 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 81 PID 2896 wrote to memory of 2604 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 82 PID 2896 wrote to memory of 5508 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 83 PID 2896 wrote to memory of 3324 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 84 PID 2896 wrote to memory of 5680 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 89 PID 2896 wrote to memory of 1164 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 14 PID 2896 wrote to memory of 2540 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 45 PID 2896 wrote to memory of 3184 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 48 PID 2896 wrote to memory of 3468 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 50 PID 2896 wrote to memory of 3292 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 57 PID 2896 wrote to memory of 4376 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 59 PID 2896 wrote to memory of 4428 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 60 PID 2896 wrote to memory of 4500 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 61 PID 2896 wrote to memory of 4756 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 63 PID 2896 wrote to memory of 5080 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 64 PID 2896 wrote to memory of 5104 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 65 PID 2896 wrote to memory of 5184 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 66 PID 2896 wrote to memory of 3852 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 80 PID 2896 wrote to memory of 2512 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 81 PID 2896 wrote to memory of 2604 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 82 PID 2896 wrote to memory of 5508 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 83 PID 2896 wrote to memory of 3324 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 84 PID 2896 wrote to memory of 5680 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 89 PID 2896 wrote to memory of 5680 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 89 PID 2896 wrote to memory of 3424 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 90 PID 2896 wrote to memory of 1164 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 14 PID 2896 wrote to memory of 2540 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 45 PID 2896 wrote to memory of 3184 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 48 PID 2896 wrote to memory of 3468 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 50 PID 2896 wrote to memory of 3292 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 57 PID 2896 wrote to memory of 4376 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 59 PID 2896 wrote to memory of 4428 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 60 PID 2896 wrote to memory of 4500 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 61 PID 2896 wrote to memory of 4756 2896 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe 63 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe
Processes
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1164
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2540
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc1⤵PID:3184
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵PID:3468
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3292
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4376
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4428
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵PID:4500
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:4756
-
C:\Windows\system32\ctfmon.exe/QuitInfo:000000000000026C;0000000000000270;1⤵PID:5080
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵PID:5104
-
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"1⤵PID:5184
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:3852
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-19_879d58d24c3061cdf765b505d892a011_elex_rhadamanthys_stop.exe"3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2896 -
C:\Users\Admin\AppData\Roaming\SPTemp\SmartPlayer.exe"C:\Users\Admin\AppData\Roaming\SPTemp\SmartPlayer.exe" C:\Users\Admin\AppData\Local\Temp4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5680
-
-
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵PID:2604
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5508
-
C:\Windows\System32\smartscreen.exeC:\Windows\System32\smartscreen.exe -Embedding1⤵PID:3324
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵PID:3424
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\wintdgc.exe
- Size 65KB
- SHA256 764813394666aa497661e1ac07e1f82d34ab5cb13586c1ed3eabf480a8beaae6
- MD5 3ead9748cf720d000423ae582880ef97
- SHA1 b4c8be1dde3df10e452622d36a6b8d6f92fc09bd
- SHA512 a0a696e8ee09ee6eea78f0931553cde1b075da26e761d7291d2ab6d6981360c4fdf367dd3cbbb5fff09dd0dd2d901dc7a74cf776fcf48c4f2ee06e3991cc4a92
- SSDEEP 1536:nKz85Fjt3sq7UjmkkhELniSxQ/rgOc9Gd2DPJ9MhtTv6vvvVVA11KzAJ:nA85FjtB7UTkuFArgW+JqLSvvd+11D
- TLSH T1F553F153C910CB12E2A4C93C2ADD86314BEDD785E5110D6FA9E3B3ADB558093EF8DE02
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Config\config.xml
- Size 195B
- SHA256 b19c4020255de091a2cdf594b82d36e4de9c1a8d297ba099a7056b526e9b896b
- MD5 c0e6efae18bb3c023b0c8ee5ed8db368
- SHA1 b58f07cc134b41db881ba8ab58545db42b2aef73
- SHA512 91896b798064c34d818d8dfcdf2536ab8b99978e144f7c586bac3c7592048a5bc8b11d8b56f24c0629cc9a54fdf1173c257da36147b513938660f717a504d8aa
- TLSH T1FAD0120A2780CD9A34324521C3F61306DF0915A740061458394F50B30B75C524EE3235
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\IvsDrawer.dll
- Size 428KB
- SHA256 014ab931cf4a97aae30c6843e690ecbb632c2aef67824dc2c46473591823debc
- MD5 493617737d5587574933f3c9d8aefba2
- SHA1 a56e6f8c7a72ffdee4dc5e1669ff0841bf85a5bd
- SHA512 f205f27247685725c807c1f779285efa367363c75d272ab2e61383db8f2f248715f3dd58129be3dbd82035e70de5c99901725e06485982f09ab0cd760288f914
- SSDEEP 6144:64xooqv/MadWhSJCLqMZFk55icZr3+VJ8GmpzEoZcmapT:l1PaWICLpFk/ZGaGdT
- TLSH T112949E9071D640B6E52F19B00AF97B3BEFA5A6D64F1B48CF979DDC0F4E219D1903220A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Lang_0.xml
- Size 1KB
- SHA256 e97d6f5c7535d2e1065c0b6fdf2655a619bd4b65afa41d5d39885b0e654ce0b2
- MD5 4cd37c04dd00781343e50be238837b9b
- SHA1 788f433028157c4573f4706d3165522dfe6e8985
- SHA512 360721b305f4860bd20dbae1f72b650255724c11fe3069aff7cd93dee41c9f6c12ab313da3ca73d7910d86369b7aba689ff64cf141f910a99e4bf8711b353570
- TLSH T1363158B07898CE556A752B717F5C14802A9D0866C31DD1CCB8EEB4040AAB8B8273E2D2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\PlayModule.dll
- Size 120KB
- SHA256 74de688b5cc7f9f44b2ee33061902384aeee0a9a1f7deaa673c566f1bb2e3334
- MD5 ddb53748213a4552dbeadb0d7823f0a5
- SHA1 97ca5912406ffc371d8e41b27151982dea68668a
- SHA512 4509fe1e586ab0c38c257e05bc7482f88d67d4fc736311d43b83e57f66e22a8eab4f1daf2d7294d18ad13fa97ca304b1eae4450ef4bf6707787f8c971462c28a
- SSDEEP 1536:lPkrw8Qc/uPC6xYQbQthSs8HIkodnGtWSczn9w++te6soP6y:lPkrwy/uPCx4QIXW9yte9E6y
- TLSH T1FFC37E1039B3C437D4444A3E5551C3564BBF761BAAEE8807FB9E0BC40E123988AF5B7A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\SF_UIBase_R.dll
- Size 724KB
- SHA256 fe65b2d4099a80eb614f9e6628d4ad5934055073d32e4abf85863f5f48509f57
- MD5 44526398fb6d0a2011e450dc289c6cc3
- SHA1 3b320ee9bc793bb1a4347f5ff1be75bf9c9f62c1
- SHA512 67150170102f74dfe14b60443d1dc7b3e1b294ae3893aa962b16ac8322c2c7f2239afa8e243a12e47e327d4def463cc972228a40b00fe8cc32440e4f6e08b983
- SSDEEP 12288:D4Dpp5DRTk3frRY3ONUy33PXFWRb6+Ukmg14NASM:op3DorPNUy33PUAk34OSM
- TLSH T1FFF4AE233AD08077D25F4273488BA37FB3B9A961593C9A132FD61F2D2E345568E19387
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\AboutPic.png
- Size 6KB
- SHA256 39d002ef4e338cb16e6e65ae7fb5342d25854d3189e4714ff8ed4adaaa2d6b6d
- MD5 48faaccdb27ce68c35f480f97c4abb2d
- SHA1 d729a6b257d22aadc820d3976f0af20ce2a95ae7
- SHA512 c3e86140d7785e060728d8a6db0800d9660eadd143a7555325f43712db9840fc9ac73c252c5596171d588117bac4ab0c0b3079e1afdce594e2aca39508a564b2
- SSDEEP 192:DNUENaQi28l6DhYFONx/6btYm2duWWN4CT9:KHQJwC5AtSNm4+
- TLSH T1B8D18FEE6ED5314927034B6A4126DB644736C04C810CFBFBE88D65E0F7B5E51A922F35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\Frame.png
- Size 1KB
- SHA256 230f49410d4b621ed85653314cb2a60a1590a6c44ce466d577feb16c81472f11
- MD5 afd041318717c13a8f89eb8c1eed9232
- SHA1 e51b00c94aa7176fa6408cd03dd7540ce85d4ae0
- SHA512 2fe4c8e6c201f87e1a167f9fd2fcb197d1dda74e12cdc01bf36929b60d7e00ed72e174d036416fb7a73e92f63e293a255d27ec7c9c926cf12358c91487203e8e
- TLSH T13121BAC50690FB4F5092BA17DF2F155140B9AB773D0EB0304A36588A20EFE96871D362
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\FrameMain.png
- Size 547B
- SHA256 ebbc50a53552a1db6319bd08c55e5f271a412269bebdf1c53b399a832c54e199
- MD5 7a23fd2600c0842417c4930160fc49dc
- SHA1 a5e89dbf267e61f86af0e184f9550681abd8b246
- SHA512 fcf222bfe0d3624119d7e545863775a7ec3c61969fae065f7dbd0d328ff08ace5be7e61cb3097b4eb40f6b224f4b1c0ce9657d8e7c32b1cab1d343f47b295664
- TLSH T1E0F0C044033B263C93099DB72D7331982B35327D97D0441BD53DE1590876BC1C7C419D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\bg_filelisttitle.png
- Size 389B
- SHA256 024d759d6adc6be3467747f56d68dae765c5e8bccb96319cae5ee85406354fde
- MD5 9a742979b291fc7e4beab9319b5c1462
- SHA1 619f2c6138a934115be7f517575c2f300e529260
- SHA512 b59ef0e475767d82a7329748633ddfe07ced98b656c1e9e6916d9d8996b9f9326a09d22740f0e6057efb1d1d33eb1c5939f96244cd02aeaf011cb720db48d8fa
- TLSH T10EE0F190F947547EF2D4A732164F4910250808C65EF005890127CC353D8C0758E57FAE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\bg_monitor.png
- Size 77B
- SHA256 8b85e5c405b63d5d9dad299dc1ddbaef7226114c964233d17765cb32efb4d23c
- MD5 10fc711d6064cc815b8fd8d4f798a015
- SHA1 f06d826040d7b1f0ebd0bd6d54b97e651cfe4641
- SHA512 fcce89c13cacc76d8ef2e522a8afb72ff3afdf9eb6b36084b04c6bf35741052742f254c3c89314276fae94483eaaeaf580931b2a1b30bd83668391c9d7f24e0c
- TLSH T1AAA011E23B208B3EC2AA03220B000A20AE3082A0A3200A000082802003E222A80A0382
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\bg_tabbar.png
- Size 77B
- SHA256 66756117995117e29abfffac6e3704eaa25408f3413d663186546022c468f33e
- MD5 2b9c8c7df76186d5cae41c6f739ad9bf
- SHA1 0b07959ae4b221d570acaaeaf7a86eb154167964
- SHA512 9bf2f75dd459e14e9d5eadee3a9d5155fac96d93eae5176f470e24da51ca01e2143316384d2edd2c7febd4ae5f176fc4f0a8647b974270fb945a2b135ba96fbd
- TLSH T165A012E151519F29C365022366210420F8305150132105010042902202432458080142
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\bg_toolbar.png
- Size 122B
- SHA256 75cda4d81e888033d08a32ba989d6725a4e8a113ac11801f166143fd5b07c4c8
- MD5 c29fe7bfdea70172872b7b44db7bfa0b
- SHA1 41bd4d81ab5ef87f193dfdbfc298a9d43be3b0df
- SHA512 2a14b17e5bffa1478e56a4607393fa988bae5ce41bd98df08bce8e4a0fb0eb553f5f029b28cca6f5e90a6751955c42a299f90dca74c0e7500539c47011d81881
- TLSH T133B09BD755202D74E650012352601610ADE58E564765037C5155E67D5D5D13940C43D6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_addfiledown.png
- Size 1KB
- SHA256 b21f6662d5ed8c8f68939e9d8c9c477fcbb0500701e3ba6443edad5d04a610fa
- MD5 4e3b00cb070d2e40967a89fe6c829bc9
- SHA1 ad35cd40c93f94bd9761dbc83c9e5a57b068e6be
- SHA512 51aab24b0455c123e43804aed514979fbccf71b68fed1acf3a993b7c31ca30e4226d97cc5031da57388d6b4ec37f52805c06db449775fff171186865ea76978f
- TLSH T1AA311A3C59DB0308FDF6037C42DDB4D5B9B3B1447D97D261182EA99191B7864E2CC943
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_addfilenor.png
- Size 744B
- SHA256 adbf87a4bd9913e01463b29a05cb60897baa2e8c8bc4b8c14d3ad0771dc9a24e
- MD5 94846e7e8a4d5ce3da43e9c6f3d9da17
- SHA1 e24572d54a35f4903e8c5080e629429e347fc04a
- SHA512 bd5640877723dd30965c5402fa34183d044d94e79fb02dcd4de734ca74855f7a9d552d4d355d35ef0768227d1fa270953739ebf24beb41e854eddf5dde03aeb6
- TLSH T12C01B5F07B8102627DE14720FC8908BFC43AA241C703A04F343256335A4A399FC6B2AA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_addfileover.png
- Size 988B
- SHA256 ec60b901e6f4838cd3e0f23761c8be9a5dc2a67328d9e873d4b018cf0ba9e98e
- MD5 098ffe4b357a8f9f9c7fac758141e16a
- SHA1 bfe9e4de38bbae644d3e166daa664d713460cf20
- SHA512 c6f8a43791a0bca0340e0e1439f176359239580d0a81f947767e0fc8e478620ba7b2edbbea57a9716623fddee054b98a584aeeebc157d10bc38318ff25caed0d
- TLSH T1EC1108D3237C1AD3249FA9F9114ECF6B08779C2C0815202912BA9C309C835EA831AB21
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_close.png
- Size 136B
- SHA256 fb9db7364ca43411ea444c09894d7d178b9f803d0020731ca58a739edb2d9999
- MD5 f36adcdf529ae67e51f4c365dd57ffa6
- SHA1 acb0190c014ecba805843f0c0f1630db97c760eb
- SHA512 201dfec402070a9548e6b234ba0e33e5dcb90bb609745a84e6ecf52544927f15a724a8bc2100e842864404a895dcaaaad43457cd63a6ed962cbed7fe9159c7ce
- TLSH T165C02BF39214DC78F5AB1AE7021480B1B893532C09A561DC108DCC340121A54C8099C5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_commondown_short.png
- Size 630B
- SHA256 0e5a2defc49c4b27982a536b2fe181d90d2ca066a7f762231c29ce7063025b0a
- MD5 0a2a3e83e963dc5808b8be774b3e582d
- SHA1 a3d05b293b29a9ba62b0b5c73318dca56c8a7135
- SHA512 2c57ebc62a5063875ef25257493423e309559a465eac756aa764976a592b934af6ee7038078b99b0739f65dad658e7ef91c21b7e768ef55e9a5d10b9817e5aa6
- TLSH T17DF0C8E37095ABE4C711C4F6C046E042BB48820E9612023C808BA8F0031F2A101B7806
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_commongnor_short.png
- Size 748B
- SHA256 7802ef7164c592071f6bce416171c1065cc2b73ce8c7885e60a2693c621f53de
- MD5 a6fdaf8b93ff9caa1672dcd753869d1e
- SHA1 fac2837dc0de8622dc0f48e58c32ea29b0182231
- SHA512 6fc477ac29f55da63615a4117963af88ce23083375821954b912acb5676e0891a2b0802649f7a0b4057b0bd27530cd15fccecf401703717b0ff39c4d00d0c352
- TLSH T11001658963F12AFCF18298906435C973DB4EC4468A2E2C6C938DC69254659B742DA538
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_configdown.png
- Size 2KB
- SHA256 b09c7d28972ed79c7c475fe1589387f56b87db05606cb26579e710516368665c
- MD5 5587839ba743967ff7f76931510b07d3
- SHA1 6e653da59c2bae701ebf9fa84e7e38c8e1baa467
- SHA512 b6cf6df2afed15027d8aea771d47f55a886f546d818c382eaa39d992b8438a405bb1771509048fba6edba0f66ce28c3ea781d664bfd259bc00cca10371220b01
- TLSH T131513B9870104B46B4A3177D950D2F41BFE80AFB2C0779F964DCD7EC640126B3998720
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_confignor.png
- Size 1KB
- SHA256 b58932afee4e2f335f64083364bd416fafd3094dceb6f3b6ab10c84c19f822bd
- MD5 9f9981655e6d1115705d533a9ad70e4f
- SHA1 d3efae54cc12f079e3638e108e2c12afc7c620b6
- SHA512 75c1c845f2b350bcfb7e99b02d975c883f4c5aab20c16372cd8d693038f8617c29aa5632a1f5d5ae2dd0ae4a29a77b6f697c37a18d2dad794e01a1e74cbef065
- TLSH T1FB310AC149F62E9329FECA094A051AE7513B30CDA294113C93A3857FD92794614EC949
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_configover.png
- Size 2KB
- SHA256 b6d8a23d293b81f1b05abb15e3d541f085c166b3b3c1211997b843b67c026101
- MD5 01f4103cd31e715894d9af8b4aad03d0
- SHA1 c5e32d02938a6c9c292a2a5b5a28a7edf72b7d74
- SHA512 60eb8ce31483f9a799e9dec8fc320a97e43b81f1bbc1011d1cd0fadb204fb2f859895de160eadf6f44c73be9465b6b48ac284934d1560872bc48913eb62f14d4
- TLSH T12941F8E19858265CDD3163314260F8FAAFF82F2460F40D5BA61B518AB4A13068EC18E3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_deldown.png
- Size 477B
- SHA256 9a590eed1fd9af7563c222f78fd186cfffe1ea63e29ce9f8a8fb233aac1374c0
- MD5 1fb5738cf1dccf94bb7c3716499c4d79
- SHA1 0bf351f22a08606e8b6ae2d0dcd02ed17bf2bf36
- SHA512 03332327cc5d837f64f1195f1a11ab4176ebe09e6886928cfaad14d73954da53e55de394dd480af12d1c3398be61328827215be97839b41b23da3102564881db
- TLSH T1FAF0549A0CF4EF3F69C5731CC37AC5056E168C151A62034A0310EA9213361A002D02D9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_delnor.png
- Size 592B
- SHA256 5d14f34915b0e2a06eb554018bbcef8bc21693f970288c2e1c7b129bddd04d4f
- MD5 a5b6fb715947095a68b7d105191e8155
- SHA1 b3098c1afb277b5d9307332099870f51d399eac8
- SHA512 232f8aafa7e30bb847edcfc2a0be3eec99793fd6864dd2bd2259a7c1675ed97b7d2889221d3ad0c95632d804c6c2ae83643261d7ca4b6abe6c15d03986e37ab4
- TLSH T15DF0475223C65C35D45B337D07F52D8550B0105C3A09012C0A7E7A5E35C51049CA965E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_dragdown.png
- Size 1KB
- SHA256 0e36a701f7634d9671d645da5c442aeed6917be2713c14f88df6b2dc58a69d55
- MD5 f12358ba6c842a6af92e3e75afc525bb
- SHA1 3c248c9c6adb5d88f3b0d5aa472dd52c7710907b
- SHA512 cac5d6ba1d2d07d90e365336f3e37b3868b103598fc5b79c60bafff06e3b590cef1407ce67ee835007b721f3ec9672a80e58c9c6d3c7aa035eadea05fe900153
- TLSH T14A411B622D604F5E8C8874597495A40BFAB251718F718BC5DE36B44D8CA8A08F8CA719
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_dragnor.png
- Size 886B
- SHA256 8714d5b08be85e69ee9c8fb600f1845e4086b03b749cb167e697c330913375e2
- MD5 8d5f75afe049f5167f17f67dec83d789
- SHA1 d058df8d45b290d281ede5f8ef10e9e229ae6e22
- SHA512 5ceb3d755bbc17c3498c979ca7fd38f5480c7ca1b34d430b9d29ffe4747684e2cb78e4781a5e118cb0d3e2b57a8c4eb149fdec12b0409d38ac8e12e16cdc431b
- TLSH T1A111E64526397034D8AE13A19C100C4CEECC0BBA8D310B46A5D8FE24643173682BC2AF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_dragover.png
- Size 1KB
- SHA256 1e70b468ee758509bfa415e7028a67d34420284245b009fb3c08202d4372fd06
- MD5 9b4b4a119010fb88a6eeab32bacf8fde
- SHA1 2ae0e957da471292d03a9bafb56d4996be877f81
- SHA512 e90a658860e2aecc8b1e639417c68cc749349d28a29a9a5399c7fa74be21c61fe514b4b20944f22e56f4d861ea039340111b72b09abf39620e2e63139c1945b3
- TLSH T1F921EA3B3B942559C50FE474D3F5C064FED5DD6D8940A51240E79178D960541A03C059
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_frameselectdown.png
- Size 1KB
- SHA256 4efe0a62a02e7d45e8ec66be642eb4fa2d89b1254ae176dc061b0c7f807a0348
- MD5 ab0d96f0b87c908510a3708704de3a19
- SHA1 9b2f2516a5d09721e70712da7b37616563d59fe9
- SHA512 ea60dbceadd99316ccd295101fa82a3410e075edc8f9bc35364c6febe74ab40b19b89417122bff2fa81a1e1ffede93bd59f416a25a12164b5946954aae47c402
- TLSH T13A313C9712278535F2463B05BF1C002D7C7BA45D9B61A11FF81A052F42AE6B5019444E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_frameselectnor.png
- Size 648B
- SHA256 8deadabb0f536cd4573549db60541e9b1dae598cc198f69f3cd1a8e2b05838a3
- MD5 5bb2b24eef14734c1e0ec6cc99101c8e
- SHA1 052ae2655810ee4111721ef3f38b0bcf0152ef86
- SHA512 9af48b3e5a58715945685b158ff30d097cdf4324291ddbf39c581c7e994100bb2a6a8be9046e24c0a56056a1e30df3a451e07e5d0e15b236db3cd022c7d104ad
- TLSH T1FFF0C8D1E7D40A1CD706F3F6071D3979764DA0E47C25429A68430004393C88CC4C4C89
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_frameselectover.png
- Size 919B
- SHA256 7a0225509d5ce02480ebe5302600b01720aca54109c34a378351bb79a2db8893
- MD5 6433810686ef08782885446a59989995
- SHA1 f5a0dbcc3ee4c5b61bd5e04219e5a2e68cc9c11f
- SHA512 ea75ae8fdefcdcfec8beec5c859432d50e68dafc312bbdebc39ee57c593fef2fc408961da909b5ef53c42ccde5653c9092f04ee33eacf487b3ec6d49b304b3a2
- TLSH T167118892510722DDDD36C813999D5304C441BFD2BB335D769E9AAC54B8260440C892F6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_fullscreendown.png
- Size 1KB
- SHA256 b25d1b88dbaf21147eb1f09be0ed05a10873d41c33b31b56a307d4a54d6cb38e
- MD5 5b9285018bd492361894ffa18d864539
- SHA1 5f60922f094e5ac000a446fa9c1492cfb123fff9
- SHA512 c7b05ffedff2e2a4925b561471d071b2fb45b0df716ef48ce392708a00aff38d81c019a18250f0981a3c0a57301b1d1dc7b3c9fd74e0a17ec6d733e1ad2cc98d
- TLSH T169412CA33332D4675A624F63800F378A61A0653D7C19C63B8C1858FF147D56D45C867F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_fullscreennor.png
- Size 899B
- SHA256 4a688c6def45cbbe46d7897434f4dc84f99b7abd6c015d2a22545b546912d1c3
- MD5 7285052cbb0ff14ff9cd86431a63ae1b
- SHA1 549c5f6a1bb9271ecbbd69f52326a9c0a3adb033
- SHA512 a79d987dcdd2fcd26a856fa4bf270c5c966900b7f946e96a32aac83a9ab7c9e35cb26f7bc1a34c3d1369b05a8a47dbe7604b312e5da6021eae8a56cb728d1412
- TLSH T1E51184B9266053E03B64CC6195050216DD39A239DDDE66DD67245E3E0F3814463010D4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_fullscreenover.png
- Size 1KB
- SHA256 697f724bb29bc65cc9d1dbde18f5d5815e26cb3286a2f3588442bcdd09d3d278
- MD5 466663ff4161f277af7cd0d577532dfb
- SHA1 0874ca70c4d1f88b2332d3f0fa18b2a88fbb48e8
- SHA512 106bb579ca53f1e11dd2b996a30fc578b48306c72c3703b19c9fa05cdad982add8a42e3b28fb325d950cbe7d623034f7bd12787e4e30835599a95b5e6e907377
- TLSH T1AC21EAF22928836574125774A66555034FE8337646333735E84039FFD98E08883B5789
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_ifullscreendis.png
- Size 1KB
- SHA256 983bff817a8da7d4a88edbff1659389442362a392b742c874a1dc0998ecaa426
- MD5 f4d46da1ac5369f73042a6506e43e94a
- SHA1 14775628f569ab3bae18e10d33262c39e4e6c3a4
- SHA512 153ce728af076e3d349ba40daebe6ec4907df42ce71023d0cf7c1e7b054f4347c9053f0563c79a1ec59468b29b251b879e7f4479a8406c54db4ea420a61d38c6
- TLSH T11F210AC2FE7DE1509011653756C88001E51BC1B1E7532A07452B183C985E563F2DD6B9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_ifullscreendown.png
- Size 2KB
- SHA256 db8847096ea9ecd2efa89552a42640fb88db30d080638b4af15c9b122930f520
- MD5 f6dd67e2cd6d54efe274f8c29c3c2330
- SHA1 69a107bde03937f259ee171f52119d20757d0dc4
- SHA512 fc872a96d784c8ee6cb6518225d7b6bbf4921727f94bb3ca13a2c40413c0c318d83aec3d1c520a20b8a837d164011a89e605b9ab09010685a622000dc7f608ef
- TLSH T1EB410AFC75839CAD9AD2FEB41990B05CE1B51152654035C3247CB53C1964B6CA4EA31F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_ifullscreennor.png
- Size 1KB
- SHA256 99eee6325f4d036ad5c1ff8f40472c95c3c12dd71ae94641fe6195d145016e9e
- MD5 ada24e5d7bd98066dff002569777d51b
- SHA1 efe8ede41d82fbe16eb7c252178458f92a5c3a5f
- SHA512 9e0ee7363abb9e716196acf2108d3638a3695822b9026b1f5bc578aaa1342406d6ff2ffa2305ef4f2748dcc40fadfa2eeb459adea54b505228b0ec327448cc5b
- TLSH T17A21C87921B59974DF681AAE9C71ACA4D4D2827577299B870A17881608CC7B0D688141
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_ifullscreenover.png
- Size 1KB
- SHA256 c3b85e5b1f9ff060d765cd1456f5f0eda75a1b79a448c09376433f3e9a45542f
- MD5 f597cf43236901f0aacd4a6936f4e13d
- SHA1 38f8e322e52001dc50098fd369277b63efe8f451
- SHA512 0b0ec406e70e81c819ecf571b1fb93329211be04f72c31ed10f11a233380152b0818157258bca86feba3da71eeeca16806c69dc5dd07b1e0de7daf20e5cd804a
- TLSH T1D33108D9BA6A0E34A17BF3A534D43234A73A486BDAB4A3C3851BE0B749447D98E001C1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_lock.png
- Size 144B
- SHA256 cd51d6520d600bc174c600a1e91c2b142f762ad306d93155390ac3af837ab173
- MD5 a3039eedf5764c9057b0565b4db40b46
- SHA1 58056d11cc5a2e82c6e27ab14da9f57a2cdc5732
- SHA512 827a90eaa695a60993a01d3138e794bebbdbc96eb9a387b71a64ec838b09f79ec7c11daea09df9f52f8ed7bcea75e763f4dd1d04fbdd7e6c9323d267737e019c
- TLSH T135C02BD263189E32F43B1BEE04254930A432C328888349C927428C718625B880C97391
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_maximize.png
- Size 111B
- SHA256 8c3545e4342ee9967d07df77ec8ee146ac4a639c4abbdf50f3fa66efe40e770d
- MD5 fd6ee378a7d1387fd243e9917c517b30
- SHA1 b5ab64ebf5d9731ceb2baec21412f4d6ae8fe6fb
- SHA512 db162aca73d93f519110d89ca0f14800b3ba04337fdb8c6a364ad84e9ce313f7f753d198c9ef13ba7f0e75cf99282438fc3e62177761e934dcec7669d15aeeae
- TLSH T1F7B012F7F1500F3DF15903EB42277670F8A2C2AC0A50019A61857C3A34D168542526ED
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_minimize.png
- Size 96B
- SHA256 8abae066bf6fb536aa1ee3b4c4fcf1c84a350a32ab47b8afde269de9617d9440
- MD5 e5cc3d4ac9846c3a14c3d48e0e2ad311
- SHA1 4e5662bd831f531baff84d54945a4ea16d6373ef
- SHA512 c952748bb4baf693a6b1cead8c56481aae2214f07472aa8de466bdb6f4f74b1f55db5b056e0210daa3b4ace4755ac379616364d3a04483a18ec4c8fe87845858
- TLSH T162B012E7B1480E38D74625E7812B0030F422A27C0E9522384109CB340041040889C2E2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_selAllcheckdown.png
- Size 601B
- SHA256 b061ceb2ee4455abdaf6f54d391e48dff0df873ac066e1f4043e7dca6c52e350
- MD5 17bb06fc7db5a33b9d616983046bea74
- SHA1 1713873ec9eef280f377041947ad483639de6b3a
- SHA512 370a6359ced757465a4d2b82a7e6a78336cefab8a9949ecad71d084278c8757e5d2cddb4a8c78ec2fd2ced3472d0c83bd101fa33045580f8fd8e56fbf1a3a900
- TLSH T116F0628631601A34BB486F5B562ACC1BC8731A0B437468D218CBD413332469280A9B9B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_selAllchecknor.png
- Size 722B
- SHA256 a18798c12b04058eb90600d9b7cacd83c8dbd7185ae5ccc691acc0d99b05dd46
- MD5 47062da646d14a4d44606e879e1ae19e
- SHA1 a17a5197dd0eac2a885eec052852d2e2a3cdb0b9
- SHA512 f3ed08f6795b080b672587cde9a524920cafab0e4fe913986629688e87260292d2969703bf1c12aada702bdf955f9b30b687125cf557e8b1dbbe2ceebf04be58
- TLSH T1F20160484F9186A9A0379FF27302199AEE190C622F25918E228A463B40B07264C19CCE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_selAlluncheckdown.png
- Size 358B
- SHA256 3cccd50396821489bedda49acade40df62de43c2c2c3ab52b3efeb7bf1237b1f
- MD5 c5bf8561d99ab8cdbec5be6379945fb0
- SHA1 194181e5db3e5f1e30a5339d4282456cc764e8aa
- SHA512 d68164736349a9c058c5ade88d4cbe8e2766e0617bacfe2fdaab46d85c9681dce870a72cfc3820cab0272325ee311c62b6234fb4c62fdc8c8c261394012bbd84
- TLSH T15CE0C0624934E648F1738A12C27A2180CDB3011D0BC2E389034D60332707A39E0155B6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_selAllunchecknor.png
- Size 487B
- SHA256 8c91d269ac89ce3e24c3e779a68d4e0b011adafbf2e250cc0c5c91ccfa7992f8
- MD5 8a4e0e54432729777923c80449beb3f9
- SHA1 cc8e032911dc3174687d2bd4c24ceead57191141
- SHA512 1d3e88018564c8f437f75aed9ef377f1194f85196cf1ed0be52c8d71af64e0713fa3f9870ecc6344267a04ab9650bacb0b802d8b9dee601dca003d6ac6414466
- TLSH T1C8F054955F685DDCCF945F7599170D30B4182ABD26BB020F200BC430330B215C840E0F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_selectdown.png
- Size 1KB
- SHA256 9d243e2448ff419348ae35eb97ea597a5bee581bae99ec437ad4f6762cf445ba
- MD5 8462df8225f820bb91489f5c10ad735d
- SHA1 b294a4f25152ca2bfc75ffa6683e10cc6615d4ae
- SHA512 f73c483a2cf5dc653e424652a3e25cb5bdb19a9800747dd3c0a55d557169451308dcc3f7493651aeedec121dbf472d281c18f35a0c06747a4eb11d9f9dde432e
- TLSH T13231EAF2B6409D5C3B6F77BDE974C4267ED7AC8AA5A9E3F44143C5905640080C2AB4FC
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_selectnor.png
- Size 628B
- SHA256 f44901379ca39395b4dce48ff23be16bfc725ed2c007c24c812598e1497f80b6
- MD5 d7ee8ccb2bc2fcd1c3708a80aff7ddd9
- SHA1 b69d4192597b8b934152ffbf976a3dc3573097a3
- SHA512 cf0df6a997d25cfa960b5309f084c3333fd5f0e88cd6d294a08c67b953bd852bcd609e86eaef8fa705efa2c0e1637ce15a77e84cbd53f6af7803b3d6dac65294
- TLSH T113F02D3681F9A153EF083F3B030A2192C178836CA2130B6830E26E21B91989C1B08F86
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_selectover.png
- Size 899B
- SHA256 bb9cb825e856efb4066406eea66ab5f520bba7b068d2b76b4835cf1e9833d12e
- MD5 b94c73ac1116415faefb972c7cd2a508
- SHA1 f3830123f4e1089387d4261658bfe266d0cff627
- SHA512 bdbc5c0660a4db7efcfa642a1f7bd13feac5b2ba7723d37cf9b08c9502b0df550d7389e2a16e9879d3128816a928acb2227067f1a498b56c135f9f90a2688527
- TLSH T1091184D0A7502B2D6A7F5565652ED1B0D6D41B5EC6424282B0660395120552F4AB53C4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_seperater.png
- Size 141B
- SHA256 ef0ef6f92c648f53a7501fd1d7f2076b0f79e1f7403991bbc8849c27aef5fba8
- MD5 a13fc81362de6b7cee25ac2109b1d9c6
- SHA1 59c568a1d9dc8c0bd13716d170914efedce405ea
- SHA512 54a52eb63d83c5d22e8b97b18b2952643b87122c19f2014027ba634df620668f7568e14aca8a691d484fb01c77f97f1169549abb8b96f6d3e500c518a5d6cd15
- TLSH T1A4C02BE39F2C4834DA6ED7B3935010B2EE701F5187220E160DB1FD71D682B01317C182
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_tabSelect.png
- Size 254B
- SHA256 d68c3c3e1290a763edb739a1ba90dee2bb0606a1b8a5c6eb039e2890899a2cec
- MD5 21e9186500a90f969903acefccad7595
- SHA1 0259a3a8bcd2c0b5dd5015afa31a8446f241e553
- SHA512 ab137e4b45cbc3343a6f86f804ee75250f3aa51fd6f9a4e1d63a4cb76fbcd11106206b4ddb6259adaecd71783667ec3ce5cdba1aa7f1624e0d5268d9dc6b2cef
- TLSH T15CD02B4325545A5C514AA69B69802364647352390FE7068D840C44324D1B51886C81EF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_tabSelectUncheck.png
- Size 259B
- SHA256 4a2804af0f601007974b5fdbc73e75cc9b7aa0f0ced6efad9187f05744b240b1
- MD5 5494a681893440ef3dd4484c9d0ac617
- SHA1 90e3d3533945b0a5a64cd7d3bf3d7de80efe533c
- SHA512 27736cc8f1b70700bfd105e85cfc604aacbc43cd337014817e6927ae978b47f6490f7374e317c3fef4425b09786a9b5058bef9c21690255ad415ced453682d0c
- TLSH T1DBD02BD232A56C5CB19AB63765140198EBA59E240026174A592A6D60E9A51D920C52C7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_tabUnselect.png
- Size 388B
- SHA256 62a732a107f35adcad232b2a3d6e8155b77eae4856a6331a1542afd70bc69535
- MD5 8955be430a5c4ab92d62126a02960a72
- SHA1 2d6f94a9443dbedf29d5978c29ef23c6471fdac8
- SHA512 19c10b22d24f0682ed5bbd0ff6e252571502f8cc3761872ffa0fa087e58e9998a5f367d9c6ef7471b13c32cb731a9939ec502408459426edc62f7cef85447414
- TLSH T120E0F1A2E721323DA4C14F32E61E56A59DBB51E5D428110C121DB36C301355BD2D06E9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_tabUnselectcheck.png
- Size 356B
- SHA256 c986628cbbdbfac91fc0046da247d4ce8837c669971d4c82c5f76e5004eb66ed
- MD5 638f946c7089c202d4896f083dc6ebbe
- SHA1 dc3ca5e9568672651975addf8006d83f7359504e
- SHA512 a3dd4c81f20884619c3ac5a705f5f3cf2289e3e6fa6a0cefaab41ec7fb3f284a1b314ac0cdcb2c01b2fea7926044d20126a5b08d1926705be0b68a8c594df403
- TLSH T1E4E0C0F6C3D31E39EEA7013501D9206C94335483DD484BCC4840F66238343B51042356
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\logo_0.png
- Size 4KB
- SHA256 e3536ca7433446331f77ccfc7d3411d8f4492f95e663bf2eca90db92e3ebbdc6
- MD5 7747afae7a5684d2a0aaeda8b0d54b00
- SHA1 87c99edb8937f5123fcbb47694a8718fce5d2002
- SHA512 8a1965db72fa10f37b1ea9cbb026c1863ff8906b8ad3a7a993b26b9e082c65ff3cd7f3d526bf0a1b28fb6e243e8b131379bcd691ab5769101d46f787e1fd44e3
- SSDEEP 96:CVy9HdIvuKWqq4BCnem/PTlDNwWESZmRLWMM+yYBizoPKWJh8:CVUI1BCem/PTMPSZ1cyYO1f
- TLSH T123918E6FF8D9697769CD0DCB4066B0FD16779E00DBD6CA2C07606EB90510F1754805AF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\scrollbar.png
- Size 1KB
- SHA256 83dba0950b0abb308a4433d131a35214fabff7150e812b76cb963cc5b3fcdfe9
- MD5 877fcba305bcd6e47611891ab1720922
- SHA1 b2f5b91a272648c06109ddc9210aff1f27a45bc8
- SHA512 ed10e20034740b02a9bb35ace4b392f209ff53cf06d3b2144ae5b81f15682eab32f89ef9396cbd59f5c0285a4e2737e7cdc8ac8bd812a33aeb052df23538c93a
- TLSH T1CC3138A271E88032FF6735FA0612F930C1B9F2B368B1D39D7DE11915C80C3D4806A4A9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\SmartPlayer.exe
- Size 800KB
- SHA256 98c4e937dde640de3a3ab5193f1f71406ca71f62af001bec65eae2af1db97d38
- MD5 12a8a9bf78f4b9d78c86b480fb8456c9
- SHA1 5a78587b273de9336384b3de9b7af8d09b0321d0
- SHA512 27c3ed2c101ee8319b9075893546b11560367b53f22832b78936cd5fb54f749af1c5fecb2093e2626178edc0bea655f019a5089ab3bf03363cacdf281e984246
- SSDEEP 24576:fB+OFBqZCLBhynviiXDtbDr8wK3VUaGFWW:ZJFBDBwviYtoVUaGQW
- TLSH T1EF059E33B3C1C0BBD55202326809A37D9275FD925F388AC76BCA2B1E6FBA1C16D35651
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\SPTemp\dhplay.dll
- Size 396KB
- SHA256 21ab7faf55bd68e69e3ae92fbbd172caa4818b34a04e7c51174e3bc1b05086af
- MD5 268f003d3b47d9187b557dfce26b886e
- SHA1 bd6202b53fa093fc0e16cb8b7befa97ade279e59
- SHA512 e13e1d6c2be866c568f090df5528f9b23a69592b4e562434a18d9d8a11a305278ae54418d555fba0c915b6e42f5cb3d867332f8f82e01d505bc6cf79d7c35ef9
- SSDEEP 6144:TmahID58pXda9sOsdcxewxGTLjAYLD5j0C+HIUIc9tFZv:aaODoXDTCTYgw5wNHIURp
- TLSH T1B2849F12B990C0BAC29F12317E5CAF6FA7F8A2850D75E543B3D8851D6F32A11D32A317
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\xaxc.exe
- Size 97KB
- SHA256 2d911f03d0a67f2c4fd139bafac0caba59d8b7e09fc585c2efb82667cfc04827
- MD5 3c9db2964512f9a5eefff0ca47edf794
- SHA1 66b5be58b80be1af40633fdbbc3160cce4b72a78
- SHA512 42df4eda13808e48a745ed5c1cc3a43b611b5ff37ffd827a355c193144a70a25cd74ba03d6ce35b589f2b2786e4f13d068d596adcd21942bb41d8ec842bfb1fa
- SSDEEP 1536:JGEAGwjA4a1KPl+QpzGI9Nl4fWx2Vk7j7xWYWW+en65uEux//QOPaZN7TYl5lgNK:cEBwJT4IdohViNWz1WEi4ZtSD2mFLR
- TLSH T1B7A30212F482246EE7D5BF3F6A4108C0F4029AB12311B5738DEBBADD9959DCABCC164D
- MD5 SHA1 SHA512 SSDEEP TLSH