stihat | 34eb4717fc00536470770667b6b8523937cd2bde892cc04b89e0e8620cb26e8d

Analysis

max time kernel
149s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 00:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_dce9041288e262b14f507d44838b36f5_amadey_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe
Size 2.9MB
Sample260822-bbxyeazejg
SHA256 34eb4717fc00536470770667b6b8523937cd2bde892cc04b89e0e8620cb26e8d
MD5 dce9041288e262b14f507d44838b36f5
SHA1 d71cb805f044319043bb46d0f5af6d29ec8961ef
SHA512 d9d6f527e80f698414633a8993116236bcd981e73819cad922b9c645b1ef2de0aebfa411d9b7c5dcf5f3f342bb46f917f46510cc31964adcdd6f2cdde57bf4d5
SSDEEP 49152:3Es1SVYt7MMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMVMMMYJJ:3E297MMHMMMvMMZMMMlmMMMiMMMYJMM1
TLSH
T1D9E50603E7818DE5E3A90931CE158154972AF91D5BFB5632349822CCEE77383BF61A39
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery stihat persistence privilege_escalation spyware worm

Malware Config

Signatures

Family: Stihat
Stihat is a worm written in Delphi.
worm stihat

Detects Stihat payload 5 IoCs

resource	yara_rule
behavioral2/files/0x000600000001b714-6.dat	family_stihat
behavioral2/files/0x001000000001c3f1-11.dat	family_stihat
behavioral2/files/0x000d00000001c40a-36.dat	family_stihat
behavioral2/files/0x001000000001c3f1-48.dat	family_stihat
behavioral2/files/0x000d00000001c405-52.dat	family_stihat

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	2026-08-21_dce9041288e262b14f507d44838b36f5_amadey_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe

Detects executables packed with ASPack 15 IoCs

resource	yara_rule
behavioral2/memory/3440-0-0x0000000000400000-0x0000000000634000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000600000001b714-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5840-7-0x0000000000400000-0x0000000000634000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x001000000001c3f1-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5840-9-0x0000000000400000-0x0000000000634000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c40a-36.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x001000000001c3f1-48.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4548-51-0x0000000000400000-0x0000000000634000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4548-54-0x0000000000400000-0x0000000000634000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c405-52.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3440-47-0x0000000000400000-0x0000000000634000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5840-57-0x0000000000400000-0x0000000000634000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5840-58-0x0000000000400000-0x0000000000634000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4548-69-0x0000000000400000-0x0000000000634000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4548-73-0x0000000000400000-0x0000000000634000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	2026-08-21_dce9041288e262b14f507d44838b36f5_amadey_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	2026-08-21_dce9041288e262b14f507d44838b36f5_amadey_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe

Executes dropped EXE 2 IoCs

pid	Process
5840	HelpMe.exe
4548	HelpMe.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	explorer.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	2026-08-21_dce9041288e262b14f507d44838b36f5_amadey_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\A:	2026-08-21_dce9041288e262b14f507d44838b36f5_amadey_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\H:	2026-08-21_dce9041288e262b14f507d44838b36f5_amadey_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe
File opened (read-only)	\??\L:	2026-08-21_dce9041288e262b14f507d44838b36f5_amadey_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe
File opened (read-only)	\??\W:	2026-08-21_dce9041288e262b14f507d44838b36f5_amadey_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\G:	2026-08-21_dce9041288e262b14f507d44838b36f5_amadey_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe
File opened (read-only)	\??\V:	2026-08-21_dce9041288e262b14f507d44838b36f5_amadey_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe
File opened (read-only)	\??\D:	HelpMe.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\I:	2026-08-21_dce9041288e262b14f507d44838b36f5_amadey_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe
File opened (read-only)	\??\K:	2026-08-21_dce9041288e262b14f507d44838b36f5_amadey_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe
File opened (read-only)	\??\M:	2026-08-21_dce9041288e262b14f507d44838b36f5_amadey_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe
File opened (read-only)	\??\Z:	2026-08-21_dce9041288e262b14f507d44838b36f5_amadey_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\D:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\O:	2026-08-21_dce9041288e262b14f507d44838b36f5_amadey_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe
File opened (read-only)	\??\Q:	2026-08-21_dce9041288e262b14f507d44838b36f5_amadey_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe
File opened (read-only)	\??\S:	2026-08-21_dce9041288e262b14f507d44838b36f5_amadey_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\D:	2026-08-21_dce9041288e262b14f507d44838b36f5_amadey_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\J:	2026-08-21_dce9041288e262b14f507d44838b36f5_amadey_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe
File opened (read-only)	\??\N:	2026-08-21_dce9041288e262b14f507d44838b36f5_amadey_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\P:	2026-08-21_dce9041288e262b14f507d44838b36f5_amadey_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe
File opened (read-only)	\??\T:	2026-08-21_dce9041288e262b14f507d44838b36f5_amadey_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\B:	2026-08-21_dce9041288e262b14f507d44838b36f5_amadey_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\AUTORUN.INF	2026-08-21_dce9041288e262b14f507d44838b36f5_amadey_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe
File opened for modification	F:\AUTORUN.INF	2026-08-21_dce9041288e262b14f507d44838b36f5_amadey_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe
File opened for modification	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe
File created	C:\Windows\SysWOW64\notepad.exe.exe	HelpMe.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe
File opened for modification	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe
File opened for modification	C:\Windows\SysWOW64\notepad.exe.exe	HelpMe.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	2026-08-21_dce9041288e262b14f507d44838b36f5_amadey_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Internet Explorer\iexplore.exe.exe	HelpMe.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe.exe	HelpMe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpMe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpMe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_dce9041288e262b14f507d44838b36f5_amadey_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\NotificationData	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f481cffcda87848be43b5fdf8091c1c60d0260001002600efbe1100000064ff3facad0fdd019b9d7a55bc0fdd019b9d7a55bc0fdd0114000000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3668	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5840	HelpMe.exe
5840	HelpMe.exe
4548	HelpMe.exe
4548	HelpMe.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3668	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3668	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3668	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 5840	3440	2026-08-21_dce9041288e262b14f507d44838b36f5_amadey_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-21_dce9041288e262b14f507d44838b36f5_amadey_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_dce9041288e262b14f507d44838b36f5_amadey_darkgate_elex_gcleaner_glassworm_icedid_njrat.exe"
1⤵
- Modifies WinLogon for persistence
- Creates a file in the Startup directory
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Windows\SysWOW64\HelpMe.exe
  C:\Windows\system32\HelpMe.exe
  2⤵
  - Modifies WinLogon for persistence
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5840

C:\Windows\SysWOW64\HelpMe.exe
C:\Windows\SysWOW64\HelpMe.exe
1⤵
- Modifies WinLogon for persistence
- Creates a file in the Startup directory
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4548

C:\Windows\explorer.exe
Explorer.exe HelpMe.exe
1⤵
- Modifies registry class
PID:4808

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3668

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.exe

Path C:\$Recycle.Bin\S-1-5-21-552508041-2681165170-3229858294-1000\desktop.ini.exe
Size 2.9MB
SHA256 af80f4c98a018d1eb77e7e21ad73e4bf2a58a298c5151ceca05d2aa68c2348a8
MD5 ecfe6584631935cde28c689c2958bdaf
SHA1 acafb7bdc5d7b8aa7f1e1c140e03b52c7ff5ca06
SHA512 57f8b92d09f287fd772d236339bae1cea160b21dcef5100de0998045efc7a0cb8c0f81068a13487de88794aa6b49bc70db06c9f447aa0c5dd772e59c70b63b6b
SSDEEP 49152:3Es1SVYt7MMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMVMMMYJy:3E297MMHMMMvMMZMMMlmMMMiMMMYJMMO
TLSH
T16AE50603E7818DE5E3A90931CE158154972AF91D5BFB5632349822CCEE77383BF61A39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iexplore.exe.exe

Path C:\Program Files (x86)\Internet Explorer\iexplore.exe.exe
Size 2.9MB
SHA256 95eb569ee9dafbede5bfc7b139a42de05297fb68b7e1fd687798eb6c58847add
MD5 1ea17ef8721dd1e2d4b217deb298e601
SHA1 c75b127002e4362ec17d169c0013136df9a70aab
SHA512 78dfdf433ac0ad9bc3dbf01965392dadbf3d12745e8e9f929b00f9027e9330c12e3caa9c77d01a4b06d88680b27a8a68a34d5ae926dafb73ad53db3534d4862e
SSDEEP 49152:3Es1SVYwPMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMVMMMYJw:3E2WMMHMMMvMMZMMMlmMMMiMMMYJMMH8
TLSH
T15CE50603E7818DE5E3A90931CE158154972AF91D5BFB5632349822CCEE77383BF61A39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 b52562ead53705188ae1a2b7a1e823b11128ada785df5879f79768670133b4e9
MD5 a0e48c06127469c16e82da80c6b6545c
SHA1 79352b4430d87f1f10e0df4e95359231295c77f7
SHA512 0a474fd5b4bb7cd56a679609d3538eb6607054028fb426516c5967669361016cfb1b0d7cf94143b5aa5fed53a03b9a0ed5a02dda52e8ccdfca296242ddfed82d
TLSH
T1CC31ED1806DB2F1BE1BBD676E6F66623E634B890FA11AE5D0090560E0C26F43AD05B1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 14a6654ca9caac3deb54af660f173d30522404c8eb25e9308a81e4f5d93186cd
MD5 c397173480723fc2dd0320dda3a7d3cf
SHA1 02c03ea19ea5ec0767fda24d18c6efd94f0f9309
SHA512 f4adc47bc2ee0d4cd09d0feb0917dd67ef5a4923d71ad528b793fae9293a38d936f7ae72818ae0886371f46c5a07f9cdf31238091289e1a25becf9c257995ce3
TLSH
T19B11AF0C15E3272AC3B5857BA0AA2B32F3777D02F6E55F9A408A5382BC452019D05FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 c5da6a210e0b83269a064b8d0adf75923b994f8afe7bd9481b4fddaa798acf43
MD5 957457fbf0043d4143b4b6ce21c7d461
SHA1 11fcefaef272bc3e108f390ff154bf9bfd40e58b
SHA512 3f7a27886a13e3b9e6bf21fc7ce0511b74d60e1a8c245c3be613ddf26bf0bcfa7f9fd47400ab0406084bfceb5c60aae5ceeac381bf7dac950f36a07aab6249af
TLSH
T1D731ED1806DB2F1BE1BBD676E6F66623E634B890F611AE5D0190560E0C22F43AD05F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 7600a60b1980799e2c462a83a3d3b5dc72a39084a602fa3bf44c820579aa20f5
MD5 0388cbe944433a7d070abd379cffbdfc
SHA1 a76515a9050c2ba5c73b21b934f31ffbcbf57df2
SHA512 99fd93701a94e13759cdd6afb21ef6ffc1f75163fcddf81af059e9252dba8b9cbd987ad0d3714a5204bd97ef32c1ec022044ee14e21368bb08bc7e790bdcc1e5
TLSH
T1CE11AF0C15E3272AC3B5C57BA0AA2B32F3777D02F6E55FDA409A5282BC452019D05FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 15d037d893adead5bb427952ba29f05fc5ab50d742bee114bc4f1b307284e457
MD5 02c3c496706dea3cb55ca437d0c0af8b
SHA1 3c87ffc44f879b68b3a0a921495eff8afa74c805
SHA512 0d63e2c40a2bbacb51db7b71c0bbbff0bcad864c822b516679b4c1a35963f3b5a33207ad29f47a9ef77df8877d058126698f875c8c67d33c83fe44716ff192d8
TLSH
T1D511AF0C15E32B2AC3B5857BA0AB2B32F3777D02F6E55F9A40865382BC452019D05FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 d6a2a15ef130b663c9b99af3101ef2f6ac5c8a03645f131642fb9ceef9a35d17
MD5 5f60d435c97e69877a42806f33afc4b6
SHA1 6234a07f58ff9b33817f149b74235fcfe52901a2
SHA512 57508b30f65d25cb4131ddded89c28e2e1469ae0de29e72a4aa102c04d71336f5bb574f4685f8e619290339ec0c656e6e672f371fdac40b6e955b491ab92133e
TLSH
T1A231ED1806DB2F1BE1BBD676E6F66623E634B894F611AE5D0090560E0C22F43AD05B1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 15c032a52c1a8835687c90fc0ac797bbf6b16a76770e0dc881a08ec05f0a19a1
MD5 e3fc5f396d997f1edd317fb07008496b
SHA1 87675084c7be5b9235bc816cc3b9212bdd6bf602
SHA512 ab9aa0841846811a7d1f686057b56bdb586f720e642db44b6f0842cbaa06dd3ee73e87041365d699482260916a9c5f1d3bc2520c90ff116bcfca10e6f3a38127
TLSH
T13811A30C15D3272AC3B5857B50AA2731F3777D02F6E55F9A40465242BC452019D05FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 ef208c60e02b1e5755efd2f6c9a79159748d8dd76ef0eceb0e41fc20d182160f
MD5 907f2c93c873f1c20d0ecf1b9a5767e6
SHA1 bd9d13075dee055f4dc0508f8603d46ab2bdc327
SHA512 8648090d451597ac402b79aab1079754e84e01bf8c26c18eda879259ed37f522469ac7f6fa5165e27c9b72ff3f0fdd764f956a65a8c6473e043add0610e78dd5
TLSH
T16611A30C15D3272AC3B5857B50AA2731F3777D06F6E55FDA404652417C452019D05FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 225dfa1f7e1a283bf882364d8d2ff415af5ed73c366f95c3de31d78a2c3f5f9f
MD5 62d3ba53926cf508e2c6bc9d022a4f70
SHA1 365b8cc07526eee92751285af225b5e2f034bb1a
SHA512 8edee93bc1421006f3bf46ae13f2797a42353a1d4804d473ec44fd579474e262c7b71ee93f3b27658b2dcb763288ea074e23128e27a93f31c5617d1e38c3cffe
TLSH
T11A11AF0C15E32B2AC3B5857BA4AA2B32F3777D02F6E55F9A40865282BC452019D05FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 ebaa0d6f9f761a50432f0b75ccbcc75e4251be3abd7b83e2e9e83c94132c703e
MD5 1519e2de21306405a048ee1fca14a61f
SHA1 2a2340e69e2398b975503eee46150a3523fa5c61
SHA512 521ab1125e44be559ad9f6eae03c28ba152c878e3ddcd669219fc07a0b6dce0b90063ad2601664dec5f1afc1c59055170f55006afb74f3b4271595dedda65de4
TLSH
T18211CC0C14E2272AC3A1853AA0AA2B32B3377D02F6E55F9A40865282AC042019C04EAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 709497a40f134026beff987e42f602942e046a3ef7fbd0e3eafc027b05b6d356
MD5 bc52de80a119cb5f55c003a79fae3367
SHA1 6eb218cd162e9e3f2096ab8b1f62a52fbc6f21d0
SHA512 47e6379158500991848a64f20081d015f5e7fb8f5aadc2db23a6b4de6ccfbaa57bb8f86ae08e1c0efbd49a62fbafc01fe1868f371f6755f86da7ab5a752fb741
TLSH
T10111AF0C15E3272AD3B5C57BA0AA2B32F3777D02F6E55F9A40865282BC452019D05FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 f88c06b7c99852f6ef7db0a45cb44cd6e1a1a37379202bd62b3ea3fab8dcdda1
MD5 0437ca6269daa4c37b6a5002bf97caf5
SHA1 b9ac3646b14a367ed16c50ce0d6900034391352d
SHA512 a5889240fe83b516a063a1e91802209cddab05e05f629341c1cc2bc988fafcfa540f2962c2c1ff949be7bb2ccce89b351c05e943aca7b012ff06603e14e9ebb5
TLSH
T13D31ED1806DB2F2BE1BBD676E6F66627E634B890F611AE5D0090560E0C22F43AD05B1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 db1979c8ab02c5532e306bf977369d9aced9398c0ac601a5d25586fa2c4b9d11
MD5 40b84946fa22a3cfc9798193a6d62823
SHA1 970b4390b897c3468b014c2bd13e63f38a2c2058
SHA512 e20909326fc8a326c852f5d219076dcdafd93546bca1d532080aa033ab581c6d57d6e849ec8223268b2f99df585e1a1a33c36f61d1c105579b74dea4b8f61440
TLSH
T1B411AF0C15E3272AC3B5857BA0AA2B32F3777D02F6F55FAA40865282BC452019D05FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 73273c9beb7d06300bbf6115e45842bac840310c300d07dfeed822f3eb21bec6
MD5 870ae34bc028ea03f7c443edc377a053
SHA1 66c37cbcfb45c06f71e34b1d0f29277afc2b3b0a
SHA512 833ddc8303b12cc9358ad4ee935c56c261e8b490c29c68f3a01b60162a23b40cdbf327642607ca9537920629a1179b65b3c984e4a640f43fe239844574d2324c
TLSH
T17E11AF0C15E3272AC3B5867BA0AA2B32F3777D02F6F55F9A40865682BC452019D05FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 c74d0e50ced51d595b668404804f0ac1e1593a1fbcea34c416f4800ccd1b1436
MD5 35231e1bf59ec1cea1f07d9d911bf343
SHA1 cc3556f66d8241cf9f3b693b089d9fd363de72ce
SHA512 7c821a1a3b673f30b37da23fb84b6c51a633ce65ccf922e2456ae259eecfbde9ad6f2a5834408bf948371b2738bd4e47a7a32a8e25c06cb8794017f4d5cb119f
TLSH
T1F331ED1807DB2F1BE1BFD676E6F66623E634B994F611AE5D0090560E0C22F43AE05B1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 bb64384bd653cfbfa40631a996e107fee18be1369b955af00b9a48f37521e03b
MD5 0346654cc3ee3d26564e7016376434bc
SHA1 daaeaf86bf70e39d87506c06732323faca85a21d
SHA512 b888359aafa80ec7ae72a7387076d8f0969d5e51bf680a864196fe6014f7eff77e7e50db74b4356dff3d8c8e8e963679ca58f3ceb27b6aebb14be78cbce3fef8
TLSH
T15D11AF0C15E3272AC3B5857BA0AA2B32F3777D02F6E55F9A40965282BC452019D05FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 6c50f741181ddb396ccf3a16ad86ef89b458bc58919b875c8ca72ed57b4dea35
MD5 a4d3530d7183d85b77a45c49d408b60d
SHA1 3eea3c17f4f5b277aba2e0f96ce5898565939b4b
SHA512 67c3ce25a6875be3f84254097af414d3a806bef134ba50d64db0e126a1c468be31de64727107f047b8d7a5ca73f7cb1bc2878b457d51b008c97f1e81138b23d9
TLSH
T15611AF0C15E3272AC3B5857BA0AA2B32F3777D02F6E55F9A40865382BC452019D05FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 45d9e87ed578a19622cbdb426d1c1c913ed760176a7d709d979b56acc5f23f20
MD5 7c432ba6015e6556ea9c3e006869b660
SHA1 0efce5d40a5afbcaa1dac36d4b9ac2bce72c6c7d
SHA512 be4a8abab6c9138aa92f18f6c52d98b315f0e94deba12edc8b09085d15a3bbd3bd136edc213c286cf10d9bc0319eee1f0e0a87c819afa10bad57310971ec4daf
TLSH
T16631E01806DB1F5BE1BBD676E6F66623E634B890F611AE5D0050560E0C22F436D05B1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 c198ff55d34a02dab442a46de081c3a6e7037cca7a29b0a70282530e9abf308b
MD5 eb14566f9b3899902c8a65323c4ac369
SHA1 4057c390f66cbf4b9727365f2fb00a5f13baeea7
SHA512 cd4d2059aa8074d38db4a17b553106ab62015800c98d31328dc16fa824a33a13e89308c316d23415e4cb8903d4e9ca3c93cac91e54c3c46d0547703f3ff53214
TLSH
T1FA11AF0C15E3272AC3B5857BA0AA3B32F3777D02F6E55F9A40865282BC452019D05FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 28ddb0b8e17b5e947527e84884618c029b556db0ace21574e3250f75f543cec3
MD5 824c5d932e4aea5f2661450b31e7f97e
SHA1 3dd3c32346fedc1e548f9923a5f0aa4bee79b7a9
SHA512 4d24261a66ca8c3c4e6f744f989459dc15d4de00f66e8d4c192eee4970fb2011b866b6be0d8f6a67dd468f240e16a6c3f46ef5b0d77c204eac7586beeb0c7a31
TLSH
T1F231ED1806DB2F1BE1BFD676E6F66623E634B890F611AE5D0090560E0C22F43AE05B1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 f75bdc0775dadd3157d22ecf87d3d3fdcda33f505255b9bb5ea6937770575508
MD5 05a535ca15253f4703c5bc7bc68dded4
SHA1 11553c1407bd2a84299b9181c058d348adf9777e
SHA512 7cfa27a5b52154779d281a4c7ad337ab76a4e4f70fb77770f2adab07cf67a13d67eba91822383ea9b5f19fd5641e9a0ff58ac79d058615538e2bf5c6aae6ceb4
TLSH
T14011AF0C15E3272AC3B5C57BA1AA2B32F3777D02F6E55F9A40865382BC452019D05FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 ef5174e1fbd0c73882d1cc234816ddc665d0e1dc003e7f405b9fd911e784cdcc
MD5 193b4de9da25259ae8893a6a37e8ebbd
SHA1 4c7840b4c7082e4ec7b2975552598cd527ce840f
SHA512 51a723a7e999fba4a0b20f5f64d0d7a06bb3504ec272e3cd9ccbdcca5ffe2f12408e2c97b039eb7ea0fe5ef0cdcd58589466316648f62435d40efccefdec915f
TLSH
T1B211AF0C15E3272AC3B5857BA0AA3B32F3777D02F6E55F9A40865282BC452019D05FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 0fc7d6b2a3f8a67c4eda2b281f973c60521439f75583142dc83aeb9cb0f2bab4
MD5 b0322cc7c252ad87093eef920110c19a
SHA1 39a58514404c42d0812f9612f5aa15c799d1872f
SHA512 a35d3eb6fd028ccd50fa17f1a5162231b98eb556d63c257e49daf806284ae4ec88f946df36d67dd025038e8d3dd6a0793edae2baf5b905da348240dbff5db5e4
TLSH
T19D31ED1806DB2F1BF1BFD676E6F66627E634B890F611AE5D0090560E0C22F43BE05B1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 4d71c631d9272b248c9cbb154e75a2fb51b79a8b31f6ca9a439221833ee9a94a
MD5 f7724a3282c8fd5a99952eb5e01aeb3c
SHA1 0ed306c01f3727081778262e9867db58a4002256
SHA512 9e8c3e8d0b8436e2777066de27395f2ac1abe902d93fb4ae9260d5e656c4573add5b8d123a2d2328db54b702751af4b8d98e279d932a42ca29d6aa3af3f4daa1
TLSH
T14611A30C15E3272AC3B5857B50AB2731F3777D02F6E55F9A408656827C452019D05FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 4f3df8607d3079d397825bd1f4eca3fe15de178720e4d58e72c71b162d40cc96
MD5 8e1783c888bb018dfe6711c92e598d46
SHA1 34b9982d85118b8ad85368861bea574d0ce4a475
SHA512 34c360748584e2a6922c433c3529a6712fe168182c5e56b7736245ed05d70e851ac6338a8aae44cc6238812cf8e749bc7d1c59fb526e1de9a8287d3874f1a4a1
TLSH
T12611AF0C15E3272AC3B5857BA0AA2B32F3777D02F6E55F9A40965282BC452019D05FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 14316daffabd38c973178dec55faecd16c6abd44fee0d424b1db0c54ffdb871e
MD5 74319a9f853a8bfef928b5b823f7bbdd
SHA1 25973c38d8e2c1b8bb6c94a562120e767b8ef8b7
SHA512 892c0bd998622ab0480bb5ec540ceea3cb317243844e8e0f10d2fc9849ee962f0863ab4b0f06a8be02d2d15f1a14ede98619a192a7af062152ab0cce6a24eae8
TLSH
T19231ED1806DB2F1BE1BFD676E6F66623E634B890F611AE5D0190560E0C22F43BD05F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 d72046b5a2d5d5fa4c0edc42aaa9a04df7cdfe9ed5fd7b4430f514dac0296da8
MD5 9667c6d101808b3f4eec0a4cbef7b73c
SHA1 df9418916edb42962b39ca7450ef5c69a8868391
SHA512 638ce8cf7b97c36d10308822e98bbce97dd29324b4f23f7a5d1d9056b77b9f416eda0460c0b7f420d441ffdfac72ec837973f9ec5194acc66641f91249d2cf9f
TLSH
T17311AF0C15E3272AC3B5867BA1AB2B32F3777D02F6E55F9A40865282BC452019D05FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 f8fd0b390b09e56229f18e9781c3233755cd58cc40c55546d1167b8c95a7e229
MD5 2939e1539dc3a4e5e0dc5097a0619640
SHA1 aaa0f29c4f681cbdac064e407c6a123291cabc80
SHA512 e7a3bc2183cee219ce7a156a8cc0cbdacb620ca51a91f9eb03a40faee6fb12b0cbe4a0c97fd94d985ae4a356413ac8cbeae0b7336e2ba8e5b436e18c8db291dd
TLSH
T16B31ED1806DB2F1BE1BBD676E6F66623E634B990FA11AE5D0090560E0C26F43AD05B1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 d0db744532c98c0dabce654c17bb38e80727f22efe9f26f23f86e6f7caa47def
MD5 e89fd4d8f61fcc3a2cf017661568f60c
SHA1 de3d3fd009ba0c7cffa2efa6ec449890459dc2b6
SHA512 5a68b0b7e8473eb86ca253f56b2c46ae67ab422b8dd2ff5955065df93f64470e72845692fc1054730d56f5b06e3ec8ac4f2362b909003ce17b66bd1c904352f3
TLSH
T18511A30C15D3272AC3B5857B51AA2731F3777D02F6E55F9A40965241BC452019D05FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 687ff3aa15011801f170bc22adeaab422fd3593c31ce043a899e2d35b25481a1
MD5 2d9cff4ba21185bf71cc0962eabc7f19
SHA1 5ca38f348a97559dcf2d711594a7dab525983266
SHA512 821f0a3b89e87337d656461b68822bbb002a08a90db1e38005f0b6a90f2d73f28bd7e11de4577bdce728feabd132b89aa83683cb321e415844dffaf3282b8cdc
TLSH
T14A11AF0C15E3272AC3B5857BA0AA2B32F3777D02F6E55FDA40965282BC452019D05FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 2fb965dc6989bc011e08d2d10849880ddffb7542956f9873aafa00b57cff80c1
MD5 77190ff981444ae8a735b29a20641e46
SHA1 dcb0eb5000824f6d6d263f584fc8ac117ca3f863
SHA512 0bd3738666f3015fbd560f3b6def59d2d5de8578ac386b9ed75dbc2f47b3155333a99f859f7e0bd36996e0efb1c886e3c0894a334d3f385ff76cc13984868812
TLSH
T1EE31ED1807DB2F2BE1BBD676E6F66627E634B890F611AE5D0090560E0C22F43AD05F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 e7d89b164c7595008361e47d1f969ca44f6546f9aa222bba32bfe92ff6a03529
MD5 a156088cb294170ae600c3500c231b34
SHA1 f1663641f3ded297a3b78025b2690186ee8c587b
SHA512 dc028f8d78870b8561fa0bf5860fa216a162e555fc0e92f6ebb64213d140aa94e9a359eadc5eab9b5663ce4e9b38f1da1ebb1e291546aa9e6f7a4a7e2d9f3439
TLSH
T12E11A30C15D3272AC3B5857B50AA2731F3777D02F6E55F9A404656427C452019D05FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 5701a501dc2b3b0316d1b23ab2d57c3c767f5a68eeeacbae1540e23567699fd7
MD5 e5670fada7265d125316fff1450d141a
SHA1 3378aa0fd0e8efd0dec8d0cffc05bff4a84f6c4e
SHA512 6dae0c6144e1f1c5b80a2381dcf10504438e9cecfb47bf6849e520510178c48bbe9d267c8071c6bd0c4ac1ca520a54eb8caa52411fde940f45e4dc3e19ee76a0
TLSH
T17231CB1806DB2B1BE1BBDA76E5F66623A630B890B650AE5D0090520D0C26B83AD05B1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 07725111de3370179ef87df59ef9d619b96ac6bc3f76022ddf68562628e0ee73
MD5 4b17365f3ec3b8b4c871ef17e90e2b64
SHA1 0507ce91e382d6899e821eaaf3625a1a03d9521b
SHA512 31a3a3267b23d3d3d28c76f400e5e17ceb9d776745732d88d9f1ce936dc258e5bbab1b21154e6e7a8c627b9c3948fe6e305a731787a35abe734a630c1b6d5011
TLSH
T17811A30C15D3272AC3B5857B50AA2B31F3777D02F6F55F9A408652427C452019D05FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 3478f1090e4201d64680e7f8d313bc35bbe66906e6e0c41bf0590e5d10717989
MD5 d2c7e881cc73df26fb671e8d952fb958
SHA1 0713ecc223dd39598124bc6292704b992607e7d1
SHA512 a01bb30a925483a78eb5218762c0049c8634d00df2da5f16f70daa85463f8a853b7f76620ec7a22edeefeef9184f68a40c356e3a57c4ed6f2127ef5f20a195a1
TLSH
T12111AF0C15E3272AC3B5867BA0AA2B32F3777D02F6E55F9A40865282BC452019D05FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 a9caec7a7972e62564f322f08fc6d088d148b549e90f0aef3105da6451501291
MD5 2f74a10bdb75abfa61dbf08df41b40d5
SHA1 d22cf124ef160f7553ad394c00be2571f02723c9
SHA512 e632375ac06ebe0bc49f6c1cb7f2b2744685a29ef19bff9a0cf6403211983ef8afef0451b3a03235d121c44954af09dec60884a1ec8985e16e8dc88074c9ea31
TLSH
T112311D1806DB2F1BE1BFC676E2F62623E630B890F611AE5D0090420E0C22F83AD04B1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 8029c65ee202b60bfc129780c181f45323acc9058278fb899a8550075b5d23ce
MD5 941093b9868d8ffea3d8a78cfcbac5b5
SHA1 fefba0487c6a5cfb952b851ddd66e30394cdab5a
SHA512 1f71085a11d41fcdd2b5b33129af4701f071f49974e5f38bdc1109b915992613b33c40813000c0e03089e2b700b24a303e29e1869b1f899c43e4b62c8546c028
TLSH
T18911EF0C15E3272AC3B1853BA0AA2B32F3377D02F6E55F9A40865282BC05201AC04FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 f1065b0ab3a6cd44f90bdb1b9df3ef7bc6a63049b3561acde2d057731cdba6b6
MD5 ee5a75f074fa085fb79e1a68f8d0f88b
SHA1 2a6117c69a12fec9625ea0111d5452293aba34ba
SHA512 78510beb7ee431b39f517d90d3744c3766751b02a91612b2d3c7fbec31c112d07d1ccbc75c5f2b28615095a546856f56cf169095a50f556dd9c86fbed62828b2
TLSH
T13711A30C15D3272AC3B5857B50AA2732F3777D02F6E55F9A404652417C452019D05FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 f4657bc1d397d0b6baebb0be085a23d6888454b01b26303fcfe6f24a0d33cff2
MD5 11c08ef938d0257b89a0110cb2c94b41
SHA1 c71b67a43f0f57a16b761eb0e3951541e629eb33
SHA512 b53a97c4646df00503508911845603e10de7b3dda85010dbbeabbc64d7a8a368264ed27c47bc09efe8d965c380b61dea206ba01ca37c4353e183d8234a6651d7
TLSH
T17811AF0C15E3272AC3B5857BA1AA2B32F3777D02F6E55F9A40865282BC45201AD05FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 58adb9b2812c2f79ef764bde0db29a85a731de8cf9996c000b40df68c0ac9d88
MD5 124e279b3b42bf667c26d528e5cc4f93
SHA1 a043a5715f3d919135dae53d7fc60fa245ba0586
SHA512 1bd9ca1362b966f8d0e3c15b7bb9ac53f55ddb1d85fb63896f0b02bb8c5890a051700fbd5ddccd769524ec56935e7557e9d7f845c62aa7787ebd05d80d540fde
TLSH
T17131ED1806DB2F1BE1BBD676E6F66623E634B890F651AE5D0090560E0C22F43AD05B1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 253cf62c28764f2130f1818804ffff6b5dfe96aa58a692a64a18b650735f81be
MD5 fe12b184af5942029cf4c7674a528530
SHA1 24299e33c96c4a3644727e39b5a5b84200a38829
SHA512 f603ac33019d1fe91647ec2fe4011a3741a779436abc59d047bb5fcdff90f395942a6d85eb0c47ec6c3e404d1c874d35dfdb4870fb8ef8f7af96e14050b247db
TLSH
T10E11A30C15D3272AC3B5857B60AA2732F3777D02F6E55F9A404652417C452019D05FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 bdf8aa796baee058caa79805ab6043d7905a49d4fa4fb86c48c9080347a61f41
MD5 476922285d386ba435313f171236c182
SHA1 beae292b50da69ab2e94a955bf5014a63690b8ef
SHA512 5df915f63939b9d39ac87ac5082bba28d1fdb3d5cd9f6b77ed21c6ee1058e0900e0783b756c0580d91312aa8b0187a5dd6302ed0983a2a19308cfa2de2e8c59c
TLSH
T10B11AF0C15E3272AC3B5857BA0AA2B32F3777D02F6E55FAA40865282BC452019D05FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 c70c70945a3acef0f316e94803a7d376d498a77504cef1e8aef1582e906349d2
MD5 cda2196fed191933f4adac5ca497e244
SHA1 22b0365f1e57d4de41dbf16a3719632dd9f0be6d
SHA512 2e5a696089bbffb01ee68c7f7b28b5f0f19b47c8541f8b6c41d9f5c43781bb13fb2215f8e28b767a0a76efc8d80d3ba145a18c280fc15b247ee9edfab4dffbf6
TLSH
T176311D1806DB2F1BE1BBD676E2F62623E230B890F610AE5D0090420E0C22F43AD04B1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 54636a324d94338c271b35a44c33aee5b1b60bb9f91e94afd35a9ae83f07b879
MD5 79d23087b64543e83c6e9908741d3016
SHA1 c82cf62c5d0df643c2502f1e6d4d5c6697398dda
SHA512 b7916d5fa1bd494f0c8f0728eaac45807c3de197995de39f96a68dfb68cc9236549b92c78036798c1bb2a4cf7b69de54bd206d948a3583ceb0be17056782c70e
TLSH
T15011AF0C15E3272AC3B5857BA1AA2B32F3777D02F6E55F9A40865282BC452019D05FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 796ac45cfaa84841c66328a49f1758825ffa64ec72c884819ede56434874503d
MD5 2e16c393a73480695264df6bc4518226
SHA1 15f9c9376efd11e7be84b5284dd82bb2eb307af5
SHA512 e3113e0e9cdfab1daff23a65a8a4410b6aeb00e1b345d4b6c001c15a093a91177f64563141364b27fb26e0ee290116e53f8ee79fec5689aec1a7cbee543c7e42
TLSH
T13911AF0C15E3272AC3B5857BA0AA2B32F3777D02F6E55FDA40865682BC452019D05FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 ce7a9df3808aa95e48bff1f7f848e7843619b75a631c367e23631c6d5d8db2c1
MD5 ff417f466136808baac3eb1fbc354bb5
SHA1 e4220a6ceba33cd313f400d94170a08abc65d59f
SHA512 2a3078733aab8a5632cd7a0d04ee38395185491bc2076d86f9143f95147b295aeb447e852e18d10bde4cc8da499ae8b8df6ba13b51071944783ccf9666d6b5e4
TLSH
T1AD31ED1806DB2F1BF1BBD676E6F66623E634B890F611AE5D0090560E0C22F43AD05B1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 c313c1eac5e42861f5afde6294bbfe7ceada855b87212b33afa987eba4e1eb88
MD5 f2e1e0894cef707128eac13173e7fbb6
SHA1 35c15eb4b611eda72523d6ad360946d8d935d24d
SHA512 62a0bedd34b62275499b2e40ff0df92fc65805fcca5507390f5e9c23926e7212d91fc5abafc05d0a88d8a79bb9e510bc1c91057f061038528ecfd537691eb310
TLSH
T16A11AF0C15E32B2AC3B5857BA0AA2B32F3777D02F6E55F9A40865782BC452019D05FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 762a6498e281852d90dc614e6659c88835ae704a19996c79a0120aa5176542aa
MD5 7794fb774dc05deb9793aa3bfdda0acc
SHA1 c91e51d150bdad302d8f687d17d3c7119389021d
SHA512 e76cb14f96af912f4ef7d899a0368983ec65f4cb3082da7b694f906f0b986c94ecfeaee750ccdb97c1791c55aa17f0f9a0d2f150e8dc5522b8b69b27f3553387
TLSH
T15111EF0C14E3272AC3B1857BA0AA3B32F3377D02F6E55FAA40865282BC042019C05FBF
MD5 SHA1 SHA512 TLSH

Submit Download

HelpMe.exe

Path C:\Windows\SysWOW64\HelpMe.exe
Size 2.2MB
SHA256 6735d46ea8d96c5d82c22655b0ca38db3eebb23d62ddd76a1d65609d1d1082ae
MD5 b2291d6912e4113ea2f099aa5e115cd6
SHA1 fac316c741a3c73802497c21673a74b1d428ea2d
SHA512 c10b188fafb9e3abdc5b8e18d079441a3c34d0db2253fb4089e81c4617c30c5a039945b4238e392108bb679c8a759c7413b65cec053d957fdb4450347886affa
SSDEEP 12288:Kp4pNfz3ymJnJ8QCFkxCaQTOl20er5+nZoycL1Jer5+nUA1YaL8i0DMjmer5+nIZ:EEtl9mRda1JXAVDbJmD46mx
TLSH
T1B3A5B207E7814EEAE3990932DF148154972AF51D5BFB1631389802CCEE67387BF61A39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notepad.exe.exe

Path C:\Windows\SysWOW64\notepad.exe.exe
Size 2.5MB
SHA256 9c5dd1d3437c625c116cf7e0601478f2971ddad7e70ba360fe25efb4935d7279
MD5 6eee71ed456e55440060ba2855ebb7b9
SHA1 0dc8666b04a455e00b15676afcf9c57f862fdf24
SHA512 51056e20efbb5cb95ab9ef046cf307cc61e0ce9f85b73d8978fe1283372963d9a9f6c33e273fa386f3c1114bf6000533e22f8b96fa17b5fca60ac4ef1a8414a8
SSDEEP 12288:Kp4pNfz3ymJnJ8QCFkxCaQTOl20er5+nZoycL1Jer5+nUA1YaL8i0DMjmer5+nI6:EEtl9mRda1JXAVDbJmD46mMtdnwD5GJd
TLSH
T19AC5E413E7814DEAE7990932CF148154972AF52C5BFB1672349812CCEE67387BF21A39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notepad.exe.exe

Path C:\Windows\SysWOW64\notepad.exe.exe
Size 2.5MB
SHA256 32c7ff014988e1822aa1732500cc4858af55892ae2fa49a739f36d18ae6de2a5
MD5 1e70be5a08fe1ccc14e18bc970272dff
SHA1 e42d3d49b796ca569f0c7651ebe20bac3fdc790d
SHA512 a27ab207311a101b00c6454d8bf29f56ca934dc9bf35b9dace79949cabc56b86c769f0ed6a60dc7c7f493fac4b1099691d30cebb8339128a17c618dab5ff8902
SSDEEP 12288:Kp4pNfz3ymJnJ8QCFkxCaQTOl20er5+nZoycL1Jer5+nUA1YaL8i0DMjmer5+nIG:EEtl9mRda1JXAVDbJmD46mMtdnwD5GJJ
TLSH
T1B4C5E413E7814DEAE7990932CF148154972AF52C5BFB1672349812CCEE67387BF21A39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AUTORUN.INF

Path F:\AUTORUN.INF
Size 145B
SHA256 cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae
MD5 ca13857b2fd3895a39f09d9dde3cca97
SHA1 8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0
SHA512 55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47
TLSH
T188C04868F16A939D1E0C399093A400237083A208019E420E93DDE4A53DD41084F05188
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3440-55-0x0000000000950000-0x0000000000951000-memory.dmp

Download

memory/3440-0-0x0000000000400000-0x0000000000634000-memory.dmp

Download

memory/3440-47-0x0000000000400000-0x0000000000634000-memory.dmp

Download

memory/3440-2-0x0000000000460000-0x0000000000461000-memory.dmp

Download

memory/3440-1-0x0000000000950000-0x0000000000951000-memory.dmp

Download

memory/3668-72-0x000000000CA00000-0x000000000CD4C000-memory.dmp

Download

memory/4548-54-0x0000000000400000-0x0000000000634000-memory.dmp

Download

memory/4548-51-0x0000000000400000-0x0000000000634000-memory.dmp

Download

memory/4548-69-0x0000000000400000-0x0000000000634000-memory.dmp

Download

memory/4548-73-0x0000000000400000-0x0000000000634000-memory.dmp

Download

memory/5840-58-0x0000000000400000-0x0000000000634000-memory.dmp

Download

memory/5840-7-0x0000000000400000-0x0000000000634000-memory.dmp

Download

memory/5840-9-0x0000000000400000-0x0000000000634000-memory.dmp

Download

memory/5840-57-0x0000000000400000-0x0000000000634000-memory.dmp

Download