stihat | 2a7ab479280c132e67a615fdefeb489c2577ef5ac83331bb0e432870361b37c5

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/04/2026, 15:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_5cebb18f098df5e3c80a8a120c232e00_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
Size 3.6MB
Sample260415-sh1fjsa16p
SHA256 2a7ab479280c132e67a615fdefeb489c2577ef5ac83331bb0e432870361b37c5
MD5 5cebb18f098df5e3c80a8a120c232e00
SHA1 fafaa1cce746abe9ea1f1bedceabb9b3128b46bc
SHA512 555683fddbbba25510d770d1ed3c363488af81c994ecd8d05c67d677bc19df3ab9d45e9a1a369e521df213f64d87c6364921c978b3d4fcd351a096422167ecac
SSDEEP 98304:+E2H5Wky5WL5Wj5WiM+M6RkMkIM7M5WCMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6O:+ny
TLSH
T1EF066B02B3E89425F0F72A305D76A7744A7ABC51AE38D74F3294790E2D71B81AD31B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery stihat persistence spyware worm

Malware Config

Signatures

Family: Stihat
Stihat is a worm written in Delphi.
worm stihat

Detects Stihat payload 10 IoCs

resource	yara_rule
behavioral1/memory/3392-0-0x0000000000400000-0x0000000000478000-memory.dmp	family_stihat
behavioral1/memory/5472-7-0x0000000000400000-0x0000000000478000-memory.dmp	family_stihat
behavioral1/files/0x000a000000021653-6.dat	family_stihat
behavioral1/files/0x00070000000244c7-35.dat	family_stihat
behavioral1/files/0x000100000000002a-43.dat	family_stihat
behavioral1/files/0x000100000000002c-17.dat	family_stihat
behavioral1/memory/5412-49-0x0000000000400000-0x0000000000478000-memory.dmp	family_stihat
behavioral1/memory/3392-48-0x0000000000400000-0x0000000000478000-memory.dmp	family_stihat
behavioral1/memory/5472-51-0x0000000000400000-0x0000000000478000-memory.dmp	family_stihat
behavioral1/memory/5412-66-0x0000000000400000-0x0000000000478000-memory.dmp	family_stihat

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	2026-04-15_5cebb18f098df5e3c80a8a120c232e00_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe

Detects executables packed with ASPack 10 IoCs

resource	yara_rule
behavioral1/memory/3392-0-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/5472-7-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x000a000000021653-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x00070000000244c7-35.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x000100000000002a-43.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x000100000000002c-17.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/5412-49-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/3392-48-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/5472-51-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/5412-66-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	2026-04-15_5cebb18f098df5e3c80a8a120c232e00_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe

Executes dropped EXE 2 IoCs

pid	Process
5472	HelpMe.exe
5412	HelpMe.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	2026-04-15_5cebb18f098df5e3c80a8a120c232e00_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\E:	2026-04-15_5cebb18f098df5e3c80a8a120c232e00_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\L:	2026-04-15_5cebb18f098df5e3c80a8a120c232e00_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\W:	2026-04-15_5cebb18f098df5e3c80a8a120c232e00_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\T:	2026-04-15_5cebb18f098df5e3c80a8a120c232e00_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\K:	2026-04-15_5cebb18f098df5e3c80a8a120c232e00_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\O:	2026-04-15_5cebb18f098df5e3c80a8a120c232e00_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\Z:	2026-04-15_5cebb18f098df5e3c80a8a120c232e00_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\R:	2026-04-15_5cebb18f098df5e3c80a8a120c232e00_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\J:	2026-04-15_5cebb18f098df5e3c80a8a120c232e00_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\P:	2026-04-15_5cebb18f098df5e3c80a8a120c232e00_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\B:	2026-04-15_5cebb18f098df5e3c80a8a120c232e00_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\A:	2026-04-15_5cebb18f098df5e3c80a8a120c232e00_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\M:	2026-04-15_5cebb18f098df5e3c80a8a120c232e00_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\N:	2026-04-15_5cebb18f098df5e3c80a8a120c232e00_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\E:	HelpMe.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\H:	2026-04-15_5cebb18f098df5e3c80a8a120c232e00_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\S:	2026-04-15_5cebb18f098df5e3c80a8a120c232e00_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\U:	2026-04-15_5cebb18f098df5e3c80a8a120c232e00_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\Q:	2026-04-15_5cebb18f098df5e3c80a8a120c232e00_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\X:	2026-04-15_5cebb18f098df5e3c80a8a120c232e00_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\E:	HelpMe.exe
File opened (read-only)	\??\V:	2026-04-15_5cebb18f098df5e3c80a8a120c232e00_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\Y:	2026-04-15_5cebb18f098df5e3c80a8a120c232e00_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\AUTORUN.INF	2026-04-15_5cebb18f098df5e3c80a8a120c232e00_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened for modification	C:\AUTORUN.INF	2026-04-15_5cebb18f098df5e3c80a8a120c232e00_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HelpMe.exe	2026-04-15_5cebb18f098df5e3c80a8a120c232e00_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_5cebb18f098df5e3c80a8a120c232e00_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpMe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpMe.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe

Modifies registry class 20 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5260	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5260	explorer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5260	explorer.exe
5260	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3392 wrote to memory of 5472	3392	2026-04-15_5cebb18f098df5e3c80a8a120c232e00_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-04-15_5cebb18f098df5e3c80a8a120c232e00_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_5cebb18f098df5e3c80a8a120c232e00_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe"
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Windows\SysWOW64\HelpMe.exe
  C:\Windows\system32\HelpMe.exe
  2⤵
  - Modifies WinLogon for persistence
  - Drops startup file
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:5472

C:\Windows\SysWOW64\HelpMe.exe
C:\Windows\SysWOW64\HelpMe.exe
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5412

C:\Windows\explorer.exe
Explorer.exe HelpMe.exe
1⤵
PID:6108

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.exe

Path C:\$Recycle.Bin\S-1-5-21-1609746302-1884177235-1125644204-1000\desktop.ini.exe
Size 3.6MB
SHA256 3bf3b25c9feb434f8915700688edbf05e5aa8d5d4e471c46d050376ac2ed8729
MD5 39c958ed946a567ced0021a606f28ea6
SHA1 cecc27deed667b5f4545eac8c42f00dc9ed10365
SHA512 cc2296d1d4a5e7833b35515e7a1455279ea421ab376755c9a85b3d42434792189f6ea6ce4a65bbd429cb32e97289a0aa7eb9ecb5f4b79946b2e5abeec8fe31a1
SSDEEP 98304:+E2H5Wky5WL5Wj5WiM+M6RkMkIM7M5WCMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6u:+nS
TLSH
T131066B02B3E89425F0F72A305D76A7744A7ABC51AE38D74F3294790E2D71B81AD31B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 5d45de5767d4dae36b2d1509ba91071b611d00b8b8ec35840ec227b2e57900d3
MD5 f425d3af38fcda781a37583a0c3e2b42
SHA1 089032744f590277b8af2014e7522fe64f850dd9
SHA512 22590d2eb3551845947430d3577328e9fdb0c200e97c7689a28bb44c226f61c1caf88b68cc046c87dcd3dcf80af9180e0965ab4b0edf38ad5b8783c11144004a
TLSH
T1F711C22917E22B37D3B25939C0B717219763FC02F4B59BAB408446514C44300AD09FFF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 67d1017dc70a43c6c1ca50fbd7b7cee92237b85eaae02f3e79c9caf841b9ba6f
MD5 71a55dc8aee2068944e0f53dc36b0734
SHA1 5aaa3ed009a59e1a005ea955df03c8e53ed6086f
SHA512 d510111378e60dace0c19e95a489dcb7291289f2b5a39483c0ec515336597c836b4aac88e13e4700bd3fa78f3ddcf34954db99afeea4c9ecf58903e2d7e89a5a
TLSH
T1CF31CB0A8BC72B71F37AC539C5F746569A30B9D2AA00BF2C0094934D0C32B82AD05F6E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 49dae10311a253e253640265112b1e2c2ddfcf72ffa650490115df99d7c1fccb
MD5 5adc4f3b889db7a924aa2d53e29110e5
SHA1 2d396aeb666f655a6a12a853ba25f50aeeb78edb
SHA512 d087e575f7100c37b0021fe5bbfc19c5fed78f45133e30a6e918df3b997a43efe30af2490486b4fbfd5fd17a9794d928795657cc06710eaeb466ddb6d0796b05
TLSH
T18F11C22917E22B37D3B29939C0B713219763BC02F8B59FAB408446514C44340AD09FFF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 994444f58f8a09182e4ab2d3f1130581f76ffc4ab671c69d5247e006be56a030
MD5 bc8bc7a650d87fe7e0faa4b0014c36bb
SHA1 264089824241389f8da080098e8d02a8cc9e3f25
SHA512 de65f521c318692be05c01ffc0bce30790d731f810e60dc7b93a761a419561b48ec46afa6fb318474677160cfede4f43a0764296239a1119d12c282c0714ee09
TLSH
T1F811C22917E22B3BD3B28939C0B713229763BC02F4B59BAB408446515C44300AD09FFF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 b74789d47bee17d8f7fb413fc5e998a24b7ca944f0a81124488f9379ca7f9c3f
MD5 46e6017895f12fe74dc66a10b9f8d5a6
SHA1 b620ca33a9f71b9842cd6bcfaf0afc1b9540c3d7
SHA512 50c60983650dd7409ba56bc9b56d89edc79c9a5e2b50eb3f380d8a5c1da304a7c05ce152630708f6e2aba2d5a970e3e8568be6479e19854b4bea050d01e7b14e
TLSH
T1A631CB0A8BD72B71F27AC579C5F742579A30B9D2AA00BF2C0094534D0C32B82AD05F6E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 f19a4990048649d6c9fd2a30fe2853e8186b9aeaf31e07ac33ecb7afa8c84dbb
MD5 e87904e85f81696c2e006246b93f439f
SHA1 f44b592c63dc002e98a7328b820d7158f36d72d9
SHA512 a602f4458ee25c59b2393ca5c842bf91ca27d21bdfc57bc280f76d27208136585480bc73d3f06f1d429f9f7ac64d57e3a09f7fd20a4a4eda523d1a977536e2ea
TLSH
T1FC11AF2917E22B37D3A24939C0B717219763BC02F4B59BAB408446514C44211AD09FFF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 066eae646e4444cff2e4bc9401625789a479bf0a3b974c7afc4222b35b47a5df
MD5 04b5c21ebc4b2d1c11f129c3ecddc089
SHA1 ddcc38a411b6783d5efec51541bbfcf69564c9e2
SHA512 f61350617b569113050e3abf6f41bc4ddbe23c5363e5e48db73fc74e3f47e3649dc27e932d42c5e8d4c4d5a8ed0e7e8a652cfc572cbf609d2776be3edefe9a38
TLSH
T12311C22917E22B37D3B28939C0B713229763BC02F4B59BAB408546515C84310AD09FFF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 b649c996fef543baaca9012706b1a5cb68e45f71966db315b8f6653f5ecab71f
MD5 304855e7bb4333602c117db1338873ff
SHA1 bf02c56509b799da9a4a8db48ebba6b3624d3b54
SHA512 c036aa50b32db32ac342550dadf85b878ccd65e8546140683e52cc7806dfe63592a22a760dc9f91410e1f33e4b83d0f5ca41df9477262ccb26d141ab11c2f8f0
TLSH
T1EA31CE098BC72B71F276C535C5F741579A30B9D2A900BF1C0094534D0C32B81AD05F6E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 28a53ebae9acf5113080f83482e0e765cd65c8642bee88031054b5da5fc6dda9
MD5 c1c30061188ab4f452e7cb4503400046
SHA1 f28754101bf88dc2fcc84bc9eb927e1727c772c1
SHA512 001d1d64cc735ad0ec3b00f54835b165b726d668e481a0230ac39f620d142b89a28261f0f8bf1b482a3fb337b8f92b97e5f9abda516c08e1f6f2890a20174765
TLSH
T18511C22917E22B37D3B24939C0B713219763BC02F4B59BAB408447514D44341AD09FFF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 bdaa593ccd0d5f8226f23e80764c8dd0f6fd34c94498b25a9fe13bc4853f5a2f
MD5 139cdd2b8c4fc714cac09c8b785a37b7
SHA1 c2820330c6011b3e798347b567162045f885bf57
SHA512 07f1008a0edf8a6f65b8c213ae3874bd67a0929cb284e29a19c9780358648c4afa6c41866e3189d79838da0e1722f112cc37c13db7c75181d0b697dc6fc6f47c
TLSH
T1B011C22917E22B37D3B24939C0B713219763BC02F4B69BAB408486514C84300AD09FFF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 daf3bcedf818af925ebb86fc0fbdb8f9a3cf3b59e6a273b9086b6bf5fe151c3c
MD5 5557332f82e3b8e220114015edbc0eb5
SHA1 bcc0da152ee83f91da108f141b0204cf46901c17
SHA512 671acde09124a317e5e7315ea835e4993f68eb560cb14d43b711e378cd2f39a091e7c9c23371cfbb9cb9e14e552f73a5df3ffa1433f4a4aec5c4cbf60ff0623c
TLSH
T1E731CB0A8BC72B71F37AC539C5F742569A30B9D2AA01BF2C0094534D0C32B82AD05F6E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 2118abfc8461f8a0ff4b9d1390945b3ffcac0faef4123519e9514bc2097dd904
MD5 07fcedc4e1d366ecd87993131264389b
SHA1 10e93c44b46d5f9d87c2610a4b08e0778ad65150
SHA512 dccc1fe6db6f9a642561a7e5b059fc9a32adffaf8ae35c782c81320d11a89b81fa5357209644bd4902fcc5e887fcaf7b964670c3d723867fc8555f407a6a217d
TLSH
T15C11AF2917E22B37D3A24939D0B713229763BC02F4B59BAB408446514C44300AD09FFF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 9cbcde46c686df543fc858f78f380153b0ef1dec1228d2e8cc941c33dd2f4b85
MD5 75045678780b4df42d948bea4c08145c
SHA1 fa4bb4e03a8131337f02bb8af60ba017d388d845
SHA512 a6b00531d493935d7ec18d8dc8ac0ff993254e15603eb34966acf19903560b59dc395852950f1fe564aa61ef03ad406ec47e32c72265afdf6f8af27a53da630f
TLSH
T1C711C22917E22B37D3B24939C0B71321A763BC02F4B59BAB408446514C44301ED09FFF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 0c51249c6836d7d53cef4e006098d1cf6857c052da51d5e1a0163ae0f47a6549
MD5 26ef2bb8724d7d68cd128159f0234685
SHA1 17994c2f1ae0192b82a04e738ccb31e15a9a85d6
SHA512 7fe3e64a15981d6356ba048c1f094704a3b5b5f95cf84e0b266ec99879fdf4de1c2e296e6eb722f950c8ed6b2020a28f5f4761336894bbd588870de091ca0341
TLSH
T1C511AF2917E22B3BD3A25939C0B71321A763BC02F4B69BAB409446514C44200AD09FFF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 a6a4d028b62ba098ae5e76090a71fc0811e40b7536516aeaa2ba86c384bcde9b
MD5 d2247e6cb8cc4578679d8577985e9a27
SHA1 2f2d7edca97c4525987d75d98776a01245d0e9f7
SHA512 e8ea6189069dea798d704c008c9760fd3db95fbb8ef7b043d351254367cef2c616aab73db979aeb21f6791c32c7a4dc1ec62297c20b81283a7cae1ea916379f3
TLSH
T19231CB0A8BC72B71F27AC539C5F742569A30B9D2AA01BF2C0094934D0C32B82AD05F6E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 28d3e353e52baf10cb8756d5b4b1d5f516932491a9dc8c97171d4f83165176fa
MD5 72eca27ae2c02c135c54666a234f1280
SHA1 09e31364f516a8978fb5b98525545728e13a1563
SHA512 e63045d3758f7722a36e855832fa119cca3ecbf013b04200d109bd276ea994913b6669406c861b3d3da70f49b4d4db789932e28eb85d7ab56f362613535d92b6
TLSH
T18511AF2917E22B3BD3A24939D0B713219763BC02F4B69BAB408446914C44200AD19FFF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 814137bbc7f28fe77d3060106b2c48e22883b6f1f0fd76563320838363b0ce23
MD5 da03191f63ca89f6e45f3d6277160880
SHA1 97630ee78f821642ef7d823b9e7c062c540703f4
SHA512 9e43af27d3c51539db90affee509ba0145b6d9f90a1e5dc672a033769b7cb186d9d33974731ed4495bdfc2a500cc6f687b8c2a39a3933f502980e8f8991492a8
TLSH
T16911AF2917E22B37D3B24939C0B71321A763BC02F4B59BAB408446514C44200AD09FFF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 aa191b1c7496222a2cadc7d489eeae701e6487c8d218c27447357ddf2bac0d1c
MD5 b8d59997d58ccfc6510d7825d71a8fae
SHA1 2025d858e17221ebf282a461910e2d2739ce1d80
SHA512 1be5c74284f02d2696dfde36b6b54778f943dc5339b7a3fc81616b6443655429b12f3ceb871dcb51c9362f0b333fbc0d75485e12cd0d0cea61adf2442a3e02bd
TLSH
T12531CB0A8BC72B71F27AC539C5F746569A30B9D2AA01BF2C0094534D0C32B82AD15F6E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 db960517374d0881837ce0a7f2a8c9ed30d21fb2e67ecf7a38516e9c9679d09d
MD5 6cfceb6578a613f06813a19e31605b47
SHA1 0f7717df58f22e5c9ba43dd2c0d729ed47b68120
SHA512 1c57901f14526f3809cfb61ac0e5d559aaa900e1895fc92b4b975a3236a95f6c41d51cefaf83c0b5f9d62441b2fa1d440ecd1f52c7b51c284357fb22c877abf1
TLSH
T15B11C22917E22B37D3B28939C0B71321A767BC02F8B59BAB408446514C44300AD09FFF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 cede844a5570edd8945acc44fad01bb969f38bfea3342e0f2e26f8ddab31e33f
MD5 58bd440d5365bc9d25d6d6da2d7d2753
SHA1 6f251a01972db5d8c1c066b6de4916ce71d886be
SHA512 91badfec6fa2df642ee8bde9df1d0a03e1c609c8ff229c192eba6f577e8c75993a1b95c063c8a501890ac1322a145944b2126b5c288fa360b8543f6573d285ac
TLSH
T14431CB0A8BC72B71F27AC539C5F742569A30B9D2AA00BF2C0094534D0C32B82AD05F6E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 bdc24993f054e781a502f19a50b9edc6de128a6cb92a2854806ad647e1b52783
MD5 d77066388c2629676f93e6e1436ac21f
SHA1 2b30fcb363df9ac7469664f9ffa7ac906702bed7
SHA512 b80e870d684e09ffe126bde1ebf7ab125f0898b512f9d6c0680b4527696559dbeadf7f2eea44e185d4cf6b67d91891747bc5a4ab33ccd7e414862f13b7ebc9c1
TLSH
T12911AF2917E22B37D3A24939C0B717219763BC02F4B59BAB408446514C44200AD09FFF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 fd476a5015e4bc27df0456896e4bb32b03d3530d6c203c94e97163c9b8aeabe4
MD5 103fa40ab309a4cbe9dadcce9f8dbffd
SHA1 e26c6d1f8a11c2a3dc2a0e3b2c12d2fdb9cca8cc
SHA512 c80e3214690ad98b46258d7dddc38963e9c0358953c4e10553fa95ba941dd7a47ca58ff2bfe22cef09fd5e424ff5c08cb9a7aa1a8b97d7ad6c328474653355a5
TLSH
T1A411AF2917E22B3BD3A24939C0B713229763BC02F4B59BAB408546554C44300AD09FFF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 fad7d955e29a0c25750492b7b0f7fc8d6a165a23120e67826268308fb4ab68da
MD5 4eb10d5a5fcd32f2c73ddcfe45c250ff
SHA1 61fcb80a343ff355dfd4e7fd44a9d190321a882f
SHA512 363a0f941c31fff88ecc421cfab77df07ac52ebcf9b1b78932402b15e90ebb787ac790f25ff7f2c6c70f964b5d228824fcf02a369988126a30dc7e8ac4d4f9b5
TLSH
T14911AF2917E22B37D3A24939C0B713219763BC02F4B59BAB408446515C44210AD09FFF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 d3ed8d35e6eaf8d0b3ea36d6077871b82c4b25bad6740c18b421cc2abf68b8cb
MD5 650af38f7ce03fff87b93a2619fd0ec8
SHA1 a9e8c8d367c60ad6b8154b430d8bdf95de7a8a44
SHA512 666630d692f4f20bb5da9715483a22fb7456452cf9649b2665dc66faef46f79188ffca5791eebf57a96bfd00f145e18474808da1ac7df9bb72047acab1280ef3
TLSH
T1EA11C22917E22B3BD3B28939C0B713219763BC02F5B59BAB409446514C44300AD09FFF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 1c9cf1c8b38454b81d0ae082f6f9162f9138fb0474711a404c7be373a2f15c2b
MD5 d495d8e18804729449f178689639a78f
SHA1 e8397df39d31610e26d79e657dbbfe2d0dd869d9
SHA512 c3325d3104aa453c2d8ccb5c48a5e8f877c5d7f1a3809ca3d95d90839443687852413523fd7fffbfd6e200f6242d70910efb3f5070b1eee1f321a92b746dee29
TLSH
T13411AF2917E22B37D3A24939C0B713219763BC02F8B59BAB409446514C44300AD19FFF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 f83cc4fe5399f6d0e4cd993974733352c1bd4ab05dfef0a3b4834942301881b7
MD5 4405983364bab5d116fcd65c9bef5d19
SHA1 f3b1cc9edcac6464d6be52551dd1fa5169366cd3
SHA512 b6f7be79c30d92e48e905532ac68f19c5048acfff0ab8c8ae076a83f8b3584ffeeccaf7035021b5b32295bca1faf534888ba7990a88761a292ee58b40dbcba4d
TLSH
T15411AF2917E22B37D3A24939D0B713219763BC02F4B59BAB408446514C84240AD09FFF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 d5e51b76754c68c25547d5b73e08f86fb67fd90370b8eba0403ecb47d7f7bf78
MD5 5a38058bf20210c618a501492f1de207
SHA1 6aa30dfd2733ca6713d99339bda18ce7a10a59e9
SHA512 f12cb11a669fde849b30726af23e57ba70a9d0e143cd5c51fdbbbeb4e49316cee42672767d5af512fc39401a45a66cd7fa42151d7521aa986a336f935c46180b
TLSH
T19031CB0A8BC72B71F27AC539C5F746569A30B9D2AA00BF2C0094534D0C32B82AD05F6E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 9417eaa6db251140f66301b8b82b121f723b323d1b8823e3524d2c3d09c37e0f
MD5 f76e86694a405e8450d1ed3b54eaa0ba
SHA1 7c62bb0e3a9f92e537134aeba8b7e133614450b5
SHA512 1da33d0503fc882ab5ffa81f910b1d71a2902744236acc65ea715fea643acebb0d7409bdffd0dd696ae7eceaae1c7bef238e827813a258b9a8c13d3242ae4d4b
TLSH
T15E11C22917E22B37D3B24939C0B713219763BC02F4B59BAB408446514C44300ED09FFF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 3f1d3f9d554f3dd5bad47e75856dc750da05ef2a957385ef9c9a85a29f6a84db
MD5 aa28f7336751e8c09243c150855fe355
SHA1 aa37ffd1fc98c2331dd9c61a8b6ffc564a8249b9
SHA512 e5529cbda974aee39d7f5e26aeeb8da4d5601ab9a725dca556756269884d08ab371ced8eec3d34a3d2f53a2979b576379273b911971320262854f13dfe4fdb9a
TLSH
T16D11C22917E22B37D3B24939C0B713219763FC02F4B69BAB408486514C84300AD09FFF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 9d09bf1811700eb1629f778359680fadcc33f299efb41575b7ea1e1676b24521
MD5 01f1d96aa1128812aeb0bf940a24c9dd
SHA1 4cf83b4a6528186668141e773304d1a783d5cd1c
SHA512 ed3c0e4074bcb2b5d3bb70fd69db8dd542b2a03874d13f900441e5972327809e28ed4e926ca88b0016626cd8e001603ba86f39ac0010fbcc3264852a81ef3e88
TLSH
T1A731CB0A8BC72B71F27AC539C5F742569A31B9D2AA00BF2C0094534D0C32B82AD05F6E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 e641ffbce42b69b78aa0e3e5f444e30703f49b6ac64d664caf3374b6719fbb1b
MD5 7ea2884435e3a92312161b8dc2d66156
SHA1 69ac659ef9ea4cd2da67528802e4433fae215554
SHA512 43be71ce3cd9aaf1b81abb7696311cd14bc1ada0ef860862e94c67650ad565360d3083d11a91a2483aed250f70b85b30fc37b2165cb8e81ca7e8fbde168b1e60
TLSH
T13E11AF2917E22B37D3A24939C0B71321A763BC02F4B59BAB408446915C44240AD09FFF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 2baab2c8c9ca6904ebef55ce0591c01b4ba2f740bdc367099b69223dd414767f
MD5 61e3074e0c029cd9c767405f1d7a840e
SHA1 4bfd640101f6de57022701e90026ebfa67825db1
SHA512 4b370dbc599af3aec789e9984e418e0af96b044d76a08ccfb08e1710ab8b87d38b03d7654835b23a6e3050d5436512f2d136cd5b894584b5b6c49f1527952322
TLSH
T1D331CB0A8BC72B71F27AC539C5F742569A30B9D2AA01BF2C0094534D0C32B82AD05F6E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 cd12ff335842d8d868d6afaf3606c824e009305037fd042c3a778ef9e9422a52
MD5 e1537e84b690858dc4e2442f4c87b066
SHA1 3981a5855d0c2e4141a9e0b5f6efc65d2a5cc3b3
SHA512 3ec4f35d2f557defec626f2089cde451e1a5981abca2746abd02181570172bd03411f58e3e7d64c05f8ca52fc2c8b311484d1bee35dac6bb354232e68937e12e
TLSH
T14B11AF2917E22B37D3A28939C0B713219763BC02F4B59BAB408546514C44241AD09FFF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 f2b87226460e15f00ddd73e3e0f3521367f8b4b18c846092e83fbdb000a810e0
MD5 48fb1495ede37b5129d2553c0a9a75ec
SHA1 26bff21865cf4045fbafcd7518ae39a1640a7b3d
SHA512 c9e2205cfbe58bd29674339cc2095128ffe019de309c3a0226c36337c8134931f1ef01fb689405803c20568001270bc2d9e325fd604207232665b41869faa3b7
TLSH
T12231CB0A8BC72B71F27AC539C5F742569A30B9D2AA01BF2C0094534D0C32B82AD05F6E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 ba911cee828f7d9564675885f2614c9f2b2f79701e3974b6ef9b4db7adb83d6f
MD5 cf16071cc94e19110b1f3dfa4e205b53
SHA1 a01843d6c813f3c38bbd710af3225eb6b3418324
SHA512 20a96eec6daf82d5ab9f7d52564df9615bc296d245cf1d817079cff71b6c3ec43691e1e1b39188d680fd1e4df55156f5a724ea6522e8ebd201a18de514b0a676
TLSH
T1E331CB0A8BC72B71F27AC579C5F742569A30B9D2AA00BF2C0094534D0C32B82AD15F6E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 54e564870ead7da20e671d0d25190c9905838d28aa01c2ebd1354984b5dea682
MD5 1b31239f70a23bbcff1d11a180a16acb
SHA1 0f818ac10a518cac48fb3e1a180b8db72554c0b0
SHA512 8930edf8ef4a1e6a6bc6d30f3cfe5d4309d98012262ce579b7d9fcd3bf06f8ade5452e7dbebf377d378652798cd921aa23b13d21dc46eb64da66f7c07d75846b
TLSH
T18611C22917E22B37D3B28939C0B713219763BC02F8B69BAB408447514C44340AD09FFF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 d5453f196072cac41a5d2e0ada2337ddcd5c3c6eacdbdccd3abc6159ad0bc4f1
MD5 f506bb84f9094daf914800f95c7947be
SHA1 8e8a1366f2ee4bea472b83b09a98e8c5409c50c4
SHA512 477991a041445be63e2ed4ca73346bc0c27d5efda1fc87f4d7bf1ffb0cc80416369c4fda951960ec632188e404ea89823dfbe14cb6af81bd3a2d952b768a0799
TLSH
T18311C22917E22B37D3B24939C0B713219763BC02F4F69BAB408546554C84301AD09FFF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 393cd2ed5b9797715a3ce4a5aa855dd789fceac561b023809b8e64d45b174582
MD5 1e79d91fd305a316afc38d166102ad2d
SHA1 896b543140562a0cdd4bad4bc03d402d0adc9d47
SHA512 c12690b65f35f660380ee7085034005646aff53f1f9deb993a364ca4187a69740f85dc052e09003e7e7384846018b3417227e3098b2bd343e011d1a0f38f7b5c
TLSH
T17A31CB0A8BC72B71F27AC579C9F746569A31B9D2AA00BF2C0094534D0C32B82AD05F6E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 792a8540f1887edd3742ad01306db54d0a7400fd25b471f6ccc8d5d8fc5c9412
MD5 22ea5d631792184c15ff152f4e2190f5
SHA1 c4e293c0618f451743b2b307fce7740eabc9c3d6
SHA512 2a67362c0884ee335d29343441a8c5921522638fab2a3dcc36e643401fcbb7c48ca0662fb575607819ce271ecba97b420e1aaa387c2f1d44a8842af7a3014971
TLSH
T17111C22917E22B37D3B24939C0B713229767BC02F4B59BAB408446514C44300BD19FFF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 2d9ce0a9bcb1760c5529281895f57f322fa71fd3280ae98c2a788e08222cc08b
MD5 7d3aeefd1edfaa2843d3992148667deb
SHA1 e0488eb27c3f04ccc7b411099083cc84835db40c
SHA512 6037963003c28096cfa4a27f9f1489c138a3415a731ad9b6a1e7beb5dd5ce54f832875f45d30e2ab20e395230e6b7edb49947db741e1ceef39ca035878e47690
TLSH
T1E611C23917E22B37D3B24939C0B71721A763BC02F9B59BAB408446914C44300AD09FFF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 02deed1829b404235b5c8e3db1c6a180f153a31f010ee4c239b5fa9cb545479a
MD5 c2d34c5fa8f80724bdcfe09ba023c12c
SHA1 c79a0115dd392f09fb9711edb23ce9dab220aa06
SHA512 22e38934ee9a108b16b72e9aa89ec0d29de652a48fc48d79d05ee7e30c00c363c5f4b870b716dd35b63b5eb864652a848cc23afc7af6b98309201d36da411d9f
TLSH
T15431CB0A8BC72B71F27AC539C5F746569A30B9D2AA00BF2C0094534D0C32B82AD05F6E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 b1c41cfa9ffeebacda9db1966a020a9b7a657c91f50be115d02c5286e8a695a6
MD5 512a483120b7e3c41060b30f596456bf
SHA1 73e9e9fec194576b8d26c73bca9e1dbcc37c1cb2
SHA512 f6e9d72c9b72d6a6cfb3ce601b78ff77ecc0658dfe946981d334fce3f8090ef394b0bf299bfbab30b78118a0e19aa38adceca10d6e4299ae125bbd1145c11944
TLSH
T15C11AF2917E22B37D3B24939C0B713219767BC02F8B59BAB408446514C44200AD09FFF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 4e0e1ec8ccc508ce106f92f8d45fa38ecf3d5f652c05cc48391e588b2977f7df
MD5 b9cc7966d0352c9cb381e5887e651782
SHA1 875e00103ab837608adfe7ac85692846348bff85
SHA512 5035e8f48bb515a3216353f1f4bd2f19a36efa83ac711f6545d9cd334a196d53264f808afbc66015dab1d3a15810ddae607a05cc2da1ddfbe24df3cf6224d340
TLSH
T1A111AF2917E22B37D3A24939C0B713219763BC02F4B59BAB409446515C84200AD09FFF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 84e831152e3479da5f4675283da3399298bab1168ad7e58c5c5c5a778898093b
MD5 d8af4520c9f678529cfb00346075377e
SHA1 7c2e0e537a0c82dd2f2b5a92c2c57b59009897ef
SHA512 1e556c5322061eb37a9ad0c7f1c914d5d36dd40634fec69dea8626b0d8d879e867fa9b06e72cf87e0d9b2b723d9d8f5f09a7c50e364d38784c47a700ae1900d9
TLSH
T1C831CB0A8BC72B71F27AC539C5F742569A30B9D2AA01BF2C0094534D0C32B82AD05F6E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 260821fbd184e5e3ee0ff2aac72fbbf8d9a7d949b02a2e6dc4f9cb7770287279
MD5 9a7a9ac73d6696315e7b23a92b1fdbef
SHA1 f9b33d5bcf2075cf2ce68843b1be744de8637b6e
SHA512 4cf5820def1b5b7e5b6c76b4c973509d0bf84affa577368a674f99e20a73cedce057c1eb97850222d314b2e77e1fa8bf80cb3fc8f84e6002e6040f11143ecc85
TLSH
T11011AF2917E22B37D3A24939C0B713229763BC02F5B59BAB408446514C44201AD09FFF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 eb2ad53cbe68d29eaac41ff19a3eee5ea77116800b4d7bfbe96dfd7ddf8fa628
MD5 c7b92d854db3ca4b53acf9af3f24eda5
SHA1 0ed78419223510e6ffdd192228d2d17347308d88
SHA512 8477d5930c4d2c09711f68c51d6524099fd7bc6fe3061da3a770e90b1b040658080a14e75b19c4006c84c55b000b8ba043053b5e990f8b67e82a3a1a7fb69cee
TLSH
T1DA11AF2917E22B37D3A24939D0B713219763BC02F4B59BAB408546514C44310AD19FFF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 b50b010a6f82dbd57f8ae23bf77e08756746f3fdc8949f3eee9fc67f825098a0
MD5 cd8b0a5cb719d06c9c17c6fb956b2458
SHA1 76ddc5519c87acaf5f296c06caf597f784092630
SHA512 4dad6ee082800caaf308b714b32bdde5025f98029dba860ba8a3dfa66a83275df0a8fa6819ef9c3dfc855aafcbddc11f3e078b5356b811c5f935a666895eda70
TLSH
T16631CB0A8BC72B71F27AC539C5F742569A30B9D2AA00BF2C0094534D0C32B82AD15F6E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 0ae711c44fa9d919ba324521afc7a030439a0ca3af5bbbdd5d0f1a59401c3b5b
MD5 7eca132b5b54f46b556d946109e2abb1
SHA1 53a9415679943091b9cafd3e581fd70119f32985
SHA512 07391cd98385468f9aad4680f54dc6c6f696ce8f6296d670b34fa7e7f56db2544b426aa46f07a0edec412c538492f48621cecde9c5fcfa8bc00971d8cdb7b759
TLSH
T1C011AF2917E22B3BD3A24939C0B713219767BC02F4B59BAB408546914C44200AD19FFF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 ad89943d033ea4c65030ad8490891dfd02fde9d60ceec49726791121453496bd
MD5 1fa532e7ceedabb7c5292880f96fc3b2
SHA1 a9f2189efcf5daf15e71c1a6969a54c8a72281ab
SHA512 e0a5af7e9603cc36b83bea1ac58983f2ea69a09a0e495c48a0fab1ce6395123aef0788683871d07cfa2a98744b6fd505404a2ff479c7d548bb1c7cb49e6e01b5
TLSH
T15511AF2917E22B37D3A24939C0B713219763BC02F4B59BAB409446554C44201AD19FFF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 d17ea4ac6ae2d6b82314930366c2c865338c4b044b8c8597801f99fe01669ec7
MD5 1f1c4ce0f90be6479ab6cf718c9167c7
SHA1 9d8f06359d91b97d621a179cf0a55e403af3b8c2
SHA512 3f356e233f3568456c9c1b6776f1ef96ea3e3050dc92c5821eb85e7576a73346b584dfb46571a52f069d83d0b3e2af720bda299b45b32305ea1e159f432323bc
TLSH
T1E631CB0A8BC72B71F27AC539C5F742569A30B9D2AA00BF2C0094534D0C32B82AD05F6E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 01512a83a17d64a52d0cbdb09387b03b28afa8940a1d6bae822a7b46c02fbfee
MD5 f40c1460db983e7f484f139cb76e2715
SHA1 cbaf815aa2bf26ea46518d1b991e118098741cf0
SHA512 2f694cd571dd32a6b1ea45422250dd34cf66814325e8b9aa90ac4cf8ddef1bbdd5f91311218c19961bf8acb6906aad2a1972250bbf56c6edee2a278001385188
TLSH
T19A11AF2917E22B37D3A24939C0B713219763BC02F9B59BAB408446914C84240AD09FFF
MD5 SHA1 SHA512 TLSH

Submit Download

HelpMe.exe

Path C:\Windows\SysWOW64\HelpMe.exe
Size 3.6MB
SHA256 3e761114fb42b8f9915e2e1300e0abac91e74c04167ef1ae82698957b870677e
MD5 dbe8e5dbec3cfee0955934c764b346d8
SHA1 335ae4c4159c3a5f9cf863235d634d4b7ff54150
SHA512 a9bd15b9ad587358db50bd4aacb6d4b1815705ebffb97c2a233c8da76da97192ec50fb80c3df0129684f3d9a8c9e79529791d9616a23836e59ada7db399c8ab6
SSDEEP 98304:+E2H5Wky5WL5Wj5WiM+M6RkMkIM7M5WCMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6A:+nE
TLSH
T10E066B02B3E89425F0F72A305D76A7744A7ABC51AE38D74F3294790E2D71B81AD31B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini.exe

Path F:\$RECYCLE.BIN\S-1-5-21-1609746302-1884177235-1125644204-1000\desktop.ini.exe
Size 3.6MB
SHA256 19b70825cb33f4df6ecb2f349a63bdc00626c7cbff4e3610728df9f0a14ad6f4
MD5 1a2c757112ba4132badedeaa4787eec1
SHA1 a843f8c75db00a0bf9e4780f04285ad08a8214fd
SHA512 57a1497c3d52be93ce798ffc7be94b251fdc875870916928e2f5b74ff4fe112700999d45a66d0f13af62fcca8dc3b1448a2a3ddab999d1fbc40d929a478ee998
SSDEEP 98304:+E2H5Wky5WL5Wj5WiM+M6RkMkIM7M5WCMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6q:+nG
TLSH
T1CE066B02B3E89425F0F72A305D76A7744A7ABC51AE38D74F3294790E2D71B81AD31B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AUTORUN.INF

Path F:\AUTORUN.INF
Size 145B
SHA256 cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae
MD5 ca13857b2fd3895a39f09d9dde3cca97
SHA1 8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0
SHA512 55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47
TLSH
T188C04868F16A939D1E0C399093A400237083A208019E420E93DDE4A53DD41084F05188
MD5 SHA1 SHA512 TLSH

Submit Download

AutoRun.exe

Path F:\AutoRun.exe
Size 3.6MB
SHA256 2a7ab479280c132e67a615fdefeb489c2577ef5ac83331bb0e432870361b37c5
MD5 5cebb18f098df5e3c80a8a120c232e00
SHA1 fafaa1cce746abe9ea1f1bedceabb9b3128b46bc
SHA512 555683fddbbba25510d770d1ed3c363488af81c994ecd8d05c67d677bc19df3ab9d45e9a1a369e521df213f64d87c6364921c978b3d4fcd351a096422167ecac
SSDEEP 98304:+E2H5Wky5WL5Wj5WiM+M6RkMkIM7M5WCMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6O:+ny
TLSH
T1EF066B02B3E89425F0F72A305D76A7744A7ABC51AE38D74F3294790E2D71B81AD31B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3392-48-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3392-235-0x0000000000910000-0x0000000000A30000-memory.dmp

Download

memory/3392-55-0x0000000000910000-0x0000000000A30000-memory.dmp

Download

memory/3392-2-0x0000000000460000-0x0000000000461000-memory.dmp

Download

memory/3392-50-0x00000000021F0000-0x00000000021F1000-memory.dmp

Download

memory/3392-0-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3392-86-0x0000000000910000-0x0000000000A30000-memory.dmp

Download

memory/3392-1-0x00000000021F0000-0x00000000021F1000-memory.dmp

Download

memory/5412-96-0x00000000007A0000-0x00000000008C0000-memory.dmp

Download

memory/5412-66-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/5412-49-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/5412-65-0x00000000007A0000-0x00000000008C0000-memory.dmp

Download

memory/5472-87-0x00000000009C0000-0x0000000000AE0000-memory.dmp

Download

memory/5472-7-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/5472-51-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/5472-56-0x00000000009C0000-0x0000000000AE0000-memory.dmp

Download

memory/5472-236-0x00000000009C0000-0x0000000000AE0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads