stihat | 1ae48141b3ebec5a32700c3e9dacdf3445da1f6c958deda3afd8501d8a9d5174

Analysis

max time kernel
150s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 02:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1ae48141b3ebec5a32700c3e9dacdf3445da1f6c958deda3afd8501d8a9d5174.exe
Size 1.1MB
Sample260831-dfg4vstfkf
SHA256 1ae48141b3ebec5a32700c3e9dacdf3445da1f6c958deda3afd8501d8a9d5174
MD5 16492b48f64690e66056a5de161cd5cc
SHA1 a92c319e4190858627c0566e254a57aebfd8857d
SHA512 ea75aee1a632903cdde9a5b95869cecf4742fcb804bfd2c578bd26171e4d7a609cc65e5c40c0557aa114ebb8ad8b1c779204f3862103b99b14fc31461bd76725
SSDEEP 24576:TEtl9mRda1cSS5GJ//mWclRd1jRi0sjz1A:oEs1hS5W/mC1A
TLSH
T1C1358D27A7D08431E1B315385D7AA6790937BD212BB4988B27EC3D0C9F77AC1A835793
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery stihat persistence privilege_escalation spyware worm

Malware Config

Signatures

Family: Stihat
Stihat is a worm written in Delphi.
worm stihat

Detects Stihat payload 53 IoCs

resource	yara_rule
behavioral2/memory/5440-0-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/5440-2-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/files/0x000700000001b867-6.dat	family_stihat
behavioral2/memory/4176-8-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/files/0x000100000000002f-17.dat	family_stihat
behavioral2/files/0x000d00000001c473-31.dat	family_stihat
behavioral2/memory/5440-41-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/380-42-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/5440-43-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4176-44-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/5440-46-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4176-51-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/380-55-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/380-60-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/5440-63-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4176-66-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/380-75-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/5440-80-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4176-81-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/380-90-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/5440-95-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4176-96-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/380-105-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/5440-110-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4176-111-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/380-120-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/5440-127-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4176-128-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/380-140-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/5440-145-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4176-146-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/380-155-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/5440-160-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4176-161-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/380-170-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/5440-175-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4176-176-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/380-185-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/5440-190-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4176-191-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/380-198-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/5440-201-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4176-206-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/380-210-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/5440-212-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4176-213-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/380-219-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4176-223-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/5440-221-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/380-228-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/5440-231-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4176-232-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/380-237-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	1ae48141b3ebec5a32700c3e9dacdf3445da1f6c958deda3afd8501d8a9d5174.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	1ae48141b3ebec5a32700c3e9dacdf3445da1f6c958deda3afd8501d8a9d5174.exe

Executes dropped EXE 2 IoCs

pid	Process
4176	HelpMe.exe
380	HelpMe.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Pictures\desktop.ini	explorer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\desktop.ini	explorer.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\Q:	1ae48141b3ebec5a32700c3e9dacdf3445da1f6c958deda3afd8501d8a9d5174.exe
File opened (read-only)	\??\T:	1ae48141b3ebec5a32700c3e9dacdf3445da1f6c958deda3afd8501d8a9d5174.exe
File opened (read-only)	\??\Y:	1ae48141b3ebec5a32700c3e9dacdf3445da1f6c958deda3afd8501d8a9d5174.exe
File opened (read-only)	\??\D:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\O:	1ae48141b3ebec5a32700c3e9dacdf3445da1f6c958deda3afd8501d8a9d5174.exe
File opened (read-only)	\??\U:	1ae48141b3ebec5a32700c3e9dacdf3445da1f6c958deda3afd8501d8a9d5174.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\H:	1ae48141b3ebec5a32700c3e9dacdf3445da1f6c958deda3afd8501d8a9d5174.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\P:	1ae48141b3ebec5a32700c3e9dacdf3445da1f6c958deda3afd8501d8a9d5174.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\R:	1ae48141b3ebec5a32700c3e9dacdf3445da1f6c958deda3afd8501d8a9d5174.exe
File opened (read-only)	\??\G:	1ae48141b3ebec5a32700c3e9dacdf3445da1f6c958deda3afd8501d8a9d5174.exe
File opened (read-only)	\??\J:	1ae48141b3ebec5a32700c3e9dacdf3445da1f6c958deda3afd8501d8a9d5174.exe
File opened (read-only)	\??\M:	1ae48141b3ebec5a32700c3e9dacdf3445da1f6c958deda3afd8501d8a9d5174.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\S:	1ae48141b3ebec5a32700c3e9dacdf3445da1f6c958deda3afd8501d8a9d5174.exe
File opened (read-only)	\??\V:	1ae48141b3ebec5a32700c3e9dacdf3445da1f6c958deda3afd8501d8a9d5174.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\K:	1ae48141b3ebec5a32700c3e9dacdf3445da1f6c958deda3afd8501d8a9d5174.exe
File opened (read-only)	\??\L:	1ae48141b3ebec5a32700c3e9dacdf3445da1f6c958deda3afd8501d8a9d5174.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\A:	1ae48141b3ebec5a32700c3e9dacdf3445da1f6c958deda3afd8501d8a9d5174.exe
File opened (read-only)	\??\I:	1ae48141b3ebec5a32700c3e9dacdf3445da1f6c958deda3afd8501d8a9d5174.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\D:	HelpMe.exe
File opened (read-only)	\??\N:	1ae48141b3ebec5a32700c3e9dacdf3445da1f6c958deda3afd8501d8a9d5174.exe
File opened (read-only)	\??\W:	1ae48141b3ebec5a32700c3e9dacdf3445da1f6c958deda3afd8501d8a9d5174.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\B:	1ae48141b3ebec5a32700c3e9dacdf3445da1f6c958deda3afd8501d8a9d5174.exe
File opened (read-only)	\??\I:	HelpMe.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\AUTORUN.INF	1ae48141b3ebec5a32700c3e9dacdf3445da1f6c958deda3afd8501d8a9d5174.exe
File opened for modification	C:\AUTORUN.INF	1ae48141b3ebec5a32700c3e9dacdf3445da1f6c958deda3afd8501d8a9d5174.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HelpMe.exe	1ae48141b3ebec5a32700c3e9dacdf3445da1f6c958deda3afd8501d8a9d5174.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpMe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1ae48141b3ebec5a32700c3e9dacdf3445da1f6c958deda3afd8501d8a9d5174.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpMe.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\NotificationData	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f481cffcda87848be43b5fdf8091c1c60d0260001002600efbe110000006fd933b1ad0fdd016cd717e5bb0fdd01c8f281eebb0fdd0114000000	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1440	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1440	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1440	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1440	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5440 wrote to memory of 4176	5440	1ae48141b3ebec5a32700c3e9dacdf3445da1f6c958deda3afd8501d8a9d5174.exe	89

C:\Users\Admin\AppData\Local\Temp\1ae48141b3ebec5a32700c3e9dacdf3445da1f6c958deda3afd8501d8a9d5174.exe
"C:\Users\Admin\AppData\Local\Temp\1ae48141b3ebec5a32700c3e9dacdf3445da1f6c958deda3afd8501d8a9d5174.exe"
1⤵
- Modifies WinLogon for persistence
- Creates a file in the Startup directory
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5440
- C:\Windows\SysWOW64\HelpMe.exe
  C:\Windows\system32\HelpMe.exe
  2⤵
  - Modifies WinLogon for persistence
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:4176

C:\Windows\SysWOW64\HelpMe.exe
C:\Windows\SysWOW64\HelpMe.exe
1⤵
- Modifies WinLogon for persistence
- Creates a file in the Startup directory
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:380

C:\Windows\explorer.exe
Explorer.exe HelpMe.exe
1⤵
- Modifies registry class
PID:360

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1440

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.exe

Path C:\$Recycle.Bin\S-1-5-21-3986082593-3624157295-3514260330-1000\desktop.ini.exe
Size 1.1MB
SHA256 f74cdae7dbdf9381ba28284f438bc0cf5f65206cdaeb7f98045868b448324be2
MD5 db62ae4071b819ff900875d74f5d1fdc
SHA1 56e3a4fd0f6183dcfd0c923596554f3bdd8eff32
SHA512 00f09ac7773214471dbf7a1f86cb34e3f43e9e0137d416b3dea971cafe527088f1f3f275b86745fc26be604d981f63333e23f13ed09b33c962d0ea5651bd4aa2
SSDEEP 24576:TEtl9mRda1cSS5GJ//mWclRd1jRi0sjz1Q:oEs1hS5W/mC1Q
TLSH
T12C358D27A7D08431E1B315385D7AA6790937BD212BB4988B27EC3D0C9F77AC1A835793
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 7e298b009dddeea9d90bbb416697c069d50928b18e76b30183fff3bd38f252cb
MD5 0c4679a5d94a36325f44c001cbe8804d
SHA1 919727b931c4ffd9d41ff554d1da639d728eb6cc
SHA512 e0d8d2556e40b2549219c1bcb3367c587548044a2a3ef08b03047ff20fcdf85df4b29e5a7d4cf34db055c749f1149ec0c777715019d0dd8f70f04efd0eb3994a
TLSH
T1D811AF0C54F12B33E362563991A76B5293337D03FAE68F9D008552C298041809808E6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 3ad90684a27071ecd0f1baaa8af37ba57144a34745827365ea23365534d9f878
MD5 d5c83b3a35b7047fc6e8ce273cb36ea1
SHA1 b4039a28fa41c3aa1d3f62514d13c6897baff67c
SHA512 f67dadd6f9385f1c905fd9817472c63af9c1dcce6fb97490dc070489fc26b812933d3ff3ca8e1c7ca3ca876effa706a853cc7594e664fe59e94e3999723e9a69
TLSH
T19D11C20C54F22B33E372567981E77B5193337D03FAE68F9D008552C298051809848E7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 a33bc9fc8f5cc748d4acfcc417cf9421d5753d8f4e21efd48b9a21cbe1d8bf0c
MD5 2c86203c9f500eaa0b00fa8eec4a76d1
SHA1 ddb9fbf744bad5975a6a16b1ce91f0ecf8363ca7
SHA512 6c3281b64fec03ed242bd379b452a7dd4b88d37ab9c599c4c2ad5e0e10dd2a11ecc095e9cb50d32c50e11506fe4c0fee4eeb8bfe639f07b2c851324395cf39d9
TLSH
T1E921DF28B9D23B22C27F953985F72A5ADA75B843B7436F4C0055828F4C12B536E46B1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 2bd8fdb507584cb7aa84299acf9130bbdafb863753fd783c96b04148f0ed1d79
MD5 4b99b61b356e6027e5ab95bd4b5d4f45
SHA1 623c289fb4b2daf513a9d19491f7b9d795e0dec1
SHA512 98c1e396845fa5d0ca91ee058d4eff6e787d0ec83f16fd51d013f5c86bb90c0c50cf7682a95cd4e33c71198d3dff35277a534c0cfa664aa8c13945439d4ebe20
TLSH
T1FA11AF0C54F12B33E3A2563981A72B1193337D03FAE68F9D008552C29844181A808E6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 2a2545cfc334a50651a695642fe3c453a192530c1e03f5c607ad02fc2f5447fe
MD5 6835a2572c1235bf57516b9779d34209
SHA1 1934cf3ff6b3b1f323584338ca42556b0008b9d7
SHA512 1ed0653afa4664596ce7d6ae5c25d53243101e385c01d5ba82887c1678e4200c08bf6fdbdb4676d46c0d9f90622cf9f11b20fb0103e1774c5680210e41801fba
TLSH
T15E11AF0C54F12B33E372563981A72B1193337D03FAE68F9D009952C298041809808EAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 b6418ac74777fe16d5e084dfaeb4dc8c9a7161d43cc2e097978151409d794032
MD5 24c04688d5145bd49e5a7ed2220beb44
SHA1 cda38a993391bb46ead112077af018b96da37733
SHA512 b63778b96d1ca9c73b8b723c862710cde101dec0fe142785acd96417327fd10e9f1ecb8b95aa1847a78664e81cc2fc4ff61b8fe4b5d7d3633ba3dd629aca3382
TLSH
T16121DF28B9D23F22C27F953985F72A5EDA75B843B7436E4C0055828F4C12B536E46B1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 7cbab63fdadae9d1e8d8a95a4e30a538d873ef7fdc9a1fae993708a9d4cbe515
MD5 81536b6e38fa3ceca8293f87cc9f3cac
SHA1 576f5aabb46dc0c1ee12b18c55eac3b9fc067894
SHA512 4554131b26748d0dba90cdf19c813dd6f77b8667ee6d86da3023f7b3f65c546f57c47f8824e0f930467623cf94f5ed32842f6941d3c8190adeb95353a80ad92c
TLSH
T1F211C20C55F12B33E372567981E77B1293337D03FAE68F9D409552C298041819808F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 cdf532e405987c38923e7161ec2172cd4608ea362fe58c700284bddc87cf97c1
MD5 708d3c628e3e5b719589f3ec173addab
SHA1 8ed2bf09486a847389e032a84313eb085964fdae
SHA512 961dd5c7b2d9b976b437829942799bcce5860c0afaef608719aaea7f6e1a90c04d20c3e338cfdc4deda87be9cd7b05f07b3bbdeab05cc229725615375e3ce0f1
TLSH
T16411C20C54F12B33E376563981E73B1193337D03FAE68F9D008552C29804180D808E7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 8234bfa0689f742f330ee17a79967ce69d646e9f84fb3a04a5e362dc87ae1e18
MD5 b951dd7a0e433f2df21b895f439b9acb
SHA1 7b2e7e43305d4f1186bdc39ff93dd0e024755ba6
SHA512 fcc3dd048825d7e1155dc2b08a8bc2da21f57254d182db1b521f2899534924a6c1afcfe7f27966851cc8054743890d2f048253144e915091ae3ec3e2d0743649
TLSH
T14321D21879D23F22C27F953985F72A5ED6757843B7436E4C0055828F4C127535E46B1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 d63aca96291bfb2906a09a0fcdbabae4f6ed031c93ff2a2aa17dbccc8c479ed3
MD5 c53a7af24be80639aa8892009c530d8b
SHA1 dc3a2a64171ca9cbd6e968fa0ac35b001190a248
SHA512 864cc71d7e688ff4a99e0bd9e7ad55ac59226dfa58ca77d0150ba5c6edc90f92e39cbc9b272b14eb7729966bb02be2a9c6151d193b66e89263dbfc4a4a7cb9dd
TLSH
T18711C20C54F12B33E3B2563981E73B1293337D03FAE68F9E408952C298041909808E7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 9ba80bf1e66b703d7e56b4ce041369360fb15ed416f938ceefda0ecf34542bd9
MD5 afb1e683f2a2aeff20fdd179266bde5b
SHA1 162c1538a237a73b7eb8fa2c1a5c76b6b0877486
SHA512 9518cd47f75cc1504fb097151c916aa95bec0a6dc30967bd152db953f88211701cb94a7b3205042229f26768a11d4d1e9bbf299e0f4cfec9ce5e6b6cfe466858
TLSH
T15811AF0C54F22B33E366563991A72B1193337D03FAE69F9D008952C29844180D808FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 a121f861d99d0dd259beea2eb30e7770d545390bf61859c5dfd144adfa9e0502
MD5 fe0f19d75041b53cb68874f84dd2421f
SHA1 c9a2c7e13faf1651e3f2b45a973e378c01e9ad3c
SHA512 8fe614d3ce904f8d76f965a2a862262eeae4884081164f9683a35204fb55ec1a91e9966e41392f7356e1229520db7a0c1c5e89f6bb1e5b33e236bef838e7fb89
TLSH
T1E6210F28B8D23B22C23F963985F72A5ADA71B803B7436E0C0051828F4C02B536E46B1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 d4bbdd46972e1523875f47ab83679e9ebca9f33303ed9c96f2b275d26498d25b
MD5 05c345c39bf57222fe09bb3e3e0012d4
SHA1 ecade0ac4d61610ce06eb8c1d0feda1541ad9033
SHA512 c7958e3cbc0e2f37d1e51eb36fcb0ea22a4c691ab2eb9c3808dc00a6322a1ca86779bfbade04bde0aceebaa0a096a89ab34839807635bffb46844dcf3a95d7d1
TLSH
T13B11C20C54F12B33E3B6563981E73B1193337D03FAE69F9D008552C29804180D808E7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 b756170b2aded5891c550bdb0f35dec2c43631c93cf917ff2ac05821f4f00f63
MD5 5db00be1bd9369cc726b7c319490dd18
SHA1 95236b1d0d48aba3fb646afffd8d1e7148b4c4e8
SHA512 3c6b8c26ab99b6252e7060562d31118275e80aff5f300a7f3557cdce11ced66221876153653da8a584b1eb661d146dc8aab65229919cebca78f036ebe41d406e
TLSH
T14C11C20C54F12B33E372563991E73B11D3337D03FAE68F9D008552C2A804180A808E7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 c40be315258a22a1d2a7f6fd245bd2fe141b96ffbb38a5b626235d4cdd961066
MD5 f5c7b569dab36822e90c4304bbd71e10
SHA1 4ccec9e7dc5d5bbe2609bd997d09ffd6a0924678
SHA512 076de6ea7cf15118803734e7eb287337046d2412cf8698872809dc823bb0d587e77040961189243c1a91e55d7560d12da0c1f239f0bb495fd8b0bde8f9513706
TLSH
T11F21DF28B9D23B22C27F953985F72A5ADA75B843B7436F4C0055828F4C12B536E46B1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 d9b8f75db0dd102419947cf6401880b3a3c5630442c3b31b4c2ed9055623016c
MD5 cd18f8b314cbce08decf3aff605b611b
SHA1 e402a8fef4813b61bf1cf60c2f383616c9a8e159
SHA512 1679eaf88034ab69c593b9696aa18be8f8042686b975aaf0034f90ec9d66d6aaf3e0d4ac153f373be9fae32aa4703fceb0de3b167311d5b744aa0eceb8b562d6
TLSH
T18211AF0C54F12B33E362563981A73B1193737D03FAE68FAD009552C298041819808E6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 0dc7f7f6253963495306d55c4d6ae0d5031734be12e73429bb3020c5a71d7b55
MD5 cb8c315e708eb8016a06fae8c09de10e
SHA1 a3b3b67c5568b74b6f484b62e8cd8a3430751125
SHA512 712142c9cdcff403162e416ec801b342e8245bef45580da8542575fb75b7d664525f698ced8fff5d1a3e9aa72f9869753fca71828bd67dc3d9fa1c5d6d004c8e
TLSH
T16421021878D23B22C27F953985F72A5AD6717803B7437F0C0051828F4C027435E46B1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 6477f741a0e086d64c57139dc647b267bd86e1db9523dbaa91974c26d2c6ec28
MD5 e40b5f4db35b31ce41e8a3b16684e8ab
SHA1 76bba91bafd840a8ba353a066a990a46e97a6ab3
SHA512 0c52d6bd82dcd8c89118c6a15a54be6f564c3b2115856d64f9fc83d76aff2a491c58d0cb0a92a24811ec34e3612ae86c5f08c7f315595595887df7062cc3337b
TLSH
T14B11AF0C54F12B33E3A6563981A72B1193337D03FAE68F9D008552C29805180D848E6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 8440845e909fd230b8e78fa808022bdcf6fb2d6fb8cd74f209a93d5919a4c660
MD5 de5949c05a79312aff0e2cdc2005b900
SHA1 e6206b10e620590fd9ed99aa250a927f4af99d2f
SHA512 94e161a81c9c667234aa841633cd3c1b759bef474de94d2d82ac4f5d25d2afaf1c7fa2a46aaee3d1f9225df6b1fbcd9823367a22dc390d28d41cb7ce2d12560f
TLSH
T11411C20C54F12B33E372563D81E73B519333BD03FAE68F9D409552C29804180A808EBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 b3382de9bf7e6ccacbbf44cbb9489b9a885113535f216a6ffc92102b688a19af
MD5 9ca2275792157c4a379e5fcce312d927
SHA1 bb5bee4b1d0c1ade2223edd053ee8cc35d41b368
SHA512 ea347c4d73afc7915a7852c1c56d76e1688a02dc13aca7279d590878002f6b2ae0c1db81314f3d704bc76c409b6a6efbd43b29c4433f57f58cca64564c91e4d1
TLSH
T147210F28B8D23B22C23FD539C5F72A5ADA71B803B7436E0C0051828F4C02B436E46B1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 54bd1be6baa0131c137099df5c3a2c9aa33801bf0a55b10153748bee2caab245
MD5 aa2947a93285dd733e6107faf66c99a7
SHA1 5bec0cc6595f59d433ee8435cc3a69ea8e7a25b4
SHA512 525ae22a41966eca49658302a3bb4eab72bd13a7d03ab42282476dfa6c7738f726389b2e32aafdfacbaf3b07d678330c9d171a9a944020451d345a6310222deb
TLSH
T1C611AF0C54F22B33E362563991A72B1193337D03FAE68F9D008552C298451819908E6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 81022048cac8d9124d263e1c5aa76928624c6e16fa090d6516164361254c8bd3
MD5 cfa7bdf04d49381d36388ff82fca5ce7
SHA1 f152e60fe6998eaae56b2d42359cf38d0175e01b
SHA512 3b57384f6871271bbadcab2370cb8be0cb2aae93cbd6ca4256390ef7b9a50ca96f37db0e9f181b948d0295f892ccff62a40b96abeaee9eda9d6bf1082e190938
TLSH
T1BF11AF0C54F12B33E372563991A72B1293337D03FAE68F9D008552C298041809908E7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 0c958153c106f2d357e2d5b7c3d59dd954ead5cdb4a768bbd2892471dd55c1b7
MD5 93e00c03c04b944cf3e32c86e316f73e
SHA1 daef2d47666585562046b8121d65a47c910ce3e4
SHA512 a5b7ef6e46e0fc20331eab77854937daaf1c76c2d08b7d7c52ed9ca7862865fdcb96681a73ba1c2a85b0089fac0f907112f3efa96e233aa325f232d995a94f12
TLSH
T1C4210F28B8D23B22C23F953985F72A5ADA71B803B7437E0C0051828F4C12B536E46B1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 ff891759e2c708c8f5afeb01abe4c0e62735438110d4e449208cf7feb07e3256
MD5 8c9091d7c04ffcc7e60ac8f253e3527b
SHA1 fb1aede324502a50420a45d89bb3bb99b0f85950
SHA512 192a87943c934628a15d2d5fb2e90f7e87dcd45a0348dbb94905c37f166cc9cdd2259957422bc044467ffa9352b784f6ac86650ff326ef24244070c197560171
TLSH
T15F11AF0C54F12B33E362563991A72B1293337D03FAE68FAD008552C298041809948E6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 9cd530be4b3d73d8c09d93817047818d76d9d5cbfd70acbd918cf3d9ef31c480
MD5 768a6e664c938a647dd2c0d35c65705b
SHA1 0a6a2be48c93948aaba15cfb62aeecdf2291badb
SHA512 7456ad7aa61db1c074a07b3baa390e54e58344c817584be556fb5526a571caf3cd861d651fe2d0c4818a9acc03d8cb1e38340f04bf78c20dc043ed8448eb826a
TLSH
T19511C20C54F12B33E372563981E73B11D3337D03FAE68F9D408552C29805180A808E7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 c35c120ffd83f623d074c86c4e76359e2ad18fe7ecfa876ec9f5b9a24e948a7c
MD5 69305f47f830d4a8cf0b9ff5bde947b0
SHA1 fa28487c481d083b8251cc70fdfb23b80dea97e0
SHA512 931801a22482bb656748e6ec22774b4ab91b7423b9a168fba8eb7659e2e22486dcef648937379c62b30ceecd570e858fdb41a0368aeced8d4defbb7a7a1c220a
TLSH
T18F21ED28B8D23B22C23F953985F72A5ADA71B803B7426E0C0051828E4C12B436E46B1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 423b13a9ac7c56fdca0778bce44e273c1e3eedfe42a5aa0c4952289c72e41db2
MD5 79945866dad7e84baa1147902c755164
SHA1 85919a7118e51a07ccbf110ed93c5c38ed0af259
SHA512 2a01cb6afc905fc1f4c092ed53f0cbbb3b44e43767cd6b96a2d8e819a82e59fd65b5ddccebf1f6ae7c238f4e78f44ed593ceee9506cd6b47c284be5b96ef5ff2
TLSH
T1C311AF0C54F22B33E362563981A72B1193337D03FAE68F9D009552C298041809808E6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 a4d644eb92f226287ed8541bcb2902764e055c589147dbd8408e17f5bc2756f6
MD5 bff2f1db92f4e86cf0731fe80b7a203e
SHA1 7f55f9e75bfaaeb73817268926443bf69dac2c23
SHA512 ef77e56492cb61c2670b5c79b5a703ad71e7d9fff9576422eea42329defe7eba3bbe35032e2e94afeea22797a69d0612cf2e43a94bb3fa77d7e06144aa41b560
TLSH
T1AE11AF0C54F12B33E362563991A73B1293737D03FAE68F9D008552C298041809908EAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 51885e2c78668a0fffd895368d4268511b3c5b20f16d058e4a01e5fa21d27479
MD5 fcce70f4ae3fec4845d7d7076f5aed20
SHA1 89c35f9ed30f93ca00591e06f2b19d27ce8d23ea
SHA512 eb55e85c691ce236997415f50b02c1617adc122f755d9e006dd2cc9efe4e7ff5b187acd9ce324f147942c52feb10bd7ef8f8070b2dd5843348047d2e9c8fd0d9
TLSH
T13F210F28B8D23B22C27F953985F72A5EDA71B803B7436E0C0051828F4C12B836E46B1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 758defa4c3d97a3bd60fe38eac9d46ca2e6333e54be1a790779edc8f76714a6f
MD5 d9375a989987a2f8ddd0b0cf2348a948
SHA1 f0392702530c17d69550cb694557ad2848f6e48f
SHA512 812b1bb486873ded6e45bee069bb799c1d1432f109493fbe43652c067df95e6df995356de5e998fa1e6f3c681347e7b30b10b74e77b33f071d918e1b979baa26
TLSH
T16B11C20C54F12B33E372563981E73B1193337D03FAE68FAE008552C29844180D808E7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 548a4b263f2102257a549ab7863bd75a8e08bb1aba6af34dbc768c91db6c9962
MD5 d5f7303daf960dc7968decf61d365d08
SHA1 7cb840897c5118685a0783e58e9b5ac6429281d3
SHA512 c1008e57d6fd43be452c1a5142b7a29c1d8c7be9b7f3f232d1f5197b8a449ba2e74551657662f8353810c9681c2c288167ee2f8d53ceee1cdf4d1e7b8084c69f
TLSH
T14321DF28B9D23B22C27F953985F72A5ADA75B843B7436E4C0055828F4C12B536E46B1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 54878a90e5b46e2726f396d597b26123080441a29ae13832463ab89c0ac5bbe9
MD5 e77568004f16a76e9819c24eeb36956d
SHA1 b488c386aa9606b9f6e3655fb78bc7ae6f22b328
SHA512 880f8351ebf39c9c507c42f3b62bc20bcf8ff11a4063285788a2a5c01d3c9443015dfc0048cbb4f52b920a0d92d1251330cbc8284930f14fd42c7eec5a7c56f2
TLSH
T1CF210F28B8D23B22C23F993985F72A5ADA71B803B7436E0C0055828F4C02B536E46B1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 c9af9d5605e824828823b6ba00fe287c97d10bda4c771ff3bb7265d4ef0bbae7
MD5 ac19b8e7da043f9e4364757c18df71b4
SHA1 f2a4b893291d393697d5639bbd141afd0a197a23
SHA512 14f00855ac7f533431c1e1a0b8a5af40cdeae9219b120dfe494480992753c405ca35c0b6b8029b884c38f2b26ca6245c85a42da83f29d28a8d2dffa526f7d7bf
TLSH
T1E211C20C54F12B33E3B2563981E73B529333BD03FAE68F9D008552C298041809808E7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 1f36dd39281dab79e701b788d5f575c05d8f30f0c919c0890a77fbbf856a1461
MD5 684146a8580001bc399f161151ffbf71
SHA1 efba5ceeaa8b17dfc79ef8eb3b60a2ce89864f24
SHA512 fe173f03832bd9449bca95891333757809dfc6a77b64fe2be855ade9efbfe3020d8ee4f1d993113757b072ba895108272ea5ec28dce8f095807107dbf1943624
TLSH
T16621ED28B8D23B22C23F963985F72A5ADA71B843B7436E0C0051828E4C02B436E46B1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 0fb56f1ed9ba68a7957836b2d54710399a9186380f56ccf7f2b66ac156b75622
MD5 20115084437c715730fbffacd0b8ba02
SHA1 dcc9afe31cda88178a426a0117c6379764db3758
SHA512 28eae746c97140c730c5d1330ffcd910fcbf6240aab1553e6147c9014a96305a9848c395f7ce7637b0a2633a4970cde7524c5b5ff39fd30886254a7721d09bca
TLSH
T16C11C20C54F12B33E372563981E77B119333BD03FAE68F9D408552C298041809808E7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 ce34701dd17383eff365ca5d0eae242098e32f6ac5acc5dfe1249ee47ee76bee
MD5 ead0ab595c42b0260503d2844778f5aa
SHA1 7611de02a0afc49d1470ecaa6a435ac47d444051
SHA512 d3f7a7dc24c1836561a490cf38f808ba4b652f5aec2722de4571667d6d91455ad41b31c5800bd7981599e1f1b0165faa6b810f45a12b08d23ce73612b6ea1924
TLSH
T18321DF28B9D23B22C27FD53985F72A5ADA75B843B7436E4C0055828F4C12B536E86B1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 d4a73537083c2fec1034d755f15c3d0a9ce3c4c5087ffdcf2a19c5f935af005b
MD5 d5d65a28ce108c8b46ed242bb51bc5c6
SHA1 eaefa06d79b9d1f4274c7082bccd52fd1b05f43c
SHA512 6f30885ec79767afa169bdbbfb0e0775ec0fd4be318d7cf4475473251db5a6c17ceb26ae7f9042c8d1e029319bb32384513e112c15c3928d01ed96d45003df63
TLSH
T10511C20C54F22B33E3B2563981E73B1293337D03FAE68FAD008552C298041809908E7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 6feb414ad4d748e6c053eee42cfa991ba919f293ff5ccc34a31f3a022d81a306
MD5 746c78d4d6e7b1c85e7e2209c477a6a9
SHA1 db41dff94165314c8c00047ddea0e3618a396e28
SHA512 b69c297cfec772209e82aea6fb13aff1739a26d7da9099ac3dd616430265533b0d080764b4038d7cfca11457775a030cac99e3a52cb498fb3833bb81975fa751
TLSH
T130210F28B8D23B22C23F993985F72A5ADA75B803B7437E0C0051828F4C12B436E46B1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 94448d8e2df7ab2b9dfbbb49bce924a3374037a96fef1bade8dc170b86e5939a
MD5 a8263788f28cfaed5b90c6aa36221534
SHA1 e9a82fc189d48ab75429de9e55024aaba312cc0c
SHA512 a69310f88f6f0fe1ba27084a3c646906520af7b298c159f25493c5a65facc68fee7689181abbf83da5b18e75279d7f1fae82b04a76370d31dfe4042b5b4919b0
TLSH
T1A311AF0C54F12B33E362563981A72B1193337D03FAE68F9D008552C298041909808E7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 1af527301185a4fbe5106c725f18a5f30d498df564e064d3b6f1eb84e4b2cd4b
MD5 05dd3d2c07aa6cdcd2a1ff7ed8c621e2
SHA1 c003f9cf8f69a1851b9f9440da9cb18e39da8463
SHA512 4d4566997205f8696bea027332978c8551f4faccdce5e3ba7a92d243ca55f9b821bcb2289de6ef09bb62b3dd82e8d4ca5afd8daaafe559df1b0b76efadbe886d
TLSH
T12E11C20C54F12B33E3B6563981E73B1193337D03FAE68F9D008552C29804180E808E7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 c1fed8df0fcf8cb7f7d658ccabf12edb42be2d00c846795a043ca3650b74ea0b
MD5 cb46f5f781493a6356fb18a4f691233c
SHA1 7528ee32f6dadf5b9cce32b771b0064cb319d76a
SHA512 0be18868d38b855bb38e388d99574190888ad2e679daeefdf52a4a48d94a6de55f5cafa5d2a4b901ebd4a47431ce55ebed20dfcd4302b645979625f6efc1fb71
TLSH
T1F3210F28B8D23B22C27F953985F72A5ADA71B803B7436E0C0055828F4C02B436E46B1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 2eb449c08de3dd779b57f1af8e3c65bfefc2b92cbf5fc61a924a19e58bab3926
MD5 3aaabf8c7fe854e2c51cb32a79fdb392
SHA1 fc8741dae3cf9240e50a5ea509de3ac9789e5540
SHA512 dcd7400627407aa68a57ec3a70aaa814298ae29e7d868fbe76b79950b02a26ac2bd710d2205b02f14f71886e60bbbcc31f9fa47978b7b1d721325f9670abcb9e
TLSH
T1B911C20C54F12B33E372563981E73B5293337D03FAE68F9D008552C2A8041809908EBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 034b977f645c41580727eeb830ae676547b016bea9a818eddeb221bf4edc1c7d
MD5 eb1e17710252b35838a4d303d5ebb86a
SHA1 e05a635bb023c4c3260435832e85ccd66daf92e3
SHA512 9f43354fcf4c11cb6ac0f123be4a5bf7ad613e18fc5963545a7548458e83639c506b684d301700afc7d367c67eb01b2be4c6847b0b2e3c67c05d7cb5bb069834
TLSH
T11011C20C54F12B33E372563991E77B1293337D03FAE68F9D009552C298041809908E7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 76e1a2c7322da58649a2b8f46383ed1b26f73c085c5dd2cb2bc000719876117b
MD5 6c086b004c548c7d3d6cb76ad7afadab
SHA1 5596264dc13e89f79e13b9ffb81afeadb33079e3
SHA512 543a02e8d6a04f5e8a526d9f7456447a85b25b452087e78fd865a3e390a44c2706610fe3bdfa17e2d5372bc2cf8fe49338bbe5b7a46b960b530a27a205e2f02b
TLSH
T1A0210F28B8D23B22C23F953985F72A5ADA71B803B7436E0C0055828F4C02B536E46B1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 c0dcbe75cc57fa436b98f9da111936d2051ca670f4fd4ac5ed8964d1f604619a
MD5 b97f2bf905cf0b889d558da28f2d9b92
SHA1 24d5a8579b7499543d0ac5799228197c6754ef81
SHA512 3d2b4d1a40816c6013c3fe40401d927de6673d7481b7e1bf6f592a6031568d7a5dfec0c85c35ace63d9a90d0905c2f3e74598913ec009c83b10a8d6e0f9e4e92
TLSH
T11F11C20C54F12B33E372563981E77B1193337D03FAE68F9E408552C29804180D808E7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 07cbd9ceb2de2bd1e6e23c5954c3ce2339bc3a5be8fd465acf8468b644339cb0
MD5 0d146c10f893e7df2c07f847a03abb5a
SHA1 cb3f9a5053fb3e7cfabb10c83ebab234fa3c4379
SHA512 e5e6f2522adb45f00937fbd620593cbc8de77e8fb15cf942e0e7e7d9ac49f31bcc372ca2de2a11ba7b5c453dae4fd8d22aec1dccead39d631959d7e1d2a110cc
TLSH
T10721DF28B9D23B22C27F953985F72A5ADA75B843B7437E4C0055828F4C12B536E46B1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 d164f496bafbacb86a20260c1976f04bee0270fe2a67779ce36766bc36c03e3e
MD5 d74252c616680921c5194b68b43c252f
SHA1 c311e14fbee4cac560c7c9b88dc3463f65c523e2
SHA512 09d4a82e79403831060e76801d6600485b24ca537cd8620d0a86dc2332a2dd39b6a9a9d583959087ea4885d55fbbd9b574983c538e0063456182c30b46ce8695
TLSH
T19711C20C54F12B33E3B2563A81E77B51D373BD03FAE68F9D008552C298041809809EBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 d634b4f67ef11d1e9c765de2a6cb86cb642d6494c2c9a6f7eb45786f02360893
MD5 847125f01204b97f4ca715fd1222a692
SHA1 5a153c3bba837fc2e9a6e055e412f823307a5a74
SHA512 61e67f31b8668e0581b287a5176c7fdfedec7187fdb1dfa33dc4387aee48cd55a51b68379e5a8e54e09f08e12f6c648cd44548bbd3e320035d3f68fe650d803f
TLSH
T19D11AF0C55F12B33E366563981A72B5293737D03FAE68FAD008552C298051809848E7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 3784316d382caa1f94203461214c7d2a65da0e68836c27e3fc6a8cc283a761f5
MD5 1eeb30d0e28ccc044c2728b4c39965c1
SHA1 7ee3a3fb4a05afc6e2bff3fb03e2a170309439ed
SHA512 b93cca96dd1798f9e0d2721565a464e05e2045eb2d48a16a8d5c2ef9054d8b80edfb53fc02e9bb25dba2b96769a1f67bb03dd742c17b9d05791e6117c9e7a1ef
TLSH
T1BD21C01879D23B22C27F953985F72A5AD6757843B7436E4C0055828F4C127535E46B1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 18baa44ed18e1a489f20b6a34d3e6d96c846ba58eb0a69f519169708cd1d9cc3
MD5 f8089d564ff5e41aa8a63928b8c01d69
SHA1 f2edbaabdba77552269c4e256b8503459e15b298
SHA512 8b5c8bbfb2d6a38959db57f62757c76f06a7237395cd37d25fa4e1c18a15b055613c3b6bfdf8f6f3f95d78db1a6c632e246813e61928f3a62606de34d0db1587
TLSH
T16911C20C55F12B33E372563981E73B1193337D03FAE68F9D008952C298041809848E7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 3b7e5577bcb0b2b78a55e7fac12be1d9850947df6bb40ba5347180de6e1d6052
MD5 dce6629681edcbb3203d6488be6137d9
SHA1 4a86a2953f1f9c2113d4f605cb8e94692be7ec20
SHA512 da65dbfc0c23665d001f278350dcbfa848c07ec85f6b1b1dbfc51e0330288fb28b777064cacdb7bf225510f378fd409457b65be298c039296bc485707187abaa
TLSH
T1D7210F28B8D23B22C23FA53985F72A5ADA71B803B7436E0C0051828F4C02B436E46B1F
MD5 SHA1 SHA512 TLSH

Submit Download

HelpMe.exe

Path C:\Windows\SysWOW64\HelpMe.exe
Size 971KB
SHA256 a245ec31c2c31da951fdce8274e979eafd59313338cfa97877921c0a44e0fbf7
MD5 e1d2d9144fbe6c84a96e45d535bf9afc
SHA1 0081dd08efe2c39e1a562ade4c20345599a5b9ae
SHA512 c1b6ab43ee766eaa036c0237012210dcc19978248939cada0470ebd130a6ab17632176658295284163b2420e1cf51785a7591c485a546ad71530a78bb6f04148
SSDEEP 12288:Zp4pNfz3ymJnJ8QCFkxCaQTOl2BU866px5GpX/Kc:TEtl9mRda1cSS5GJ/h
TLSH
T1B7258D27A7E18432E1B3153C4D6B96750837BD512AB8988B27EC3D0C9F77AC1A835393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-3986082593-3624157295-3514260330-1000\desktop.ini
Size 1.1MB
SHA256 ff33793f390a729d9ec7b79d30358f0468938f510974227de4f5adcf08dfc6cc
MD5 7101e45e470377e6948c251aa885b5cc
SHA1 46b7fcb7b83870e876ef66dcd445ae5b789605f7
SHA512 56b9ee990dac6abb899396c65f02ff59f13309c754a0d7ec602cf69850799946721324f012eb3801f24ad10b72cf364b58d4580a704c74d6809a90d590af57ac
SSDEEP 24576:TEtl9mRda1cSS5GJ//mWclRd1jRi0sjz1L:oEs1hS5W/mC1L
TLSH
T176358D27A7D08431E1B315385D7AA6790937BD212BB4988B27EC3D0C9F77AC1A835793
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AUTORUN.INF

Path F:\AUTORUN.INF
Size 145B
SHA256 cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae
MD5 ca13857b2fd3895a39f09d9dde3cca97
SHA1 8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0
SHA512 55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47
TLSH
T188C04868F16A939D1E0C399093A400237083A208019E420E93DDE4A53DD41084F05188
MD5 SHA1 SHA512 TLSH

Submit Download

memory/380-60-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/380-55-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/380-120-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/380-185-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/380-90-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/380-140-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/380-75-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/380-198-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/380-228-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/380-237-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/380-105-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/380-42-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/380-170-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/380-210-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/380-155-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/380-219-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4176-66-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4176-96-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4176-161-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4176-8-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4176-232-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4176-81-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4176-223-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4176-213-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4176-206-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4176-146-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4176-111-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4176-176-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4176-191-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4176-44-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4176-128-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4176-51-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/5440-46-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/5440-190-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/5440-145-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/5440-127-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/5440-63-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/5440-175-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/5440-201-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/5440-110-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/5440-43-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/5440-160-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/5440-212-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/5440-41-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/5440-95-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/5440-0-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/5440-221-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/5440-1-0x0000000000460000-0x0000000000461000-memory.dmp

Download

memory/5440-231-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/5440-2-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/5440-80-0x0000000000400000-0x0000000000477000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads