stihat | 48e5ff5a38729ec96eee8ce2b34ad04d5039bcfbcb13764b2d9f6c27274ab612

Analysis

max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 11:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_a3d0b041d98bd97fb3ce536fcf59f989_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
Size 3.5MB
Sample260415-nrt8nsfx6x
SHA256 48e5ff5a38729ec96eee8ce2b34ad04d5039bcfbcb13764b2d9f6c27274ab612
MD5 a3d0b041d98bd97fb3ce536fcf59f989
SHA1 a720860cc827e8ab7895a492d57f16599493b80f
SHA512 65dbbfe1141dc89c16ef39409f52807d1b910d8de667bf210c041cd15a973c6670a74d283ff38305cd1e7645b028153ea549b8942da60e52ce116fb654fffcea
SSDEEP 98304:+E2H5Wky5WL5Wj5WiM+M6RkMkIM7M5WCMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6n:+nvD
TLSH
T177F5BE02F7D4E872E0B701344D23E7749A76FC615A189B4F36987A0E2D717C2A936B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery stihat persistence spyware worm

Malware Config

Signatures

Family: Stihat
Stihat is a worm written in Delphi.
worm stihat

Detects Stihat payload 11 IoCs

resource	yara_rule
behavioral2/memory/2640-0-0x0000000000400000-0x0000000000478000-memory.dmp	family_stihat
behavioral2/files/0x001200000002ad8a-5.dat	family_stihat
behavioral2/memory/3272-7-0x0000000000400000-0x0000000000478000-memory.dmp	family_stihat
behavioral2/memory/3272-8-0x0000000000400000-0x0000000000478000-memory.dmp	family_stihat
behavioral2/files/0x000100000000002c-18.dat	family_stihat
behavioral2/files/0x000100000000002a-44.dat	family_stihat
behavioral2/files/0x001900000002b481-36.dat	family_stihat
behavioral2/memory/3844-50-0x0000000000400000-0x0000000000478000-memory.dmp	family_stihat
behavioral2/memory/2640-49-0x0000000000400000-0x0000000000478000-memory.dmp	family_stihat
behavioral2/memory/3272-53-0x0000000000400000-0x0000000000478000-memory.dmp	family_stihat
behavioral2/memory/3844-70-0x0000000000400000-0x0000000000478000-memory.dmp	family_stihat

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	2026-04-15_a3d0b041d98bd97fb3ce536fcf59f989_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe

Custom signature

Detects executables packed with ASPack 11 IoCs

resource	yara_rule
behavioral2/memory/2640-0-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x001200000002ad8a-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3272-7-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3272-8-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000100000000002c-18.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000100000000002a-44.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x001900000002b481-36.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3844-50-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2640-49-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3272-53-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3844-70-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	2026-04-15_a3d0b041d98bd97fb3ce536fcf59f989_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	2026-04-15_a3d0b041d98bd97fb3ce536fcf59f989_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe

Executes dropped EXE 2 IoCs

pid	Process
3272	HelpMe.exe
3844	HelpMe.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\M:	2026-04-15_a3d0b041d98bd97fb3ce536fcf59f989_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened (read-only)	\??\N:	2026-04-15_a3d0b041d98bd97fb3ce536fcf59f989_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened (read-only)	\??\X:	2026-04-15_a3d0b041d98bd97fb3ce536fcf59f989_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\E:	HelpMe.exe
File opened (read-only)	\??\H:	2026-04-15_a3d0b041d98bd97fb3ce536fcf59f989_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened (read-only)	\??\A:	2026-04-15_a3d0b041d98bd97fb3ce536fcf59f989_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened (read-only)	\??\G:	2026-04-15_a3d0b041d98bd97fb3ce536fcf59f989_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened (read-only)	\??\K:	2026-04-15_a3d0b041d98bd97fb3ce536fcf59f989_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened (read-only)	\??\R:	2026-04-15_a3d0b041d98bd97fb3ce536fcf59f989_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\P:	2026-04-15_a3d0b041d98bd97fb3ce536fcf59f989_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\Q:	2026-04-15_a3d0b041d98bd97fb3ce536fcf59f989_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\J:	2026-04-15_a3d0b041d98bd97fb3ce536fcf59f989_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened (read-only)	\??\V:	2026-04-15_a3d0b041d98bd97fb3ce536fcf59f989_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\I:	2026-04-15_a3d0b041d98bd97fb3ce536fcf59f989_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened (read-only)	\??\O:	2026-04-15_a3d0b041d98bd97fb3ce536fcf59f989_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\L:	2026-04-15_a3d0b041d98bd97fb3ce536fcf59f989_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened (read-only)	\??\U:	2026-04-15_a3d0b041d98bd97fb3ce536fcf59f989_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\E:	2026-04-15_a3d0b041d98bd97fb3ce536fcf59f989_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\Y:	2026-04-15_a3d0b041d98bd97fb3ce536fcf59f989_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened (read-only)	\??\Z:	2026-04-15_a3d0b041d98bd97fb3ce536fcf59f989_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened (read-only)	\??\E:	HelpMe.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\T:	2026-04-15_a3d0b041d98bd97fb3ce536fcf59f989_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\S:	2026-04-15_a3d0b041d98bd97fb3ce536fcf59f989_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\B:	2026-04-15_a3d0b041d98bd97fb3ce536fcf59f989_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\AUTORUN.INF	2026-04-15_a3d0b041d98bd97fb3ce536fcf59f989_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened for modification	C:\AUTORUN.INF	2026-04-15_a3d0b041d98bd97fb3ce536fcf59f989_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HelpMe.exe	2026-04-15_a3d0b041d98bd97fb3ce536fcf59f989_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpMe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_a3d0b041d98bd97fb3ce536fcf59f989_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpMe.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies registry class 21 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	explorer.exe
Key created	\Registry\User\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\NotificationData	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5008	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5008	explorer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5008	explorer.exe
5008	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 3272	2640	2026-04-15_a3d0b041d98bd97fb3ce536fcf59f989_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-04-15_a3d0b041d98bd97fb3ce536fcf59f989_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_a3d0b041d98bd97fb3ce536fcf59f989_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe"
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\SysWOW64\HelpMe.exe
  C:\Windows\system32\HelpMe.exe
  2⤵
  - Modifies WinLogon for persistence
  - Drops startup file
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:3272

C:\Windows\SysWOW64\HelpMe.exe
C:\Windows\SysWOW64\HelpMe.exe
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3844

C:\Windows\explorer.exe
Explorer.exe HelpMe.exe
1⤵
PID:4432

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.exe

Path C:\$Recycle.Bin\S-1-5-21-2397528088-2630719772-1129911217-1000\desktop.ini.exe
Size 3.5MB
SHA256 c4035c879bab5fad27cd3779313bf2d9ab0b5dc222f1b5a5f432d04257e388ba
MD5 fc2a31992022538c80a8d9fe9805ef76
SHA1 35a8e22500445e619f2b31cd86c18188f3c2983a
SHA512 ba2c4fb9785dc8f0342157b5f5a1ee33c3e5980a8f8737d64356f1fa439ed0fd9b80feb45755e373bc0be1ae62bd485e93eda5ee6aaeae1c7360de1e0875f9bd
SSDEEP 98304:+E2H5Wky5WL5Wj5WiM+M6RkMkIM7M5WCMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM61:+nvB
TLSH
T19EF5BE02F7D4E872E0B701344D23E7749A76FC615A189B4F36987A0E2D717C2A936B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 e7a8d51ce78cb9d2d667827260f0ac83d04cc7172ce43e28cf25412112f5400d
MD5 2cd1763bc61dbfa068841a690f726390
SHA1 0fdcabd0a39ebc90d9741701cf028749dd3b6a13
SHA512 d867d3999ab2991d58855b27e187bbae110091997e95cd3240dfa093edb9771f66353e04b140d6aa42fd1981b753db40f160dea6289d37541da76a1e9ca155c6
TLSH
T17911C22815D11F36D7B1963990BB57224677BD02E5AA8B0E809803819C86112B8DBF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 ce45baefbbfd5bc289ca8f55e7a0874d19db771a78296eebae4f68d68a734677
MD5 4b0eea1df587c02daf50d7eca1de8b3e
SHA1 b5a004e417364132e4822dbfb0d91801426af9b8
SHA512 28178e7eb56eba4e71c33befbe28c9ce1c0192e0157353f6f267dc1ed3a0ddea7f63ad5232faa97b337cee7a786a7f92d64a6bd287e41c052c59159aea660e2d
TLSH
T1E7318B285FE61FB4F67AD139D9F286969131BDD2B705AA0D0050838D0C72B429A4BF1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 8d63bdf21985cc9f01f54c3891f47b10b30bd6f790e87fbaf5b67d26a497f1bb
MD5 688e219211e256f517b1b65abf2cfdd3
SHA1 9f4ec236dc1d0acac38f99a35bcd414f72962d44
SHA512 13165c0c19d8d86405fb9e81eca4320e3af8f60098c461da3f14abc9049dd361b761a1576f9713d662ca8c2fae4ca0470a37ad1bb8deb8cea6795b0c5b66825d
TLSH
T16911C22815D11F36D7B1863990BB57224677BD01E5AA8B0E809803819C86112BC9BF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 589ba60e05f518bb54e98670c862bd9358f7041373dba5ba3286a7a4826b1f31
MD5 d021e9d239cb63749f23661395f2e103
SHA1 8badbe2e539e9e86e5d744eeb2c20e219258aa92
SHA512 9e0b4e74aca373face446a0711a62e22223d5e705accfe157dbd35ba3da63e49bdf2ffbff6e4cc999fc13e4ac4ff75a184ce3c258c40749718f9679bf5390de6
TLSH
T19A11C22815D11F3AD7F1863990BB57224677BD01E6AA9B0E809803819C86112B89BF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 77542e2b34f04fba49bdb8508a066abb21eb4e40f264d9a7a6e24562cc089079
MD5 3b1991b363062860f14ea5aebea265fe
SHA1 8b5a090843c491614b2f18e6c6c46fcf0509bb97
SHA512 709c94525694cb577cdfe923cb5011e285072640d3aea9c061726d841efd9f5acecfbcb06b314fdc96e6dd20f3208065ddd606f9c611fb50a230154afda8c480
TLSH
T1E0318B285FE61FB4F67AD139D9F286969131BDD2B705AA0D0050838D0C72B425A47F1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 f3d61e760e331267fda2798dcf9295ff19b68bfcefda8e92e3a9e2f7f0e20f87
MD5 907b357c71f727a542037712211f7e9e
SHA1 004a73ba4bbb18f724af2b5c9767ed165b0265c8
SHA512 22cd4ba0e90ce45160e0a7e43fbf37dc6ac83c93b186fb556df13d1844792304e619237057b61f31103630faaab8b4cf62e64fe2c56103675afff46703202481
TLSH
T17011C22815D11F36D7B1963990BB57228677BD01E6AA8B0E809803819C86112B89BF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 a9a66147f5f0c6dbb03b5a405df61c8fc628ba1e39f0156a94b58c5503ee79c6
MD5 10f5ae16ce662f20433ca8be56e89779
SHA1 23e8e1b405ae773fcc601060fd41c0372cc01519
SHA512 99ab2c4f20a7513851fb25133cf247357c1583c59085f56e4f9f2946571d67cc9f3ee392bccd8a1709e66a35ea3825f92af26c31d5662d90a747ff31a24db4e9
TLSH
T14F31AB284FE61FB0F67AD139D9F286968131BDD2B705AA0D0050838D0C72B425A47F1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 44fe30476b6bb88c0f749940c785cbadee956137222db0e11cb5898fafdf490f
MD5 6a790353bd8df02ac556689c2a6d6c47
SHA1 4c67f8e1b890d4012f62e8c103695c77ddfa3154
SHA512 ed5b8bffd662e16b89b46d8f4fdca14f0aa7c880d81fc0be302c8ff1b791ab3286df168cfadb0bf3e9389618f32971856530d6399989bd7625b7bd55129eb2d2
TLSH
T1BB11C23815D12F36D7B1863990BB57224677BD02E5AA8B0E809803819C86112B89BFBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 54946f3fbf0126c9e2c2d429778d4a5e6450bd781d9bfe5c67871bef1eca5d2c
MD5 3dcc39d7ed497af9ac97166cae9c22f4
SHA1 c6066c582faf01ec463d9665e92e74f58a303442
SHA512 6f0409dd670079d8bc740a841c2fa3ecb47f71bb52fe2ef90d2ac441b52a31348a57de0619eef71d2d8ee61ea7dfac2d319f7faa07334a76ab3b2dc2d7539850
TLSH
T16A11C22815D11F36D7B1963990BB57224777BD01E6AA8B0E809803819C86112B89BF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 6633cff633ca5cdbbf8df83d6a1de58ab367ee402980f166ff91741a0b7990fa
MD5 181d91119bc121bc3dd9a389e0054210
SHA1 58cf848d44cd854c639d59a74645b0d8a250b442
SHA512 1d6e392c34d335aa158d007a48215e86b0b91d0afe02c0df728e421fbe47d94958ea0e46e0bd4cc7773edb78621c02c29f2edb9386d98a0ffe8c49c587d7f086
TLSH
T109318B285FE61FB4F67AD139D9F286969131BDD2B705AA0D0050838D0C72B825A47F1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 2b1494eb8cd03879248a94314325b8ca4d6d6d979a7e2e0d4d81745e0786e94a
MD5 96327dfb1385c81239644174de85a560
SHA1 7a5d3ca9418b0ff26c456c5ac0d042ad6fcfd2ea
SHA512 5ec30606d7ed8132e7972a95e5ebde6e3c64c57a18e1b3ad973904859359ef9f0e055f2f88bc0d81a4db2d3f156874876a3bf53bcd34bb4f3d32d3d332ced74d
TLSH
T10C11C22815D11F36D7B1963990BB57224677BD01E5AA8B4F809803819C86212B89BFBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 a9ae42ffefcd8e002780dcf9b509e83675dfd7be1927704bf3e3fc08c2de9def
MD5 409286e8b7bf43890e536536ac8d47f1
SHA1 04a609dcc90042d5fdb30572e0f382814e28805f
SHA512 71debece9f93849e146a8492b57e278efcfc45f6d379a390eba73e9411410d47321114f1c677eedf80b016910c55e3c87984b8d1b00b4cecda2d6d7ca31b3f60
TLSH
T19F318B285FE61FB4F67AD139D9F286969131BDD2B705AA0D4050838D0C72B425A47F1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 fa1a73c16b215672b6f9ae2a07cf3c8b9095c93fd9d8bf08c02a6b3b0527381a
MD5 75e96096d93384479807c04e39d08a4a
SHA1 6910521f9f4c399651d86316ae1628dcf41af52f
SHA512 b29f3869f19d1913e6d476984066704d7565def73e97beff2a791f70413d103fa0ac138f1050d24d9c394a81fd2ec26c8301de1c1546be39a393266ffb2d36af
TLSH
T1C511C22815D12F36D7B1963990BB57224677BD01F5AA8F1E809803819C86112B89BF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 760ac5c9f5b49d88ec721c33abe4ea2a7699e6bde6e37456ddadfb3bb46aebdb
MD5 f06818fa2ed5057b280f2de90a14a876
SHA1 8325486e3d373857ac39f31471ca750f5d0b0c44
SHA512 0be3338fa0afc270d786a524c8f40cfcfce59136a18e35791a92ab937f6f6212f7e85806d49d5939a02532a56e134991bcfa5e8f6187c30dbbc13de7b8300635
TLSH
T11211C22815D11F36D7F1863990BB57224677BD01E5AA8B1E809803C19C86112B89BF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 3779344acccae9e7b015c15634b42405bc4311fc6ecf18631cab9cdcc7cb6b0c
MD5 730ce632bc74dde6c6a9cdda7f056956
SHA1 e0896a13c1d6abdf7b33c2336518d81607d6977e
SHA512 35342407497faa7bea2c7eb04b635542c0b4e2bbc87a9e56bbb7f2997e483364e2b26bf905552f071978b551af1ec02cee20d9cfcbce68250ce6791715306d9c
TLSH
T1D23169285FE61FB4F67AD139D9F286969131BDD2B705AA1D005083890C72B425A47F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 e81fc93da698c556c0dd3ad45cbc0e81c2bc5772ded0c33f0f6abb7e2b40fdce
MD5 60432824e23288a4fdedbcf611748927
SHA1 ca2528772b77e75871c0d0bf6eb40dc933abe74e
SHA512 c9072b90069d711222c9aa2925296d15c370cf6abb977fd70b8c268109a491a81600d0a741e13db52a0e0897a98c6089428ac62a547bdedef5121a4f693ca091
TLSH
T17011C22815D11F76D7B1863990BB57228677BD01E5AB9B0E809803C19C86212B89BF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 383ef6af30ff5232acae862574b4e25dacce97af5c3631625c5434aad72e62bf
MD5 b507cf77496dab956d9343ca04f140c3
SHA1 8c4d227af8ca655889ac748a5bfca594176e8633
SHA512 5557d049394030db04bd0859cbd5f0c1c00cc2860451d4a715b5498f02da60f03ba45044a90ca63e01ad365acc0d4c6de5802d57f6968d8640602ee9ccef94fc
TLSH
T1EC11C22815D11F36DBB1863990BB57228677BD01E5AA8B0E809803819C86112BC9BF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 bfbeca028b7b778247da148aef2718d0f56a16f4e7719736253cc132d0122ad6
MD5 6bac4a60b57c15b03ab6a150c0feff92
SHA1 c758ca7280620fc3606f39bfbbd517960b9c03f7
SHA512 ec5694b910294c8c91622aab868e5ed3e933f81a1c7895e3bedd8a6aa1ccf5d0bf353b4924e9a6f27a2775fbbe1efad0821fd2587342b205998eeed9f7527090
TLSH
T10C318B285FE61FB4F67AD139D9F386969131BDD2B705AA0D0050838D0C72B425A47F1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 324026cee69a5587f5885573bc2a7094b6278401d645b9099242b9e352f41036
MD5 d19b2a54d873393ff96a145e24c55429
SHA1 dd4674010987bb7c3843fada46a10d6c99163a81
SHA512 8b295a5694b3225a365b7ee7273c47b0bd04958b5d345d044ff18dde04b7bb8cad71000a507d5955bac15d3b93ca4bb9f1fa238c498a08b24fb2bb0621e8ac5a
TLSH
T18611C22815D11F76D7F1963990BB57224777BD02E5AA9F0E809803819C86212B89BF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 acc300a347965763c2ae3ba561d05a9a77cd1edd1413143bfa51150d6c4594ab
MD5 43961a9d908566de3f3a3c54f7a97d17
SHA1 7b5c9951b3c327565a0ce57859b863d37d8855f9
SHA512 ebbb48d234f2d67fb935bbce4630236475ee01129e7505b4a59ba5d793352ed673b5f686d4ac671179acb2c9b5c8802061b1ea338bb429b11b623aa2bc0718b0
TLSH
T182318B285FE61FB4F67AD139D9F286969131BDD2B705AE0D0050838D0C72B425A47F1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 e8d27de24b62ab371931a74726c3e16d6c34980bb9e64b688b8f463534fc653e
MD5 e5cefd16bf119be383a62ac77f297940
SHA1 c729ec7d570be5f075340da2eb3cc3fd39f41304
SHA512 6d86815956f2cf396073af63048a1920ba412357a45d6ef92a1b2ea1c36fe39ab4ee24ae14bebb61380ce77e129c1328341a651d5680a3ff2eaf48b3358c50e4
TLSH
T1A211C22815D12F36D7F1863990BB57224677BD01E5AA8B1F809803819C86112B89BF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 87ec726d1c9c4d4cd3317966da30ad2b0a9fcbe3f9ee08c1df91ff4e0041a787
MD5 a8c4e817cd56b6fd5012408f374e6075
SHA1 87558b17ab5eca30a55aaf58ada921f49bcd9083
SHA512 00c14f70e6079c932da57ae2b12704793dd1fe5548795ad0300469171e0bd6775f505e2cb63e9e09d4c810509b595a4ef2e936fc41fda2a2d4bb89ecdd54edab
TLSH
T11311C23815D11F36D7F1863990BB57224677BD01E5AA9B0E809803819C86212B89BF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 9d69957b3bac12eade91354232e15db2877b6c9c4bfd65c4b9935cda079af3f3
MD5 bda44ba6cd796dd4262b9be17c85ad3e
SHA1 4647c4682a141985e4a6af624bd200ee6e207313
SHA512 c7dda7e98754d321a1973a23f7fa7fd826027af56afaeed319ca19610ab71f17456a1065287fa0a57cbf15724426bed6eae6c5cee24f48b9676dd1e2fa37d875
TLSH
T15D31AB284FE61FB0F67AD139C9F286968131BDD2B705AA1D0050838D0C72B425A47F1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 f0fce64847ba7645bb95a49d5a5ee27d54f31ba4e46856ab5f1912394a59d209
MD5 d6fc133d5a5b5859de8255f83a3f18c6
SHA1 4fb4921e682a2126cb843a833967377a4a401b87
SHA512 9e3719ceed6b58e111a5909001c5b416b59923d861bba42fbdcc64b3c42e13bcdf573b8bf6ba0f5bf914b3dcec12b7673e378832832b4c6cd14d0fe7246e85bf
TLSH
T1B011C22815D11F36D7F5963990BB57228677BD02E5AA8B0E809803819C86112B8DBF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 4999f801d3652f5aab31637afb7839ec8a73742cdd2742e13fc810f7abbbcc42
MD5 9050b61d2cbda4d3ca493cde25488b30
SHA1 5070173904a8dc67fdb3b4d4bc9edce7962ec722
SHA512 5b33bda3d2021aa025c2d2682f7285e32d6df134fe1b701c72bffcb82ee98ad4176332d513cbd879d409acca056fc72af83e052e8b5056433a44b18d55164f3c
TLSH
T16E11C22815D12F3AD7B1963990BB57224677BD02E5AA8F4F809803819C86112B89BF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 7f436aa5048fa8feda237fc3cbc7fa4db7922a798422799061eabae2deea3ad0
MD5 7cf4018529921a819de904a339147f63
SHA1 c19171560222c678e56ab5bc396f369369a006ab
SHA512 87bc346cae25d96c32b45b54c8e56567fe0a3f348d939b7af0960afb2cd08418b1b2840700150a09fc250422517ac087426079552189eb14c493ddf0f4074e7a
TLSH
T15831AB284FE61FB0F67AD139C9F286968131BDD2B705AA0D0050838D0C72B425A47F1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 25d4eb53f52d4da4d9c71c9cb3ba4ffe5a7b3291ee161816d163430ccf223edd
MD5 579998d2c4e1ee62f183d57118005dc7
SHA1 804f34aaea2355d5d2a335d04f64f09bab4be32d
SHA512 7fcb8a454454446ec63f4716141ef91085158bbca1e967372833a489027d983524e1cbe0b170acd47368a44040d4ac905f88c6a877ba96ebfd1b0a4c1bc24a02
TLSH
T1BF11C22815D11F3AD7B1863990BB57224677BD01E6AA9B0E809803819C86212BC9BF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 62f2929f0151c53598718f54f8dfb59af97236ea7661db507e062dc96f4e9fe7
MD5 74c41dc47f3e24a8e9ba1fe37c744c8a
SHA1 5ed376184f34db1358fded6d214d6934d50eb6ae
SHA512 84a7e0aea963f7f5d35fba83993d63d51be2141da82dc9b560f9f02034da37775950d307815099200257c97be29292322b2702e15cdc490046e19c98c93ee1ba
TLSH
T16C318B285FE61FB5F67AD13AD9F286969131BDD2B705AA0D0050838D0C72B425A47F1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 862756cf59b211b8f64d904bdef340328fee3080e5b6bfe9bfd399d5509feaec
MD5 3cfda8e92bf79104b29e521ecde0907e
SHA1 f12d3d7d04a306f859ac8f0665458a112927eea7
SHA512 42d4e500128b19debba0cc7604d11c146effd7f6f32c43c2f9f96a270cb95a1333e92b5a2ec360be764afdcb9ec0b97d17bde33e296927e929acc8b1c7d85a1a
TLSH
T1AA11C23815D11F36D7B1867990BB57224677BD01E5AA8B0E809803819C87112B8DBF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 d9798404b1301f344006aa0d9cc789786b261e4fa6128f83c67a838733e17745
MD5 6662b13fdd3690e9db55fc26e8bf11c7
SHA1 72b0f6bef9d760a8616d83855226fc1fb7290021
SHA512 874e8aa77f768257a518a6adcc638af260cec83c802d8fca588e05cccc65c17afcfdc92f8384a11534a2f5fb42eeec1064499199b2cf714f7673f7f9ca02d293
TLSH
T1EF11C22815D11F3ADBB1863990BB57224677BD01E6AA8B4E809803819C86112BC9BF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 1e1cc0a13f2edb6749b4ac04067481a50280deca190cdd5ec4834ca556b526ae
MD5 963336fcf457b31fb57f819d286552b0
SHA1 95195981a8f66e8afaa20afc2e7fa622bf75de5c
SHA512 64248cec6ce3787c4862ecd69bb4ad3391d496667922280394e7c158ef13e530fad5cc0632bf70d81513f44d3aca48fcdb59d22dbc9e939efe36ffbf117b6929
TLSH
T142318B285FE61FB4F67AD179D9F286969131BDD2B705AA0D0050838D0C73B425A47F1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 8345cbe35563247635bd95e5156a66e41eade7c00911e0b72baed1a2d6de64fd
MD5 dc6a49a155ec1389763fd7b851f7c25a
SHA1 a018520c4ae7dd9ecbbc25090b4b5edf515c396b
SHA512 f314140e31a89d83d43fbc88cabc77c7bca1b9b53d676fe47843a3fa4268a8c0175edc0a4ed2f035d9202b7fc9e59e8fee847fb68fcb775df9e4de02f18f80a7
TLSH
T16D11C22815D11F76D7B1863990BB57228777BD01F5AA8B0E809803819C86212BCDBF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 2b2929df6bdf69b4769e79726db661ab0cf4dc7ab69d440e756c4158b1d2e7b8
MD5 9a637b0b9ebaa9c627c45e1ebfb14801
SHA1 bac930d413bdda1b6e6646af88495fb70237e64b
SHA512 26c1820966fa99219589f3c994f104ca1f8d3479f09a79dc20f8b8b166d1c29098dfe879804eb6590cd612ab1ff4e33c7ddf3609f187ff95d2082356317c2d5f
TLSH
T1BD31AB285FE61FB0F67AD139D9F286968231BDD2B705AA0D0050838D0C72B425A4BF1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 fab97e2490c7183448fb35d034c7350f0d721c58859e7b30d29c3846d1330e62
MD5 ec9d0dad292246980fbb174fb6603406
SHA1 b89df00f9ec79964fc4d50d5cb25bb4145498116
SHA512 66ea2b31e9519ef14d50e6e7c42a0463129f3b572ab7b1215252f0036ebb477424d66c0244975a99964eed8cffa72bb5af2c2f823e1a815248a63a062b48add4
TLSH
T1E711C22815D12F36D7B1863990BB57228677BD01E5AA8B0E809803819C86112B89BF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 f89c00cf6cb33d570526ba33ebca10d3cf3446d8ddaaf7e94a4d107672a81750
MD5 d7bab41c458e8fb21e9de4f5e5eaf90a
SHA1 700d5f60c57d0a304d6b8b957ab31e40a731bc20
SHA512 dfa266202ec2a177746a4eb15bbc9b5c3dcba89a28232fe7c131d7d852bf12fc9fb7b8a887416a838cd284e9551c3dbf2a6a3e04b24d4ec2d3fc67870571f939
TLSH
T1CE11C22815D11F36D7B1863990BB57224677BD01E5AA9B0E809803819C86112B89BF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 bdb950e86254e55cbae1b4ace4b9d092b355ae12299a0d388671d0c48e1ecbc4
MD5 8684c553bcf9cfa4ec9d1a0b5d4c80f7
SHA1 20c24e62ed0ce4fb9e45be5b31fec8245ef26c4f
SHA512 95e2fdbddacd2df86cd36da769fd27fa15570a097dfeb14dbdad71715233f5630eda896cc63251accfb6177ea49ad507c8093a5fecd5e15969508e887d296b66
TLSH
T1C711C22815D11F3AD7B1863990BB57224677BD01E5AA9B4F809803819C86212BC9BF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 2e67013ff1b9d187eb7c01f0da257a8d6be8fbb7ce46aeaeb24b16c7ad623163
MD5 57bae61768b405e03bad03575c9a715a
SHA1 a64320479db91159260c5b5c53a37a321a69b70c
SHA512 e96e4927f82b127be61e94f59a8f9b3d3d8ad62e92c3f2a46498628d26f8abddc03d967d71b5df33ef28f6bb0da4d4007e051bca9b80f91c507f6877c0feea92
TLSH
T1FB318B295FE61FB4F67AD139D9F386969131BDD2B705AA0D0050838D0C72B425A47F1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 65597cd2f2c09135d89eae4c15ba1175283f79285bf0a7cda48c22e052eb7d21
MD5 9c50a26ea111955d5a1af9bc26b16a8a
SHA1 85266260b5c4bd4bdceab7c4abaae65ccac111ca
SHA512 651cb0052d7bae429d07d91b63377df345e2852b05b808303551adcc3815a7d96e273f64ed6760808a91032bb6e6ba1dfba32c8a29a5a384225f8ef162c8ca27
TLSH
T1B911C22815D11F36D7B1963990BB57224677BD01E5AA8B0E809803819C86112BCDBF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 2ffa40832da93279710a9f8bf57a3913332abe7b24e4da26f567a8fd4f2165fe
MD5 a6d7244053a97156475a60e8aca4cf0b
SHA1 42cd89da58a7413f56d6b34af9bfe5c83aaaedf4
SHA512 264083e401940b8cccd2fbca540a8aef5da441940524ac8068876ccb09eb84f6cdff15f716d7d50126f61eb30e5842b53af1fb82d78743602d8d070dbde2fd35
TLSH
T1A831AB284FE61FB0F67AD139D9F286968235BDD2B705AA0D0050838D0C72B425A4BF1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 3d64b43d46108ea7730ef849debf8ff05e51c795e0e7d0d4fe8f5358b60f3377
MD5 8650392be07788123915feb5f8122d54
SHA1 3b2c8b4933d92671d70f6cf1aba60fbd03f01e27
SHA512 aaf202b24a962630417b493d33e5f5bcb1cd1f507aab6e9782356f9f1b9f81820879d8a32aa04755a921f33113a20a3fb05536208c2e4babe0464736d61fea3c
TLSH
T14C11C22815D11F36DBB1863990BB57224677FD01E5AA8B0F809803819C86212B89BF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 32941fe62026a4de81c5cb9d16045a45e940b60f1db99e1cc8ba7309f1454629
MD5 66f799c4d394a6e44c027808a5df4567
SHA1 25f08f592f3c077b72c2a0fe4420b54f6cdcfbc8
SHA512 5784895d1be3441533f8e0318be9d51091b70c3d096773c478310c063daa7227dab2deaf0fdf5dfe080c9265b68faa0871117d5936b37384b61b247e2202fd36
TLSH
T14F11C22815D11F3AD7B1863990BB57224777BD01E5AA8B0E809803819C86112B89BFBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 1cf9f1b1cddf2aae5913bfd7b49e81f1d3922f5712485a0e5cb6b6fcc0915aeb
MD5 f025fffaa84717f079ffaf1f19caf2ec
SHA1 f21d1bbe21238813b1bb9e7ea809b4d20500a949
SHA512 d4a5233f76888ae05a001456bf67622c5604439f3cb683433330375f3b247932bf51f6560e56f274d6c2b95b19f9b5cfc13b3190230ed5163ce1aed1f31a92be
TLSH
T16F31AB284FE71FB1F67AD139C9F286968131BDD2B705AA0D0050838D0C72B425A47F1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 980a4a53eb95a523a4cad585e926960747a57e7ec6c3cccec0572e7492f6fed2
MD5 afc348a0275c4c62bcc5ec23e6ce7ab9
SHA1 77537b578eca83dd4103e5de26e749cd4a0f5736
SHA512 c7f5a6ed71eea914189c153ce9c233157980cb734c8ffc9347531d98d006369ac08293c6b220668a6dc06c8362102ca4839427944bd3935e6be7d12a336769de
TLSH
T14711C22815D11F36D7F1963990BB57224677BD02E5AA8B1E809803819C86112B89BF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 f9d65560d8d36024d6cbd45fcb89f95856189b67c58e67c5428fa086778d5249
MD5 3e0b6994417f497d733fda9124f5499f
SHA1 229733bc205f8886c318c2cece95944006207107
SHA512 196b33a6c90af434c706835f558a49200dcc6592a8c1d7301a139c359f96ae3469531ffcf7705d5c439ef7cc0c603204d3143529c2c17d54d76477cd319fefe0
TLSH
T17111C22815D12F36D7F1963990BB57224677BD01E5AA8B0E809803819C86112B89BF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 1b073b74192c77b6b3379c73afdbf8fc2e55635433844e5903528fddef425622
MD5 3c97fe38e514a546d17744aaa6957912
SHA1 ca625abe66915505228adff3a56688dab1ffe416
SHA512 c8bc4e9b4e3ea8c40b90e8a7abcf88b4af64b1e49ea6c4a0224d7fb08331a2472837e43fc97988cb3c65cf7040c937288be0318efed3e949a6d92ab3e569667e
TLSH
T10311C22815D11F36D7F1963990BB57224677BD01E5AA9B4E809803819C86112BCDBF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 70efc34bdbdad6ab30ebefb09cc153d499abe70d7d3e0ebc52a356d64170ee32
MD5 015fba8418f0899be1dc75961171c776
SHA1 fc38b449389b28957db76456dd9159c975e6168c
SHA512 0d626a1d58cae774b7471e137c516b2be39ca05051dec2fc35fa643e8174f86393891131c4c6fd3ed49d128973b4594ba6af9a97304e6f86bc07083d5fbb407e
TLSH
T1F131AB285FE61FB0F67AD139C9F286969131BDD2B705AA0D0050838D0C72B425A47F1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 26f20c0a71c30d0789ab913d7a384c3ba50168a55a47e593e58c196abae3aa78
MD5 d5e4b47c39323bd8c78f0629477b00c5
SHA1 5ad29019b5abcf6bb798886850d3538984a55e37
SHA512 5bde04076ad8e4d0e91597d37bfd3837b5e585f61a3cf02857f99ff08f13f10e95eabc47b3b5c6cb61e03e6664373bb8dc6b6a25a2431859009dd6e15929dd81
TLSH
T13D11C22815D11F36D7B1963990BB57224677BD01E6AA8B0E809803819C86112B89BFBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 b704366fd22b24fe14335f928aa184894d3d8feb932dc223d6fd6d7f1bbdbc66
MD5 a745b6211e68c40e64ec43a204fba6e5
SHA1 ac72aeb615bc77b50a9a729eb897f44e862dda02
SHA512 d5ecb886e38fb3d399fd9a8036769e0e7ed5f704d20d73b8ba85a92edfd77136a65b4e321d27e090e0e0744b94d368a9354c8de35c11b6f156d8881665cdadc9
TLSH
T19E11C62815D11F76D7B1463990B757114677BD01E5A64B0E809803819C86111B89BF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 36c83b21b68b7005ee4c7e794c61579c922c68985e8e84a91b69d59217cbd213
MD5 9a05c8681f7bec693edd99799efc5b87
SHA1 6e6d988384d3f5ea941e6404da40bad6c13b6ebe
SHA512 c1edbb7ae10164226237fe6dd834fcfb17ed6fc060947768f6034a0b42ad5b11b58b39ffa30687bf067c3a955f46e96b8d46ed12b7e40e04ca2c16bf43253ac5
TLSH
T1BB318B295FE61FB4F67AD139D9F286969131BDD2B705AA0D0050838D0C72B825A4BF1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 c331867379001b2608ccfe5333599c2e3641eabe644802cb26def5d79f21d49c
MD5 3ab2ef06f994cbf0996ebe52338ec86a
SHA1 d4aa4d726d1900c9410ce0333178bad632361264
SHA512 7d0d973be4bbea77c024e527829c47fa4122d4aedf0c0e452725419810a0b96ddfdf5a407d40ad532223c6abd665525f795b456945917f9761ec9aaa995c0718
TLSH
T11111C22815D11F36DBB1963990BB57224677BD01E5AA8B0F809803819C86112B89BF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 c7632a56736a370ce3e053a2979a553603808a86b0d3d5eb9cef1471414636da
MD5 86c7f5cdd36ab9f00beea8246b25aa43
SHA1 bcb7b4b602fb92dc09b54452c9ebaf4929420749
SHA512 3fa06dacb9b806f84192b25e4e9e30fc3960491d579396c4c5f588f529a1bd422a2542ae96385b2a7b69deaaae126f4c0ab503c59d87464a4cb9eec596ced4cd
TLSH
T18811C22815D11F36DBB1863990BB57224677BD01E5AA8B4E809803819C86112B8DBF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 0eaa3fbde90d11676a0c85b9be8b35d6f2b9d7e3cc5ae977a201c7aeefd05d00
MD5 94dfe10618ec1ea8eba1bb9355aa8901
SHA1 8e99d4b247078f7576a2b4fd4b1628c29ad281d0
SHA512 0cf26ea2356dd89ee8ba5801555dd474609c35c5e727f1495f29596167a76f4479e949c5b252a0ef77ff05373d2e88a65d66d82ff529921484ff96faaa746d6c
TLSH
T1623199294FE61FB0F67AD139C9F386968131BDD2B705AA0D005083890C72B425A47F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 5158b27c50bbfb29943994505eb16a0a2f39b5a4c6c624a263fce1d2502dddb8
MD5 c89496f3b4a6939f2985ea8cdf2b1cd1
SHA1 06de572861a221064eed817a475a29665bf22c1e
SHA512 c5a92f51dda92daa82fcebc69eb34c6aa6f4c88d22bf4d45260bd0424ce75daebd222e0a6c9f53fd734e1fb31cc20d2ec99fbeb2ff048e45141f22a73ec35c88
TLSH
T14A11C22815D11F36D7F1863990BB57224677BD02E5AA8B0E809807819C86112B89BF7F
MD5 SHA1 SHA512 TLSH

Submit Download

HelpMe.exe

Path C:\Windows\SysWOW64\HelpMe.exe
Size 3.3MB
SHA256 81155c66596d374e75a00c52c75809cab1358be7d3d9bc0f2c28a2a7b6ae0f7c
MD5 bb2b040b807ddd95d428607fc1f446b8
SHA1 f96ab5291e22fd0bce884aa90c80788f2452587f
SHA512 5e652b106bb2b03b06c6dde09dab40125f1c32cd893d1470febcc8a6d1a1c94a3e8ff7e3b999c0515f430216512e639d55bf8d02f41edbce8375d79f102b6819
SSDEEP 98304:+E2H5Wky5WL5Wj5WiM+M6RkMkIM7M5WCMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM67:+nH
TLSH
T1D5F5AE42F7D4E872E0B601344D33E7748A76FC615E189B4B32987A0E6D717C2A936B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini.exe

Path F:\$RECYCLE.BIN\S-1-5-21-2397528088-2630719772-1129911217-1000\desktop.ini.exe
Size 3.5MB
SHA256 95304383a58124e12e884029abdfb4425701c5a1987ed9a5f91eab3c5e50b21e
MD5 59cc988631ec244e0f885e77e42f85b3
SHA1 ad4af4a637fb26521db39347e6bab49feb6df49e
SHA512 f56772beb7dd36e25025f1368c1f92da391d12065c2a5e85953c948a02edc4662b6dbc961e9b11ba95201d47f3910565a0e74cfe513f9cde6df799508f172bf1
SSDEEP 98304:+E2H5Wky5WL5Wj5WiM+M6RkMkIM7M5WCMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6A:+nvM
TLSH
T1AAF5BE02F7D4E872E0B701344D23E7749A76FC615A189B4F36987A0E2D717C2A936B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AUTORUN.INF

Path F:\AUTORUN.INF
Size 145B
SHA256 cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae
MD5 ca13857b2fd3895a39f09d9dde3cca97
SHA1 8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0
SHA512 55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47
TLSH
T188C04868F16A939D1E0C399093A400237083A208019E420E93DDE4A53DD41084F05188
MD5 SHA1 SHA512 TLSH

Submit Download

AutoRun.exe

Path F:\AutoRun.exe
Size 3.5MB
SHA256 48e5ff5a38729ec96eee8ce2b34ad04d5039bcfbcb13764b2d9f6c27274ab612
MD5 a3d0b041d98bd97fb3ce536fcf59f989
SHA1 a720860cc827e8ab7895a492d57f16599493b80f
SHA512 65dbbfe1141dc89c16ef39409f52807d1b910d8de667bf210c041cd15a973c6670a74d283ff38305cd1e7645b028153ea549b8942da60e52ce116fb654fffcea
SSDEEP 98304:+E2H5Wky5WL5Wj5WiM+M6RkMkIM7M5WCMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6n:+nvD
TLSH
T177F5BE02F7D4E872E0B701344D23E7749A76FC615A189B4F36987A0E2D717C2A936B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2640-0-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2640-1-0x0000000002460000-0x0000000002461000-memory.dmp

Download

memory/2640-2-0x0000000000460000-0x0000000000461000-memory.dmp

Download

memory/2640-58-0x00000000009E0000-0x0000000000A5C000-memory.dmp

Download

memory/2640-52-0x0000000002460000-0x0000000002461000-memory.dmp

Download

memory/2640-49-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3272-53-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3272-7-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3272-8-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3272-59-0x0000000000890000-0x000000000090C000-memory.dmp

Download

memory/3844-68-0x0000000000A20000-0x0000000000A9C000-memory.dmp

Download

memory/3844-50-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3844-70-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4432-51-0x0000000000DB0000-0x000000000155E000-memory.dmp

Download

memory/5008-69-0x0000000000C00000-0x00000000013AE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads