blackshades | 095816ddc954f148908d83b18ec2ea05930f3abc913c437c49b18652d6f85183

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/09/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
095816ddc954f148908d83b18ec2ea05930f3abc913c437c49b18652d6f85183.exe
Size 2.0MB
Sample260909-sd2staysa1
SHA256 095816ddc954f148908d83b18ec2ea05930f3abc913c437c49b18652d6f85183
MD5 29da169eb85fd25bb8b61ae92fbe3dc7
SHA1 21c9e2134d21848cebcd4621fe56281fd3ec48f0
SHA512 cb8056df289cdf8b0ccba4c7dfab2861bf8519d399e2e554532ff6e3497775ca7dfec43589d426c5537bfaec995ff61a78fd13fcc4c2efe26edb2bac4de4b5bb
SSDEEP 49152:dsThC6TYNwUXz+JR2wjx8+X5gZ+th1aaucQPfM7cSCGDt7WWcrRhajx3l7bQonWl:dsThC6TYNwUXz+JR2wjx8+JgZ+th1aaw
TLSH
T171A5F2FE264E2C65F14BBA2B821B771BF65651A2604B0F048A8346E31DEFF53BF11146
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution blackshades persistence rat upx

Malware Config

Signatures

Family: Blackshades
Blackshades is a remote access trojan with various capabilities.
rat blackshades

Blackshades payload 14 IoCs

resource	yara_rule
behavioral1/memory/1840-35-0x0000000000400000-0x000000000045C000-memory.dmp	family_blackshades
behavioral1/memory/1840-51-0x0000000000400000-0x000000000045C000-memory.dmp	family_blackshades
behavioral1/memory/1840-52-0x0000000000400000-0x000000000045C000-memory.dmp	family_blackshades
behavioral1/memory/1840-59-0x0000000000400000-0x000000000045C000-memory.dmp	family_blackshades
behavioral1/memory/1840-61-0x0000000000400000-0x000000000045C000-memory.dmp	family_blackshades
behavioral1/memory/1840-63-0x0000000000400000-0x000000000045C000-memory.dmp	family_blackshades
behavioral1/memory/1840-66-0x0000000000400000-0x000000000045C000-memory.dmp	family_blackshades
behavioral1/memory/1840-68-0x0000000000400000-0x000000000045C000-memory.dmp	family_blackshades
behavioral1/memory/1840-72-0x0000000000400000-0x000000000045C000-memory.dmp	family_blackshades
behavioral1/memory/1840-75-0x0000000000400000-0x000000000045C000-memory.dmp	family_blackshades
behavioral1/memory/1840-77-0x0000000000400000-0x000000000045C000-memory.dmp	family_blackshades
behavioral1/memory/1840-80-0x0000000000400000-0x000000000045C000-memory.dmp	family_blackshades
behavioral1/memory/1840-82-0x0000000000400000-0x000000000045C000-memory.dmp	family_blackshades
behavioral1/memory/1840-84-0x0000000000400000-0x000000000045C000-memory.dmp	family_blackshades

Modifies firewall policy service 3 TTPs 10 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\bot.exe = "C:\\Users\\Admin\\AppData\\Roaming\\bot.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Directory\\Windowsdef.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	095816ddc954f148908d83b18ec2ea05930f3abc913c437c49b18652d6f85183.exe

Executes dropped EXE 3 IoCs

pid	Process
1632	Windowsdef.exe
1840	Windowsdef.exe
872	Windowsdef.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDef = "C:\\Users\\Admin\\AppData\\Roaming\\Directory\\Windowsdef.exe"	reg.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1632 set thread context of 1840	1632	Windowsdef.exe	89
PID 1632 set thread context of 872	1632	Windowsdef.exe	90

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/896-0-0x0000000000400000-0x00000000005FD000-memory.dmp	upx
behavioral1/files/0x000700000002451e-15.dat	upx
behavioral1/memory/896-28-0x0000000000400000-0x00000000005FD000-memory.dmp	upx
behavioral1/memory/1840-29-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/1840-35-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/1840-34-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/872-45-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/872-41-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/872-47-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/1632-50-0x0000000000400000-0x00000000005FD000-memory.dmp	upx
behavioral1/memory/1840-51-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/1840-52-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/872-53-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/1840-59-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/1840-61-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/1840-63-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/1840-66-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/1840-68-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/1840-72-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/1840-75-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/1840-77-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/1840-80-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/1840-82-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/1840-84-0x0000000000400000-0x000000000045C000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1768	cmd.exe
3092	cmd.exe
5028	cmd.exe
1616	cmd.exe
560	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windowsdef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windowsdef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	095816ddc954f148908d83b18ec2ea05930f3abc913c437c49b18652d6f85183.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windowsdef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
4928	reg.exe
4912	reg.exe
2816	reg.exe
1300	reg.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: 1	1840	Windowsdef.exe
Token: SeCreateTokenPrivilege	1840	Windowsdef.exe
Token: SeAssignPrimaryTokenPrivilege	1840	Windowsdef.exe
Token: SeLockMemoryPrivilege	1840	Windowsdef.exe
Token: SeIncreaseQuotaPrivilege	1840	Windowsdef.exe
Token: SeMachineAccountPrivilege	1840	Windowsdef.exe
Token: SeTcbPrivilege	1840	Windowsdef.exe
Token: SeSecurityPrivilege	1840	Windowsdef.exe
Token: SeTakeOwnershipPrivilege	1840	Windowsdef.exe
Token: SeLoadDriverPrivilege	1840	Windowsdef.exe
Token: SeSystemProfilePrivilege	1840	Windowsdef.exe
Token: SeSystemtimePrivilege	1840	Windowsdef.exe
Token: SeProfSingleProcessPrivilege	1840	Windowsdef.exe
Token: SeIncBasePriorityPrivilege	1840	Windowsdef.exe
Token: SeCreatePagefilePrivilege	1840	Windowsdef.exe
Token: SeCreatePermanentPrivilege	1840	Windowsdef.exe
Token: SeBackupPrivilege	1840	Windowsdef.exe
Token: SeRestorePrivilege	1840	Windowsdef.exe
Token: SeShutdownPrivilege	1840	Windowsdef.exe
Token: SeDebugPrivilege	1840	Windowsdef.exe
Token: SeAuditPrivilege	1840	Windowsdef.exe
Token: SeSystemEnvironmentPrivilege	1840	Windowsdef.exe
Token: SeChangeNotifyPrivilege	1840	Windowsdef.exe
Token: SeRemoteShutdownPrivilege	1840	Windowsdef.exe
Token: SeUndockPrivilege	1840	Windowsdef.exe
Token: SeSyncAgentPrivilege	1840	Windowsdef.exe
Token: SeEnableDelegationPrivilege	1840	Windowsdef.exe
Token: SeManageVolumePrivilege	1840	Windowsdef.exe
Token: SeImpersonatePrivilege	1840	Windowsdef.exe
Token: SeCreateGlobalPrivilege	1840	Windowsdef.exe
Token: 31	1840	Windowsdef.exe
Token: 32	1840	Windowsdef.exe
Token: 33	1840	Windowsdef.exe
Token: 34	1840	Windowsdef.exe
Token: 35	1840	Windowsdef.exe
Token: SeDebugPrivilege	872	Windowsdef.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
896	095816ddc954f148908d83b18ec2ea05930f3abc913c437c49b18652d6f85183.exe
1632	Windowsdef.exe
1840	Windowsdef.exe
1840	Windowsdef.exe
1840	Windowsdef.exe
872	Windowsdef.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 896 wrote to memory of 1768	896	095816ddc954f148908d83b18ec2ea05930f3abc913c437c49b18652d6f85183.exe	84
PID 1768 wrote to memory of 4412	1768	cmd.exe	87
PID 896 wrote to memory of 1632	896	095816ddc954f148908d83b18ec2ea05930f3abc913c437c49b18652d6f85183.exe	88
PID 1632 wrote to memory of 1840	1632	Windowsdef.exe	89
PID 1632 wrote to memory of 1840	1632	Windowsdef.exe	89
PID 1632 wrote to memory of 1840	1632	Windowsdef.exe	89
PID 1632 wrote to memory of 1840	1632	Windowsdef.exe	89
PID 1632 wrote to memory of 872	1632	Windowsdef.exe	90
PID 1632 wrote to memory of 872	1632	Windowsdef.exe	90
PID 1840 wrote to memory of 3092	1840	Windowsdef.exe	91
PID 1840 wrote to memory of 560	1840	Windowsdef.exe	92
PID 1840 wrote to memory of 1616	1840	Windowsdef.exe	93
PID 1840 wrote to memory of 5028	1840	Windowsdef.exe	94
PID 1632 wrote to memory of 872	1632	Windowsdef.exe	90
PID 1632 wrote to memory of 872	1632	Windowsdef.exe	90
PID 1616 wrote to memory of 2816	1616	cmd.exe	99
PID 5028 wrote to memory of 4912	5028	cmd.exe	100
PID 3092 wrote to memory of 1300	3092	cmd.exe	101
PID 560 wrote to memory of 4928	560	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\095816ddc954f148908d83b18ec2ea05930f3abc913c437c49b18652d6f85183.exe
"C:\Users\Admin\AppData\Local\Temp\095816ddc954f148908d83b18ec2ea05930f3abc913c437c49b18652d6f85183.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SnlkX.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDef" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:4412
- C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
  "C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
    C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1840
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3092
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1300
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:560
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe:*:Enabled:Windows Messanger" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4928
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1616
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2816
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5028
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4912
- - C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
    C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SnlkX.txt

Path C:\Users\Admin\AppData\Local\Temp\SnlkX.txt
Size 152B
SHA256 4620f5f49d3f3c3fcb10d7dd83e5fdc0b2efd44ae429ee5a8dc3e64d76e6bc9a
MD5 130a1ad614bfc1851533b7a02e302622
SHA1 6cd68d0bacb7b24ca9baedc80d90f1bfca3bb92c
SHA512 16b5e40deb2e66287b86bbff11ac986f36b94a5849fbe2ed7124296e95d563ec0e9b00cbd6008c993c383d1610d371177faf5a9cd5da77a34a778e901f9e7a25
TLSH
T11BC02B027AFCAF0AF0315A13011FA284C7E247D73000AA4D5780010C6C56D4FD4A21D3
MD5 SHA1 SHA512 TLSH

Submit Download

Windowsdef.txt

Path C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.txt
Size 2.0MB
SHA256 367685f2229458117f1b8bf357410e8b5451a1dd7d9bce89366285d94cee74e5
MD5 73f1ab0f5d86fd3a387e07347c71bdcc
SHA1 2170d0c310952ccd01934fc4a8260b4d21d3675e
SHA512 4af690d73761d51f492e2838632ee378744f3ea85067bd9447120b8f042b8b844636dafcc0b3593ecea02bd2b6954562d123cef777ade2db41faa5ec54e28f94
SSDEEP 49152:dsThC6TYNwUXz+JR2wjx8+X5gZ+th1aaucQPfM7cSCGDt7WWcrRhajx3l7bQonWS:dsThC6TYNwUXz+JR2wjx8+JgZ+th1aal
TLSH
T1DAA5F2FE264E2C65F14BBA2B821B771BF65651A2604B0F048A8346E31DEFF53BF11146
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/872-47-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/872-53-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/872-45-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/872-41-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/896-28-0x0000000000400000-0x00000000005FD000-memory.dmp

Download

memory/896-0-0x0000000000400000-0x00000000005FD000-memory.dmp

Download

memory/1632-50-0x0000000000400000-0x00000000005FD000-memory.dmp

Download

memory/1840-52-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/1840-63-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/1840-51-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/1840-35-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/1840-29-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/1840-59-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/1840-61-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/1840-34-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/1840-66-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/1840-68-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/1840-72-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/1840-75-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/1840-77-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/1840-80-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/1840-82-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/1840-84-0x0000000000400000-0x000000000045C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads