stihat | b6f612dea6805d7b532b5725487a6ed8d753f2736da9ff806b5df42017648eae

Analysis

max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/04/2026, 02:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
Size 3.6MB
Sample260425-cle11sb141
SHA256 b6f612dea6805d7b532b5725487a6ed8d753f2736da9ff806b5df42017648eae
MD5 1fee6275739d6f8ab5fbc96fe631e53c
SHA1 7c4c217db89aeda79dc901dd46188025fafd9568
SHA512 d2b76d5993a4f7f34ec9447192ce69a8a5dc73dfb074f89086825b5f2e7982965519713e1da2e6e77b11e8954dafe4d0fbd8e935715ee77aa6054988fc920fbe
SSDEEP 98304:+E2H5Wky5WL5Wj5WiM+M6RkMkIM7M5WCMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6n:+nr
TLSH
T10A066B02B3E89425F0F72A305D76A7744A7ABC61AE38D74F3294750E2D71B81AD31B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery stihat persistence spyware worm

Malware Config

Signatures

Family: Stihat
Stihat is a worm written in Delphi.
worm stihat

Detects Stihat payload 11 IoCs

resource	yara_rule
behavioral2/memory/1868-0-0x0000000000400000-0x0000000000478000-memory.dmp	family_stihat
behavioral2/files/0x001a00000002b331-5.dat	family_stihat
behavioral2/memory/4136-7-0x0000000000400000-0x0000000000478000-memory.dmp	family_stihat
behavioral2/memory/4136-8-0x0000000000400000-0x0000000000478000-memory.dmp	family_stihat
behavioral2/files/0x000100000000002c-19.dat	family_stihat
behavioral2/files/0x000100000000002a-44.dat	family_stihat
behavioral2/memory/1792-49-0x0000000000400000-0x0000000000478000-memory.dmp	family_stihat
behavioral2/memory/1868-48-0x0000000000400000-0x0000000000478000-memory.dmp	family_stihat
behavioral2/memory/1792-51-0x0000000000400000-0x0000000000478000-memory.dmp	family_stihat
behavioral2/memory/4136-52-0x0000000000400000-0x0000000000478000-memory.dmp	family_stihat
behavioral2/memory/1792-63-0x0000000000400000-0x0000000000478000-memory.dmp	family_stihat

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe

Detects executables packed with ASPack 11 IoCs

resource	yara_rule
behavioral2/memory/1868-0-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x001a00000002b331-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4136-7-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4136-8-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000100000000002c-19.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000100000000002a-44.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1792-49-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1868-48-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1792-51-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4136-52-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1792-63-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Drops startup file 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe

Executes dropped EXE 2 IoCs

pid	Process
4136	HelpMe.exe
1792	HelpMe.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\P:	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\M:	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\U:	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\X:	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\Z:	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\V:	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\B:	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\R:	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\L:	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\Q:	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\W:	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\E:	HelpMe.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\H:	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\N:	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\S:	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\Y:	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\E:	HelpMe.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\A:	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\I:	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\K:	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\G:	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\E:	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\AUTORUN.INF	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe
File opened for modification	F:\AUTORUN.INF	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HelpMe.exe	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpMe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpMe.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies registry class 21 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\Registry\User\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\NotificationData	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1840	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1840	explorer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1840	explorer.exe
1840	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 4136	1868	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe"
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\SysWOW64\HelpMe.exe
  C:\Windows\system32\HelpMe.exe
  2⤵
  - Modifies WinLogon for persistence
  - Drops startup file
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:4136

C:\Windows\SysWOW64\HelpMe.exe
C:\Windows\SysWOW64\HelpMe.exe
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1792

C:\Windows\explorer.exe
Explorer.exe HelpMe.exe
1⤵
PID:3200

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 3097e1aa5d14f612d8761647935d3d415f6f72b8bb4ad9fd522f0d736f756658
MD5 6bbd07fe1a46a3bff911f7d33ce2168f
SHA1 dd959bf4cbe4b06908c0ef0467b2afeca6e3f52c
SHA512 0ab46feb703f847231a15a7a8dbc5008ef281363ee10fe5303763a4ce1e66667078f0aeb9ed1dd68fa0d7fb737bb4769754d59ba3e33072ecaa866897d8d5f32
TLSH
T1AF11EF2D25911B13E3F4A67E50672330F3737D22F5A15B96818512905845102B944FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 cd6b213e613364910be881993dcdb9370bc0f764e487b3a09e5dc3feb7cf9e6d
MD5 9a6f906769690009965c1f5158caee90
SHA1 8d7148f3af33481a64b350fbc3c80da001b675e4
SHA512 0d53754bc24dd0992b09a5acd4107fb47d28d1c000212db76b3a78a483356537539c474b605dee511278259d7da28a43643792acdf27a636caa57f907714bce9
TLSH
T18231C02D8BD71B61F3BAE17A95F34659F271B9F2B711BF0E008142880C31A41AE45F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 ef8e3ca3e2f75ea19fb9346fc7d9751bf9459bbf1d79ea66a52ba864dec4203f
MD5 58ae78fa16b15a56a6c5fa922f8476b4
SHA1 94c6f5990a2e2b633065683da12ad1084a62b32b
SHA512 bb5a30f651de1cf228c9917fffb37268978304df9b3b32424e744bcb75d96cb558c9f387febd55f256a3a7ef7cc7543198c99ae3e92d9519c2dbf1862f2d3e22
TLSH
T19D11AF2D15911B13E3F4E67E50676331F3B3BD32F5A15B96818512915849102A944FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 b66fb0c5e7f47f49c4eae88427d50c72018a01b91fabee2e5117ceacd2811dad
MD5 d999de997c2c54ff12362614f4d2ef7e
SHA1 6e454e2680b9c6a48e473ddac931f3dd15210903
SHA512 915fffaeaab5c89c89d1e34ce12b84fe68819533faf73ee07173647bd39dd71a5c4a57ec19a966c7730f0bb20d86fb176805d2c47b3823a7ccfeb7c19a5cf3f4
TLSH
T15411EF2D15911B23E3F0A67E50672330F3777E22F5A15B96818512905845102A948FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 8a36537aa78b8ac5ff3f207e917785ba0119129ee8bef823803770d5e95a3f64
MD5 0b8d96d9b3c9d9c5e568b6ca31a42fd1
SHA1 d6660bc106a9c49123e3a02ca914fd89b96053c3
SHA512 eeee33b1be6e2424d64093d7f8cc61158ad6c7266a32bba8d345d75d2b7ac7d5f288ae52911acf2fedf10b0632df7b69b83da3c2ec037fc0d7e66be8129a5cdf
TLSH
T14331C02D8BD71B61F37AE17A95F34659F271B9F2B711BF0E009142880C32A41AA45F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 ba4d624b74e5846fcd3e8d004f1d22363cc736650379e09fbf468105706e1034
MD5 9f57c7b0864b0b98c12a7b8ad881a5c5
SHA1 dfc28546f55ae2f5f0a8914a5ee6f10257031fb9
SHA512 0b38924fb609e511e67290c76fa576e8b7e146dec32fa972c3a906ebb45983568a356923eb0b5010b4ffb304126641bb248f224f6138c9a888815a0624f6bf34
TLSH
T1C911AF2D15911B13E3F4E67E50676331F3737E22F5A15B96818512915845102A944FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 65cf3d9b3cfea4dfad4f46ae6be47b46143a25b28a47d384416b42f2ccfc6832
MD5 fbb38d668562ef796b1208e45895ed30
SHA1 7f8c506e09e0108d77c052ba94839e02056c70c5
SHA512 f129fa6bc9720f2d9adac0a164608e3c08b8b03e17ab1c3871540a12fe59c10007fa8f24dbf993d65448488fdbeadb1d6d75dc111d384ce1435d9da2bb139f92
TLSH
T18111EF2D15911B13E3F0A67E50672330F3737D22F5A15B96818512915845102A944FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 c4ba03f366005c1572d8d029b6e5917ec8ce42ea7f1606cc477b4e293cff3e2a
MD5 f45e75be5645f18e50cfff140324bd08
SHA1 f89f88e9d2e7a427040bc43076071158e8d3fca3
SHA512 8f8eb107d4c619e13d6917e012e5114a28cf2e345f26d6582fdac9f00fa08cac4a4d96b6a49eab76351898531f713dc61a17e395b2e12f6b8eedfa7e366b2f5f
TLSH
T17731C02D8BD71B61F37AE17A95F34659F271B9F2B711BF0E009142890C31A41AA45F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 b4eb837c73cc288f2458eee38aa9952e064d4fc852081299ba15bc5c704dc0ac
MD5 a1f98d7a3fa93661502f54fabc0b1ad3
SHA1 a255069bf0109c9d16fd1f8b1b9a62affb85ce27
SHA512 a9412e986a2f46bfb80a0fd447ef16a955c1ce515f59a5bc2c81f425b1478cbc93c8fefd94136eba35f8380107aaea21e69e6940b409e37b6a928c8779876418
TLSH
T13011EF2D15911B13E3F0A67E50672330F3737D22F5A15F96818512905845102A944FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 ba8330cf02eb6fdcea14e27a8d9019a307c0d67d6fb0bd4684139b979e65bc2d
MD5 6795dba408ed57dc12b05d63bba2cf87
SHA1 8e697264e0425eb335bce782252ac0d4d9487129
SHA512 501c30d8e8cf795ba189820d41f3018fa88dc8512f1eb8bf3973be2fdb1c7e69e71094621b6b1f7fcab5162960a7fef6c6dce97893934e2925b83319e3e8a202
TLSH
T12B11EF2D15911B23E3F0A67E50672330F3737E23F9A15B96818512905845102A944FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 57d38d9a74ab1e74e2849400f4fcdf7266fc2577694c7722e345712298f00f88
MD5 e2f3143bd2a731ce526fed713e09f01d
SHA1 f657e901793644772a1423e8670dfc4268b06abf
SHA512 8b42e580a7c8824a1041fc59b769da8d27cffc038beb494ec696a59b4baf8e4ee71423789f8aa91057c30aa51763aa9b0540bdcaef66550de4b892051ee20acc
TLSH
T1B231C02D8BD71B61F37AE17A95F34659F271B9F2B711BF0E009142880C31A41AA45F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 6b086ce8af9907833fff9dd61e4c8c1b8cd7832120929c5bbf94b678db6427ef
MD5 a74ccf4667ece2120c960321dced569c
SHA1 79810f04fe0dde7a5eee3c4ee2fb5d2abb48a990
SHA512 8a044e0083c0af9227e13ce15042bb067c7faf13f689773e107267856c6d99f77d68cef05df7ea0a4d17dd600743883eb8b97a1f12a954762fb9e85491f04d99
TLSH
T13411AF2D15911B13E3F4A67E50776331F3737E22F5A15B96818512915845102A944FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 9d9194bdd05b1b035f05bdb3de6097876217c55b519675b870f4f978d00fbbc7
MD5 da65c578440bac1e023c902fb591da0d
SHA1 060f6ba38687af77fb27f0ab94408ce05a219b8a
SHA512 f8bd3f38ee708f85a382ce85060b9aa2912e5eec5dc4f393bffd651c342b91d8b96e907438131d31edbcb48606e9f41509efc8280a8a680a41fd856a4e78ac9f
TLSH
T1F011AF2D15911B13E3F4A67E50676331F3B37E22F9A15B96818512915845102A948FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 b2ba7f56587fb35735fa2032909bc887b951feafc1d9d32a59540635871c418c
MD5 43c3a05e73db4b822eebe3a6c95feef9
SHA1 1725e6a34bd52eb0edfac373c0ea333633200394
SHA512 cc1537bc6b76046e98b46a620de678b3a90bb0a62f4f1734243f4059aeff3acf2ddef6285ee5985f1b6721e8966c3e48e49399235ca5f60110d3e543ef09825a
TLSH
T11B31C02D8BD71B61F37AE17A95F34659F271B8F2B711BF0E008142880C31A81AA45F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 0b20d40a916f4da116f21cab5405b48c3b5313abb4ed784852c0bfc6c54307f4
MD5 e7f2fbcaebe1cd5cfefa8cf3d54ad597
SHA1 adbbc915d0372c0cc6412b398d3132b11c0c7564
SHA512 47fcca149ff710e0c90ff1ac545b1c272d899a7427d438c7c82d0751ce6f87219f670408083d77d9006ad69ec3f54790637adede893a0d38a351d15396fad925
TLSH
T1AE11EF2D15911B23E3F0A67E60672330F3737D22F5A15B9A818512905845102B944FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 502a587886adadde2915176b9cd44313cf24bc23b55974dcb62888bd4d3360d4
MD5 394b9e366dcfb188b5b0faece58432be
SHA1 900cc11995e7f01a4e44c915c28fff15293f85b5
SHA512 adc5516adaf3adfe9547a8d711bd5b38e09653b4db48446ae4347e4298b3b9a1bb1f88a7203dff68e7ece13020c2ea4f99d316f41193ca189852f261373c35c0
TLSH
T11211AF2D25911B23E3F4A67E50676331F3737D22F5A15B96818512915849102A944FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 9e05eac94dbedf5e4bc7c25ed883941f2c2182033c04f32f46d0c2216d77709b
MD5 4154ea5be1e0c236d61d7c507e23a134
SHA1 1dc0af0c73ed7bea394c83be26be7fb87b2fac5e
SHA512 77e338c0bfa8ac834495f3cd64d8aeba2232eab35da28f071187de66b484f429968cfc290b1f58bdaee63ff4de0e9e7652e0e91a4f3077f70377b584d1eb19be
TLSH
T17B31D22E8BD71B61F37AE17A95F34659F271B8F2B711BF0E018142880C32A41AA45F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 8de51d041494c56d2beca5a11082ee4067defab61f97692a2ca426e2186efea8
MD5 c8a8f30ec03e958d42958cf0cefaff81
SHA1 5c7be8326fb56a3bb9ced6e14b6abe37e9ef1e2b
SHA512 32454b3a899ddcb14c86f7686650b5876d2e764b3075a282115ae93ad385355454fe7b76a5d438e19d975eb4f0f6f40406cf1e617369663772e5e729afb9e813
TLSH
T12E11EF2D25912B23E3F4A67E50672331F3737E22F5A15BA6818512905845102A944FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 b81c8b620dc1e28fae1b8000e8c9dd67df8ba4c0c41a7135a3902b6de50c0e70
MD5 e16c1fe28378c4f3a21fedb1237a2593
SHA1 241600a470de5aa7b0dde6f0b677656b2b1a65b5
SHA512 83b8476fe5b570617c2cd13c25542c65cbbb401ab821c7de1a2725329f513b8863a522d8410b1ed5f96fe24c13e06bfdd9ad3909468b466db2aefef02174bdb2
TLSH
T1CF11EF2D25911B13E3F1A67E50672330F3737D22F9A15B96818513905845102A944FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 7b311fffb56e66fee879e2a9053b68d9b2dc9eba0e393f45674441110955908d
MD5 acc152d45f04476f004d1b7efee0c7c8
SHA1 f3963db0eff1b272b0418ceb468cac802d173ce9
SHA512 42f2f9daa9ad8e1970bb14381c9a000151c9fc160f728714f7e00ec4bada12700be20381b662cae4c1f179d6a80d839eaea0c5f784a115e77dedcda8fa8d7cc5
TLSH
T10C31D42D8BD71B51F37AE17995F34659F271B8F2B711BF0E008142480C31A419A45F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 41cd71c906d08f31d6f612e9a36d211002babb503c5a31d7eaafc953c7f7baaa
MD5 321cb6bae411dfd520302fd1a49bab50
SHA1 ca1c0f15196e4ca775e710565033f45fb22d0ee9
SHA512 3201606f32415021f655d8bca918f9930116ab1eb54a87d116c9792f6af09290b4f398f6a5a19da80c6af4fb3129709a8fa0d1f9395af9baa6c1268f9bd77b45
TLSH
T10111EF2D15912B13E3F0A67E50672330F3B37E23F5A15BA6818512905845102A948FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 c56dfd21175c7af34b4f572541a344c56f45232fbea16761e847931cc6cf03d2
MD5 2af96d5f535f7006e94112c12747495f
SHA1 1344324d01af2e680a48b6265db2a909639b115a
SHA512 7311a543c76e896d707ce791ad9bfb906f69ca0d60f86971c0bb7d74418ab8dfd2b51616e48a168004a3abcbb82661fe16e7ebcba712cb76c8b63d4e99918c8c
TLSH
T1EF11EF2D15911B13E3F0A67E50676330F3737D22F5A15B96818512905845102A944FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 95b20853f68c895606a6020e075bb1b11a164ae6430290fef0e203efbd44135b
MD5 f2929db97e3caed5aaa8e6aa3a9d6899
SHA1 93f607a19b2c7bc8556276a5f1d6fe0b7ef98cb9
SHA512 0d09cb63f4b024d10fb37fa89b472fd2bf421dd57367b5ae26a513b12423c787970a117658d24ef11111bfc0403481feedb3ed3455d157eab66e401e3113a8f2
TLSH
T1C211EF2D15911B13E3F0A67E50672331F3737D32F5A15B96818512905C45102A948FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 a233db5312834a296839f29bb02a8e694d7df5169bdcb8e3169ca69b6be54402
MD5 397424d312bbc377abe118332d767dea
SHA1 6b7da3930606858401045d83e88f6ea50fe75af0
SHA512 c6065445881439c5f0635927fd6fd5fcc080e1235cf4c256e4b87ef37d0c925f55af721fe13455196c5c20176dc8a2ebbf3be8fc8f632c63fdb566e71f7844df
TLSH
T16911AF2D15911B13E3F4A67E50676331F373BE22F5A15B96818512915845102A944FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 8b9a8889acb649b8d8ad628445f8c37629bd12afd333a6890b1b51766afba5be
MD5 d588b36d6e286acf536bf8ca89785d13
SHA1 d37376c8bc161970454cad0b8f096307765bc331
SHA512 7e835ba29db6ad1977eace839a0221f816be19cd4c048210731e310c6b722ab5a9c4a45fae987324bb217b5634d18f164d87cfd1cb83939dfeb471f10eb660b8
TLSH
T11C31C02E8BD71B61F37AE17A95F34699F271B9F2B711BF0E008142880C31A41AA45F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 f98b4fe98e52d9f2a78abc789692a37f5a59725c02e809905732987341112eca
MD5 bc78c0414996c12289d7b3ee65b4d20a
SHA1 7fd5705b72cdb4f719f317a8898eaf986f3c9480
SHA512 047c76e6cea23f87b257c0386d42bb8d680435cecb5182d425467cf854873f6fcce8c7bc1111e24f393a05d8675a4e930013266176dc33a833a404e109d1d475
TLSH
T1F311EF2D15912B13E3F0E67E50672330F3737D22F5A15FAA818512915845102A944FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 ac72ed7762445784e9828f0c2155a987fb94616e0f9936aaed042b6e888dbab1
MD5 62ada9b804fc3db8e6a51676364080c7
SHA1 e3f54bbceba3dd370d3262de78e794f6d3c5ea27
SHA512 7527986bcf7f8d1c96d4d1175e1ca2f6703a7bc75bfdd0be81a2480d46855a01172752b358eb65b9d106d9db86d4f5aeb61c5c77a16b9c5b79bab6a40422eaf7
TLSH
T19E11EF2D15911B13E3F4A67E50772330F3737D23F9A15B96818512905849102A944FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 4e0ba0ca855206167d6d641a96b750cfe843a61ea0ec5b5b6172c1ea040efcd3
MD5 c47f1912bd7451db2473b27c8b13354e
SHA1 9b8f7af604efa7f90009430792c62a813e438ecb
SHA512 20b1c0dbd334da2b2ac42370dea9d27a29bf9e8cbecdcc76a19f6edc1f08bbd3ffbd569fa2abe0882f951a79021df3c156373dfba04095853277d4ba2ed0388f
TLSH
T1C431D22E8BD71B61F3BAE17A95F34659F271B8F2B711BF0E008542880C31B41AA45F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 a81d3393e851bf85b56192c167e65e4fb8f071dbd1b23856dc9bd3ca5094273a
MD5 f19a501e58df1609673d5c82ab25032d
SHA1 1272044fb0902eedac8221197038ab58f13ca3bc
SHA512 be34c5addbf65111b8ea602c079a5910e6dbb2b2f6c1fdb7e7869d7b0076ac0864c1b2a151be2390efefa05435524e409718a93d4b5cbd46f291734a0586a94e
TLSH
T18811EF2D15912B23E3F0A67E50772330F3737D22F9A15B96818512905845102B944FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 42100cafc5db35f9185d15f4a064cd41f4cbb1ddf8ab4872da2ae1575e3c26fb
MD5 0923ac5f824579159a58a32f0a6ab733
SHA1 d0cbbbafa6b28375b9cc2adccf61307f7b2c323d
SHA512 8de617e6a4803eb173a1c53354920ade9451a86b43b078d22881b07d96eb4444487178c473d1de24501a07e8971b5df5e6a3f0c05f48b7ee143e679a7e149f82
TLSH
T10931D22D8BD71B61F37AE57A95F34659F271B9F2B711BF0E008142880C31A41AA45F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 19cbd4c5f1ecbb700bc6595e53fd2d1434c7df86689acf266ced562ade39ae5b
MD5 31f36192fa5e4436175ca94df960c6ac
SHA1 c36639cc243a0df60737f3e39d6306775cfa0db8
SHA512 c13de2143554ce680292f6036d97b3865c979606c253e99aa4ab3751f9cfb3432900d82eb631fc5ae675642dca7be279839002efc8f828b9047b54a3451994c1
TLSH
T18511EF2D15911B13E3F4E67E50772330F3737D33F5A15B96818512905845102A944FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 14b06ae051772ce99c68fbf4f558e1ba981a4b502154455020d06cd43c66ade4
MD5 c4bcc7ce01f0236d0f210f1b8dd8311f
SHA1 cf52026dc7a098f1e7749b52f3d00790a7005289
SHA512 6d68b57dd5fe16ba61b8c998c231cecf6e6ef02d4ee23875ac38a95793eb1d0703d1e632bc6b7761411c06d9c685fab359e7e8d8e9025b714aece1ae8a27a085
TLSH
T12331C02D8BD71B61F37AE17A95F34659F271B8F2B711BF1E008142880C31A41AA45F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 e0cb3158b56a45c418774f9a95e5836d11d5b4110f0e9ed53a3695611181899c
MD5 3e1dc227500cbc4dcc5a1ee160359ea4
SHA1 ca8ffb284e12a7cac0f1b1bd9a62d86032339827
SHA512 e34ee6de33b12ccc6a242144233b929e18ac729ebab5633393736c3bba60c0b3af9b4dd27598bb4cf713174f57fe8035b4272c7d9713bf355234793a912f6594
TLSH
T13811EF2D15912B13E3F0A67E50672330F3737D22F5A15B96818512905845102A944FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 5bdf351ba76c29ea87b5047bc4d385a6b6a52ebb8e396a3552609edb1e06604e
MD5 1394e226863e2636831bd4c4e1c44ada
SHA1 d0e98ce407dbc4a59a30f1b6640345353e4e3353
SHA512 d216ab6486ed83c7ede4f33d48f4cc10321ebd75eba21c8098bd9c29f4e017874c3581fd34b4a8abc7b9f101334dbf3baf61288a3df6dbacc5a3ea9942f58379
TLSH
T1CA31D22D8BD71B61F37AE57A95F34659F271BCF2B711BF0E008542890C31A41AA45F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 40f8dfef60ed3911d911a4b56a8a60c3461490ebe656003364e4d571ca230dac
MD5 e1812ab2f5e6224bac02f9ca45af5337
SHA1 5f97c0d4e0f089e4a0562251ade2a79c5ed627b2
SHA512 c754c167efe8b7388f157a5fc18879988811a0cd963cf2682c08bcadfac515b4947f4505b2d5e3920746c101bcc7bebbbadc8cb18a278dd190da9625970239aa
TLSH
T15A11EF2D15911B13E3F0A67E50672330F3737D22F5A15F96818513905849102A944FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 f9f9676c39e477008d690ed034f27d5e4e205ac6231d022802f623e5fc061ca5
MD5 abaf5590d3a0979ed0e63ca6babdeeee
SHA1 285db59f21ebfe2da3d11f19eb357aebd1ab5b5f
SHA512 0d558ecdb08b720b74a4886f0783a41dc53113287082bbe156b30a07c40f4f049c4b1b7ce30a8d55a4c21dd684eee5861b569bee69e5c41e83d7f9395db702e1
TLSH
T1E731C02D8BD71B61F37AE57A95F34659F271B9F2B711BF0E008143880C31A41AA45F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 d57b20a51fb6b92bc5297ca48a94c72e9901c344b3149ac31db6ac2eb0ca4de9
MD5 54f693f04e9e7eee6589a0eabcd8934c
SHA1 36bfed50da99c1ee6adf1cd373c2c4beb9a744b9
SHA512 e60928c4ade616aef0a8648cea935d14e36319a8153a22f6e1e45f9b390311699e067f9e5320f1a7992e373d12db2dd1dcd1fa7284fc25704872012d286ccf65
TLSH
T13E11EF2D25911B13E3F4A67E50672330F3737D22F5A15B96818512905849102B944FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 a4165e4d627c4b22ce1c9b147cccaa2f7dee8f0c65715912a1f17fa39d0e81c4
MD5 f22acc5b70824aba1251e016a393e97b
SHA1 929bb9fa6cc67484974ace5cc3a6d9b3ab88ba76
SHA512 d19fb47c930c383e6f896598791b34beacf5f9a067fb21eef7227f3c7f25ce38ba177189ef21d0c87ff9e77109341b68955ff90f2686755ad3e83f08873d4f0f
TLSH
T10F11AF2D25911B13E3F4E67E50676331F3737E22F5A15B96818512915845102A944FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 4704f8cbfbc47898a15abb3c9f43ce88641b39f3d6860ce56eb5ade5f387c5f7
MD5 274ea6f464aea01eddbd4b0b2d95910d
SHA1 2326ca62d15d9af399f5e44e6684fc0283584b08
SHA512 746ded0cb6a507f6f30310fa437d9ed9c4ecc586581d085bfd50114c5796cd6ecd0c40449d51c19958c1ce09e7b9e8026e9d5d5da06db25662ac1d7a1533255e
TLSH
T19131D22D8BD75B61F37AE17A95F35659F271B9F2B711BF0E008142880C31A41AB45F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 a713498cf8e2c3dbc96ee17643c47a664c0243073ad54e3f68a927ee4b26482b
MD5 c3c459cc826e00238cf2c3428941f889
SHA1 500a7789a1f022c78c41fa8385fb56a7d0202d6b
SHA512 510147b8d76180c8f04597fb8424c476bbedffcc8928328721f2a049b62aac58fa4ddd550030adc01ee4b7789894c00f5ca72a5bea1eb614521abe32f0004c42
TLSH
T16711EF2D15911B13E3F0A67E50772330F3737D23F5A15BA6818512905845102A984FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 10065c42a5ebee2d2969f674c86f29b2ae5e093440a0c5e85f9e8ed941d63acb
MD5 8943496dcada326b376938e7bd12f964
SHA1 44562305cd8cd4acdeb917e188c25003e2fafe51
SHA512 9976966e0cee0ee491f21a4bf9cb29bbb8d4444a53cb2dd5ee273e8499a6b8badf687cd90f112d70b80287e2f5273245b1381c0830cc6aff0df6fa87e402cd92
TLSH
T1B011AF3D15912B13E3F4A67E50776331F373BD22F5A15B96818512915845102A944FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 487d76e6e7f48ad217f75bbcae9d7e9e84ce935bc2e5963233c191c7bcd64cf3
MD5 e0f8e25019e6a4e20707681022fc8919
SHA1 6faeb2f67ee437fa41cc457f61b2ec025ffb0620
SHA512 e501314c687c1eec4b852cc0a0bd5f2b3c07633ae86b4f221c4df99357aa532b8bc3907260f4a0b4537926e4d92bbc45f2ae8a5b884f139f5990f8c830eae193
TLSH
T18E31D22D8BD71B61F37AE17A95F35659F271B8F2B711BF0E008142880C31A81AE45F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 c2ca02aeddaf550ebadffd318eed7792e13b9637d3189c320f285add001ce1ae
MD5 4bf5e91ca949e3d6a97b4ea88f9ffc6f
SHA1 c7f0fef6c1cc8821ecc7209e7eafdc40630c5cc8
SHA512 49763d2810c06382bfe50cff397339d4d51dec52f02f74bd90bafe0c3e8b4df5519f6c6bdbf5ae49af1f36f90c16917ef7733707b3a7415780c7547f055f6677
TLSH
T10911EF2D15911B13E3F0A67E506B2330F3737D22F5A15B9A818512909845102A944FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 de368241c345a9a3068f0cfa5f04cca07ad9cb7d48d5234bc6f5bbf11d6f0ec4
MD5 f92930d16ebeaa26467d6b6e6c5077f5
SHA1 bbc6202352bd3aa4806eb24a43c69a2265838527
SHA512 4e75486785c74de5f01ac3c14f443860a4aeac1ce280590b6e04b1abd0a44d670e3155d5d801153c9879ac8f2f86bd81e5c225e77f2c47aff3b54516862676d7
TLSH
T14211EF2D15911B23E3F4A67E50772330F373BD22F9A15B96818512905845102B944FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 d3b2cb5d99665c04cf9ef7280d461c51fd69ea36631afc0545afdfbe01de5b13
MD5 72098547951b7165dc8fb2cacb321f87
SHA1 7a26d852b058e587ddae1ad78e26e12f7acfd022
SHA512 47ffc4177c45ec4e98dac058be765244a491b7b86149cccabd336a540b598775484b26e97ada7d22e2b1211b4ea0173852aba65fe31afb6c2e1b8a0728ff806a
TLSH
T1D031C02D8BD71B61F37AE17A95F34659F271B8F2B711BF0E008142880C31A41AA45F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 946aee35062b9e48e5122c7c06e58d30be0393b4da5b5a9f26b242bd10a03777
MD5 755503a83c7c252bda364e70577ca7e5
SHA1 8fbfe1900f821cb3d79e9b88162d813dfdc58df7
SHA512 50abff69bccbb044529d690174152174199cdde27e8f9b1b7e9c97a80b96285e003a036ab616b3474b056588579c5c4ab14f027d241f2c69897e4d2c66bd636f
TLSH
T10D11EF2D15911B13E3F0A67E50672330F3737D22F5A15BA6818512905845102A944FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 7a5000d1414fd615293d8bbe326f060a0ed6c32b86b15bf2d2aae6174bdacf0e
MD5 aca238078860a141b7cf2f6ed4232bac
SHA1 4dda50d9569eaac4fade465d93f29c36d21a4215
SHA512 913af52d8fe0355436942d0a643445dc20735af6129dd8adeec792c21ee51cca7ae492de4a854a4929597cf0356e1c22f4a6e5ba0e686158f6e52896a0f40fb9
TLSH
T19D11AF2D15911B13E3F4A67E50676331F3737D22F5A15F96818513915849102B944FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 365e71a4d6ef8edfe0b4d50877369efd95d4dabcbaeec5539d45a14b76766ef4
MD5 62c58d12033aad00e2acee318394f328
SHA1 6262b0b427f472315a135dc1c7415fceeece7203
SHA512 c311b7cae3a7ac053670c6fc010a418c41c2d07e0be43e64fa54c24eb106d60c0c584712b906402833b6f276415507d5d1d7e6e9f78874385220cd68c48411cc
TLSH
T10E31D42D8BD71B51F37AE17995F74659F271B8F2B711BF0E008143880C32641AA45F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 a3b4d1a85511a91ba4c129062111ff715fb7a97a0a869f9a37f3592261f03a54
MD5 2f2fe7efb3f0d3473f6d5a539e2ee1c0
SHA1 efcce8791b0c63daf56d4a5a7d84238767169b19
SHA512 3da19381a1dc183efbb6ff99ac7645f712cf7a1f4960a4f1308dc0fc2b215d431424e72f5e6aa8a5777efc05df917615851d142881c81a2c35bbb561de58b4ee
TLSH
T12D11EF2D15911B23E3F0A67E50672330F3737D23F5A15B96818512905845102A944FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 beb2af0f881467e712b6e8b24b3b98f995a20a7df8b243f92d9869b2f662a780
MD5 781eca23e6836d8e8d2423e3dc65a4a8
SHA1 568dc76c9e049b131f55f41f2ad6a97b943f8146
SHA512 24950f2e05b6a68199ec1f224f09f4c44f81f9138953d643238a97842c1f47be48b38ce49e4226ac4e2005a10d9e8b6498c0cc9ff58d7c17a510082610dc4cd5
TLSH
T12011EF2D15911B13E3F0A67E50672331F3737D23F9A15F96818513905845102A944FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 f89b408bff5b060732445a130ed661149e411a35303e5d2f0eb95615e089fddf
MD5 3bc6e922dbd2572be73e467e6ae6ae19
SHA1 f6e08370cdbc11554bba686a9d2f6d5b33745875
SHA512 0d628bbd99f4af460b2d139edbd6cf3bf972e98fa0116ba2a4827ddfb5bf03f65d9823848a54fbc86615f5047823d9147253da2182d4e334fffdf379497ca104
TLSH
T19E31C02D8BD71B61F37AE17A95F34699F271B8F2B711BF0E008142880C31A41AB45F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 34b2b4adc51f3bdfa8eaeaeaea9e95482b1369bdde0679e58e9729520c2a6b60
MD5 04c3e4f1a7b913a73094079054b5f51f
SHA1 f86a99e3438de901c579522c0be21fb1b96b152a
SHA512 ed3e3446457586db4d90a2f51a3e8f0afc38e5306cf13b5bd853869eef348bdb58ab4a9d7b8105756ebab394fff1042e8a84ff2b05a3242a7c0f5951087b1bcb
TLSH
T12911EF2D25911B13E3F0A67E50672330F3737D23F5A15B96818553905845102A944FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 fa9084e12a7944ed447004d3086c1e162019baf28692e2d868dd1f5eabfdbb26
MD5 c6bddbcd8afe3367b185cc2eee65b092
SHA1 d144c0a94e0710a9f3e8bdaf4ae35b973619deee
SHA512 d57075b1d87fe524d328bd3cb27af69b3edbb1e1ed86dc901a952ee160daacb4870aeb1afeb88db914f85cf16a3d3b207ce74a979ad9e0cbb9e61a8f966886a7
TLSH
T10D11EF2D15911B23E3F0A67E50672330F3737E32F5A15F96818512905845102A944FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 26a3f3717e4a9b7c8f41706cdfe1dd05f21c3fabeb5535d1d0e6aa5527757090
MD5 e2da36a883ad8a806d77f757c95ce4b9
SHA1 39b91112147b99cf168ffacc84e30e75b6729c12
SHA512 9f9ddd5a672abae2063529000a6bcfc20410d26db70d6f8d9fc937c69524b38011cd9634a9133f5c036d53132144736e4cb489529ea5ccc26a14242200917381
TLSH
T1CB31D22DCBD71B61F37AE17A95F34659F271B9F2B711BF0E008142880C31A41AA45F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 6748d04de19e770a77341bab09b1d778442a8227aebee7c701b6bdc08c386157
MD5 08b251c978f0be8b5e93016c643fd535
SHA1 32c263ed479129a682323ca691c9616f583a6266
SHA512 6d5739fc5fe18a55206fa43e53b997c4d59a1196ff1da1afe6d431ccab36404d3eb08e4ca8738698a87827cc0d4834398b17855b069ec06dbb1162b9aa1cb5c1
TLSH
T17D11EF2D15911B23E3F0A67E50672330F373BD22F5A15FA6818513905845102A944FBF
MD5 SHA1 SHA512 TLSH

Submit Download

HelpMe.exe

Path C:\Windows\SysWOW64\HelpMe.exe
Size 3.6MB
SHA256 ed6c5b9c86e1ee26c72cac58b191d4a313af3e25b02da867d899a95c3176e877
MD5 2b868e227256fd435fdc805b4f2eaf13
SHA1 ae1402726584ff8dd47bbeab4fd6ce8b289fe6bc
SHA512 844197f308609938229bb8fec1a50258184b314a80cba303409cc2845863b3e469cd67f4aef33b3da88e98e1d5bd938bac40cf365b0c14dd58c50f8138094cae
SSDEEP 98304:+E2H5Wky5WL5Wj5WiM+M6RkMkIM7M5WCMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM62:+n6
TLSH
T186066B02B3E89425F0F72A305D76A7744A7ABC61AE38D74F3294750E2D71B81AD31B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-2122505878-652277452-2375749442-1000\desktop.ini
Size 3.6MB
SHA256 5ae4a49eb28901b4c3ada6a2ddd15303d60ecec8f8c32fb33a63c3c5343e95b4
MD5 e6e90ac50b0282229cf031a5073df479
SHA1 51aed20a70c43e965560bde4e46fe7360b79ff2c
SHA512 b50446b28f7884eb6afc4314f6569878b28ecd072c67388419e4b1789ffc3fc6472b645edce411685ed82d7a7b756e6ca05532387aef7d1724f36ba6d2517f32
SSDEEP 98304:+E2H5Wky5WL5Wj5WiM+M6RkMkIM7M5WCMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6n:+nj
TLSH
T1C4066B02B3E89425F0F72A305D76A7744A7ABC61AE38D74F3294750E2D71B81AD31B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AUTORUN.INF

Path F:\AUTORUN.INF
Size 145B
SHA256 cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae
MD5 ca13857b2fd3895a39f09d9dde3cca97
SHA1 8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0
SHA512 55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47
TLSH
T188C04868F16A939D1E0C399093A400237083A208019E420E93DDE4A53DD41084F05188
MD5 SHA1 SHA512 TLSH

Submit Download

AutoRun.exe

Path F:\AutoRun.exe
Size 3.6MB
SHA256 b6f612dea6805d7b532b5725487a6ed8d753f2736da9ff806b5df42017648eae
MD5 1fee6275739d6f8ab5fbc96fe631e53c
SHA1 7c4c217db89aeda79dc901dd46188025fafd9568
SHA512 d2b76d5993a4f7f34ec9447192ce69a8a5dc73dfb074f89086825b5f2e7982965519713e1da2e6e77b11e8954dafe4d0fbd8e935715ee77aa6054988fc920fbe
SSDEEP 98304:+E2H5Wky5WL5Wj5WiM+M6RkMkIM7M5WCMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6n:+nr
TLSH
T10A066B02B3E89425F0F72A305D76A7744A7ABC61AE38D74F3294750E2D71B81AD31B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1792-51-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1792-49-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1792-63-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1868-48-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1868-50-0x0000000000740000-0x0000000000741000-memory.dmp

Download

memory/1868-0-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1868-2-0x0000000000460000-0x0000000000461000-memory.dmp

Download

memory/1868-1-0x0000000000740000-0x0000000000741000-memory.dmp

Download

memory/4136-52-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4136-8-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4136-7-0x0000000000400000-0x0000000000478000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads