Overview

overview

10

Static

static

3

2026-08-08...ee.exe

windows10-2004-x64

10

2026-08-08...ee.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 17:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-08_de3abb2397f7346f57687e2ca2a32e9c_amadey_elex_floxif_smoke-loader_stealc_tofsee.exe
  • Size 386KB
  • Sample260808-vpsema1dqe
  • SHA256 a13c2a55f75ba9a38eb73b696765a91b8c01bc54300635029536bb663b097133
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarebackdoordefense_evasiondiscoveryexecutionfloxifpersistenceransomwarespywaretrojanupx

Malware Config

Signatures

  • Family: Floxif, Floodfix

    Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    backdoortrojanfloxif
  • Detects Floxif payload 1 IoCs
    backdoor
  • UPX dump on OEP (original entry point) 3 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 3 IoCs
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Drops desktop.ini file(s) 42 IoCs
  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 4 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Runs ping.exe 1 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of FindShellTrayWindow 52 IoCs
  • Suspicious use of SendNotifyMessage 46 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_de3abb2397f7346f57687e2ca2a32e9c_amadey_elex_floxif_smoke-loader_stealc_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_de3abb2397f7346f57687e2ca2a32e9c_amadey_elex_floxif_smoke-loader_stealc_tofsee.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4392
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Jump.cmd" "
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4764
      • C:\Windows\SysWOW64\mode.com
        mode con cols=60 lines=5
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1460
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /K C_to_E.cmd
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1988
        • C:\Windows\SysWOW64\reg.exe
          Reg.exe query "HKU\S-1-5-19\Environment"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4812
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu" /v "{59031a47-3f72-44a7-89c5-5595fe6b30ee}" /t REG_DWORD /d "0" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4116
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel" /v "{59031a47-3f72-44a7-89c5-5595fe6b30ee}" /t REG_DWORD /d "0" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2652
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu" /v "{20D04FE0-3AEA-1069-A2D8-08002B30309D}" /t REG_DWORD /d "0" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1896
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel" /v "{20D04FE0-3AEA-1069-A2D8-08002B30309D}" /t REG_DWORD /d "0" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1584
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im explorer.exe /t
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:5692
        • C:\Windows\SysWOW64\sc.exe
          sc stop "CscService"
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:4004
        • C:\Windows\SysWOW64\sc.exe
          sc stop "SysMain"
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:980
        • C:\Windows\SysWOW64\sc.exe
          sc stop "WSearch"
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:4920
        • C:\Windows\SysWOW64\sc.exe
          sc stop "defragsvc"
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:4468
        • C:\Windows\explorer.exe
          C:\Windows\explorer.exe
          4⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:3420
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1 -n 2
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:996
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" ver "
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2492
        • C:\Windows\SysWOW64\find.exe
          find " 5."
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3476
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1 -n 4
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:1064
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1 -n 2
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:4116
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1 -n 2
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:5940
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1 -n 2
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:2312
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1 -n 2
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:792
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x00000000000004C8 0x00000000000004D0
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:460
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:628
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4176

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        1
        T1059

        Windows Command Shell

        1
        T1059.003

        System Services

        1
        T1569

        Service Execution

        1
        T1569.002

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Active Setup

        1
        T1547.014

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Active Setup

        1
        T1547.014

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Defense Evasion

        Impair Defenses

        1
        T1562

        Modify Registry

        2
        T1112

        Credential Access

        Discovery

        Peripheral Device Discovery

        2
        T1120

        Query Registry

        3
        T1012

        Remote System Discovery

        1
        T1018

        System Information Discovery

        3
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        System Network Configuration Discovery

        1
        T1016

        Internet Connection Discovery

        1
        T1016.001

        Lateral Movement

        Collection

        Command and Control

        Exfiltration

        Impact

        Service Stop

        1
        T1489

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        tiptsf.dll.tmp
        • Path C:\Program Files (x86)\Common Files\Microsoft Shared\ink\tiptsf.dll.tmp
        • Size 579KB
        • SHA256 d3d97d8aef1ad34643df5baa6a6dcdf771b1000b7e6ca0bd596bbe5a4111f1e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tiptsf.dll.tmp
        • Path C:\Program Files (x86)\Common Files\Microsoft Shared\ink\tiptsf.dll.tmp
        • Size 579KB
        • SHA256 238184c4c73df14e7fee39ea5a95193a7d34775f0425a624972a0eae81ebf728
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        symsrv.dll
        • Path C:\Program Files\Common Files\System\symsrv.dll
        • Size 67KB
        • SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 599B
        • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        C_to_E.cmd
        • Path C:\Users\Admin\AppData\Local\Temp\C_to_E.cmd
        • Size 51KB
        • SHA256 4b558c544924b354bcbe1977592fbe3e30169f53cff0dcc47b88e310a669c308
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Jump.cmd
        • Path C:\Users\Admin\AppData\Local\Temp\Jump.cmd
        • Size 143B
        • SHA256 90ef2f935496576017e42f405f6560f18165689b4ea23c1ac95d913a29cedabb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        desktop.ini
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Contacts\desktop.ini
        • Size 412B
        • SHA256 48a6703a09f1197ee85208d5821032b77d20b3368c6b4de890c44fb482149cf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        desktop.ini
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\DOCUME~1\desktop.ini
        • Size 402B
        • SHA256 cafec240d998e4b6e92ad1329cd417e8e9cbd73157488889fd93a542de4a4844
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        desktop.ini
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\DOWNLO~1\desktop.ini
        • Size 282B
        • SHA256 b029393ea7b7cf644fb1c9f984f57c1980077562ee2e15d0ffd049c4c48098d3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        desktop.ini
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Desktop\desktop.ini
        • Size 282B
        • SHA256 4b9d687ac625690fd026ed4b236dad1cac90ef69e7ad256cc42766a065b50026
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        desktop.ini
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\FAVORI~1\desktop.ini
        • Size 402B
        • SHA256 a45e345556901cd98b9bf8700b2a263f1da2b2e53dbdf69b9e6cfab6e0bd3464
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        (WINDO~1.LIB
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\(WINDO~1.LIB
        • Size 2KB
        • SHA256 ebb7046c4dfdd73e17906c216497a1463895454ef1d662f25c017d017cbfc60e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        (WINDO~1.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\(WINDO~1.LNK
        • Size 1KB
        • SHA256 a9d20412393e64817561eb25042982e513e1d0ccba0acdc03eb51aa790a89943
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        %APPDA~1.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\%APPDA~1.LNK
        • Size 1KB
        • SHA256 74a2f514102e8897379ff1b9e6fad621619513cf25df75aa8b8560cf217c47b3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        %APPDA~2.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\%APPDA~2.LNK
        • Size 2KB
        • SHA256 bd82e268db6fe6982e6c04b52d7754e27af6892144042710c0333b3d5ea74c1c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        %PROGR~1.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\%PROGR~1.LNK
        • Size 1KB
        • SHA256 7e69c28838c2df0f3d925c2bc6a8305f807ab936d126d2ddf14ee1622c9081d9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        %Public%.lnk
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\%Public%.lnk
        • Size 1KB
        • SHA256 5fd6c1e6d7e7eec1a5481d31e7699602e9e05b062134d3adfacb6d9a56da793e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        %SYSTE~1.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\%SYSTE~1.LNK
        • Size 1KB
        • SHA256 f456ff400c5c90336fef8fb996767125b36dbc0e2b56506ddd413d944cc75778
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        %Temp%.lnk
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\%Temp%.lnk
        • Size 1KB
        • SHA256 8a23ba8ad5b844ecbf6eee81d365d4e8e906a7c7ee6eda25ba7592eca6c577f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        %USERP~1.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\%USERP~1.LNK
        • Size 1KB
        • SHA256 08f40692cf8d56d8d8cf6c8cad1a5036c96dfd96eed5198f5b6a403e4a45031b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        %WinDir%.lnk
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\%WinDir%.lnk
        • Size 1KB
        • SHA256 c5c7625b07d55678b225e35ed67fbc81fe2fda0c163c9dd22039ff6067da0106
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        (GODMO~1.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\(GODMO~1.LNK
        • Size 1KB
        • SHA256 ebeb7ba783247ae1c6e026731e4f5406d99d50de652835f0715e94831b5c2b2e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        APPWIZ~1.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\APPWIZ~1.LNK
        • Size 1KB
        • SHA256 ee3f567206e77c2f727815a300fdae5e0c0eccd24d0037ea893f7bd0c8b3b028
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        CALCUL~1.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\CALCUL~1.LNK
        • Size 1KB
        • SHA256 3150ef02597afc8f33b2e605ac9d7b55de62c94a81039c23776104c26678d2dc
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        CHARAC~1.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\CHARAC~1.LNK
        • Size 1KB
        • SHA256 2bb9a296624e6601587b33594eaed9704d494bf32c87b8aceefe7d81ffcea86d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        CHKDSK~1.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\CHKDSK~1.LNK
        • Size 1KB
        • SHA256 a03a61316697b6c05c9c5cf0b8b1bc31dbcd18333d5eec648ef2fe82bd89973d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        CMD~1.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\CMD~1.LNK
        • Size 1KB
        • SHA256 f7577bfbbfb117d5c7cb44449584f0d9d01cb9654c13006e324bb26e79c54e8a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        COLORM~1.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\COLORM~1.LNK
        • Size 1KB
        • SHA256 c123a61017adcbe197acfcc176bab0d520acc2c5882783fd3ff6689e9023df7e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        COMPON~1.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\COMPON~1.LNK
        • Size 1KB
        • SHA256 785075112738a694356ee253181aab623a9e4a8eb33c7cd8a3e9ddc5d2e85a54
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        COMPUT~1.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\COMPUT~1.LNK
        • Size 1KB
        • SHA256 829609ac18c87b50a9c34f53dc134074fd9e70fa12d378f9359e296c7a935551
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        CONTRO~1.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\CONTRO~1.LNK
        • Size 1KB
        • SHA256 b11da95a7c14be6c534d5c6ae4f1d9a213ab59432b695fac3c78527c265da78b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        CONTRO~2.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\CONTRO~2.LNK
        • Size 2KB
        • SHA256 8ca7ae76496bdb149edea21757ba9211a6425871f833eb36ae161d5a1d738b97
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DEFAUL~1.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\DEFAUL~1.LNK
        • Size 2KB
        • SHA256 a53d152336ec10d2280eddcb611d82ff7ae96e062b663268413c6f0c1222507e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DEFAUL~2.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\DEFAUL~2.LNK
        • Size 1KB
        • SHA256 f0d30f1fbdb3f6e3f37db491adec0c48435ef8c5ecf82a594de9af7238f50f16
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DEVMGM~1.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\DEVMGM~1.LNK
        • Size 878B
        • SHA256 1c4cb7bcccaa378176a99f7b65d1df7d6d91e787dfaf3ef8c2140622b2e17b8d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DFRGUI~1.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\DFRGUI~1.LNK
        • Size 1KB
        • SHA256 da4598c4c25b914e5f17432c0fe17a00ed74b55d66cfd48289edb2a85c935853
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DISKCL~1.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\DISKCL~1.LNK
        • Size 1KB
        • SHA256 b1085da2d41e01be689d6b1b22d0e89d80bb045d76b53969d5d8ae89de38ef92
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DISKMG~1.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\DISKMG~1.LNK
        • Size 885B
        • SHA256 498fcfa3ead87889041d9636dd96a19cfc161a0a6d50720f662b487b8dece8cd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        EVENTV~1.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\EVENTV~1.LNK
        • Size 1KB
        • SHA256 f0c114ffd691908868060e5ce700d67c86ab721b70599272cc12c06711f5f6b9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        FIREWA~1.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\FIREWA~1.LNK
        • Size 833B
        • SHA256 c27f78609d34600076adbd6fe5d57eb7b450fc5de695e71586031eeba75b0465
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        FOLDER~1.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\FOLDER~1.LNK
        • Size 1KB
        • SHA256 ff06fa7f9a0fe2e1a329e29a4d0aa6750341b8e59ee8c01d592ae134c7b21bfc
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        FONTS~1.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\FONTS~1.LNK
        • Size 966B
        • SHA256 ba19571ca112d4a6aaed10ff7f4e3fd4c90a5b41aa73849230647b14ab06929a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        FSMGMT~1.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\FSMGMT~1.LNK
        • Size 873B
        • SHA256 e7ec8e0f0e00bf4247e93e8f1d770ff4c75c348f6c97935b9f1a9c70dd665bcb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        GPEDIT~1.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\GPEDIT~1.LNK
        • Size 873B
        • SHA256 9d83ddacb22c72c3cf2bb57a28330d71d7e8046ce27c990f1c9ad4fe83236ccc
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        HDWWIZ~1.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\HDWWIZ~1.LNK
        • Size 867B
        • SHA256 293004e1078d4a7b13b058cdd9b254c4945f29a5beae0c328651c7eb5c64a661
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        INETCP~1.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\INETCP~1.LNK
        • Size 1KB
        • SHA256 248469b867640550586acb2558d806998c0fef2d047a5446bba13e4c79fd1b9e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        INTLCP~1.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\INTLCP~1.LNK
        • Size 1KB
        • SHA256 4d1915ccf4ed6e41ea43fdd4485bbf085d72553446a8772f8da00ddb10ef88d9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ISCSII~1.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\ISCSII~1.LNK
        • Size 1KB
        • SHA256 53e4cb9946fa4618b3dd8ffc913f88ce1d75cbfddf0ec9b653f38008120364cd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        LUSRMG~1.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\LUSRMG~1.LNK
        • Size 878B
        • SHA256 4e5a2a0bf425043f6d2c93d2be491d586011f2977e377730ea6ed30f1538555b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        MAGNIF~1.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\MAGNIF~1.LNK
        • Size 1KB
        • SHA256 28e66bf0d21fce9b1b78bfe8aba00bcb47e2fb8a9ef903130ab914f971be98a8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        MATHIN~1.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\MATHIN~1.LNK
        • Size 1KB
        • SHA256 ab3288b57cec628a04a718f6ae19db77af70d68aa649687afa3cfa241df98ddb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        MEMORY~1.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\MEMORY~1.LNK
        • Size 1KB
        • SHA256 23ff6a2477aa3a787d59b99d698e01855d3349d43b6918460f286a4560e48e49
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        MOBILI~1.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\MOBILI~1.LNK
        • Size 2KB
        • SHA256 13718d3c7dccd2e90eedd5d4f16d2bbdf3abb6f8786555ad14a3c44788017a05
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        MOUSE~1.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\MOUSE~1.LNK
        • Size 146B
        • SHA256 b4b171104d77c3fdb4af62771667d7ae01853666805c4c8dd370cfac1494bf88
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        MSCONF~1.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\MSCONF~1.LNK
        • Size 1KB
        • SHA256 56829d8ad8d64ee2b3057a4a39ab437ba2cec59a0ed31e7b274a4a0d607507a8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        NCPACP~1.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\NCPACP~1.LNK
        • Size 1KB
        • SHA256 87e306565604688efe54fbc97dae8e9d61de0010552bdb0cbc133237ddc353ae
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        NETPLW~1.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\NETPLW~1.LNK
        • Size 1KB
        • SHA256 fc0284060a559b846b9fe82f68aa9627cc0e005e6321e0b86516a0551dbe5ed4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ODBCDA~1.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\ODBCDA~1.LNK
        • Size 1KB
        • SHA256 66d52fd163003ee986d9f9ad824748a898808b217857af7f66eaf526e3cd5032
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        OSKEXE~1.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\OSKEXE~1.LNK
        • Size 1KB
        • SHA256 077f8cbccb73115997bce1019f129fe9f91ac45c1b3a6be93f5ea94270a12269
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        PAINT~1.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\PAINT~1.LNK
        • Size 1KB
        • SHA256 8ff7c45e0d42dabb5510f9e0fdfe30144896e392320c126f7988c495dca7a6a0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        PERFOR~1.LNK
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\PERFOR~1.LNK
        • Size 1KB
        • SHA256 cfa6582608508ad4a6ae9aa629b4fa4732c6cd4734b801af278bb68f61e2e236
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        desktop.ini
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__WIND~1\desktop.ini
        • Size 70B
        • SHA256 460d7804888395a5ae1ecd07998d0319452b85a3570a2d92b33e1647d3c188d9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        desktop.ini
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\desktop.ini
        • Size 580B
        • SHA256 4c0d757717dec80eca8c6cbbfdda4706eb38fbbb7624933d5429dafc7bb9f0ec
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        desktop.ini
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\desktop.ini
        • Size 114B
        • SHA256 af94e42be1a612da2c0d10b887f31a8ca149ee0ac2543b11c5482809f141f6af
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ico.ico
        • Path C:\Users\Admin\AppData\Local\Temp\_My_\ico.ico
        • Size 52KB
        • SHA256 294ba3bb2edd7b458a4bfb0ba2433350233d7e83ccd22ae0848e433cb1b691bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/628-294-0x000001FF81EA0000-0x000001FF81FA0000-memory.dmp
        Download

        memory/628-304-0x000001FF942E0000-0x000001FF94300000-memory.dmp
        Download

        memory/628-298-0x000001FF81C80000-0x000001FF81CA0000-memory.dmp
        Download

        memory/628-285-0x000001FF801E0000-0x000001FF802E0000-memory.dmp
        Download

        memory/628-286-0x000001FF801E0000-0x000001FF802E0000-memory.dmp
        Download

        memory/628-293-0x000001FF819D0000-0x000001FF819F0000-memory.dmp
        Download

        memory/628-515-0x000001FF95C60000-0x000001FF95E43000-memory.dmp
        Download

        memory/4392-283-0x0000000010000000-0x0000000010030000-memory.dmp
        Download

        memory/4392-4-0x0000000010000000-0x0000000010030000-memory.dmp
        Download