Overview

overview

10

Static

static

3

3a0ee05966...f4.exe

windows10-2004-x64

10

3a0ee05966...f4.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/08/2026, 18:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    3a0ee05966e9cf4bf33ed736a8e519ee121a2d79b493f5206c9023804ef840f4.exe
  • Size 4.6MB
  • Sample260809-xf7jasterf
  • SHA256 3a0ee05966e9cf4bf33ed736a8e519ee121a2d79b493f5206c9023804ef840f4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoordefense_evasiondiscoveryexecutionvalleyrat_s2installerpersistence

Malware Config

Extracted

Family

  • valleyrat_s2

Version

  • 1.0

C2

  • 118.107.9.161:1113

  • 118.107.9.161:1112

  • 127.0.0.1:80

Attributes
  • campaign_date

    2026. 7.23

Signatures

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Discovers running processes 1 TTPs 6 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 3 IoCs
    defense_evasion
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • Executes a command shell one-liner 1 TTPs 9 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 44 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 4 IoCs

    Inno Setup installer

    installer
  • Modifies registry key 1 TTPs 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs
  • Views/modifies file attributes 1 TTPs 6 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\3a0ee05966e9cf4bf33ed736a8e519ee121a2d79b493f5206c9023804ef840f4.exe
    "C:\Users\Admin\AppData\Local\Temp\3a0ee05966e9cf4bf33ed736a8e519ee121a2d79b493f5206c9023804ef840f4.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:640
    • C:\Users\Admin\AppData\Local\Temp\is-J3GVHGSL4P.tmp\3a0ee05966e9cf4bf33ed736a8e519ee121a2d79b493f5206c9023804ef840f4.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-J3GVHGSL4P.tmp\3a0ee05966e9cf4bf33ed736a8e519ee121a2d79b493f5206c9023804ef840f4.tmp" /SL5="$402EA,3619901,893952,C:\Users\Admin\AppData\Local\Temp\3a0ee05966e9cf4bf33ed736a8e519ee121a2d79b493f5206c9023804ef840f4.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1700
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c tasklist /FI "IMAGENAME eq HipsTray.exe" 2>nul | find /I "HipsTray.exe" >nul
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3680
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist /FI "IMAGENAME eq HipsTray.exe"
          4⤵
          • Discovers running processes
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2184
        • C:\Windows\SysWOW64\find.exe
          find /I "HipsTray.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4988
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c tasklist /FI "IMAGENAME eq HipsDaemon.exe" 2>nul | find /I "HipsDaemon.exe" >nul
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2776
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist /FI "IMAGENAME eq HipsDaemon.exe"
          4⤵
          • Discovers running processes
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3184
        • C:\Windows\SysWOW64\find.exe
          find /I "HipsDaemon.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3788
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c tasklist /FI "IMAGENAME eq usysdiag.exe" 2>nul | find /I "usysdiag.exe" >nul
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3732
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist /FI "IMAGENAME eq usysdiag.exe"
          4⤵
          • Discovers running processes
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2628
        • C:\Windows\SysWOW64\find.exe
          find /I "usysdiag.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2912
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 -n 3 >nul & "C:\Users\Admin\AppData\Local\Temp\3a0ee05966e9cf4bf33ed736a8e519ee121a2d79b493f5206c9023804ef840f4.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:4520
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1 -n 3
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:4456
        • C:\Users\Admin\AppData\Local\Temp\3a0ee05966e9cf4bf33ed736a8e519ee121a2d79b493f5206c9023804ef840f4.exe
          "C:\Users\Admin\AppData\Local\Temp\3a0ee05966e9cf4bf33ed736a8e519ee121a2d79b493f5206c9023804ef840f4.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3284
          • C:\Users\Admin\AppData\Local\Temp\is-9RANI6N4F4.tmp\3a0ee05966e9cf4bf33ed736a8e519ee121a2d79b493f5206c9023804ef840f4.tmp
            "C:\Users\Admin\AppData\Local\Temp\is-9RANI6N4F4.tmp\3a0ee05966e9cf4bf33ed736a8e519ee121a2d79b493f5206c9023804ef840f4.tmp" /SL5="$602EA,3619901,893952,C:\Users\Admin\AppData\Local\Temp\3a0ee05966e9cf4bf33ed736a8e519ee121a2d79b493f5206c9023804ef840f4.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:2812
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c tasklist /FI "IMAGENAME eq HipsTray.exe" 2>nul | find /I "HipsTray.exe" >nul
              6⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:448
              • C:\Windows\SysWOW64\tasklist.exe
                tasklist /FI "IMAGENAME eq HipsTray.exe"
                7⤵
                • Discovers running processes
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:2228
              • C:\Windows\SysWOW64\find.exe
                find /I "HipsTray.exe"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:1632
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c tasklist /FI "IMAGENAME eq HipsDaemon.exe" 2>nul | find /I "HipsDaemon.exe" >nul
              6⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4356
              • C:\Windows\SysWOW64\tasklist.exe
                tasklist /FI "IMAGENAME eq HipsDaemon.exe"
                7⤵
                • Discovers running processes
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:2104
              • C:\Windows\SysWOW64\find.exe
                find /I "HipsDaemon.exe"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:2964
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c tasklist /FI "IMAGENAME eq usysdiag.exe" 2>nul | find /I "usysdiag.exe" >nul
              6⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3244
              • C:\Windows\SysWOW64\tasklist.exe
                tasklist /FI "IMAGENAME eq usysdiag.exe"
                7⤵
                • Discovers running processes
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:1912
              • C:\Windows\SysWOW64\find.exe
                find /I "usysdiag.exe"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:3128
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Support1619701811 /f 2>nul
              6⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1200
              • C:\Windows\SysWOW64\reg.exe
                reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Support1619701811 /f
                7⤵
                • System Location Discovery: System Language Discovery
                • Modifies registry key
                PID:2036
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Where-Object { ($_.Name -eq 'SSOShareInfoHelper64.exe' -or $_.Name -eq 'FFWallpaper.exe') -and $_.ExecutablePath -and ($_.ExecutablePath -like ('*\\'+'1619701811'+'\\*')) } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }"
              6⤵
              • Hide Artifacts: Ignore Process Interrupts
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4692
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Where-Object { ($_.Name -eq 'SSOShareInfoHelper64.exe' -or $_.Name -eq 'FFWallpaper.exe') -and $_.ExecutablePath -and ($_.ExecutablePath -like ('*\\'+'1619701811'+'\\*')) } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }"
                7⤵
                • Hide Artifacts: Ignore Process Interrupts
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4700
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c rmdir /s /q "C:\Users\Public\Documents\1619701811" 2>nul & rmdir /s /q "C:\Users\Admin\AppData\Roaming\instagram\1619701811" 2>nul & rmdir /s /q "C:\Users\Admin\Documents\1619701811" 2>nul
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4988
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c rmdir /s /q "C:\Users\Admin\AppData\Roaming\instagram\FFWallpaper" 2>nul
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4136
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c del /f /q "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\1619701811.lnk" 2>nul & rmdir /s /q "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\1619701811" 2>nul
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2912
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Support1619701811 /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\instagram\1619701811\SSOShareInfoHelper64.exe" /f
              6⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:664
              • C:\Windows\SysWOW64\reg.exe
                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Support1619701811 /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\instagram\1619701811\SSOShareInfoHelper64.exe" /f
                7⤵
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                • Modifies registry key
                PID:5056
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c if exist "C:\Users\Admin\AppData\Roaming\instagram\1619701811" attrib +h +s /s /d "C:\Users\Admin\AppData\Roaming\instagram\1619701811\*" & if exist "C:\Users\Admin\AppData\Roaming\instagram\1619701811" attrib +h +s "C:\Users\Admin\AppData\Roaming\instagram\1619701811"
              6⤵
              • Hide Artifacts: Hidden Files and Directories
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2420
              • C:\Windows\SysWOW64\attrib.exe
                attrib +h +s /s /d "C:\Users\Admin\AppData\Roaming\instagram\1619701811\*"
                7⤵
                • System Location Discovery: System Language Discovery
                • Views/modifies file attributes
                PID:4760
              • C:\Windows\SysWOW64\attrib.exe
                attrib +h +s "C:\Users\Admin\AppData\Roaming\instagram\1619701811"
                7⤵
                • System Location Discovery: System Language Discovery
                • Views/modifies file attributes
                PID:1616
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c if exist "C:\Users\Admin\AppData\Roaming\instagram\1619701811" attrib +h +s /s /d "C:\Users\Admin\AppData\Roaming\instagram\1619701811\*" & if exist "C:\Users\Admin\AppData\Roaming\instagram\1619701811" attrib +h +s "C:\Users\Admin\AppData\Roaming\instagram\1619701811"
              6⤵
              • Hide Artifacts: Hidden Files and Directories
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2132
              • C:\Windows\SysWOW64\attrib.exe
                attrib +h +s /s /d "C:\Users\Admin\AppData\Roaming\instagram\1619701811\*"
                7⤵
                • System Location Discovery: System Language Discovery
                • Views/modifies file attributes
                PID:2464
              • C:\Windows\SysWOW64\attrib.exe
                attrib +h +s "C:\Users\Admin\AppData\Roaming\instagram\1619701811"
                7⤵
                • System Location Discovery: System Language Discovery
                • Views/modifies file attributes
                PID:2412
            • C:\Users\Admin\AppData\Roaming\instagram\1619701811\SSOShareInfoHelper64.exe
              "C:\Users\Admin\AppData\Roaming\instagram\1619701811\SSOShareInfoHelper64.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1688
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c attrib +h +s /s /d "C:\Users\Admin\AppData\Roaming\instagram\1619701811\*" & attrib +h +s "C:\Users\Admin\AppData\Roaming\instagram\1619701811"
              6⤵
              • Hide Artifacts: Hidden Files and Directories
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4124
              • C:\Windows\SysWOW64\attrib.exe
                attrib +h +s /s /d "C:\Users\Admin\AppData\Roaming\instagram\1619701811\*"
                7⤵
                • System Location Discovery: System Language Discovery
                • Views/modifies file attributes
                PID:1904
              • C:\Windows\SysWOW64\attrib.exe
                attrib +h +s "C:\Users\Admin\AppData\Roaming\instagram\1619701811"
                7⤵
                • System Location Discovery: System Language Discovery
                • Views/modifies file attributes
                PID:2452
  • C:\Users\Admin\AppData\Roaming\instagram\1619701811\SSOShareInfoHelper64.exe
    C:\Users\Admin\AppData\Roaming\instagram\1619701811\SSOShareInfoHelper64.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2360

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        1
        T1059

        Windows Command Shell

        1
        T1059.003

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Defense Evasion

        Hide Artifacts

        3
        T1564

        Hidden Files and Directories

        2
        T1564.001

        Ignore Process Interrupts

        1
        T1564.011

        Indicator Removal

        1
        T1070

        File Deletion

        1
        T1070.004

        Modify Registry

        2
        T1112

        Credential Access

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Process Discovery

        1
        T1057

        Query Registry

        1
        T1012

        Remote System Discovery

        1
        T1018

        System Information Discovery

        1
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        System Network Configuration Discovery

        2
        T1016

        Internet Connection Discovery

        2
        T1016.001

        Lateral Movement

        Collection

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        __PSScriptPolicyTest_1k3yxrci.h2f.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1k3yxrci.h2f.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        3a0ee05966e9cf4bf33ed736a8e519ee121a2d79b493f5206c9023804ef840f4.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-J3GVHGSL4P.tmp\3a0ee05966e9cf4bf33ed736a8e519ee121a2d79b493f5206c9023804ef840f4.tmp
        • Size 4.2MB
        • SHA256 c8ec00de19f3da2336dcf243d035c95028505581fca1248bd103840581065554
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SSOShareInfoHelper64.exe
        • Path C:\Users\Admin\AppData\Roaming\instagram\1619701811\SSOShareInfoHelper64.exe
        • Size 108KB
        • SHA256 0e332276b00e7f6cc355fd439259a9a542b6e7de87f5c7c81421221291bbb6a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SSOShareInfoHelper64_core.exe
        • Path C:\Users\Admin\AppData\Roaming\instagram\1619701811\SSOShareInfoHelper64_core.exe
        • Size 248KB
        • SHA256 dacb35b5ecd26cba9d604d1df3e14fea8d62725abeb94fa4d88a1ac25f49703f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        config.ini
        • Path C:\Users\Admin\AppData\Roaming\instagram\1619701811\config.ini
        • Size 194B
        • SHA256 27fe8364fbfed213cdfbc75148067325daf888f8bc995c9c0139689735cff44f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        CommonUI
        • Path C:\Users\Admin\AppData\Roaming\instagram\1619701811\res\theme\CommonUI
        • Size 126KB
        • SHA256 549d63416d95cbcaab3d0e0cd00992702903028192a0d30fb26801d41b9d3d3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        azure.she
        • Path C:\Users\Admin\AppData\Roaming\instagram\1619701811\res\theme\azure.she
        • Size 64KB
        • SHA256 75e1dcaeb244aa6f389761c259e1f6b09a505a5d69aeb28ef8f07f759b6e9533
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        blue.she
        • Path C:\Users\Admin\AppData\Roaming\instagram\1619701811\res\theme\blue.she
        • Size 226KB
        • SHA256 1ac1497978112418ab4a26ebf6ea50839f2b9b35ba039b679704f69f78c0b021
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        green.she
        • Path C:\Users\Admin\AppData\Roaming\instagram\1619701811\res\theme\green.she
        • Size 2KB
        • SHA256 717f8cd2811e2424b71c447de18824959b86ea3d00054f275dd6575804eb8a73
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        host.dll
        • Path C:\Users\Admin\AppData\Roaming\instagram\1619701811\res\theme\host.dll
        • Size 4.0MB
        • SHA256 7547004468370336c47516493bc895841deda4a35b7f57ad7e118be4ad8875ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        purple.she
        • Path C:\Users\Admin\AppData\Roaming\instagram\1619701811\res\theme\purple.she
        • Size 548B
        • SHA256 c283658571dc0f38b4a85176687d13cda962a3f4345fccd74360b0729891bcc4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        startup.log
        • Path C:\Users\Admin\AppData\Roaming\instagram\1619701811\startup.log
        • Size 1KB
        • SHA256 9481dd976f95b2ee381c566bf4e38bd48dbbf3fc0995f94e60a0e41e1fabf92e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        startup.log
        • Path C:\Users\Admin\AppData\Roaming\instagram\1619701811\startup.log
        • Size 1KB
        • SHA256 b77122eec49286357f581f6032b5cf3953046a7097b1f594f8202ece9754401a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        startup.log
        • Path C:\Users\Admin\AppData\Roaming\instagram\1619701811\startup.log
        • Size 170B
        • SHA256 4a202f6fa58335081e8eb0e065c4c847e15ed3037493396deefd2edb20476226
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/640-1-0x0000000000C10000-0x0000000000CF9000-memory.dmp
        Download

        memory/640-8-0x0000000000C10000-0x0000000000CF9000-memory.dmp
        Download

        memory/1700-7-0x00000000008C0000-0x0000000000D0B000-memory.dmp
        Download

        memory/1700-5-0x0000000001310000-0x0000000001311000-memory.dmp
        Download

        memory/2360-79-0x0000000010000000-0x0000000010028000-memory.dmp
        Download

        memory/2360-143-0x00000000755E0000-0x00000000759ED000-memory.dmp
        Download

        memory/2360-140-0x00000000755E0000-0x00000000759ED000-memory.dmp
        Download

        memory/2812-133-0x0000000000B20000-0x0000000000F6B000-memory.dmp
        Download

        memory/3284-134-0x0000000000C10000-0x0000000000CF9000-memory.dmp
        Download

        memory/3284-9-0x0000000000C10000-0x0000000000CF9000-memory.dmp
        Download

        memory/4700-19-0x0000000005900000-0x0000000005966000-memory.dmp
        Download

        memory/4700-46-0x00000000708A0000-0x0000000070BF4000-memory.dmp
        Download

        memory/4700-45-0x0000000007490000-0x00000000074B4000-memory.dmp
        Download

        memory/4700-44-0x0000000007460000-0x000000000748A000-memory.dmp
        Download

        memory/4700-43-0x00000000072E0000-0x00000000072EA000-memory.dmp
        Download

        memory/4700-41-0x00000000078B0000-0x0000000007F2A000-memory.dmp
        Download

        memory/4700-42-0x0000000007270000-0x000000000728A000-memory.dmp
        Download

        memory/4700-40-0x0000000006F30000-0x0000000006FD3000-memory.dmp
        Download

        memory/4700-39-0x0000000006F10000-0x0000000006F2E000-memory.dmp
        Download

        memory/4700-30-0x0000000006510000-0x0000000006542000-memory.dmp
        Download

        memory/4700-31-0x0000000070700000-0x000000007074C000-memory.dmp
        Download

        memory/4700-29-0x0000000005F70000-0x0000000005FBC000-memory.dmp
        Download

        memory/4700-28-0x0000000005F40000-0x0000000005F5E000-memory.dmp
        Download

        memory/4700-27-0x0000000005970000-0x0000000005CC4000-memory.dmp
        Download

        memory/4700-18-0x0000000005890000-0x00000000058F6000-memory.dmp
        Download

        memory/4700-17-0x0000000005090000-0x00000000050B2000-memory.dmp
        Download

        memory/4700-16-0x0000000005260000-0x0000000005888000-memory.dmp
        Download

        memory/4700-15-0x00000000029A0000-0x00000000029D6000-memory.dmp
        Download