Overview

overview

8

Static

static

3

SovietVirus.exe

windows10-2004-x64

8

SovietVirus.exe

windows10-ltsc_2021-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    25/05/2026, 19:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SovietVirus.exe
  • Size 114KB
  • Sample260525-ypfmlsfv2m
  • SHA256 4237feaeb7a098376d0025de0b283fc9e486bba763017a28ee827a232fa7cc37
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarepersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 15 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 7 IoCs
  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies registry key 1 TTPs 10 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\SovietVirus.exe
    "C:\Users\Admin\AppData\Local\Temp\SovietVirus.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:5536
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c reg delete HKCU\Software\Classes\ms-settings\Shell\Open\command /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2860
      • C:\Windows\system32\reg.exe
        reg delete HKCU\Software\Classes\ms-settings\Shell\Open\command /f
        3⤵
        • Modifies registry key
        PID:5084
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add HKCU\Software\Classes\ms-settings\Shell\Open\command /d "" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:6012
      • C:\Windows\system32\reg.exe
        reg add HKCU\Software\Classes\ms-settings\Shell\Open\command /d "" /f
        3⤵
        • Modifies registry class
        • Modifies registry key
        PID:5088
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add HKCU\Software\Classes\ms-settings\Shell\Open\command /d "C:\Users\Admin\AppData\Local\Temp\SovietVirus.exe" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5892
      • C:\Windows\system32\reg.exe
        reg add HKCU\Software\Classes\ms-settings\Shell\Open\command /d "C:\Users\Admin\AppData\Local\Temp\SovietVirus.exe" /f
        3⤵
        • Modifies registry key
        PID:4832
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add HKCU\Software\Classes\ms-settings\Shell\Open\command /v DelegateExecute /t REG_DWORD /d 0x00000000 /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5928
      • C:\Windows\system32\reg.exe
        reg add HKCU\Software\Classes\ms-settings\Shell\Open\command /v DelegateExecute /t REG_DWORD /d 0x00000000 /f
        3⤵
        • Modifies registry class
        • Modifies registry key
        PID:3476
    • C:\Windows\System32\eventvwr.exe
      "C:\Windows\System32\eventvwr.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3620
      • C:\Windows\system32\mmc.exe
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        3⤵
        • Drops file in System32 directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:3176
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c reg delete HKCU\Software\Classes\ms-settings\Shell\Open\command /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1020
      • C:\Windows\system32\reg.exe
        reg delete HKCU\Software\Classes\ms-settings\Shell\Open\command /f
        3⤵
        • Modifies registry class
        • Modifies registry key
        PID:5524
    • C:\Windows\System32\svchost.exe
      "C:\Windows\System32\svchost.exe"
      2⤵
        PID:5952
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x33c 0x4a0
      1⤵
        PID:4428
      • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
        "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
        1⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious use of SetWindowsHookEx
        PID:2504
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        1⤵
        • Checks SCSI registry key(s)
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        PID:5852
      • C:\Windows\System32\WUDFHost.exe
        "C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-3d4da987-8930-47eb-ad98-f5edc3763842 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-ca34ba92-0cba-4957-9869-8c45fbf07055 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-2c544e30-1dc3-4c01-8d98-8567834ab831 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-439b02b0-6489-4398-ac2b-2d314ccfb863 -LifetimeId:6421f2d4-2a08-4efc-9ae2-6a76939ec36a -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
        1⤵
          PID:5680
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1676
          • C:\Windows\explorer.exe
            explorer.exe /LOADSAVEDWINDOWS
            2⤵
              PID:5456
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Enumerates connected drives
            • Checks SCSI registry key(s)
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            PID:5312
          • C:\Windows\system32\WinSec.exe
            C:\Windows\system32\WinSec.exe
            1⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in System32 directory
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1768
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c reg delete HKCU\Software\Classes\ms-settings\Shell\Open\command /f
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:5112
              • C:\Windows\system32\reg.exe
                reg delete HKCU\Software\Classes\ms-settings\Shell\Open\command /f
                3⤵
                • Modifies registry key
                PID:1036
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c reg add HKCU\Software\Classes\ms-settings\Shell\Open\command /d "" /f
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:2992
              • C:\Windows\system32\reg.exe
                reg add HKCU\Software\Classes\ms-settings\Shell\Open\command /d "" /f
                3⤵
                • Modifies registry key
                PID:2392
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c reg add HKCU\Software\Classes\ms-settings\Shell\Open\command /d "C:\Windows\system32\WinSec.exe" /f
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:5436
              • C:\Windows\system32\reg.exe
                reg add HKCU\Software\Classes\ms-settings\Shell\Open\command /d "C:\Windows\system32\WinSec.exe" /f
                3⤵
                • Modifies registry class
                • Modifies registry key
                PID:532
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c reg add HKCU\Software\Classes\ms-settings\Shell\Open\command /v DelegateExecute /t REG_DWORD /d 0x00000000 /f
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:5060
              • C:\Windows\system32\reg.exe
                reg add HKCU\Software\Classes\ms-settings\Shell\Open\command /v DelegateExecute /t REG_DWORD /d 0x00000000 /f
                3⤵
                • Modifies registry key
                PID:4832
            • C:\Windows\System32\eventvwr.exe
              "C:\Windows\System32\eventvwr.exe"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1708
              • C:\Windows\system32\mmc.exe
                "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
                3⤵
                • Drops file in System32 directory
                • Suspicious use of SetWindowsHookEx
                PID:5500
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c reg delete HKCU\Software\Classes\ms-settings\Shell\Open\command /f
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:3476
              • C:\Windows\system32\reg.exe
                reg delete HKCU\Software\Classes\ms-settings\Shell\Open\command /f
                3⤵
                • Modifies registry class
                • Modifies registry key
                PID:5968
            • C:\Windows\System32\svchost.exe
              "C:\Windows\System32\svchost.exe"
              2⤵
                PID:3140
            • C:\Windows\System32\rundll32.exe
              C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
              1⤵
                PID:1912
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                • Suspicious use of SetWindowsHookEx
                PID:6020
              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:5280
              • C:\Windows\System32\spoolsv.exe
                C:\Windows\System32\spoolsv.exe
                1⤵
                  PID:5204
                • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                  1⤵
                  • Drops file in System32 directory
                  • Checks processor information in registry
                  • Enumerates system info in registry
                  • Modifies data under HKEY_USERS
                  • Suspicious use of SetWindowsHookEx
                  PID:4020
                • C:\Windows\System32\WUDFHost.exe
                  "C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-44031b9c-7ad6-4368-898e-c750724780ca -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-2562c4d8-63e7-41f2-b69d-9e20dcf02d29 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-7fa1fcfa-3494-4cd9-a3de-cad1f3a0014b -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-29ffa74e-316f-4d60-af1a-46cadca4b634 -LifetimeId:7c8face6-2a9e-491e-8e79-9a55d7daa4f6 -DeviceGroupId: -HostArg:0
                  1⤵
                    PID:4816
                  • C:\Windows\system32\dwm.exe
                    "dwm.exe"
                    1⤵
                    • Checks SCSI registry key(s)
                    • Enumerates system info in registry
                    • Modifies data under HKEY_USERS
                    PID:4016
                  • C:\Windows\system32\sihost.exe
                    sihost.exe
                    1⤵
                    • Suspicious use of WriteProcessMemory
                    PID:6060
                    • C:\Windows\explorer.exe
                      explorer.exe /LOADSAVEDWINDOWS
                      2⤵
                        PID:5588
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                      • Boot or Logon Autostart Execution: Active Setup
                      • Enumerates connected drives
                      • Checks SCSI registry key(s)
                      • Modifies Internet Explorer settings
                      • Modifies registry class
                      • Suspicious behavior: AddClipboardFormatListener
                      • Suspicious use of SendNotifyMessage
                      • Suspicious use of SetWindowsHookEx
                      PID:2120
                    • C:\Windows\System32\rundll32.exe
                      C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
                      1⤵
                        PID:3936
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:2904
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                        • Modifies registry class
                        • Suspicious use of SetWindowsHookEx
                        PID:5508

                      Network

                            MITRE ATT&CK Enterprise v16

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
                            • Size 471B
                            • SHA256 bb46df84826799b9f4379660adf429a03efbd64f71188bd6fed97db912504816
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
                            • Size 412B
                            • SHA256 a52618b05f96729f4aa937f3e74cbe03c412ceb41ddb9ebaff50aa461d8dd880
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            mmc.exe.log
                            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\mmc.exe.log
                            • Size 1KB
                            • SHA256 2138a704c567f1018ec0e8091ae5568050fb1858f67a69ece9719e2dd072dc91
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            RecentViews
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Event Viewer\RecentViews
                            • Size 105B
                            • SHA256 5607b57c3c58070f54b8f68fa22808f9ad14c60bbf05f00da92a162585c3c562
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            Settings.Xml
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Event Viewer\Settings.Xml
                            • Size 109B
                            • SHA256 50fd9d76d1c43bb16b166de02aaf8adec09eb5bc4cefdca9d1af2e0f7b1d8f64
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                            • Size 2KB
                            • SHA256 2cafe258359466573bf91dab7770f07d7098ba493353d01fbacb75edd94cd7ea
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            0.0.filtertrie.intermediate.txt
                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{91667051-b372-4cff-b762-4daa7792b1e6}\0.0.filtertrie.intermediate.txt
                            • Size 30KB
                            • SHA256 dbde1c7ce64381d0dd036ad858f25f15b295b61d353a74d294b03f84057455b5
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            0.1.filtertrie.intermediate.txt
                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{91667051-b372-4cff-b762-4daa7792b1e6}\0.1.filtertrie.intermediate.txt
                            • Size 5B
                            • SHA256 8e1e6a3d56796a245d0c7b0849548932fee803bbdb03f6e289495830e017f14c
                            • MD5 SHA1 SHA512
                            Submit Download

                            0.2.filtertrie.intermediate.txt
                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{91667051-b372-4cff-b762-4daa7792b1e6}\0.2.filtertrie.intermediate.txt
                            • Size 5B
                            • SHA256 d65b6a3bf11a27a1ced1f7e98082246e40cf01289fd47fe4a5ed46c221f2f73f
                            • MD5 SHA1 SHA512
                            Submit Download

                            Apps.ft
                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{91667051-b372-4cff-b762-4daa7792b1e6}\Apps.ft
                            • Size 40KB
                            • SHA256 94c8c5fca08e446b66792b6afd1317d23a9fb1934e3bac3b8d8b800a3cb887e2
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Apps.index
                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{91667051-b372-4cff-b762-4daa7792b1e6}\Apps.index
                            • Size 1.0MB
                            • SHA256 7c2e528ef25d64c73ea57ce9c9ea9897adea8add514f1bef2f4730fc3c5395db
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            AppCache134242126843139121.txt
                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134242126843139121.txt
                            • Size 85KB
                            • SHA256 e5bdfb6e820c4b730196f9fbc9b34a22fa4a6f8b1b17b4096c23ec6f41590ea7
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            CortanaUnifiedTileModelCache.dat
                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
                            • Size 21KB
                            • SHA256 da807a1cfbee730b9b5b7093797935febb3e4c0af2a9ab366a97b1d0fcedbe59
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            microsoft.windows[1].xml
                            • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\XUY2DA22\microsoft.windows[1].xml
                            • Size 97B
                            • SHA256 d7160697f81754665ad7aba21dd7b458ef0b03eb3ed8c2090a414acdff3725bd
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            eventvwr
                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\MMC\eventvwr
                            • Size 135KB
                            • SHA256 bed6626d3d987532bafb58aa31573314b38561e8a0b07859e4ca9ad1f8281365
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            CachedImage_1920_1080_POS4.jpg
                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1920_1080_POS4.jpg
                            • Size 76KB
                            • SHA256 c52fe9c587778066b8fd31f45235ebb5139e0c663233695dc544c5560d9671b4
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            WinSec.exe
                            • Path C:\Windows\System32\WinSec.exe
                            • Size 114KB
                            • SHA256 4237feaeb7a098376d0025de0b283fc9e486bba763017a28ee827a232fa7cc37
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            officeclicktorun.exe.db-wal
                            • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db-wal
                            • Size 60KB
                            • SHA256 5c55ec4920b70ad6aa95909b2349a9fc68c7eb76e7da4165cd3065045a3e2ab7
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            memory/2120-197-0x00000000048A0000-0x00000000048A1000-memory.dmp
                            Download

                            memory/3276-4-0x00000000027C0000-0x00000000027C1000-memory.dmp
                            Download

                            memory/3276-7-0x00000000027E0000-0x00000000027E1000-memory.dmp
                            Download

                            memory/3276-10-0x0000000002F10000-0x0000000002F11000-memory.dmp
                            Download

                            memory/5280-27-0x000001B538560000-0x000001B538580000-memory.dmp
                            Download

                            memory/5280-26-0x000001B537F50000-0x000001B537F70000-memory.dmp
                            Download

                            memory/5280-25-0x000001B537F90000-0x000001B537FB0000-memory.dmp
                            Download

                            memory/5280-20-0x000001B537360000-0x000001B537460000-memory.dmp
                            Download

                            memory/5312-102-0x00000000049D0000-0x00000000049D1000-memory.dmp
                            Download

                            memory/5312-153-0x000000000C630000-0x000000000C6C9000-memory.dmp
                            Download

                            memory/5508-219-0x000002984B1E0000-0x000002984B200000-memory.dmp
                            Download

                            memory/5508-231-0x000002984BA80000-0x000002984BAA0000-memory.dmp
                            Download

                            memory/5508-205-0x000002984B430000-0x000002984B450000-memory.dmp
                            Download

                            memory/5508-199-0x000002984A300000-0x000002984A400000-memory.dmp
                            Download