Overview

overview

10

Static

static

3

2026-08-17...ee.exe

windows10-2004-x64

10

2026-08-17...ee.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    146s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    17/08/2026, 01:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-17_eb74aaa3599db56e58b196094030c46a_amadey_elex_floxif_smoke-loader_stealc_stop_tofsee.exe
  • Size 386KB
  • Sample260817-b5yrssdk2w
  • SHA256 edd6b5de502b89a7145daccba7efe6bf109347c246c8c9d73dfc723fe0a43d70
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarebackdoordefense_evasiondiscoveryexecutionfloxifpersistenceransomwarespywaretrojanupx

Malware Config

Signatures

  • Family: Floxif, Floodfix

    Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    backdoortrojanfloxif
  • Detects Floxif payload 1 IoCs
    backdoor
  • UPX dump on OEP (original entry point) 3 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 3 IoCs
  • Drops desktop.ini file(s) 64 IoCs
  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 58 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 9 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Runs ping.exe 1 TTPs 9 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 51 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 59 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 2 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-17_eb74aaa3599db56e58b196094030c46a_amadey_elex_floxif_smoke-loader_stealc_stop_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-17_eb74aaa3599db56e58b196094030c46a_amadey_elex_floxif_smoke-loader_stealc_stop_tofsee.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2332
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Jump.cmd" "
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5988
      • C:\Windows\SysWOW64\mode.com
        mode con cols=60 lines=5
        3⤵
        • System Location Discovery: System Language Discovery
        PID:716
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /K Restore.cmd
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:952
        • C:\Windows\SysWOW64\reg.exe
          Reg.exe query "HKU\S-1-5-19\Environment"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3456
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu" /v "{59031a47-3f72-44a7-89c5-5595fe6b30ee}" /t REG_DWORD /d "0" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5868
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel" /v "{59031a47-3f72-44a7-89c5-5595fe6b30ee}" /t REG_DWORD /d "0" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5528
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu" /v "{20D04FE0-3AEA-1069-A2D8-08002B30309D}" /t REG_DWORD /d "0" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1212
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel" /v "{20D04FE0-3AEA-1069-A2D8-08002B30309D}" /t REG_DWORD /d "0" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5844
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" ver "
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5444
        • C:\Windows\SysWOW64\find.exe
          find " 5."
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3252
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1 -n 2
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:3224
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "Desktop" /d "C:\Users\Admin\Desktop" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4656
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "Favorites" /d "C:\Users\Admin\Favorites" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1880
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "My Music" /d "C:\Users\Admin\Music" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4920
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "My Pictures" /d "C:\Users\Admin\Pictures" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5380
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "My Video" /d "C:\Users\Admin\Videos" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2348
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "Personal" /d "C:\Users\Admin\Documents" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4720
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "{56784854-C6CB-462B-8169-88E350ACB882}" /d "C:\Users\Admin\Contacts" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3584
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "{374DE290-123F-4565-9164-39C4925E467B}" /d "C:\Users\Admin\Downloads" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2944
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "{BFB9D5E0-C6A9-404C-B2B2-AE6DB6AF4968}" /d "C:\Users\Admin\Links" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4304
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}" /d "C:\Users\Admin\Saved Games" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2068
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "{7D1D3A04-DEBB-4115-95CF-2F29DA2920DA}" /d "C:\Users\Admin\Searches" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2556
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v "Desktop" /t REG_EXPAND_SZ /d "C:\Users\Admin\Desktop" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4228
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v "Favorites" /t REG_EXPAND_SZ /d "C:\Users\Admin\Favorites" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5564
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v "My Music" /t REG_EXPAND_SZ /d "C:\Users\Admin\Music" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1352
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v "My Pictures" /t REG_EXPAND_SZ /d "C:\Users\Admin\Pictures" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1516
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v "My Video" /t REG_EXPAND_SZ /d "C:\Users\Admin\Videos" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2192
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v "Personal" /t REG_EXPAND_SZ /d "C:\Users\Admin\Documents" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:6128
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v "{56784854-C6CB-462B-8169-88E350ACB882}" /t REG_EXPAND_SZ /d "C:\Users\Admin\Contacts" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2460
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v "{374DE290-123F-4565-9164-39C4925E467B}" /t REG_EXPAND_SZ /d "C:\Users\Admin\Downloads" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1736
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v "{BFB9D5E0-C6A9-404C-B2B2-AE6DB6AF4968}" /t REG_EXPAND_SZ /d "C:\Users\Admin\Links" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4624
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v "{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}" /t REG_EXPAND_SZ /d "C:\Users\Admin\Saved Games" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5000
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v "{7D1D3A04-DEBB-4115-95CF-2F29DA2920DA}" /t REG_EXPAND_SZ /d "C:\Users\Admin\Searches" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2600
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "CommonVideo" /d "C:\Users\Public\Videos" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3256
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "Common Documents" /d "C:\Users\Public\Documents" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2868
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "CommonPictures" /d "C:\Users\Public\Pictures" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4628
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "Common Desktop" /d "C:\Users\Public\Desktop" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4276
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "CommonMusic" /d "C:\Users\Public\Music" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3552
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v "{3D644C9B-1FB8-4f30-9B45-F670235F79C0}" /t REG_EXPAND_SZ /d "C:\Users\Public\Downloads" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1552
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v "CommonVideo" /t REG_EXPAND_SZ /d "C:\Users\Public\Videos" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1812
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v "Common Documents" /t REG_EXPAND_SZ /d "C:\Users\Public\Documents" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4908
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v "CommonPictures" /t REG_EXPAND_SZ /d "C:\Users\Public\Pictures" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3020
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v "Common Desktop" /t REG_EXPAND_SZ /d "C:\Users\Public\Desktop" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1948
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v "CommonMusic" /t REG_EXPAND_SZ /d "C:\Users\Public\Music" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:936
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1 -n 2
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:4404
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im explorer.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2452
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1 -n 3
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:2564
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1 -n 2
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:4332
        • C:\Windows\explorer.exe
          C:\Windows\explorer.exe
          4⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:1376
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1 -n 3
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:4328
        • C:\Windows\SysWOW64\attrib.exe
          attrib "_My_\desktop.ini" -r -a -s -h
          4⤵
          • Drops desktop.ini file(s)
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:1032
        • C:\Windows\SysWOW64\attrib.exe
          attrib "_My_\ico.ico" -r -a -s -h
          4⤵
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:1004
        • C:\Windows\SysWOW64\Robocopy.exe
          ROBOCOPY "_My_\Public" "C:\Users\Public" /E /SL /COPYALL /MOVE /IS /IT /R:1 /W:2
          4⤵
          • Drops desktop.ini file(s)
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4972
        • C:\Windows\SysWOW64\Robocopy.exe
          ROBOCOPY "_My_" "C:\Users\Admin" /E /SL /COPYALL /MOVE /IS /IT /R:1 /W:2
          4⤵
          • Drops desktop.ini file(s)
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2544
        • C:\Windows\explorer.exe
          C:\Windows\explorer.exe "C:\Users\Admin"
          4⤵
            PID:4208
          • C:\Windows\SysWOW64\PING.EXE
            ping 127.0.0.1 -n 2
            4⤵
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:1440
          • C:\Windows\SysWOW64\PING.EXE
            ping 127.0.0.1 -n 2
            4⤵
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:5528
          • C:\Windows\SysWOW64\PING.EXE
            ping 127.0.0.1 -n 2
            4⤵
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:3872
          • C:\Windows\SysWOW64\PING.EXE
            ping 127.0.0.1 -n 2
            4⤵
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:1516
    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3340
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4688
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Drops desktop.ini file(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:3992
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:4844

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            tiptsf.dll.tmp
            • Path C:\Program Files (x86)\Common Files\Microsoft Shared\ink\tiptsf.dll.tmp
            • Size 579KB
            • SHA256 d4950633c9fbd08b88bc33413b240808f7f2d9f21b46749d9084bfd2b29a9dfc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tiptsf.dll.tmp
            • Path C:\Program Files (x86)\Common Files\Microsoft Shared\ink\tiptsf.dll.tmp
            • Size 579KB
            • SHA256 f9513261e83f26e2804546449b818a5601b312759a62da2ff8fe5eccc191a869
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            symsrv.dll
            • Path C:\Program Files\Common Files\System\symsrv.dll
            • Size 67KB
            • SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            prep_Activatable Class_Hermes_perf.cache
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
            • Size 595B
            • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Jump.cmd
            • Path C:\Users\Admin\AppData\Local\Temp\Jump.cmd
            • Size 145B
            • SHA256 efe7f7a86f8c5d6e0111af96d34e14d2bdf550d94c80b8846985964551bdc6b3
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Restore.cmd
            • Path C:\Users\Admin\AppData\Local\Temp\Restore.cmd
            • Size 45KB
            • SHA256 729dc19df11c47fc7842f69f51c4f6ee46d83859d098ab5d56aa2727c778d324
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            %APPDA~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\%APPDA~1.LNK
            • Size 1KB
            • SHA256 74a2f514102e8897379ff1b9e6fad621619513cf25df75aa8b8560cf217c47b3
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            %APPDA~2.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\%APPDA~2.LNK
            • Size 2KB
            • SHA256 bd82e268db6fe6982e6c04b52d7754e27af6892144042710c0333b3d5ea74c1c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            %PROGR~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\%PROGR~1.LNK
            • Size 1KB
            • SHA256 7e69c28838c2df0f3d925c2bc6a8305f807ab936d126d2ddf14ee1622c9081d9
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            %Public%.lnk
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\%Public%.lnk
            • Size 1KB
            • SHA256 5fd6c1e6d7e7eec1a5481d31e7699602e9e05b062134d3adfacb6d9a56da793e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            %SYSTE~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\%SYSTE~1.LNK
            • Size 1KB
            • SHA256 f456ff400c5c90336fef8fb996767125b36dbc0e2b56506ddd413d944cc75778
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            %Temp%.lnk
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\%Temp%.lnk
            • Size 1KB
            • SHA256 8a23ba8ad5b844ecbf6eee81d365d4e8e906a7c7ee6eda25ba7592eca6c577f3
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            %USERP~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\%USERP~1.LNK
            • Size 1KB
            • SHA256 08f40692cf8d56d8d8cf6c8cad1a5036c96dfd96eed5198f5b6a403e4a45031b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            %WinDir%.lnk
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\%WinDir%.lnk
            • Size 1KB
            • SHA256 c5c7625b07d55678b225e35ed67fbc81fe2fda0c163c9dd22039ff6067da0106
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            (GODMO~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\(GODMO~1.LNK
            • Size 1KB
            • SHA256 ebeb7ba783247ae1c6e026731e4f5406d99d50de652835f0715e94831b5c2b2e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            APPWIZ~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\APPWIZ~1.LNK
            • Size 1KB
            • SHA256 ee3f567206e77c2f727815a300fdae5e0c0eccd24d0037ea893f7bd0c8b3b028
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            CALCUL~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\CALCUL~1.LNK
            • Size 1KB
            • SHA256 3150ef02597afc8f33b2e605ac9d7b55de62c94a81039c23776104c26678d2dc
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            CHARAC~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\CHARAC~1.LNK
            • Size 1KB
            • SHA256 2bb9a296624e6601587b33594eaed9704d494bf32c87b8aceefe7d81ffcea86d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            CHKDSK~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\CHKDSK~1.LNK
            • Size 1KB
            • SHA256 a03a61316697b6c05c9c5cf0b8b1bc31dbcd18333d5eec648ef2fe82bd89973d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            CMD~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\CMD~1.LNK
            • Size 1KB
            • SHA256 f7577bfbbfb117d5c7cb44449584f0d9d01cb9654c13006e324bb26e79c54e8a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            COLORM~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\COLORM~1.LNK
            • Size 1KB
            • SHA256 c123a61017adcbe197acfcc176bab0d520acc2c5882783fd3ff6689e9023df7e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            COMPON~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\COMPON~1.LNK
            • Size 1KB
            • SHA256 785075112738a694356ee253181aab623a9e4a8eb33c7cd8a3e9ddc5d2e85a54
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            COMPUT~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\COMPUT~1.LNK
            • Size 1KB
            • SHA256 829609ac18c87b50a9c34f53dc134074fd9e70fa12d378f9359e296c7a935551
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            CONTRO~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\CONTRO~1.LNK
            • Size 1KB
            • SHA256 b11da95a7c14be6c534d5c6ae4f1d9a213ab59432b695fac3c78527c265da78b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            CONTRO~2.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\CONTRO~2.LNK
            • Size 2KB
            • SHA256 8ca7ae76496bdb149edea21757ba9211a6425871f833eb36ae161d5a1d738b97
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            DEFAUL~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\DEFAUL~1.LNK
            • Size 2KB
            • SHA256 a53d152336ec10d2280eddcb611d82ff7ae96e062b663268413c6f0c1222507e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            DEFAUL~2.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\DEFAUL~2.LNK
            • Size 1KB
            • SHA256 f0d30f1fbdb3f6e3f37db491adec0c48435ef8c5ecf82a594de9af7238f50f16
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            DEVMGM~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\DEVMGM~1.LNK
            • Size 878B
            • SHA256 1c4cb7bcccaa378176a99f7b65d1df7d6d91e787dfaf3ef8c2140622b2e17b8d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            DFRGUI~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\DFRGUI~1.LNK
            • Size 1KB
            • SHA256 da4598c4c25b914e5f17432c0fe17a00ed74b55d66cfd48289edb2a85c935853
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            DISKCL~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\DISKCL~1.LNK
            • Size 1KB
            • SHA256 b1085da2d41e01be689d6b1b22d0e89d80bb045d76b53969d5d8ae89de38ef92
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            DISKMG~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\DISKMG~1.LNK
            • Size 885B
            • SHA256 498fcfa3ead87889041d9636dd96a19cfc161a0a6d50720f662b487b8dece8cd
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            EVENTV~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\EVENTV~1.LNK
            • Size 1KB
            • SHA256 f0c114ffd691908868060e5ce700d67c86ab721b70599272cc12c06711f5f6b9
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            FIREWA~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\FIREWA~1.LNK
            • Size 833B
            • SHA256 c27f78609d34600076adbd6fe5d57eb7b450fc5de695e71586031eeba75b0465
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            FOLDER~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\FOLDER~1.LNK
            • Size 1KB
            • SHA256 ff06fa7f9a0fe2e1a329e29a4d0aa6750341b8e59ee8c01d592ae134c7b21bfc
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            FONTS~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\FONTS~1.LNK
            • Size 966B
            • SHA256 ba19571ca112d4a6aaed10ff7f4e3fd4c90a5b41aa73849230647b14ab06929a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            FSMGMT~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\FSMGMT~1.LNK
            • Size 873B
            • SHA256 e7ec8e0f0e00bf4247e93e8f1d770ff4c75c348f6c97935b9f1a9c70dd665bcb
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            GPEDIT~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\GPEDIT~1.LNK
            • Size 873B
            • SHA256 9d83ddacb22c72c3cf2bb57a28330d71d7e8046ce27c990f1c9ad4fe83236ccc
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            HDWWIZ~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\HDWWIZ~1.LNK
            • Size 867B
            • SHA256 293004e1078d4a7b13b058cdd9b254c4945f29a5beae0c328651c7eb5c64a661
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            INETCP~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\INETCP~1.LNK
            • Size 1KB
            • SHA256 248469b867640550586acb2558d806998c0fef2d047a5446bba13e4c79fd1b9e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            INTLCP~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\INTLCP~1.LNK
            • Size 1KB
            • SHA256 4d1915ccf4ed6e41ea43fdd4485bbf085d72553446a8772f8da00ddb10ef88d9
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ISCSII~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\ISCSII~1.LNK
            • Size 1KB
            • SHA256 53e4cb9946fa4618b3dd8ffc913f88ce1d75cbfddf0ec9b653f38008120364cd
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            LUSRMG~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\LUSRMG~1.LNK
            • Size 878B
            • SHA256 4e5a2a0bf425043f6d2c93d2be491d586011f2977e377730ea6ed30f1538555b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            MAGNIF~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\MAGNIF~1.LNK
            • Size 1KB
            • SHA256 28e66bf0d21fce9b1b78bfe8aba00bcb47e2fb8a9ef903130ab914f971be98a8
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            MATHIN~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\MATHIN~1.LNK
            • Size 1KB
            • SHA256 ab3288b57cec628a04a718f6ae19db77af70d68aa649687afa3cfa241df98ddb
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            MEMORY~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\MEMORY~1.LNK
            • Size 1KB
            • SHA256 23ff6a2477aa3a787d59b99d698e01855d3349d43b6918460f286a4560e48e49
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            MOBILI~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\MOBILI~1.LNK
            • Size 2KB
            • SHA256 13718d3c7dccd2e90eedd5d4f16d2bbdf3abb6f8786555ad14a3c44788017a05
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            MOUSE~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\MOUSE~1.LNK
            • Size 146B
            • SHA256 b4b171104d77c3fdb4af62771667d7ae01853666805c4c8dd370cfac1494bf88
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            MSCONF~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\MSCONF~1.LNK
            • Size 1KB
            • SHA256 56829d8ad8d64ee2b3057a4a39ab437ba2cec59a0ed31e7b274a4a0d607507a8
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            NCPACP~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\NCPACP~1.LNK
            • Size 1KB
            • SHA256 87e306565604688efe54fbc97dae8e9d61de0010552bdb0cbc133237ddc353ae
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            NETPLW~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\NETPLW~1.LNK
            • Size 1KB
            • SHA256 fc0284060a559b846b9fe82f68aa9627cc0e005e6321e0b86516a0551dbe5ed4
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ODBCDA~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\ODBCDA~1.LNK
            • Size 1KB
            • SHA256 66d52fd163003ee986d9f9ad824748a898808b217857af7f66eaf526e3cd5032
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OSKEXE~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\OSKEXE~1.LNK
            • Size 1KB
            • SHA256 077f8cbccb73115997bce1019f129fe9f91ac45c1b3a6be93f5ea94270a12269
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            PAINT~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\PAINT~1.LNK
            • Size 1KB
            • SHA256 8ff7c45e0d42dabb5510f9e0fdfe30144896e392320c126f7988c495dca7a6a0
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            PERFOR~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\PERFOR~1.LNK
            • Size 1KB
            • SHA256 cfa6582608508ad4a6ae9aa629b4fa4732c6cd4734b801af278bb68f61e2e236
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            POWERC~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\POWERC~1.LNK
            • Size 1KB
            • SHA256 f3b8282e7248bf51b07cff5724dd73e35a9c3f00d5be075ad412a2949c22c2ae
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            POWERC~2.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\POWERC~2.LNK
            • Size 1KB
            • SHA256 ad6a8b2c15965ce56af85e51856f269f9d6a5f608b24933a202a0acb3c2ddead
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            PRINTM~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\PRINTM~1.LNK
            • Size 1KB
            • SHA256 f1275256ed14a3d2a6b57b970b2f807a3c2d482fc2bd58d1a1546306bd5f87fc
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            RECOVE~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\RECOVE~1.LNK
            • Size 1KB
            • SHA256 fb634f96889b4f366dcbe8fc22040957b0bc70b239839f9eafc6d96eb10b32e3
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            REGEDI~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\REGEDI~1.LNK
            • Size 1KB
            • SHA256 1aeca9733f0d9114b9e8d1298fabbabbf8fd8ef23d4d0f7edf100a6374b8b896
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            REMOTE~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\REMOTE~1.LNK
            • Size 1KB
            • SHA256 62753fbdb313102cec15eb7eb1978b0959982756cf64f90074dcb8cf2fedee25
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            RESOUR~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\RESOUR~1.LNK
            • Size 1KB
            • SHA256 837d3f3aefe1d77ea3dedf72c50b031a6638b9b5fdf279eb5fbd6417a4d432ea
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            RUN~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\RUN~1.LNK
            • Size 2KB
            • SHA256 382751693cb4b72acc1dfd33d62989e271497e66ebf08d94e6b4b0f1d0be0362
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            SCHEDT~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\SCHEDT~1.LNK
            • Size 1KB
            • SHA256 53d258c846c36d86ee97e2a45baad09eb8edbd7acfc7967fae90351cf0e7edc0
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            SCREEN~1.LNK
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\SCREEN~1.LNK
            • Size 1KB
            • SHA256 8d19f6941c080d804744c3a5d3faff6c82fc33f6bb9eb470edabf91b045e7e09
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            desktop.ini
            • Path C:\Users\Admin\AppData\Local\Temp\_My_\Links\__Windows\desktop.ini
            • Size 70B
            • SHA256 460d7804888395a5ae1ecd07998d0319452b85a3570a2d92b33e1647d3c188d9
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/2332-283-0x0000000010000000-0x0000000010030000-memory.dmp
            Download

            memory/2332-4-0x0000000010000000-0x0000000010030000-memory.dmp
            Download

            memory/3340-292-0x000002BC81900000-0x000002BC81920000-memory.dmp
            Download

            memory/3340-285-0x000002BC801E0000-0x000002BC802E0000-memory.dmp
            Download

            memory/3340-293-0x000002BC81D40000-0x000002BC81E40000-memory.dmp
            Download

            memory/3340-307-0x000002BC941B0000-0x000002BC941D0000-memory.dmp
            Download

            memory/3340-298-0x000002BC81C40000-0x000002BC81C60000-memory.dmp
            Download