Overview

overview

10

Static

static

3

2026-06-06...os.exe

windows10-2004-x64

10

2026-06-06...os.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    06/06/2026, 12:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-06_7ee978087a000aa7569e5fc1f3ad0d62_amadey_elex_hellokitty_remcos.exe
  • Size 9.2MB
  • Sample260606-pp46jaes3x
  • SHA256 bbca9da3f65a007904c7d8600b0d194583fe32171ed1f3f6782a06db5a6c63dd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarediscoveryneshtapersistenceprivilege_escalationransomwarespywarestealer

Malware Config

Signatures

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 5 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 25 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 31 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 41 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-06_7ee978087a000aa7569e5fc1f3ad0d62_amadey_elex_hellokitty_remcos.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-06_7ee978087a000aa7569e5fc1f3ad0d62_amadey_elex_hellokitty_remcos.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2888
    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-06-06_7ee978087a000aa7569e5fc1f3ad0d62_amadey_elex_hellokitty_remcos.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-06-06_7ee978087a000aa7569e5fc1f3ad0d62_amadey_elex_hellokitty_remcos.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3516
      • C:\Users\Admin\AppData\Local\Temp\7z8BF55DBC\setup.exe
        "C:\Users\Admin\AppData\Local\Temp\7z8BF55DBC\setup.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5032
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.hhdsoftware.com/dispatch/vspt/release-notes?version=5.03.00.01007
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1092
          • C:\Windows\svchost.com
            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\msedge.exe" --single-argument https://www.hhdsoftware.com/dispatch/vspt/release-notes?version=5.03.00.01007
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            PID:4040
            • C:\Users\Admin\AppData\Local\Temp\3582-490\msedge.exe
              C:\Users\Admin\AppData\Local\Temp\3582-490\msedge.exe --single-argument https://www.hhdsoftware.com/dispatch/vspt/release-notes?version=5.03.00.01007
              6⤵
              • Executes dropped EXE
              PID:6108
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:3060
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:3
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3028
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2036
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "20" "C:\Users\Admin\AppData\Local\Temp\{6e9dc7fc-f3f6-5347-9991-959410e2ccf4}\psharedrv.inf" "9" "42710cbe3" "000000000000014C" "WinSta0\Default" "000000000000015C" "208" "C:\Users\Admin\AppData\Local\Temp\{4EE92393-803E-4971-BE5E-64CFFC70584F}\Components\drvreg_win10"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:4460
  • C:\Program Files\HHD Software\Virtual Serial Port Tools\ps_server.exe
    "C:\Program Files\HHD Software\Virtual Serial Port Tools\ps_server.exe"
    1⤵
    • Executes dropped EXE
    PID:4856
  • C:\Program Files\HHD Software\Virtual Serial Port Tools\psip_server.exe
    "C:\Program Files\HHD Software\Virtual Serial Port Tools\psip_server.exe"
    1⤵
    • Executes dropped EXE
    PID:5036

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Persistence

        Event Triggered Execution

        2
        T1546

        Change Default File Association

        1
        T1546.001

        Component Object Model Hijacking

        1
        T1546.015

        Privilege Escalation

        Event Triggered Execution

        2
        T1546

        Change Default File Association

        1
        T1546.001

        Component Object Model Hijacking

        1
        T1546.015

        Defense Evasion

        Modify Registry

        2
        T1112

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Query Registry

        2
        T1012

        System Information Discovery

        2
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ACROBR~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE
        • Size 328KB
        • SHA256 a5f47d59b8d08fc85ee411ec2e1015fedda08fd4a6cae2bf7b3bb1a7db2ccb5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ACROTE~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
        • Size 86KB
        • SHA256 a46d1ffbe9114015050b2a778859c26248f8bab22d5d1a302b59373bc20c6b45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ADOBEC~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE
        • Size 5.7MB
        • SHA256 1ebe469c94c2c2a5acbc3927cef19dbe2f583ba3651a55623633891c4c05cc22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ADelRCP.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe
        • Size 175KB
        • SHA256 1ad4c736829dbcb0fcc620fd897fe0941b9c01e14ccba5d18085b3ca0416ab66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RdrCEF.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe
        • Size 9.4MB
        • SHA256 3e815d583236b9cecd912fcc949a301d1e51b609cbb53a2285d08feea305edcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AcroRd32.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
        • Size 2.4MB
        • SHA256 bd7696911d75a9a35dfd125b24cb95003f1e9598592df47fa23a2568986a4a9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WCCHRO~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE
        • Size 183KB
        • SHA256 8ca27077312716f79f39309156c905719a908e8ded4bf88c2ba6fa821e574673
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Eula.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe
        • Size 131KB
        • SHA256 49091e1e41980b39d8de055fe6c6a1dc69398f17817960d64743e7efb740efc4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FULLTR~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE
        • Size 254KB
        • SHA256 129a2bfe25ceabb871b65b645ef98f6799d7d273fc5ddfd33c1cb78f5b76fa3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LOGTRA~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE
        • Size 386KB
        • SHA256 cae320401aa01a3cef836c191c2edbd7a96bfcce9efad1a21880626a64cc4dec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        READER~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE
        • Size 92KB
        • SHA256 7a8ee09f8a75b3e812f99a0b611c6720626c62c6985306a408694389a996c8e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WOW_HE~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE
        • Size 147KB
        • SHA256 686bec325444e43232fb20e96365bb1f1eb7c47a4e4ce246fc900d3a9784d436
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        arh.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe
        • Size 125KB
        • SHA256 9a7391267ab83b45a47d9fcf1e0f76002ed6640ed6a574ba51373410b94812f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        32BITM~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE
        • Size 142KB
        • SHA256 a89d3e2109a8e35e263da363d3551258ea320a99bfb84a4b13ad563008eda8d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        64BITM~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE
        • Size 278KB
        • SHA256 b8c5b99365f5ac318973b151fe3fe2a4ad12546371df69e1b7d749f7a4ce356f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ADOBEA~1.EXE
        • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE
        • Size 454KB
        • SHA256 f94ddaf929fb16d952b79c02e78439a10dd2faa78f7f66b7d52de2675e513103
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AdobeARM.exe
        • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe
        • Size 1.2MB
        • SHA256 57329b38314923c17e9dd9e153e894708389dd597fcb1438d5291c7627238653
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jaureg.exe
        • Path C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe
        • Size 555KB
        • SHA256 38b06ee250af6554e6740a1bb7acfb77b99ccdb8081880e01c386afa98668766
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOIN~1.EXE
        • Path C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE
        • Size 121KB
        • SHA256 53e47df12f0ce2005f4a2a773d194c9431b325b64c205dfa4cfba45c973b65f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe
        • Size 325KB
        • SHA256 80de06ea5d221e21f765a96750f821aaaf8eee23bfd9d8cde265a8da11041c66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe
        • Size 325KB
        • SHA256 d2f956514bc885fed054dec3ad4c0e89e59a6a38390fa8432abd15eb201468b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe
        • Size 505KB
        • SHA256 97508a81b805937e1ca57711a51d2e8d715a2748e2f9d27d39dfecc28f3fb9e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DISABL~1.EXE
        • Path C:\PROGRA~2\Google\Update\DISABL~1.EXE
        • Size 5.7MB
        • SHA256 21719f3b636ac9d9a8b5ae3f1b15faf10a5110d2d75e0e4ca8e681160642e6ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ie_to_edge_stub.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\BHO\ie_to_edge_stub.exe
        • Size 562KB
        • SHA256 5ca66d0a92c97e353cbf7fc47246f2292fb9ec2966a4abf7a03ea4a8c8b406c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\INSTAL~1\setup.exe
        • Size 7.1MB
        • SHA256 bcea62bcf7ac1a58399565cb993ff0d74e60b117760c809a6f82d1c4f50e2d41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cookie_exporter.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\cookie_exporter.exe
        • Size 155KB
        • SHA256 7fc13ee7e85761659331398585b2d5bf08ecaa65077e162f748b2b97dd0b9152
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\elevated_tracing_service.exe
        • Size 3.8MB
        • SHA256 ffbd64f72a712f25934fae982a24bcf3f2be0ade3e54c4f606f0783722bb7d2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\elevation_service.exe
        • Size 2.2MB
        • SHA256 71fa2d5fb7c3da809fc0e66b5c8e989bad16b443d24487cf4508cde7e2d8397d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        identity_helper.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\identity_helper.exe
        • Size 1.4MB
        • SHA256 2feba86fd7ed5264c069f66397b7f08d8f245233c0c7a8be563e6f9846f0723f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedge_proxy.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\msedge_proxy.exe
        • Size 1.5MB
        • SHA256 d6a52fc33703813fe2e2a549aa212fa07900d6677aece66832ae294b1f04f51a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedge_pwa_launcher.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\msedge_pwa_launcher.exe
        • Size 1.8MB
        • SHA256 dd17f95d51fc498b681629bf544553d67dbec4840265af2adcbec04d9ae70bdc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgewebview2.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\msedgewebview2.exe
        • Size 3.4MB
        • SHA256 8d98bbaa8691268632b5276bbb6a77437d28d0701c5ff083a306deebc3447a82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedge.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        • Size 4.0MB
        • SHA256 a0bf37dcf76b6bcb0e1b4a13cb525ea70d88a2a8eac4f9b1c75f79c04b7e3b09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vspt.chm
        • Path C:\Program Files\HHD Software\Virtual Serial Port Tools\doc\en\vspt.chm
        • Size 653KB
        • SHA256 af2db27a442d340045528e8e3bee85e660718a04d53477e626030da5622f567b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-06-06_7ee978087a000aa7569e5fc1f3ad0d62_amadey_elex_hellokitty_remcos.exe
        • Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-06-06_7ee978087a000aa7569e5fc1f3ad0d62_amadey_elex_hellokitty_remcos.exe
        • Size 9.1MB
        • SHA256 139ba65776bb50a2a5e349ae45ab4c6429f288bd76898863f150cc7467821f1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedge.exe
        • Path C:\Users\Admin\AppData\Local\Temp\3582-490\msedge.exe
        • Size 3.9MB
        • SHA256 6d8e5d6a4d1c147b90b5a394a5054840e19dfa3eae3ea706ffb367477cecb929
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        config.ini
        • Path C:\Users\Admin\AppData\Local\Temp\7z8BF55DBC\config.ini
        • Size 30KB
        • SHA256 2530e06faa9d73c2944c562cbd4f553d14ecbd54311587de49026a6b328cfc53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icon.png
        • Path C:\Users\Admin\AppData\Local\Temp\7z8BF55DBC\icon.png
        • Size 15KB
        • SHA256 b4def9573c7efbec6b62db1b26d91cc0823d7124c1830a493fbf2906c830ecc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7z8BF55DBC\setup.exe
        • Size 1.0MB
        • SHA256 22479b73b4bc310d3318d9cb58032d376ac93ececd0ebcbd618ce61cd5dafc2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {150A905B-EF26-4780-9315-63DE2CA08DD6}.7z
        • Path C:\Users\Admin\AppData\Local\Temp\7z8BF55DBC\{150A905B-EF26-4780-9315-63DE2CA08DD6}.7z
        • Size 8.4MB
        • SHA256 0e2db193eb41a6c0b5c9ce44916a1920a76bb61045c13da27e96ec734fcf3a58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        clientctl.tlh
        • Path C:\Users\Admin\AppData\Local\Temp\{4EE92393-803E-4971-BE5E-64CFFC70584F}\Components\cppheader\clientctl.tlh
        • Size 42KB
        • SHA256 00fa7264f14253e3dc78752045b05dfbf031163a12d50cd8104739c6131e485b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        clientctl.tli
        • Path C:\Users\Admin\AppData\Local\Temp\{4EE92393-803E-4971-BE5E-64CFFC70584F}\Components\cppheader\clientctl.tli
        • Size 37KB
        • SHA256 886aa56fc1c9cdd1d13869d05f9a6e067b0c52118bdccb5d52cfc6c0c39e95e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DIFxAPI.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{4EE92393-803E-4971-BE5E-64CFFC70584F}\Components\drvreg_win10\x64\DIFxAPI.dll
        • Size 506KB
        • SHA256 e70bbcee0d01658ccd201ebe0f0e547b9daff01b7c593a0fdd0c64e5f45d6f11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        hhdvspkit.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{4EE92393-803E-4971-BE5E-64CFFC70584F}\Components\drvreg_win10\x64\hhdvspkit.dll
        • Size 949KB
        • SHA256 1f57404c35ca35c7af1cad36bdcb66656be9e682a599e3b08abdf91357f2e021
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        hhdvspkit.d.ts
        • Path C:\Users\Admin\AppData\Local\Temp\{4EE92393-803E-4971-BE5E-64CFFC70584F}\Components\hhdvspkit.d.ts\hhdvspkit.d.ts
        • Size 8KB
        • SHA256 f9e6c45b5fa8201e2952b957eff19b929a37fbc87eb10c42b800c0e157dad771
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        hhdvspkit.interop.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{4EE92393-803E-4971-BE5E-64CFFC70584F}\Components\hhdvspkit.interop.dll\hhdvspkit.interop.dll
        • Size 20KB
        • SHA256 4d5f043383646d3b43cbef6dae9b89b04634026e7a90a0e563a42af35cb2fdd7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        hhdvspkit.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{4EE92393-803E-4971-BE5E-64CFFC70584F}\Components\hhdvspkit32.dll\hhdvspkit.dll
        • Size 817KB
        • SHA256 54c53e9336499f8abfac0854d6ec92a5d2289ece4858863d8d7868309ad39494
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        hhdvspkit.dll.rgs
        • Path C:\Users\Admin\AppData\Local\Temp\{4EE92393-803E-4971-BE5E-64CFFC70584F}\Components\hhdvspkit32.dll\hhdvspkit.dll.rgs
        • Size 11KB
        • SHA256 1edd38b9b8039b425edf3e469bd4446e103c8128565ddc869935ffccea009d0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        hhdvspkit.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{4EE92393-803E-4971-BE5E-64CFFC70584F}\Components\hhdvspkit64.dll\hhdvspkit.dll
        • Size 962KB
        • SHA256 d598cbd01f79ae7799d4b02f6c0b02278f4fd789b76925a5d24b2d23f00e3c40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        clientctl.idl
        • Path C:\Users\Admin\AppData\Local\Temp\{4EE92393-803E-4971-BE5E-64CFFC70584F}\Components\idlfile\clientctl.idl
        • Size 22KB
        • SHA256 238b02975d384d3eebd6793eb3c3afac06a7b6950ec76d2d36decc9ee57a051b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ps_server.exe
        • Path C:\Users\Admin\AppData\Local\Temp\{4EE92393-803E-4971-BE5E-64CFFC70584F}\Components\ps_server.exe\x64\ps_server.exe
        • Size 970KB
        • SHA256 8e2e8f561316afe0d85c660503c2b301468f13adacd3d28b19a2ebde9d12c826
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ps_server_config.exe
        • Path C:\Users\Admin\AppData\Local\Temp\{4EE92393-803E-4971-BE5E-64CFFC70584F}\Components\ps_server_config.exe\x64\ps_server_config.exe
        • Size 1003KB
        • SHA256 58027f2cabe8fd169f5ff79c2fa387ed55673997de83cfd81296fd7f7dc8bad2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        server_reg.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{4EE92393-803E-4971-BE5E-64CFFC70584F}\Components\ps_server_config.exe\x64\server_reg.dll
        • Size 463KB
        • SHA256 4ad6cef8025bc2ed7e6b666062eba20f8c70077ef5697b2292e2dc409aca605f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        psip_server.exe
        • Path C:\Users\Admin\AppData\Local\Temp\{4EE92393-803E-4971-BE5E-64CFFC70584F}\Components\psip_server.exe\x64\psip_server.exe
        • Size 1.1MB
        • SHA256 23079f510dd1abbcb760d1b1c18e4c238957d5bed415d83eaa4e53599646ea85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        psip_server_config.exe
        • Path C:\Users\Admin\AppData\Local\Temp\{4EE92393-803E-4971-BE5E-64CFFC70584F}\Components\psip_server_config.exe\x64\psip_server_config.exe
        • Size 1017KB
        • SHA256 24b9e01965d216bf895e686b3ae5e54fda7798b8e2d0e3012c61f5eae002034c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tcpserver_reg.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{4EE92393-803E-4971-BE5E-64CFFC70584F}\Components\psip_server_config.exe\x64\tcpserver_reg.dll
        • Size 478KB
        • SHA256 49a2ed8f4b744b302b7ca4f8ef647ece1b299f74de123dd93e6b807cef1882b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rspcli.exe
        • Path C:\Users\Admin\AppData\Local\Temp\{4EE92393-803E-4971-BE5E-64CFFC70584F}\Components\rspcli.exe\x64\rspcli.exe
        • Size 685KB
        • SHA256 4e6f2ac2ffa92ff4981ca0d35ecc7d08dd427c35a29a2569e571a4ec3f8024a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tcpserver_reg.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{4EE92393-803E-4971-BE5E-64CFFC70584F}\Components\tcp-firewall\x64\tcpserver_reg.dll
        • Size 465KB
        • SHA256 9dbf050eda96330738cd048b673d44ca5ddb7b976705bcd09000b0565f2e6db5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-version-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{4EE92393-803E-4971-BE5E-64CFFC70584F}\Components\universal.crt.win7\x64\api-ms-win-core-version-l1-1-0.dll
        • Size 18KB
        • SHA256 d62fd5e1c4d669757b0371a709f5232a3690de897901c4ba3c086111d1b3305e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-version-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{4EE92393-803E-4971-BE5E-64CFFC70584F}\Components\universal.crt.win7\x86\api-ms-win-core-version-l1-1-0.dll
        • Size 18KB
        • SHA256 fb815ddb17dc454ee66d66f1143c31688bce001f55fd4ba56304c8ccd3552f32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vspcfg.exe
        • Path C:\Users\Admin\AppData\Local\Temp\{4EE92393-803E-4971-BE5E-64CFFC70584F}\Components\vspcfg.exe\x64\vspcfg.exe
        • Size 3.1MB
        • SHA256 e1976d72676fac20ea2ab3243e8d93cd1ed0c6891fe6ea13301f94c8d4091e3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vspcfg.reporter.exe
        • Path C:\Users\Admin\AppData\Local\Temp\{4EE92393-803E-4971-BE5E-64CFFC70584F}\Components\vspcfg.exe\x64\vspcfg.reporter.exe
        • Size 250KB
        • SHA256 2ae14ccdf4d94824b902380e414f62ec163caf7ffc8a9754230970b9d22881b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vysercli.exe
        • Path C:\Users\Admin\AppData\Local\Temp\{4EE92393-803E-4971-BE5E-64CFFC70584F}\Components\vysercli.exe\x64\vysercli.exe
        • Size 579KB
        • SHA256 31237153991fea6f7bdb18ef6aabae61b6289d1c7be96a4c77e0e64b69a15b7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wow64proxy.exe
        • Path C:\Users\Admin\AppData\Local\Temp\{4EE92393-803E-4971-BE5E-64CFFC70584F}\Components\wow64proxy.exe\wow64proxy.exe
        • Size 473KB
        • SHA256 bca651d29ca217a0a83cf8f95f3e8f003127ced360acf6318e8f28b517baff82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        psharedrv64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{4EE92~1\COMPON~1\DRVREG~1\psharedrv64.dll
        • Size 1.0MB
        • SHA256 c26e5ee3db73c567cde04327fa46f404d1e221bae0a2e05d0542e267dc0c126d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        psharedrv_x64.cat
        • Path C:\Users\Admin\AppData\Local\Temp\{6E9DC~1\psharedrv_x64.cat
        • Size 12KB
        • SHA256 c0c3ee5d2ae1f29a92746127297e35588ff0efb934b464ce328d757b984af2fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vyser64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{6E9DC~1\vyser64.dll
        • Size 385KB
        • SHA256 c01813b037c5817c02a672b79657160b7f6d8aad7e5fedf77d3e91402e6047b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wudf64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{6E9DC~1\wudf64.dll
        • Size 2.3MB
        • SHA256 612f3f8829b0a878d43074b06c7f1d17817c27c30bcee127333dc3e4ed41f2ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        psharedrv.inf
        • Path C:\Users\Admin\AppData\Local\Temp\{6e9dc7fc-f3f6-5347-9991-959410e2ccf4}\psharedrv.inf
        • Size 5KB
        • SHA256 e72ced88d7a38b276989fe4e08d1391c975b50219231edde7888ff3fc688718d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dberr.txt
        • Path C:\Windows\System32\CatRoot2\dberr.txt
        • Size 107KB
        • SHA256 5c22c25a938311a315b47546b242048a095544611e6221c66d6f86c2b9bcd0f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        svchost.com
        • Path C:\Windows\svchost.com
        • Size 40KB
        • SHA256 069a84f8a38724b6a9dcd8c6e678b0d42998f70be193a6104e6d377b3e7e397a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2888-578-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/2888-289-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/2888-288-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/2888-540-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/4040-542-0x0000000000400000-0x000000000041B000-memory.dmp
        Download