stihat | c6f071b2a647ccfc18398e931a7e813ce6126d8c6a12a65193c1c122c6a51d15

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 02:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c6f071b2a647ccfc18398e931a7e813ce6126d8c6a12a65193c1c122c6a51d15.exe
Size 906KB
Sample260831-c6hmmscn5w
SHA256 c6f071b2a647ccfc18398e931a7e813ce6126d8c6a12a65193c1c122c6a51d15
MD5 72d6a4503fc4851bf10c55732f20850c
SHA1 d9d46ce6363c33b43b23cc46707327dd12b3d82e
SHA512 eb75960ed4db87426d21326ff3131fd65a5dbbcd404a36c60aa6869d51c0f1526411db18ce83a46d9522a853c83164e5200dacc8afc284ab55bab99d32290284
SSDEEP 12288:Zp4pNfz3ymJnJ8QCFkxCaQTOl2BU866px5GpX/Kz:TEtl9mRda1cSS5GJ/0
TLSH
T19715AF26A290C832D1B3157C4D5BE7B9583BFD512B9469C737E83E086F38AC1B439297
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery stihat persistence privilege_escalation spyware worm

Malware Config

Signatures

Family: Stihat
Stihat is a worm written in Delphi.
worm stihat

Detects Stihat payload 49 IoCs

resource	yara_rule
behavioral2/memory/2764-0-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2764-2-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/files/0x000b000000016cdf-6.dat	family_stihat
behavioral2/memory/3944-8-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/files/0x000100000000002f-17.dat	family_stihat
behavioral2/memory/2764-42-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/3944-43-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2764-46-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2496-58-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2496-59-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2764-65-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/3944-66-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2496-75-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2764-81-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/3944-82-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2496-91-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2764-97-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/3944-98-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2496-107-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2764-113-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/3944-114-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2496-123-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2764-131-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/3944-132-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2496-144-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2764-150-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/3944-151-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2496-160-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2764-166-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/3944-167-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2496-176-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2764-178-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/3944-183-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2496-192-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2764-194-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/3944-199-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2496-207-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2764-210-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/3944-211-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2496-216-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2764-220-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/3944-221-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2496-227-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2764-231-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/3944-232-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2496-237-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2764-241-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/3944-242-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2496-247-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	c6f071b2a647ccfc18398e931a7e813ce6126d8c6a12a65193c1c122c6a51d15.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	c6f071b2a647ccfc18398e931a7e813ce6126d8c6a12a65193c1c122c6a51d15.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	c6f071b2a647ccfc18398e931a7e813ce6126d8c6a12a65193c1c122c6a51d15.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe

Executes dropped EXE 2 IoCs

pid	Process
3944	HelpMe.exe
2496	HelpMe.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Pictures\desktop.ini	explorer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\desktop.ini	explorer.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	c6f071b2a647ccfc18398e931a7e813ce6126d8c6a12a65193c1c122c6a51d15.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\B:	c6f071b2a647ccfc18398e931a7e813ce6126d8c6a12a65193c1c122c6a51d15.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\D:	HelpMe.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\G:	c6f071b2a647ccfc18398e931a7e813ce6126d8c6a12a65193c1c122c6a51d15.exe
File opened (read-only)	\??\H:	c6f071b2a647ccfc18398e931a7e813ce6126d8c6a12a65193c1c122c6a51d15.exe
File opened (read-only)	\??\L:	c6f071b2a647ccfc18398e931a7e813ce6126d8c6a12a65193c1c122c6a51d15.exe
File opened (read-only)	\??\M:	c6f071b2a647ccfc18398e931a7e813ce6126d8c6a12a65193c1c122c6a51d15.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\R:	c6f071b2a647ccfc18398e931a7e813ce6126d8c6a12a65193c1c122c6a51d15.exe
File opened (read-only)	\??\S:	c6f071b2a647ccfc18398e931a7e813ce6126d8c6a12a65193c1c122c6a51d15.exe
File opened (read-only)	\??\T:	c6f071b2a647ccfc18398e931a7e813ce6126d8c6a12a65193c1c122c6a51d15.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\A:	c6f071b2a647ccfc18398e931a7e813ce6126d8c6a12a65193c1c122c6a51d15.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\N:	c6f071b2a647ccfc18398e931a7e813ce6126d8c6a12a65193c1c122c6a51d15.exe
File opened (read-only)	\??\V:	c6f071b2a647ccfc18398e931a7e813ce6126d8c6a12a65193c1c122c6a51d15.exe
File opened (read-only)	\??\O:	c6f071b2a647ccfc18398e931a7e813ce6126d8c6a12a65193c1c122c6a51d15.exe
File opened (read-only)	\??\P:	c6f071b2a647ccfc18398e931a7e813ce6126d8c6a12a65193c1c122c6a51d15.exe
File opened (read-only)	\??\W:	c6f071b2a647ccfc18398e931a7e813ce6126d8c6a12a65193c1c122c6a51d15.exe
File opened (read-only)	\??\D:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\J:	c6f071b2a647ccfc18398e931a7e813ce6126d8c6a12a65193c1c122c6a51d15.exe
File opened (read-only)	\??\K:	c6f071b2a647ccfc18398e931a7e813ce6126d8c6a12a65193c1c122c6a51d15.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\Z:	c6f071b2a647ccfc18398e931a7e813ce6126d8c6a12a65193c1c122c6a51d15.exe
File opened (read-only)	\??\D:	c6f071b2a647ccfc18398e931a7e813ce6126d8c6a12a65193c1c122c6a51d15.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\X:	c6f071b2a647ccfc18398e931a7e813ce6126d8c6a12a65193c1c122c6a51d15.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\I:	c6f071b2a647ccfc18398e931a7e813ce6126d8c6a12a65193c1c122c6a51d15.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\Y:	c6f071b2a647ccfc18398e931a7e813ce6126d8c6a12a65193c1c122c6a51d15.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\AUTORUN.INF	c6f071b2a647ccfc18398e931a7e813ce6126d8c6a12a65193c1c122c6a51d15.exe
File opened for modification	C:\AUTORUN.INF	c6f071b2a647ccfc18398e931a7e813ce6126d8c6a12a65193c1c122c6a51d15.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HelpMe.exe	c6f071b2a647ccfc18398e931a7e813ce6126d8c6a12a65193c1c122c6a51d15.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c6f071b2a647ccfc18398e931a7e813ce6126d8c6a12a65193c1c122c6a51d15.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpMe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpMe.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f481cffcda87848be43b5fdf8091c1c60d0260001002600efbe1100000064ff3facad0fdd016561248eb90fdd01f87cb38eb90fdd0114000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\NotificationData	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2584	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2584	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2584	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2584	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 3944	2764	c6f071b2a647ccfc18398e931a7e813ce6126d8c6a12a65193c1c122c6a51d15.exe	89

C:\Users\Admin\AppData\Local\Temp\c6f071b2a647ccfc18398e931a7e813ce6126d8c6a12a65193c1c122c6a51d15.exe
"C:\Users\Admin\AppData\Local\Temp\c6f071b2a647ccfc18398e931a7e813ce6126d8c6a12a65193c1c122c6a51d15.exe"
1⤵
- Modifies WinLogon for persistence
- Creates a file in the Startup directory
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\SysWOW64\HelpMe.exe
  C:\Windows\system32\HelpMe.exe
  2⤵
  - Modifies WinLogon for persistence
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:3944

C:\Windows\explorer.exe
Explorer.exe HelpMe.exe
1⤵
- Modifies registry class
PID:3196

C:\Windows\SysWOW64\HelpMe.exe
C:\Windows\SysWOW64\HelpMe.exe
1⤵
- Modifies WinLogon for persistence
- Creates a file in the Startup directory
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2496

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2584

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 3814d61c72c25f367054d6b1f8d3df39852a3fce33e1a33f64d463d4507b2bc5
MD5 318c1882b7eb97a109a5b01db418f56c
SHA1 651ee7feed10549de77b2489a5937b5e63d1fc7f
SHA512 918cee8c6d12ae6cf80a4c16185df85ae309985029af31a2453c7027148923706877ca4fd335ab10072848c42c96c9326cdc467e0105b53317ea4595cd816c18
TLSH
T18721BB1D66C21B16C67EE5B295FB2B99FE34B811B6521F5D0096420C1962F837D41E0E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 07f7c0c116fb8f69f64710be6d71d85cde6e50522ecc3e4037bc34b414348949
MD5 27707dc36832a2631f72ac7b1b313006
SHA1 3db15a8be7919932e4ef6f4a7037aed325888dc0
SHA512 b6926f805290ace6a6b1406e175ec3361fd71ad03d47c83874fc2c239bffadeff56db704d34b3ac4cd26807af3c5a7ed15a805692d703419b9b394a329d255c6
TLSH
T1E611EF0821913726C3A6427654AB2B12A33BBD01F5F55FEA408603825C61602A944FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 210184960f404ebe61a5ee2cca4fb515244e53e265ad3dd9ef581182ae6b98c7
MD5 167a5133ac60a055492b54c56ccbb778
SHA1 5ccfc7731308c522951535201a6daa630662d294
SHA512 03dbf1c2605cc6f3dd80b851157599b8bba4588bbc6f7c287e844042ae9bbfdfc5acc4e68aa58f5c075d033ce9f2ddb04abb1581a30c7440429087110cddb218
TLSH
T1A111EF0831913B26C3B6427654AB2B12A37BBC01F5F55FEA408603825C64202A904FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 023605609daa308169778503831327936092019261813bd54a7afe7b10f98b68
MD5 9db7852bea8fffb961c20602500694cd
SHA1 f37aef73028601dbecb0fd8b66fb37312189faa3
SHA512 9c79801ac3c5ea0b0eaadc902e3b2ee9eae7abd1173fe8047295c7c08276c3bff425b6bdc8d8da4ccd408916edc1e3317a0b02dfdc65d599a6ff99e1bfc40cc3
TLSH
T1A521EB1D66C21A12C67EE5B2A4FB2A99FE34B811B2421F5D0096420C1822F837D41E0E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 edf7de9b7cd8abe3382090905fc7810e516fce54c95c72300f0187e5be7a31c9
MD5 50eac61bb46c64d62b595bce310891b9
SHA1 91858544488890fad3799e01549e0df6d1b48c48
SHA512 16f6e590fad106809317ef2cd9a95e70a7d15c07fa26b26c69c111b51ef4efa5912d1dc2eef485b3a7205f9cbdb8b3796e452d342a93fbbf038221ccd6dc3004
TLSH
T14311EF0821913726C3A6427650AB2B12B33BBC01F5F55FEA408603825C60202B944FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 4bec133d0f0d45df92c229a38d0220fbd42c0c4abd249e6077dc010ccae41bab
MD5 99e7820f9ecc15cd1d955f0f662bf328
SHA1 25ac294a154f30e141bd35f7697d7250cea57f1a
SHA512 cec23d1661b51ddcd832238ab9a82fba5b5d2aa9dc5ac4556aa6909ef5b96e30656eebff53c1925c4c15ef5fc8d09ef08c29abdd95976c49f7daa3a27d48b90b
TLSH
T11D11EF0831913726C3A6427654AB2B12A33BBC01F5F55FEA408603825C64602A904FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 0236cdec7346be6687ead723cd5dc5ea938511618b2d019a9ead7bfd077167e5
MD5 37068d98a4a80bbd7d984e44fd12032f
SHA1 5bf95541654b47867f9a259225cf820e0d58936d
SHA512 a07da2f4fd8a4133fdabdf352574e215d1847ccb93c3fa7e05201527f73773494376ecbcba47869ad4bd76062247470dc7961c220686c7ae6526dc30dfed1120
TLSH
T1D421BB1E66C21A16C67EE5B295FB2A99FE34B811B6525F5D0096420C1862F837D41E0E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 ba5378f8d93aae69e3e2eb411497fed4d691a005e8b72a503bb032d011b907d4
MD5 5761a98e577e16367ce8f9d422a75b5c
SHA1 717dfb3ea0a4e80a754319695bc9b26330294546
SHA512 7fe9d76cb857b0084ad6a03e00f3d36f24bce74665473ddbd78142a75144187a8f0c93564b17f10acef5d4744eb7569d7affed8f34239d12aabcca713e771a0a
TLSH
T1D111EF0821913726D3A6427650AB2B12A33BBC01F5F55FEA408603825C60202A904FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 f708c4a8edf2bd340db62b726ae88868f321c6a2b22a3e0a36cfdbadb4e32e77
MD5 a51e027a252067650033c73cfa49ac53
SHA1 e099f8dda84f547c59efb42956f992916a53076a
SHA512 40cc17f48e343894e08680e9441cf1e2c8d65c21850f29215faf1257a2127274b02d5c403dd13b7712386fd2030cb89af0ccd6fda643593b4170f121455df245
TLSH
T1E411EF0831913726C3B6427650AB2B22A33BBC01F5F55FEA408603825C61202A904FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 deda470d729d011a8d984d651af81f7cfdad12a8f947e642c85aaa85c1bb40a1
MD5 4abab8aa682b1b38f9f65666db6e978a
SHA1 d9b027b525c9c2d4556a777e21cb0169e5ffc2b9
SHA512 989af962d3946928704ce2873b19f15232cd9d3e17a131a92a1951244b2ee224892c0154bf4e780a16c7e4c0fbc799830cd117ee0aa6f49077c1832317e5e5e2
TLSH
T1A921BB1D6AC21E16C67EE5B295FB2B99FE34B811B6521F5D0096420C1862F837D41E0E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 474b8191dea6b3b1159f3b6fbd39605ed4f2cab4e7c02778d9abd2616013360f
MD5 93e343da87449d42563933899d5526ab
SHA1 7382e4210b1cd5614af651fbe4f6285bf93f6754
SHA512 fc4009cfc83ceb85e70a8ef82863a0ee6693c54f1bb358c6f9382adc4f8c9d602a44b909ef0895cc4eb6d75433e26b3d0eb88a3d2907cdd1f4768a6fd2bcbcc0
TLSH
T10211EF0821913726C3B6427694AB2B22A33BBC01F5F55FEA408603825C64202A904FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 92364bfa48fe35a876a225604f024fed2b25db94c2eab1f9839e3221c1a4c3cc
MD5 29f983bf3e05a61e88b5a059d2fac2e4
SHA1 f61d26c660d42f611be82a28fef78d31eb28ef35
SHA512 17b175cdc7ef91d57f6ca35b42eec37e65ae8c160cebc924d0a91d618c3ca312798126e89cf4edd1b541f968e6e82a120ff1f6ce98455f6273fe2ad47048e22e
TLSH
T17B21BB1D66C21B16C67EE5B2A5FB2A99FE34B811B6521F5D0096420C1C62F837D41E0E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 951f31f2f1c07bb6aeb8a5b4fbad077b39dcef5975952393dae16f8b07f44c6c
MD5 eb5c1674eddd9f54f4cc6a4991c7d95e
SHA1 dc004d67259656c8ca56f869998de7b55522a5ac
SHA512 7f2b9ba7351f79afa067682cc84ac54289336918601afe433fad966cdefbdc49664a0610918ba0e1c72257100982456308beff244c0f8b63f5f8026f63dd0bcf
TLSH
T1D211EF0821913726C3A6467650AB2B22A33BBC01F5F55FEA408603825C60202A904FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 beb13a01b1ee266bde1c803c63184ad367fccfbbf3d55d72366386fb4199962a
MD5 ad7769a55b271cab713ca9a62c9a1d40
SHA1 539ce1f0d78d9221749ac5cc371b7d3a6f24bd27
SHA512 7dd92339b9fbd73261ce515e29a19cccb0e300a5e33b036b5c0dab678ebde047abd366da00e40cab0851530b12b5a6a1529156488d37530e3f25bbffae350caa
TLSH
T10511EF0821913726D3A6427650AB2B22A33BBC01F5F55FEA408603825D60602A914FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 606ea4caedd5f6ee21264c1b42938b4c4f1c1239bcdd801fa3b0e9de75af2d9e
MD5 48bf08796728f365cf4d819fee95e867
SHA1 aa5bce723da26ab41948ac5eae775b3d9db99a14
SHA512 90bbe4528a05dd193c4366f9e85750ac81ac0cd989ca404b1707a1acddf9b7fe23214857a126015f6cf8f9290e670b6dc4da5f047d152fcc3efb62f01764bb2d
TLSH
T1D911EF0821913726D3A6427750AB2B12A33BBC01F5F55FEA408603825C60202A904FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 a56a998c30527776aa0f126b7aa8aefeba0a13aca0f260d58b43fa4643e80230
MD5 9b053119f41e3ef2db042ae8d2fe8d53
SHA1 7913ebd32c034b35df90951110248a106d9015aa
SHA512 c7c1cad0dad78858f3eb002d8ee9ef072c0f1f68e8c1fdde69c3df3ffc8bef913b832d039b899a91a1a1b02fe0303ebdfc9ddde652bbee0979916597427ca8cb
TLSH
T14611EF0821913B26C3A64276A0AB2B22A37BBC01F5F55FEA408603825D60202AD04FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 3edaebf6e4a406a99558dcc75b7338f2dee9dd5f4cb34c4692adbf1ad4f149cd
MD5 0d3694540ba4d4b65fb82769f40cc2bc
SHA1 21b9b3c4c8996d97880af5da5bf2f93ba2418fd8
SHA512 2b8da7f49a7a8376381564309ea6de69f272c4cd51cacffbb10eedb4943e6d97202131646b0f1de07520f2ceb6d0f52eb8dfa2e171f073f2de730e758fc760fe
TLSH
T16121BB1D66C21A16C67EE5B2A5FB2A99FE34B811B6521F5D0096420C1862F837D41E0E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 490a12cacb961c0a688b770924588ce82a70e64b0c02ff12c7a8729171354231
MD5 e40f4809c011daa967f3d8306da19c7c
SHA1 2d035c245c62d99948e2bc1c42f18a50bde8e8f8
SHA512 e134f81434d35330c21712835c3d5ec42f0bf3dd6b404c47dbbb8f4812eb38da945cb08f4e779a830832a770eac0776fb884cbda2bcd159bc4f0a912872d91b4
TLSH
T15D11EF0831913726C3A6427650AB2B12A37BBC01F5F55FEA408603825C60202A944FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 8f3b12ee086e525d9a138104c44c3edb42a3d978ffc507fb7ab728aceb966c4b
MD5 72b4c90869de33ab000f603d7b5d8c66
SHA1 15682f4024fca1baef51c02777bd3ea380923b47
SHA512 f6ab4ace32ef8309e060290eb74fc60210198de034076169f519e71bf2a5135a818109d69d401f02eb7caf0a19bd2efa1d95930f75c3d68cb043743159d38e85
TLSH
T18111EF0821913726C3A6427650AB2B12B33BBC01F5F55FEA408603835D60202A904FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 738769d9e2a77ffa44b458754551c9d335cf79418bd90f57af44d52874b9cf91
MD5 b35cd12b40b0d4a475b1c376d7e0068f
SHA1 04d7e2b3d3d395608dbec62c9f7c534a4a44e776
SHA512 e37898e372eda418fa146fa2ffd60f2670e4389418454a0781837966a77c26e4dbaea79f31757321ff1f978ede3e635962940ea9f5b95f62b17107b083db641c
TLSH
T1A921BB1D66C21B16C67EE5B295FB2A99FE34B811B6521F5D0096420D1C62F837D41E0E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 8bbac1147bfb666f9e77e19860fcf3b3a4d1cc4b6663e6df026f2117e7fc47e1
MD5 77e40437f303c10930b616c309fafb0f
SHA1 1219a0b6d0f7469346a7cc22a32f904458a35a57
SHA512 445d4db77bf74211ac37f544959fe127b391cd4696e54c8c623061c5d4cd7c6c9581fcfc8cce4ec6fdc56a91db545abd51880df79529e05835a06ac33d7d5d2e
TLSH
T18711EF0821913726C3A6427650AB2B12A33BBC01F5F55FEA408603825C60202A904FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 2601f404d1ec7f8091aefa1151b2bdffa897220777afef054972126da3c8bf3f
MD5 6d3f692845158a7a4c9180ea22457650
SHA1 38da5dbbd3b937aa90143491ac73a9197796b5a8
SHA512 68451ff40fb812489be7de061f17ffa92216b0d58a9cea9e51925e25afb2760d2bdd191d7f9c929b4f054eeca575218f31e53d1e5a60bc8522c810c8935d0898
TLSH
T1CB21BB1E66C21A16C67EE5B295FB2B99FE34B811B6522F5D0096420C1862F837D41E0E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 abccf294de150477dc7cfd7dddb7f0bc827c9028ad8514f7ee01a371ffbdba83
MD5 15cda74d3f28095c3dc82550febd4e5e
SHA1 d7999d97e61a8457265230a6f743403e096ac590
SHA512 38341e862441097c66e11ad75e4a558f947f96021720e3961eefd9f9eafd74f3e683816259af9b111f234596c0a896c8b5546bee0c13c3fc4c64330786e0ead1
TLSH
T1F611EF0821913726D3A6427650AB2B12A33BBC01F5F55FEA408603825C60202A904FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 6016b014b72ccfe1022555499b0a8af74ea1f204577190e6717665818d741c21
MD5 56f9f71c3163fb71841bbea9c73f5f68
SHA1 aa457ebf0c46dda3968624b0afaf27c276554c06
SHA512 1b4596764a029456606b934fbe86cf9a36a3347ddc4ca974bbcaefc4a8a5a6b0ef8a96c7ca210c547509bfc3b918064d9413516864004fb441aab9ac4e50e2bd
TLSH
T17311EF0831913726C3B6427650AB2B12B33BBC01F5F55FEA408603825C64602A904FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 db9194d2cafbe20d494b459ab7b212f08508a5cc1827ef1c1a9834bcaf6c10a2
MD5 4931596e2887efe288a003f320223f7f
SHA1 723f507bf04017c879cdc10c0484cdd14094ecbf
SHA512 6377a628c2da3c8af813798c36cbb7f51ba630d4d347c1966590665e3331aa54cce919213344d969402aff9ff9a380e03a110ecab9ba4fbb872e8a2f494ffe95
TLSH
T17F21EB1D66C21A22C67EE5B294FB2A99FE34B811B2421F5D0096420C2862F837D40E0E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 2429c7446e6624d7bd8b9842e09e754fb5d5c4552a9d89e2d8fabf9a3cc5cbd5
MD5 8ae80f30dde37fa79fbd5ddce3f0fd6a
SHA1 037d8b230d343213ad06964ff669bce3572ba68e
SHA512 cde2e025036876622d9967fde1dc2b94c7cd7e9ff549c59aa315f3b1f4071c59840f40f8671a80080702642105d467f8950cb708e6376082a376684ec990a146
TLSH
T18F11EF0821913726C3A6427650AB2B12B33BBC01F5F55FEA408603825C60202AD04FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 3898d17b3b8cae138559546c62f0e7928364ec799f51b802969e6292e28c5d8c
MD5 f7e390dabde4f6769b5927c46444955e
SHA1 bece47ed148241ed6aa15103dc384e9ef21ff9f2
SHA512 f2d57769e2f70b7e386f65d5cd7978fea3a9a5d04c6650f999540640f8cecf70857308294676516423c20e702b7d071dc4fe2b7d4c9727112030ebe0e5d7a299
TLSH
T19C21EB1D66C21A26C67EE5B2A4FB2A99FE34B811B2422F5D0096420C2822F837D40E0E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 5c41a716409f10864311a2248693007e8319a680379969a5952d846f311364b9
MD5 16c8a38894e7126d54cc6fdefea46898
SHA1 b19e9c0444409a78324366781cb40e85bdd68d14
SHA512 1fdd64ce3f16b0ed5fa466c6c80a697a3707d6a40cb3ef40826d5b16e57d88dd79f6aa46f812dc6405532eb0002a726f58472fc9b92b812a9c16a23ccf8cc9a7
TLSH
T1F711EF0821913B26C3A6427650AB2B12A33BBC01F5F55FEA408603825C64202B904FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 995ed8bb2b5b798aae92780fec971c95c356795586bacbdeaa0900f36f2837c6
MD5 791cd08b21ba290d24f3303172b91529
SHA1 14d77b88843d3a76b9db19a2b028d4ce3dd30624
SHA512 cbae94a8d132f07e6233afd842fc4e44954df349c9acb8ac099cd3c69bd8d9ce9cf7b998549fca570df512b49af0afc587af4de2f280d11aadbc2a5061798277
TLSH
T11221BB1E66C21B16C67EE5B295FB2A99FE34B821B6521F5D0096420C1862F837D41E0E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 e9483e9c9a0b5ab832ea8bc46f60ea724222ecdc785ae8e1b01f85d58a05b1af
MD5 470b6fe1a36318f176f12895f6c312c7
SHA1 fc2f33bf47b36ea90f93f682b63866574f393ec0
SHA512 72ffe883105127f276777a1d8525cebf4b4d88e0629d0c615926d4e236326db05b72c7d2e765847477cbcd8e0bd8205227aa101fe42353f595a78e5152d3b5a1
TLSH
T13611EF0821913726C3A6427760AB2B12F33BBC01F5F55FEA408603825C61202A914FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 090d495a390a2a57df0d45b6e30751daf1335327e5373f6b0c96be315a40f9b0
MD5 195419759b4e886fe21ea40c65297dd8
SHA1 2f8bf3ddd33be2e97fc6d15bc266cf28f13930c6
SHA512 edf61a30ce8e9591ff2dc387bd91ceb07c945c853d419daaf36bb54e480eee15d2eedc7169bd9462fce1b0151b00187112b404d0e82d8e0d44632e4a8d812dd6
TLSH
T1E221BB1E66C21B16C67EE5B295FB2A99FE34B811B6521F5D0096420C1862F837D41E0E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 d7ac8f547dbf35d6a66062b345539eff80d30c0f3383f6cb7bdc8c31f04e8da1
MD5 69091242f5709ff3e2aa0063aea4365b
SHA1 90968a9d5f755932a9d9971a4832d5984389a852
SHA512 5a0e363bb34cfe9d2fb2f20249c97089ea7e91853f08fc9bae5c270dedef4b90986b32454993d96e12b818676b92772c6c9d09054931d0120d0d61c59eab92fc
TLSH
T1DE11EF0821913726C3A6427650AB2B22E33BBC01F5F55FEA408603826C60202A914FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 27e54da93b752af152118d7e31e4efb8e3fe73c0f801e1a4978ff65587d77a8f
MD5 fca4837a3356b062857d887b6abffd94
SHA1 20964131f41fdc543ac563eae1dfb637ad5c4172
SHA512 3225481545d1020e173f647f3e299768c44396e855147c74b7948f1f07322fb012efc02f6c4ce23c784e29d10b9d980d4aa696fd77a0697c65f6195875f61a83
TLSH
T13B21BB1D6AC21F16C67EE5B2A5FB2A99FE34B811B6521F5D0096420C1862F837D41A0E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 f2bde5176c0b28d3396f32685495a0c33bb0d2d41630a6786527a125479782f3
MD5 ba7b55611165d736a457516be1d9f580
SHA1 bda3f3923b10ed1b6fe64ea13f387f5122540e5f
SHA512 e34cef68d5a9f23da608a7a6fa06bcf56cff703451d200903e5777929ac7d9cba0469475bcfe74d193da97480d270cd29d5e0af4d0869a133d95f24e1d4f9c23
TLSH
T18921BB1E66C21A16C67EE5B295FB2A99FE34B812B6521F5D0096420D1863F837D41E0E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 0446b4352f4d8148958a89d883703e0d686053eb1aec00039e770dd92970494b
MD5 f2b37ff949eb479d15eb999049cf0ee7
SHA1 3687e8bc4ec0555774bbd51b2f00c8b311d73412
SHA512 4f75fc7fa632d6d6e507fedb26a03d3010ac19b468fe8a5db6b738cf25b4cd2fa87bbdcf7ff0ffe09c85575131343b7adb0d9c98d4602c08be6f05021d76a1ea
TLSH
T11A11EF0821913726D3A6427751AB2B12A33BBC01F5F55FEA408603825C64202A904FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 99d20627aa4096bcd93c09053fb4aab7eb017c80e0fc416b55d8e65af287e150
MD5 7fdb38ec1bef6bbb59270f7c483a9f46
SHA1 a1770171e638eca7332443c64cedfbdde382c696
SHA512 d1e05bd1069a0704644bda296b284e1e3a72069c4e1eefef288c3356332337c1e26068c54fa045e896c271e2504897ca8df5daf6a3966b14bc159e7978fb7b61
TLSH
T1B721BB1D66C21A26C67EE5B295FB2A99FE34B811B6525F5D0096420C1862F837D41E0E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 36932a21380dbf7ce61cb97e73653b3504bb60aac15cd51955492688221d0539
MD5 e6a369414e1cc3235b2e2353a5b10a00
SHA1 19ac194ff4dc2176ecfacd9d8ec2eb7a0c1f66c1
SHA512 5d0e0e48a3ea416914f662e75412abcdc9219de3e8f3249e5a1772f2d62e7aaed6a706cdae1518dedadc9537c9d6264e4026553ec1f90bbe827006902b15a28a
TLSH
T15A11EF0821913736C3B6427754AB2B12A33BBC01F5F55FEA408603825C60202A904FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 11dd1b0a99f5dadbb5f4d31add3870d950d6199e1e3c73fbef9f2120d9899ee7
MD5 cc49e944df582268e7d01c05f0dc4980
SHA1 4ce42aaad48b862ee13751f91e1f451f108e3bb4
SHA512 7199d9f8d75f6b245905f604c5806cf6c12bb5c58723542bfafb725138868e8a8b1e4841f654a2e0b7e73f00770270212a5244eaf219a9d5fb854e520d7fbcbf
TLSH
T18311EF0831913726C3A64276A0AB2B12A33BBC01F5F55FEA408603826C60202AD04FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 3951a0b2ef5a8c946981b566b3fc4178bba5518b2e6c944740ab4c5ddbd25697
MD5 23e634045edbab4900aa6992af64d0ec
SHA1 ff0e9f2df04aaed658c1e6246f7819fe5a51da07
SHA512 6b98c24ddd11ae413605dd06538cbf52fdba37cdc4666cc4a83dbec363c86a5f07ca458b2ce6e8092242c1163185f7e7e143b222c2c530e554f3143cd7b89f8a
TLSH
T15A21EB1D66C21B12C67EE5B294FB2A99FE34B811B2421F5D0096420C1822F837D40E0E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 dd11e6ff3758aa05a92b064aa194b37ebe6c051de1dd3d25b1735113cdd3f8ed
MD5 a9d2e3bd5fb28b74334c9cf69ad3460d
SHA1 63b37abc3dcdae10b78c82d6068d34fb0e71fe5f
SHA512 9377551e3a9bf06847cc7435ad5f1588ab6d828edede3c4d8abced45564bb3547f5c5f5d68bcc0f61297f153da53992d0bba26cab6ca52bcbc65baf5af609cd1
TLSH
T15211EF0821913726C3A6427654AB2B12A33BBC01F5F55FEA408603825C60602A904FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 5aa5c92309f102208a1dc639c903073d3da9beb9d01216c13db8207cd57a6ae0
MD5 929188ce6a613ba1f76e5279e3c1592a
SHA1 fe6e39f1cf6b0d063acbfb589591175f4090d84f
SHA512 3a809488d87deee0e1cfc81178d785c00ed44cd1bac4cd8d27af7fb26f572e14a585120ea005703331206e543e77a05ccaae029a8414eadf7f2ce0473a41c646
TLSH
T10011EF0821913726C3A6427751AB2B12A33BBC01F5F55FEA408603825C60602A954FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 3f0f1221c40b0c15aa5db06e7fb463ca444b4746603c7c8c2f13c5e288b47284
MD5 b732362c615b8424eeb8520a731bc5ed
SHA1 0cd6df33b887ed94880136bf94460038c2777f60
SHA512 dbd99338df8a7d9fba7ed6b245435c7441b0b1a771c9f736a75099d8b21f917b6994c31efebb45b1e812c6fb7658dbfb7676b65f91f6ff37c12d362f766a2788
TLSH
T11121BB1D66C21A16C67EE5B295FB2A99FE34B821B6521F5D1096420C1862F837D41E0E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 d9f7fef00dc23dca3c8cea6eee1294f9a88b287ebbd5fcc09487db8b65b9c666
MD5 1d8088901e9f8bc05a2c940193fdc927
SHA1 3352f9cedc6207cdc66abb0f5d3fba2e990ddf3b
SHA512 0414a81948e84196279f40ea13702de318bd901040fdbb77b0f31a6bcfd56a739bfeccd9b436748f2dd594336f1483ac8b2697a2a054d1c62ae6356a48384c28
TLSH
T1C811EF0821913726C3A6427661AB2B12A33BBC01F5F55FEA408603825C60202A904FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 d6e6a64212744d944b7ad86fe87294c77a716377323be38d52a40b6f41f49649
MD5 0e1aa98f6d40493b9e9c4f17d118eafb
SHA1 efb48e00524737f1250fb814519e5a68d80c8063
SHA512 93401a335f364aeb4edc7070e729a69e39fc1d4c361cdb63eb9e69d02868c1f6790622494293a3cde1c76b88ca7a395cb4b8088af91be609fba62e7964ade56a
TLSH
T1FA11EF0821923726C3A6467650AB2B12E33BBC01F5F55FEA408643825D60602AD14FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 ad466271e8af457ba4c4608a74b589953cb2ed7f06b910e3f99e682cbd2f110b
MD5 cbd089de2daf4c07484702b0cdc32af0
SHA1 44bdab124457259fd73badd4e8d6b2ac44aaf39e
SHA512 844701ff9178996b69bb58b8edc1f1a44c5a34b9740804562b0610d884a522b7b0b69ed42f0d587c6e8349cb9585cf145dce1114c6291317b0bcf293f548dbd7
TLSH
T16421BB1E66C21A16C6BEE5B295FB2A99FE34B811B6521F5D0096420C1862F837D41E0E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 60692bdd4911a78c8a8095ffa6edfeb14bce5f09a795c38f0aa32380ae516447
MD5 0c4fb835306bd11cc5f015d4c4c6e7af
SHA1 1cfe88de9dec2c05cb3d0740fe9bf57683b4d275
SHA512 6c8c642d4c2d7d2ddea147ac2bc01c53597a85fd4d874137abc5829828e0451c34c39236d0050b9e77e415c69661620f5add39473e1e75afe809f607faf2b373
TLSH
T13B11EF0821913726C3B64676A0AB2B12A37BBC01F5F55FEA408603825C61202A904FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 e69deb80dac5878424dbc95b09c0e8ddf41f85a95bbec4fdc841d3b59bb9cfd7
MD5 b187d833f7c493de8e8648514c9737f7
SHA1 f8743152976df6291fe244b1b76ffc170346c5e9
SHA512 1125fddf878998d375e6eb3d1f2e73a8d70011d8ff44683a5c9173492c82b0074e17b8fb32c160b00a94ff1c4b08e3768020365a3935b5c2f0777bcdec2209ca
TLSH
T18B11EF0821913726C3A6427754AB2B12A33BBC01F5F55FEB408603825C60202A904FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 d904276d7f3c7f4005b1185e875eca4d542d8c4c4804f3b4f7e04f091d011a5a
MD5 dd1af4b6f6712ce735cbe92a3062eeba
SHA1 c32d732f9dbb12d14ad8ee40a6e59b11e3e55a2c
SHA512 776a3ea9842103a2c6b381765fbbb42c056cd37260ec9bd30ef106fa0e6c3aab518dfc77a69d505304f2fb1b711a35a3dc0c71a6b6b95556132bb3d73be4b949
TLSH
T11E21BB1D66C21A26C67EE5B295FB2A99FE34B821B6521F5D0096420C1862F837D41E0E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 9c3116a4ac2dd89a6a0adf96177ba62be18cfd48386ff3971379414bca4c8056
MD5 64fe25f8fafbd109019b7e5fc2a0624c
SHA1 d30ec5abe98f8ca17964d3cd719acc9f75ebffa7
SHA512 2acadf8158e3faaca017238fcd534ff83439a1c6a95dd7224fc703f63b1a16abc53c8abd9461e0de94c325d2855994f22050b200f9e9a1d9d3c89b0f481d5b80
TLSH
T13B11EF0821913726C3A6427690AB2B12A33BBC01F5F55FEA408603825C61202A944FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 78f8567a4fe928072b40db4440f1f012624f47b0dbd8313da6fe763e58307ca5
MD5 e9ae9b7a9b0c2db66483aac09b7ea225
SHA1 331142af3318bd9964650d2d466938c4084dd61c
SHA512 f0dc650d098c1c8777a527efa0783c01c64a750e512520c5506a4f178caf98fbbbf40a00c01f2d2327f27a9b5702ae2d67f7c5f00b076853e960f5899fafae9e
TLSH
T1D511EF0821913B26C3A6427691AB2B12A37BBC01F5F55FEA408603826C60202B904FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 e6cc2668730d9656472b11fe135d9054b2c8e4c7e37c587e12ca89710d8b94e8
MD5 19e9e74c8a0173df0859a85226eb0c5c
SHA1 dde53833d1c363b92465ef2aeeb085d97a73d0b1
SHA512 4aa1e6bf5881c3a7528d2eeb426f4ec6afbf986d46e5e09d9a693fcc4931dba75b6f171f173fc95016a32b0439b69af570e801c2da19d96e4f7bffaab03eed1f
TLSH
T17A11EF0821913726C3A6467650AB2B12A33BBC01F5F55FEA408603825D60202A954FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 541f0b2765905de6479803ccf4e10184bf14fdb9671d7e03846d1c2a9fc98607
MD5 6a56d63b75a709e50e1d32594b734ee3
SHA1 61a173eff27c9c46f91b5fb0379ca96eb2d45d67
SHA512 640a14d9ae10a34cbb3863f99efd438d762da96cf2715b72e545ffc90f881697e6969e9a3674678d54599e887ecc7376c5897ff2cc86f61361a24a1125a3bd02
TLSH
T1AA11EF0821913726C3A6427660AB2B12A37BBC01F5F55FEA408603825C60202A944FEF
MD5 SHA1 SHA512 TLSH

Submit Download

HelpMe.exe

Path C:\Windows\SysWOW64\HelpMe.exe
Size 905KB
SHA256 c4b51d44253cf223a9b86320b37a81b0f581ff424597cd6996bd44a92d14c083
MD5 df12254d10000ce2ebc07b1fc76b494f
SHA1 19c8c92d0ada4c318d5fd32f9dfc4267a05f5613
SHA512 29575875127a03652caa347135f9f35ab3e9ac5b18ed6aebfc7a2ba38a83877311bc7825b65e984d847922e439fbd581f5583e2419cba8c0b46d0d9db623bb4d
SSDEEP 12288:Zp4pNfz3ymJnJ8QCFkxCaQTOl2BU866px5GpX/Kj:TEtl9mRda1cSS5GJ/+
TLSH
T1D815AF26A290C832D1B3157C4D5BE7B9583BFD512B9469C737E83E086F38AC1B439297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-552508041-2681165170-3229858294-1000\desktop.ini
Size 907KB
SHA256 758a4a3a00fd3df758356869e2b03e4cfcaffeb4c7cc86f80546ccb7584ce81b
MD5 b1e2d1ec6dd4e6726884e4bc1ec377a6
SHA1 b44bf8f1d50515f39aee27adfa267caa47642bae
SHA512 41b4891c7fb7a84d46546a0de94a8acc63a84c6018a95b4311100e09a2ce42737224464eb078d1257fe8bc11bcaaf73a5aed4c155c27fbbe7807a061e7b2f713
SSDEEP 12288:Zp4pNfz3ymJnJ8QCFkxCaQTOl2BU866px5GpX/Ki:TEtl9mRda1cSS5GJ/P
TLSH
T18A15AF26A290C832D1B3157C4D5BE7B9583BFD512B9469C737E83E086F38AC1B439297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AUTORUN.INF

Path F:\AUTORUN.INF
Size 145B
SHA256 cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae
MD5 ca13857b2fd3895a39f09d9dde3cca97
SHA1 8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0
SHA512 55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47
TLSH
T188C04868F16A939D1E0C399093A400237083A208019E420E93DDE4A53DD41084F05188
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2496-247-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2496-75-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2496-91-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2496-192-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2496-216-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2496-227-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2496-123-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2496-59-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2496-207-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2496-237-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2496-144-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2496-107-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2496-176-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2496-58-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2496-160-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2584-60-0x000000000EE30000-0x000000000EEA8000-memory.dmp

Download

memory/2764-81-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2764-231-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2764-166-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2764-65-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2764-241-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2764-46-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2764-0-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2764-178-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2764-97-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2764-2-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2764-42-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2764-113-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2764-150-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2764-220-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2764-194-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2764-210-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2764-131-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2764-1-0x0000000000460000-0x0000000000461000-memory.dmp

Download

memory/3944-132-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3944-167-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3944-199-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3944-8-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3944-211-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3944-114-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3944-82-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3944-221-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3944-151-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3944-183-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3944-232-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3944-43-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3944-66-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3944-242-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3944-98-0x0000000000400000-0x0000000000477000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads