stihat | 8dd00422a0f53ef8cb2e915df13b34986a25329623360380518fffa5dd7dfb8e

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 03:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_8b2e5eefeacab4d1173f87d745f04329_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
Size 9.9MB
Sample260808-dp572sbd64
SHA256 8dd00422a0f53ef8cb2e915df13b34986a25329623360380518fffa5dd7dfb8e
MD5 8b2e5eefeacab4d1173f87d745f04329
SHA1 5476b021869cc70e1e55795f7a130c781523ba25
SHA512 772f9f7c930b9bf798f7d9bf7ca5694f4f37ede34607974247622827975a1b34f5c8abedce4261e4210808627260b0ad5b5ae48c0abb25cd3feba52960b728bf
SSDEEP 98304:9E2R1IMo8WbGOIghnW8Dz1GHrHwe1auRa1J:9nzI3e8Dz1kxNs
TLSH
T11AA68C57B072A4B6E9D8453440F7FF2A3CF5F91102C2494DDA79226B4FB3868ADB01B9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery stihat persistence privilege_escalation spyware worm

Malware Config

Signatures

Family: Stihat
Stihat is a worm written in Delphi.
worm stihat

Detects Stihat payload 8 IoCs

resource	yara_rule
behavioral2/memory/3304-0-0x0000000000400000-0x000000000047B000-memory.dmp	family_stihat
behavioral2/files/0x000e00000001c486-6.dat	family_stihat
behavioral2/memory/5700-8-0x0000000000400000-0x000000000047B000-memory.dmp	family_stihat
behavioral2/files/0x000100000000002f-17.dat	family_stihat
behavioral2/files/0x000d00000001c48c-31.dat	family_stihat
behavioral2/memory/3304-40-0x0000000000400000-0x000000000047B000-memory.dmp	family_stihat
behavioral2/memory/5700-45-0x0000000000400000-0x000000000047B000-memory.dmp	family_stihat
behavioral2/memory/1180-56-0x0000000000400000-0x000000000047B000-memory.dmp	family_stihat

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	2026-08-08_8b2e5eefeacab4d1173f87d745f04329_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe

Detects executables packed with ASPack 8 IoCs

resource	yara_rule
behavioral2/memory/3304-0-0x0000000000400000-0x000000000047B000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c486-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5700-8-0x0000000000400000-0x000000000047B000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000100000000002f-17.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c48c-31.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3304-40-0x0000000000400000-0x000000000047B000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5700-45-0x0000000000400000-0x000000000047B000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1180-56-0x0000000000400000-0x000000000047B000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	2026-08-08_8b2e5eefeacab4d1173f87d745f04329_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe

Executes dropped EXE 2 IoCs

pid	Process
5700	HelpMe.exe
1180	HelpMe.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	explorer.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	2026-08-08_8b2e5eefeacab4d1173f87d745f04329_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\H:	2026-08-08_8b2e5eefeacab4d1173f87d745f04329_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\S:	2026-08-08_8b2e5eefeacab4d1173f87d745f04329_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\X:	2026-08-08_8b2e5eefeacab4d1173f87d745f04329_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\J:	2026-08-08_8b2e5eefeacab4d1173f87d745f04329_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\Y:	2026-08-08_8b2e5eefeacab4d1173f87d745f04329_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\B:	2026-08-08_8b2e5eefeacab4d1173f87d745f04329_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\V:	2026-08-08_8b2e5eefeacab4d1173f87d745f04329_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\N:	2026-08-08_8b2e5eefeacab4d1173f87d745f04329_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\M:	2026-08-08_8b2e5eefeacab4d1173f87d745f04329_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\D:	HelpMe.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\D:	2026-08-08_8b2e5eefeacab4d1173f87d745f04329_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\P:	2026-08-08_8b2e5eefeacab4d1173f87d745f04329_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\T:	2026-08-08_8b2e5eefeacab4d1173f87d745f04329_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\D:	HelpMe.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\U:	2026-08-08_8b2e5eefeacab4d1173f87d745f04329_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\W:	2026-08-08_8b2e5eefeacab4d1173f87d745f04329_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\L:	2026-08-08_8b2e5eefeacab4d1173f87d745f04329_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\R:	2026-08-08_8b2e5eefeacab4d1173f87d745f04329_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\A:	2026-08-08_8b2e5eefeacab4d1173f87d745f04329_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\G:	2026-08-08_8b2e5eefeacab4d1173f87d745f04329_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\I:	2026-08-08_8b2e5eefeacab4d1173f87d745f04329_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\O:	2026-08-08_8b2e5eefeacab4d1173f87d745f04329_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\K:	2026-08-08_8b2e5eefeacab4d1173f87d745f04329_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\AUTORUN.INF	2026-08-08_8b2e5eefeacab4d1173f87d745f04329_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened for modification	C:\AUTORUN.INF	2026-08-08_8b2e5eefeacab4d1173f87d745f04329_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HelpMe.exe	2026-08-08_8b2e5eefeacab4d1173f87d745f04329_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpMe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpMe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_8b2e5eefeacab4d1173f87d745f04329_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f481cffcda87848be43b5fdf8091c1c60d0260001002600efbe11000000bdac3cafad0fdd01c1d2249bb60fdd018e27269bb60fdd0114000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\NotificationData	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4756	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4756	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4756	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3304 wrote to memory of 5700	3304	2026-08-08_8b2e5eefeacab4d1173f87d745f04329_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-08_8b2e5eefeacab4d1173f87d745f04329_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_8b2e5eefeacab4d1173f87d745f04329_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe"
1⤵
- Modifies WinLogon for persistence
- Creates a file in the Startup directory
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Windows\SysWOW64\HelpMe.exe
  C:\Windows\system32\HelpMe.exe
  2⤵
  - Modifies WinLogon for persistence
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:5700

C:\Windows\explorer.exe
Explorer.exe HelpMe.exe
1⤵
- Modifies registry class
PID:5388

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4756

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4824

C:\Windows\SysWOW64\HelpMe.exe
C:\Windows\SysWOW64\HelpMe.exe
1⤵
- Modifies WinLogon for persistence
- Creates a file in the Startup directory
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.exe

Path C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini.exe
Size 9.9MB
SHA256 98682a5e05dd7ad97b556ae6c5f29324c7cb8f1cc41311308a611c8dcfb3ad7a
MD5 de7c4255f7a50ef7550bf9fe2a4de749
SHA1 e3aa5e961768ca99652199e2da8867dc2d9d0282
SHA512 8810e0eea983dcbb5c843ecb88e17eefd8afee3b6d4177d1b9d9d5a395f5a6843a192d4df7b6b6274485cbb95ed2c5aed7c512eb3c513342423c430ed66440a6
SSDEEP 98304:9E2R1IMo8WbGOIghnW8Dz1GHrHwe1auRa16:9nzI3e8Dz1kxN1
TLSH
T139A68C57B072A4B6E9D8453440F7FF2A3CF5F91102C2494DDA79226B4FB3868ADB01B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 d3734df3c604f8921a43f02da553794909de1d776b6f07a257e02bdc81e29eb7
MD5 ac91733f3e95ff6c934081c1c75372f8
SHA1 1d05f91409f0d3e90018bba62fe026ad30d1418d
SHA512 abbf9a26e04c22800e2f368e42757cb0737c46b8931f8d089c1169ca2e340edfda667f5e6eb34dca8c84a26910411c20b1e1d933cdf54a9f7336eaf13fa2cc22
TLSH
T12311AB1499927B2AC3B2E77B90B6232297B3BD02F5B25F6E814992851C00221E954F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 26fe48cfc871cab3c9da7c46ca8057bcab4ce29ab3c35ff25319c5815e1c7683
MD5 c069ab15460b3c93a9cb8b899b095c2c
SHA1 2dbe2815e4675fc462654583bdb3084dc7078193
SHA512 74322cb1aaef2254fcf3640f55aefe16342a7c27a4e6398b1e440e29f1c9fcb187748ccaa82905b0bff3595389abbaa3961fcbf89d6dc6bbb4fad18cd1fa25b3
TLSH
T1C911AB1499927B2AC3B2A67790B6232297B3BE02F5B65F6E814992811C00221E954F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 7b09eb3e7965a9dc110ae52c698e9387277cb4eda88390a4b6c363e365c781cf
MD5 6242b7c69bcff98c385e193a32d166e9
SHA1 6415d0e0fdf297187d82de291f2b7d8b0beba9a9
SHA512 e011a0771662069b81b781348a05a669c74e5a0072879bcdb04379ca3cb2fb7736b93aba18024851c53300a3f61a8bfb081e6d4cc63948d1c30913446f1ef9c3
TLSH
T11A314415C9E65B26F27BAA72D6F624538972BCD1F621EE0D018052490C22BD1AE41F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 fd6c46cbe6d6dde80f06c9515352d1d9fb115dea9cb9ce6a1dd42855fc9e8021
MD5 cd493221110be89994a152e2027bd0c7
SHA1 220b833579df7f73ebdbb40ef9fbf00de259352c
SHA512 86e3733b58779ac49dcf4381631088a44aceb900125bc9d7497fa9dd0689be61fb5430f6c347cda039f386cccc6146fcd6091c1d60a60866eb88a3382d536246
TLSH
T10911AB1599D27B2AC3B2A63B90B6232297B3BD02F5B25F6E814992811C00221E954F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 7e2717068e96993e80de6f01563ca7e1f3f0b29410b8949ee4ce7adb33291c99
MD5 ff20912178f690a382fa80e1a82f9e8c
SHA1 c6abe3e5fe9844961a0d0f7eb3d27e6f0d5b90b7
SHA512 d861bd949e571816791f4575f6de9022edc2179fda23c7ee96b1b9f7653a0a97220ecabd776efbf0931017825728dec62802e12961d340a0ca7292eed59f75bc
TLSH
T159314415C9E65B26F27BEA72D6F524538972BCD1F621EE0D018052490C22BD1AD41F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 8c69b021ccbeecfeceb0cc31c4f175e95bdb506644a6ecf32910530e196802dd
MD5 6888281b084d88862657287bea17cbde
SHA1 1bc430eaf1f67ceb6f1636374e95a7590b757e06
SHA512 bb4733a14e8433ed68379af12cbd9dc43005be138e5c1f473d3ec3c63ea3d0ee9862302f9b7c4d6e1dcf0dea21a6dfdc7bc749e323097478372d88e45e825e67
TLSH
T1A411CE1599D27B3AC3B2A737D0B6232397B3BD02F5B25F6E814992811C04221E958F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 1a4073baab04411fd87c5985647a5b128a0c2c20f80b1e6d94481b3a190d3fa5
MD5 883134c7b409c24d6a48156fd944c261
SHA1 0cc9882ce1973370746c759f5377505e396cc144
SHA512 7e7730121afc75a558506b577b5bdb7d5536606151201c7d8ec1d3561f25f9a83cfb2d0c6cc5fc188ec91e3fe0a3d2b7e23fa49c480cf722f2e75a7d51f00305
TLSH
T11511AB1499927B2AC3B2A63790B7232297B7BD02F5B25F6E814992811C00221E958F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 d586e28a2bcf556f94b51886c647f7915b60eee66375269c9b53f845411c93de
MD5 81668b2b6608a0ff6e431685e555663c
SHA1 cd23110902576f225e3a4502ea89a92634067fc3
SHA512 a0c3e0f35c67aaecf898fe0389214d17d74c387b33e3f55b88d99c9c2a6d31af3a9afd9fc1818dab38d5cea42f7901502091b010de2b6b72aa35c05a5d7dd634
TLSH
T197314415C9E65B26F27BAA76D6F524538972BCD1F621EE0D018052490C22BD1AD41F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 cfa3a9fe5dead40b44bc507e3a8344246c4b84f6de83276cd3e3bcb52f5093cf
MD5 3b037ff9ac7b404013bc2b47a6c3965e
SHA1 b88f1b535337158d5ff31d9ce71de3691cea174f
SHA512 9623fd5ad49e7b26f28e5e562a0ee2f8f2ce2be996eacc0d0aef15f4b61a3315c75b5d201fb4349cdf7aede256c28983e5adad9a9c2434217ee879de82d97796
TLSH
T15911AF1459917B26C3B2973790B6232297B3BD02F5B25F6D814552811C00121D954F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 f232d5ba5d11d1b32a3e838593aa86f6319e4da0630bd1229f0b9955635c4f93
MD5 26459b2bab4f504e43d42ec4fa5104ea
SHA1 ff2b4bf7d766015acaf42ac48f4ee03fbf7fc243
SHA512 86c66576f112a1a70094b7cb29401052229b4b84244d5f9175cabb6070a8ad096a3781a7072eada876be35b97220cb72e60467c886e47c4689dc7b665cac98c7
TLSH
T1FA111E1498D23B3AC3B2A737C0B6232393B3BD02F5B24F6E804982811C00221E958F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 347545c7538c10c3f9521f7594bd7439c2a3740211f9a9da12a6f48316be56b0
MD5 413b4f02bfe5d20385f8c772127e2a39
SHA1 abeb0d5c0e61760db4ab27250b3470b042048713
SHA512 dffe5a28c5b2e31a25075b9e807dee84e9e60ad239aae8d2c99c56378616b123cea5a1b8d09e75f42ce6d4ad7456fdb3e763a35440ec37e57730bf2a681f77ae
TLSH
T199314415C9E65B26F27BAB72D6F52453C972BCD1F621EE0D018052490C22BD1AD81F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 f43d908a4e0d54407b55c5beeb1085ac2e34840357c339986affd5ed85c9fa1e
MD5 6a09c4197df8faa2985a077737aaab80
SHA1 fbd1c47cd7d92a0cbd114f196249e59ec82858e3
SHA512 a53b473dfe0c9d8ac93d615b97dedf342d709e2c4b62740967ee6d408fe540bca735b72c8f4ae3301b6635241d3eec0b22311f7e9c60c4febcaac027d2b46887
TLSH
T10311AB14A9927B2AC3B2A67794B6232297B3BD02F5B25F6E814992811C00261E954F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 ca898c05d394c278dd5731b101fd8153658e26bcb561136a838057663afbe27f
MD5 4d430328e200eda8ec6b20d09e96bf18
SHA1 9d7f7785edd76ab92e88ca0e118f6703f13b2e25
SHA512 0cdb91e6c53d84e97952131de478bb31ad4fd5bfc6bd1e78d3a5694fb058e4ba108601f78a8e9a012a5c507cff710ccd47bc9a2740d797cf32571ffe59ad3735
TLSH
T1F2314415C9E65B66F27BFA72D6F524538972BCD1F621EE0D018052490C22BD1AD81F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 cc367a370a3d7a6b06953acc76d05228c7123cf234a2365f0197d12a077b83f9
MD5 f7f31576a4a3eadde1d008292ab8623c
SHA1 1b2acc79fade74aa69de36336e5c46d52a762eb3
SHA512 1a293ed849c8efc055bbb6950601045cc18fb29771e4c2f0a4a58a82870df3d8740d2587f820d096a5bdcef56a3854ae6ad9f68b7b1adb90321383ba37920254
TLSH
T1F7317415C9E65F26F23BAA72D6F524538972BCD1F621EE0C0080524D0C22BC1AD41F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 c172166653ff4a1f83b51ddaaf6a678af3fdbf730fe11bcec4ca9d71b773e27b
MD5 c7961edd3c32873cf96a96288690485b
SHA1 f1dea833b47a690bf01de0928f9f8368560dee9c
SHA512 17cb14745a8259de3c10fbc051835f2b35ce6595aaca3432c112680dd29fe1f80313846b400ea45ac9f88337846e995060bb613077abf35f14175e9a4cff9ac9
TLSH
T14C314415C9E65B26F27BAA72D6F524538972BCD1F621EE0D018052490C22BD1AD41F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 18da46a48cd0e653cc78816a3319ca61b59892eef53a4124ab84a0d44cb3a1fa
MD5 8f1f49103b993dc3d9f38cd045e39e5d
SHA1 45047cd34ca01a6c3f9aebf8c3d84f3b50887e19
SHA512 f8d88d0148deaa6d9f7608230e00f1d148ddb268b31162917335346a1c1f33c4eda28918982373c215c612c0aa77949a05df28d90aa9acdfec3959642083856e
TLSH
T14C11AB1499927B3AC3B2A63790B6232397B3BD02F5B25F6E814992811C40221E954F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 965925738917f707723f99cba5512a7264ccc9227a7c4b2ae0b3de20270b4815
MD5 dd91f141d4e6283663b38049b3bbb41f
SHA1 a322102679d096dfa96e0b9f7dacecbd1a6e46ec
SHA512 ccaf108e1fda00bf748610423400038b1daadeea5db5736a04d41de059ea768ee1c62fe5c96345b91c58eb820895fe32cc67645de7e06a7591af02c4e5a6b641
TLSH
T10F317415C9E65B26F23BAB72D6F52453C972BCD1F621EE0C008052490C22BC1AD41F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 9f6a36d848c58baff3291fec9a9c0f21722b78690f6497db6e2c2ab364a9c64f
MD5 18d1be584a67710ea72af4d57eb58c95
SHA1 d36df507e910326707a93e50dc150c81d8c3390d
SHA512 4a12a130170e5b2174541f1f890372ba207472ecbc1f9213ff9ece760f31986298d5992d09091598075537a749242328f8391f9ea875221c7ae0d498d32b5661
TLSH
T1EB11AB1499D27B3AC3B2A67790B6232297B3BD02F5B25F6E814992811C40221E954F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 35c36e2e75f6ec2c1fb3e1dfbab05bb9bfa9ffd1e67883e2eccf641da8fee8ba
MD5 809c36ef6235a9f77188bcc118afa4a5
SHA1 d1580ad8d6a4033ad653136f308669612e8b6043
SHA512 899a5a4912baa6d309d1a1d01f17218a24fd3888d81761b452d371faf82b3595b8d0e4fdf574021ca1236c0265cf218db7e968c09ea8ee19d00099b52e700441
TLSH
T16A314415C9E65B26F27BAB72D6F52457C972BCD1F621EE0D018052490C32BD1AD41F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 37ca13280c9cd3059ca4c8833163c617b85010f104ffecc9df443011661b3f72
MD5 64c4eec22c7908dda08ef04c7babfbd1
SHA1 80a6a9b460a69d8b95c2c06c0c88daff0b64b6b7
SHA512 6bf5a597141c5f99372fc325f0ac8293a2b29a4ea9c396266fec1b0384124f5342b04bb566e1d5d933bc6e6420784bd84487df8d5b005ed2c7ab2870d3d0b9a2
TLSH
T19511CE1599D27B3AC3B2AB37D0B6232397B3BD02F5B25F6E814992811C01221E954F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 d67e01e46c43b0edad46313da0fb6b41ab095d38b025b2c53f244d50985cd5e7
MD5 e9d64bd64faaf15f0e1a090bcccc98c7
SHA1 07884201e20a5a839aea22747b9ab4bb1795385a
SHA512 9db94b8af2226e7a6a6faa09f4efd7292ff0f1c466b73c26e1c7212db69ca3732d506e5d68409d8c6768b203aafc52dc9db2530ec18f00b241d766aa6e838f02
TLSH
T148314415C9E65B26F27BAA72D6F524538972BCD1F621EE0D018052490C22BD1AD41F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 bb77536f6985c7d826420592f2f2680ecc859976f1304199bfc3ad150f6318b3
MD5 fefd7ea6b6b64ef125512d7a7ea8afda
SHA1 2abd8f6fc7015ef36375c54cd96c4a24de3cc141
SHA512 0eb2a82db8f5b49bfb80c6b4b7fc158d1881864375f84758f86e58363e3b94c117e012445f5f07be4909ddbb2f11c70ca2f38e0ba4cf9119eb7bcd23e9c3cdcc
TLSH
T12911AB1499927B2AC3B2A73790B6232297B7BD02F5B25F6E818992811C41221E954F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 af4fcc2c25989a758fe7f9f6e9ed891811b7e268185b98eb1e2397267bb0878d
MD5 dea402dbaa9f597a8d03b67433232fba
SHA1 a381872879e8366106109e07d90eb6cf9e7ad229
SHA512 38780975041bc79369729c3eeefa531e5f2d68735118b4e690e98a88eeb64b7a8c53010bbcf323b3bf699061288aaf1a0ec33fcf413f5d2ae7144d9ab3cfa5bd
TLSH
T15511AB1499927B2AC3B2A63790B6232397B3BD02F5B25F6E814992811C40221E954F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 15dcf59a88d219a9221136d82cf4d64742a6b2cefcc0ea189c23ad9cf8a9cdb2
MD5 bd855a1de3d8e9d3c0da65416f12252c
SHA1 725e5b1cbcb8dd3c4d340715af76b2c9a6d56a22
SHA512 543e844d428a65c2e4cde2c98cdbd059c4fdcd9d3b9c02ce1ff045600966009c61b42bd27802cf7619152ae80d201df694b2690cfd14118d85fecb93e11d788f
TLSH
T17431CE1589D2672AD3B7A737D4F612138BB3BD42F5625F2D808483441C12251ED94F2F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 78ca67f71ba9e4c7c1925d4e853cdc091439d569d05413431abd829fdde693ac
MD5 a0dfe9580f94721d48356314de7e29cb
SHA1 35f5e64be6201ac5e1bc21e48795c34319e117dc
SHA512 16f688eadc4d93bba8f91a3ec880d4284e8fcf418d138a54cd30d000d78fc68b37de383506820255415224fef6f8991929ac6a8b4599ce32caa43b547f1ad961
TLSH
T10A11C21499D17B36C3B29737D0B6132397B3BD02F5B25F6D814592811C41111D954F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 f791e282d9b30f401533e62a9bbe88a3a1d26f3f5872fe45c255c462c8fe90e6
MD5 bfff1bd686dd08339e7fd0b9b0d8588f
SHA1 065982dc28de881d5d483e49227f029efa082759
SHA512 af6de23657f001a370869168e9f8ce521a9873260935f6bda5e0e2669aed91fb90e4ba8ede6175e6c4ab2236198a853d0774ad8f2697554af8dc5b5273eec35f
TLSH
T1A5314415C9EA6B26F27BAA72D6F524538972BCD1F621EE0D018052490C22BD1AD81F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 9f2d9740a3964fc7d86635ad66217205e403c66c933ac53b8b123d65ee492239
MD5 589564449bf9a9d302100ee4c67d95a7
SHA1 cf4cad658d2e645edfaf69f0b955d977ff05506f
SHA512 9e5474d37808f6e9121f7fd789a92957d42fe6f83a9a4a4813a5ccce15952d9d8b72683eaacfae0b8f555d0d4c3c11d8034d94da6f22a5699273dfbafea4b2a3
TLSH
T1E811AF1459D17B3AC3B2963790B6132297B3BD02F5B25F6D814552811C01211D954F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 2c0106e16f49484002a66ab887c448340f83a00767398d865c365de3a885e2c8
MD5 e6429b22ae57966341d5936c1f1999da
SHA1 b32e07f17e311060e4f14f0561738102367af883
SHA512 d84a011b63f44cc75bbd9e8a81de903be4adf61a41e9bba2cf4b3a212dbaa1d3200bca54157407fd60c8cfaf9b47cc38fa07bf44450d481bca6e8892b3215290
TLSH
T159314415C9E65B66F27BAA72D6F524538972BCD1F621EE0D018052490C22BD1AD41F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 f35c12aa35c365191b4436e35600233b732bfffda91784011cfebec9ceb5c7e1
MD5 3dadaf247f51318273a36a51d6882027
SHA1 1302cb9a392aac7b8b1a5c6364aa4c436ab6449e
SHA512 1c7d19e061ca1f403faf8b2bd3115e3129405d1b30172c0ccded45edf8a1ffd36a171f5496f2e411763175db5beaf9b0d0b744bc19dd91869441e0b8af7f7fc1
TLSH
T1F311AB1499D27B2AC3B2A63790B6232297B3BD02F5B65F6E814992811C00221E958F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 1f61236e7d209616dcb45d1f6afad02615675d10d69c9d0aa7c5bb2cbf3e7966
MD5 009335a6b1f5ed59dc771d389cef72aa
SHA1 9708fbca45f3e965ef257c3e696cc48fbf1afcb6
SHA512 c5e75aa100f91a14b7c66be07c6479eb4fbf8af1d1170eadf5a243f8db5847f87489cb70677cba70979bca9c9ef469e33fb65314d765771e61142c8ae706ba62
TLSH
T16A314415C9E65B26F27BAA72D6F524538972BCD1F621EE0D018052490C22BD1AD41F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 ef634e9d9a0f9018318e400e727395b4f5faec196b3959814d387ab5c56ba22a
MD5 3688ffacb1b22cf65d5d5b460d0a660e
SHA1 9ec2dc9ecc43ba79917e4e3fa9c4144f168c91ed
SHA512 1c7435a74cfb219814a91716b6151b4e0b157e16058aac7dadbeaf1659e2efcb2856f615754a2d7d446acf922a81557e63474aa2ed7883ad9c6c7f2f496b4487
TLSH
T1A611AB1499927B2AC3B2A67790B6232297B3BD02F5B25F6E814992811C01221E954F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 1f65c0119d15ca37d5722057aad06d6a9c9b115d6c2a3be5eeffe80ef429e5cc
MD5 75b8f9b04765c8b2e1f1548953a4ea86
SHA1 dea8b6184483feef762b855f1c4c195fd38f8713
SHA512 d0c91f58df9e494295e7ab537ded9cdd8ce880cee1764c9850c089a349309a4cdfdf8c05f00eaae2b4697f76f9a7a23a37791a6d5a54478abe5a56d1668b3934
TLSH
T12C11CE1499D27B3AC3B2A777D0B6232397B3BD02F5B25F6E814992811C00221E954F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 62ea03daaacc524a7fe64d9a8c3d079ab982c67a00f126d3e756f989285a14b2
MD5 8495d78c5d847cf0f1b93843b160a5a9
SHA1 32689659cdbcb40fa7cef97462b7e8783143ed50
SHA512 c9dd2efc3215c337f3221cb419be3244182e275c6dafceb860af153bcc4af89daf82ae8a377ad6affab70afe69d8f0973b68a0d2be83f0005b1daebf20aa5bda
TLSH
T142314415C9E65B26F27BAA72D6F624538972BCD1F621EE0D018052490C22BD1AD41F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 c453d55a1d8183b4e45fc04f0d6cf46fce20ca8ddaaab17b555d434f719b31dd
MD5 73a9013611949b347a95cc6607db1f04
SHA1 79a5736b639edc75e735fb631f13200434e4cfbc
SHA512 46559ee5bbe2c579f59eb3d733628e4296afd47b49d8ff859dd1d25338ea4e72e3957a71203ca0a6bc93426f2e44d6def27ade2bef84b94ab6aacd244ce5fd3f
TLSH
T13411AF1459917B26C3B2963790B6132297B3BD02F5B65F6E814552811C00121D954F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 a19a9f2104998598a9b164754fe5d73c277290ff0a96e6fdc7a349cd510f3024
MD5 1ea2cb5b9eae871ffb1df18eecac25c5
SHA1 25ad8183f7048db772caf42969f5e5dbce090046
SHA512 c59d2e7327b4b0f7263250bd6a3e73bed2b49e810a434724775a1529d90a5597b423aaba878814e882ede2d7048ba58e2f04eda5ab42b8a041498fdedf29e724
TLSH
T104314415C9E65B26F27BAA72D6F52453C972BCD1F621EE0D018052490C22BD5AD41F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 5f5266c1ce837eb738578be3ef132a55e31e21cbbb95036cf5bc53d00ea2f47b
MD5 7b1df6f01c8b3d3a8adc47226d83bcf5
SHA1 72710200591241f43c2dd7ded0b79673fc8ada86
SHA512 24b29dd37b6c7961efaa87b3a3fbf34ab6f22e6f7a80e1cc95358a93b59218b9c5c7a7d731598d3b97ede90cadcebbc1d5f5b27a8cc5ce09e1025aca4780a001
TLSH
T1BA11AF1459927B2AC3B2963790B6132297B3BD02F5B65F6D814552811C00111E954F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 a6b5c7be2b846344c57dcf27f117be2c167f9b176ab2ba3c15e8f0545cbcd736
MD5 e0183de94fdb75c7f7bf78e916c923e0
SHA1 5580b3fb3a2bcb251eb536dc734c6951c393d4ae
SHA512 86c6a999a7b1bb2229238b0a621562b0c92e066f38c99031e134a6fcb51c1fc0c222af3752e64d690d8d9cc88cad67ef90eab2672e39d09b5048d1d675253103
TLSH
T1E7314415C9E65B26F27BAA72D6F524538972BCD1F621EE1D018052490C22BD1AD41F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 ed10249666d7afc46b5222dbc9f819d712cd01a745bf0f26dedc1a489bd98e45
MD5 404fb2f99177cb5c44cfeacb817c1a30
SHA1 40a6b0f19761c79e87214340a0e845bf0f9d4ae8
SHA512 1ea9540060e391d4fb328aca2366b756f598563838b4f637f2fe32bef70f47e5357b39a4c47af73191d742668cf7e4240384f7799f8a7744ca04dcc9999a0407
TLSH
T13D11AF1559927B26C3B2A63B94B6132297B3BD02F5B25F6E814552811C00111D954F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 d7eb393938e2813f845d992fba908ce545d785a863580401820f7d2735b4833c
MD5 559c73751b136b5958854003597ecc3f
SHA1 8ca5886dc81308e49f668f3ec050f4b4e78b82a1
SHA512 3f52e856b559a367d93982475239ee121f17972c473fe54d6dfa757e48783e63ad39ca200875105f532c3af8db93108980436e9267b66267777e946b60ea266d
TLSH
T18F314415C9E65B26F27BAA72D6F524538972BCD1F621EE0D018052490C22BD1AD41F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 0a2f83aa9185c17b6a4b1941f5fbeb56273e41a6491b8310700499ec64eb8da1
MD5 3066efe863737fba32db8be307126be5
SHA1 71dae7397783462c650e617a2fe146c356158357
SHA512 0b02f931b3ed5a42487d69fd1616801b481a365330a8a899d417d84f463a2b29b3674e618ab3a26937a35f586f9beb5c39000c58223e51d503ebb7d3afa09fc6
TLSH
T1EE314415C9E65B66F27BAB72D6F524538972BCD1F621EE0D018052490C22BD1AD41F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 3b74b26e8a4cbb11e7d26ee5defe250d6e6052f1a56c1baf813f0d7a5d50728e
MD5 760c40b372fb38d6c660e5e380c7342a
SHA1 336a1e2593fac42023d7ed4be8aeced7b33d4d8a
SHA512 2972193555eca46afead7161fdfcceef620d8b9688f9b235d8d270b20baadf9926f36b21af876eef27496238cc3154b7ac6936e0e3acdc632256d20120d5b7a8
TLSH
T10E11CE1499D27B3AC3B2A777D0B6232397B3BD02F5B25F6E814992811C40221E954F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 7a382bb98d1746819c748125cbded5c64cdd890240277cdb07c8f0fa39a71f69
MD5 3602cb9f53eb8d518aa6e2f475336751
SHA1 923f58ae7d44586cd7d50f00164b070401213df3
SHA512 ece32208e3deee63b58f240b37f8caf7f7d5ff659e22b0c3d9c42fc5af754d1a3925ca88656ab17cb934528bcfda17946bcba1700402bdb8cfc95674353d3b59
TLSH
T125314415C9E65B66F27BBA72D6F524538972BCD1F621EE0D018052490C32BD1AD41F2E
MD5 SHA1 SHA512 TLSH

Submit Download

HelpMe.exe

Path C:\Windows\SysWOW64\HelpMe.exe
Size 6.4MB
SHA256 dd808e3355c7b03ed16430f3d5a56a121c8bad81204a1f760e9c5f796104dc35
MD5 61765608870fdd1529b1d0628b0812b6
SHA1 e0dc513d13a7c0d0c63790bad30f1e6c4ced69c8
SHA512 875309a11547b308d757f633f23859955811f84db82139a43180b889508bb0e1334086fbd1506a61df0f22eae5bdcb4c56390b050950bafe2d488378f3937fcd
SSDEEP 49152:9Es1RMB8NIMIm1vLb7Lb7Lrrb7brb7Ewmgi4uYCgrGgCYu+SV7SkCrWGBydrGOIW:9E2R1IMo8WbGOIghnW8x
TLSH
T1B0667B13B13294B6EAD5893480B7FF2B3CF5F4210282194DD9B9676B4FB3964AC701B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini
Size 9.9MB
SHA256 adee2320f71608415416baef1173dc14ef26baf29d7fb5d23a0a0de807dddf57
MD5 6e35a6441b220d6b5a9f101169469bd8
SHA1 ad5429fdd1184b6b4ae7b23b3ef83b42cdc3329e
SHA512 02af6b608f59111a435c121c484f1582284070bd3eaf415d51d7269dd0949feb3072cced31700a01d7b8df763e2d46cef9d612c34bd6d060b0ed70b580bc3589
SSDEEP 98304:9E2R1IMo8WbGOIghnW8Dz1GHrHwe1auRa1x:9nzI3e8Dz1kxNi
TLSH
T17FA68C57B072A4B6E9D8453440F7FF2A3CF5F91102C2494DDA79226B4FB3868ADB01B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AUTORUN.INF

Path F:\AUTORUN.INF
Size 145B
SHA256 cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae
MD5 ca13857b2fd3895a39f09d9dde3cca97
SHA1 8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0
SHA512 55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47
TLSH
T188C04868F16A939D1E0C399093A400237083A208019E420E93DDE4A53DD41084F05188
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1180-56-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/3304-42-0x0000000002130000-0x0000000002131000-memory.dmp

Download

memory/3304-40-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/3304-0-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/3304-1-0x0000000002130000-0x0000000002131000-memory.dmp

Download

memory/3304-2-0x0000000000460000-0x0000000000461000-memory.dmp

Download

memory/5700-45-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/5700-8-0x0000000000400000-0x000000000047B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads