stihat | 0cf3a844a9d671d8115fd8ad40568349d32d7282ef04de9d695837bbc9ab0b0a

Analysis

max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 07:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0cf3a844a9d671d8115fd8ad40568349d32d7282ef04de9d695837bbc9ab0b0a.exe
Size 8.1MB
Sample261027-jkr3hsstfv
SHA256 0cf3a844a9d671d8115fd8ad40568349d32d7282ef04de9d695837bbc9ab0b0a
MD5 8db532e4f3c3b633e0ab5487205ccc45
SHA1 bf33861d83205bf6feebf2c561cba86494876545
SHA512 21c8f92fce844acc5239a76b422d6b60cebcd832a4e1d67101f058413e06cf45acc1a5e4496bac75390c45aa27596e5a32faa69b90ee6728b40dda4e7fcc6a66
SSDEEP 196608:ona9+jC/EDtY24xYzXBXqn+uPo7NKP0XSGagLKhziW:oakjCQm1xOXBGSK8iGaOKhzZ
TLSH
T18A861212B3E48471E0B316344D379A680977BC612E788A9F32DC3A0D6F767C26936B57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery stihat persistence privilege_escalation spyware worm

Malware Config

Signatures

Family: Stihat
Stihat is a worm written in Delphi.
worm stihat

Detects Stihat payload 54 IoCs

resource	yara_rule
behavioral2/memory/2888-0-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2888-2-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/files/0x000500000000053e-6.dat	family_stihat
behavioral2/memory/260-9-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/260-8-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/files/0x000100000000002f-17.dat	family_stihat
behavioral2/files/0x001200000001c4df-33.dat	family_stihat
behavioral2/memory/2888-44-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4296-46-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2888-47-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/260-48-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2888-53-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/260-54-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4296-63-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4296-64-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2888-69-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/260-70-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4296-79-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2888-84-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/260-85-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4296-94-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2888-99-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/260-100-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4296-109-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2888-114-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/260-115-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4296-124-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2888-125-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/260-132-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4296-145-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2888-148-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/260-149-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4296-160-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2888-163-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/260-166-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4296-175-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2888-180-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/260-181-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4296-188-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2888-195-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/260-196-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4296-203-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2888-208-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/260-209-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4296-214-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2888-217-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/260-218-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4296-223-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2888-226-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/260-227-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4296-232-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2888-235-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/260-236-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4296-241-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	0cf3a844a9d671d8115fd8ad40568349d32d7282ef04de9d695837bbc9ab0b0a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	0cf3a844a9d671d8115fd8ad40568349d32d7282ef04de9d695837bbc9ab0b0a.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe

Executes dropped EXE 2 IoCs

pid	Process
260	HelpMe.exe
4296	HelpMe.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\A:	0cf3a844a9d671d8115fd8ad40568349d32d7282ef04de9d695837bbc9ab0b0a.exe
File opened (read-only)	\??\H:	0cf3a844a9d671d8115fd8ad40568349d32d7282ef04de9d695837bbc9ab0b0a.exe
File opened (read-only)	\??\I:	0cf3a844a9d671d8115fd8ad40568349d32d7282ef04de9d695837bbc9ab0b0a.exe
File opened (read-only)	\??\J:	0cf3a844a9d671d8115fd8ad40568349d32d7282ef04de9d695837bbc9ab0b0a.exe
File opened (read-only)	\??\Y:	0cf3a844a9d671d8115fd8ad40568349d32d7282ef04de9d695837bbc9ab0b0a.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\O:	0cf3a844a9d671d8115fd8ad40568349d32d7282ef04de9d695837bbc9ab0b0a.exe
File opened (read-only)	\??\S:	0cf3a844a9d671d8115fd8ad40568349d32d7282ef04de9d695837bbc9ab0b0a.exe
File opened (read-only)	\??\D:	HelpMe.exe
File opened (read-only)	\??\V:	0cf3a844a9d671d8115fd8ad40568349d32d7282ef04de9d695837bbc9ab0b0a.exe
File opened (read-only)	\??\X:	0cf3a844a9d671d8115fd8ad40568349d32d7282ef04de9d695837bbc9ab0b0a.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\G:	0cf3a844a9d671d8115fd8ad40568349d32d7282ef04de9d695837bbc9ab0b0a.exe
File opened (read-only)	\??\R:	0cf3a844a9d671d8115fd8ad40568349d32d7282ef04de9d695837bbc9ab0b0a.exe
File opened (read-only)	\??\U:	0cf3a844a9d671d8115fd8ad40568349d32d7282ef04de9d695837bbc9ab0b0a.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\B:	0cf3a844a9d671d8115fd8ad40568349d32d7282ef04de9d695837bbc9ab0b0a.exe
File opened (read-only)	\??\W:	0cf3a844a9d671d8115fd8ad40568349d32d7282ef04de9d695837bbc9ab0b0a.exe
File opened (read-only)	\??\Z:	0cf3a844a9d671d8115fd8ad40568349d32d7282ef04de9d695837bbc9ab0b0a.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\N:	0cf3a844a9d671d8115fd8ad40568349d32d7282ef04de9d695837bbc9ab0b0a.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\Q:	0cf3a844a9d671d8115fd8ad40568349d32d7282ef04de9d695837bbc9ab0b0a.exe
File opened (read-only)	\??\D:	0cf3a844a9d671d8115fd8ad40568349d32d7282ef04de9d695837bbc9ab0b0a.exe
File opened (read-only)	\??\K:	0cf3a844a9d671d8115fd8ad40568349d32d7282ef04de9d695837bbc9ab0b0a.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\M:	0cf3a844a9d671d8115fd8ad40568349d32d7282ef04de9d695837bbc9ab0b0a.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\L:	0cf3a844a9d671d8115fd8ad40568349d32d7282ef04de9d695837bbc9ab0b0a.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\T:	0cf3a844a9d671d8115fd8ad40568349d32d7282ef04de9d695837bbc9ab0b0a.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\D:	HelpMe.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\P:	0cf3a844a9d671d8115fd8ad40568349d32d7282ef04de9d695837bbc9ab0b0a.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\AUTORUN.INF	0cf3a844a9d671d8115fd8ad40568349d32d7282ef04de9d695837bbc9ab0b0a.exe
File opened for modification	C:\AUTORUN.INF	0cf3a844a9d671d8115fd8ad40568349d32d7282ef04de9d695837bbc9ab0b0a.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HelpMe.exe	0cf3a844a9d671d8115fd8ad40568349d32d7282ef04de9d695837bbc9ab0b0a.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0cf3a844a9d671d8115fd8ad40568349d32d7282ef04de9d695837bbc9ab0b0a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpMe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpMe.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\NotificationData	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f481cffcda87848be43b5fdf8091c1c60d0260001002600efbe110000005b4b5a1d0342dd016d2b96a21042dd016d2b96a21042dd0114000000	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3348	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3348	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3348	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3348	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 260	2888	0cf3a844a9d671d8115fd8ad40568349d32d7282ef04de9d695837bbc9ab0b0a.exe	90

C:\Users\Admin\AppData\Local\Temp\0cf3a844a9d671d8115fd8ad40568349d32d7282ef04de9d695837bbc9ab0b0a.exe
"C:\Users\Admin\AppData\Local\Temp\0cf3a844a9d671d8115fd8ad40568349d32d7282ef04de9d695837bbc9ab0b0a.exe"
1⤵
- Modifies WinLogon for persistence
- Creates a file in the Startup directory
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\SysWOW64\HelpMe.exe
  C:\Windows\system32\HelpMe.exe
  2⤵
  - Modifies WinLogon for persistence
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:260

C:\Windows\explorer.exe
Explorer.exe HelpMe.exe
1⤵
- Modifies registry class
PID:1856

C:\Windows\SysWOW64\HelpMe.exe
C:\Windows\SysWOW64\HelpMe.exe
1⤵
- Modifies WinLogon for persistence
- Creates a file in the Startup directory
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3952

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3348

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.exe

Path C:\$Recycle.Bin\S-1-5-21-4154726816-2055034831-2297277433-1000\desktop.ini.exe
Size 8.1MB
SHA256 4bd60b91d06587291236bfaad6399672f3f12d126e634e6c7ab67e6cccfbac81
MD5 896874a0b91115d66d99b6cb10582f5f
SHA1 c6c305aede86c55e4cc05779486fefa09800f758
SHA512 276b2e82ccf7c934d28e7467a1dfbbe60e6f22ba443a87c299ee0c33172f0e2b6ac992d60d7aa82103941113a7a69251ded6df781b299f883d6ab19a377bd5f2
SSDEEP 196608:ona9+jC/EDtY24xYzXBXqn+uPo7NKP0XSGagLKhzi+:oakjCQm1xOXBGSK8iGaOKhzT
TLSH
T13E861212B3E48471E0B316344D379A680977BC612E788A9F32DC3A0D6F767C26936B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 0e997644125e60cafb37f30ce66210869bec5e33c558d47543e6f11ad8fe0089
MD5 fd4ced140621ed502e8aa63c2438fca0
SHA1 4cddb67abe759d464447c08ad4ddcc457604ba43
SHA512 fd2b6da76cb869693c8beb2ae1fd24688b93dfb1ced60f955a58acb123c33215ddfbe4d5b2f7daa544c60e854672401b2112ca0a754e6cc217d72aaad7534d8b
TLSH
T1D011122C29813F67D7B1563A54E31713A3773C02F5D5AF6A418913819C49322D954FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 f13fd7d209566cb50fff420a0b763a9090645d25c0b8c86a9057d3e5b5227e68
MD5 8ccf5eccbc375d04027b1a2f76814f38
SHA1 edc7d375fd9eb148a704adf8e2d129491b54afdc
SHA512 d31ae80b32b9b4e99b57a733fead0fce22704ea1bc40be4a35bc1fef522cab620335256ee4fbd06ba443917714fa2568732486f32a5e652671e4bc408a9f1388
TLSH
T10B11522C29813B67D3B1163A00E3071293333C02F4D1AF6A418913819C49322D850FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 bd321b20abaad1178d0ed90eb5c8af7aa9c2082fe306ae2152426a538f9a8689
MD5 dbacf8ce05027ebcb58e0288f2a8d092
SHA1 91c2f91b1c3153df641a0e91686ca7269ed72970
SHA512 157e0437f4ac804424039ed942bbe89781b38bf09e74fad5ea34584746c662e25393ac1836a4469ad8c10c4be7d0a13eb96d4e57534e5b26a19c0c2432f165e8
TLSH
T1FA11122C29813B67D7B1563A50E3171293773C02F5D1AF6A428913819C49322D954FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 1bce7095cd0f3e2d8e361bd748e08ff8847488368fa041b24320e913ec42d26e
MD5 75c0c7a9a819a0cca0e3d68b44eef980
SHA1 c8c51473364944d7d1d60cf479fe2466345644b8
SHA512 a404adc8a515b2ad809f03bbdca8a1850ae44c94e394e3d381a775011ac54ecb3183d469021481f516b78701e0eda1dd6ec6ad302f5ad5bbb5762fadb316a8a1
TLSH
T11121DB386CC21F27C2B7D6378AE659A7E279785272026F0E00C947441C1B7476AC1F5E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 010a6c1ce8e309d2e3d6e5a6769a3cdaa4b045442c1d75561fd99abc7c2245ca
MD5 071a3ff2f8fb1c6883dd051223097881
SHA1 6395cb42ba04d964901a3d0f8fe6ecc65ba18f36
SHA512 0301f58441853fec4bb8e22579674321312a1bbe9485091611937ff4d1e68fb308e58b948c7937e33d71147af37723649e19fd81697e81b797b60d559660c0f2
TLSH
T11611522C29813B63C3B1163A00E30712A3377C02F4E1AF6A418913819C09322D990FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 663b3702b1be03a6908eacecd8a28a702c9a3acfe99e1e10b3877f5230c9b3a6
MD5 0f0540f552e86afb3425685c8af5b978
SHA1 5dc723090ee1ef5459fc4cce68cae7399c2fbe37
SHA512 dee4bdbaa38539d9b8d6bdea38b1b409ff21964fb717e576de481b4a7a60cc930a38edfbd3b19e1d1185d64347da1c5b318842992261b898f6ac068ee073b398
TLSH
T1B911122C29C13B67D7F1563A50E3171293773C02F5D1AF6A819A1381AC49322D954FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 e4dca721b18189772ffd37d6e394505aa52c6fbbfc15e6030de69e0455296263
MD5 66163ef359864c4893db1f5f56c99d03
SHA1 7c3b9a67f851985cc31bb4bb10c926aedffa3d55
SHA512 614395437bb25ec75ed77afbb27dfbc1fcd87d5c7b4ae68aa8b921e0cace47cd63ac333bb4a501572ab4709e45e6a917b13e65c0c82c67111f2350913beac66f
TLSH
T17021DB3C6CC21F27C2BBD63786E65997E279785272026F1E00C947441C1B747AA81F5E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 ee61ac01171fb8c604ad8566078c19a7589126d07105ae4100c10c52a3626bff
MD5 0e19f937b799af2bc31734139760e186
SHA1 09924f58e877cfc5519f3b6eb6bf46a4536618c8
SHA512 c898bc4910be7fd6685cb8c200aa104f8a781c4d05ab21e2c278816548853cdae6904f55f4b76a89c5bcd45e1800bbdbfe1440c8e40036954a41107b1afba9af
TLSH
T1D911122C29813B67D7B1563A54E3171293777C02F5D1AF6A418913819C49322D954FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 a8790dc743d314410aa2fcaa487ea6ddbd90dd7a20fb3b3ebb363533e202e699
MD5 10402668038220f2616431016d0edae2
SHA1 95c1dba80c5acc221e32d1220d376b2e97ee3170
SHA512 63c7e0b7ea3a41320519ba9f27ad190cdfe91e56ba94674eb3f8be48793714005a7b9a53a1d944c4e90a93768266c6f8c3502b511fed2844f4ae2a70a9fae54f
TLSH
T1DC11EF2829813B67D7B1563A54E3171293773C02F5E1AF6A418A13819849222D954FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 5edbe5c48a4a71be011679df65ac80032ea3412f930936a5cd1c7f86fd015351
MD5 45b5d62301989a086bff9ebc6cefed06
SHA1 b9c0a0d0b11b7ae861335133ccc0562c0ee84a9d
SHA512 bad72d0a57f2d30a3e9fc7a72f84ae4dbef9f56a66240041846090e0fac0166f0cbd8e4f3114e3005610a94a57f0eac7242c480adc7f4cb47cf4637966bb1148
TLSH
T1FE21DB386CC21F27C2B7D637CAE65997E679785272026F0E00C947441C1B7476A81F5E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 26103bb9992975dada9b5f6d55e7c7336fe6ad0fbca3fb2e36f1717a5021d2c8
MD5 4b6409b962157fbbe65518f051fb87f2
SHA1 f06d0d4a56b1838b16159c3e537144a1dc1666f0
SHA512 54b8da7ee60fc602eabfe7aa41e544110a4f3f0203830cc0fce0925b036c095f2be90329ca51305b2ca59f7758a0327194e5b65edce23d0dd69ddff19089ea42
TLSH
T11811122C29813B67D7B1563A54E31713A3773C02F5D1AF6A41891381AC49322D954FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 12bd707a7e16668b7b129206bb9194db5f20909c95bf6b3be769f0e548052306
MD5 2f00600e4da91d6e81c72ad0c6261ca6
SHA1 4dcf227bc67bf0c1df67c41023baa1df6a480c4c
SHA512 8b571a51e9aed6d36167d520c817f99b60fafe64f9d25f5c871afb50e0d9eb11d6c39e47ab5a2a09e0c1cbae4825ee9c432310938891933889e12563e0c5a68f
TLSH
T18811122C29813B67D7B1563A50E3171293773C02F5D1AF6A428A13819C49362DD54FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 db983069b01cf640c83ce739a51aca9bbab1bb07e24ba5a54fcb846ac7dafbf5
MD5 44c6b335bf4fef04cf74cfd986def84b
SHA1 3ca6e3059c341d5902d8b9e062eab746d09df316
SHA512 4013c5306ab8216c33ee7693ced22674cda5e7df9ea020141e026f27c40f7e1d4ab4676bfe89ee9b191d3751d0fb5fdd524445c3cb356a15a23daba42cea1e64
TLSH
T14611122C29813B67D7B1563A50E3171293773C02F5D1AF6A418A13819C49322D994FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 30495e949935fe406c5a1e6e047ddf4800dcfb6cb7a37927bd7d5798b8327164
MD5 b4f3d66c7eba0588d15ffacb46820364
SHA1 4cfc014df365c12ff6ad31ab9a163cf5d1567550
SHA512 9e699c7f6366dc08f0ea5e4f48d28fa2b5cfd6460393efd4e0c7f44da1f939be25c02967f4ce6e2f89505f8fb5a593cd01700b636900450ae2b26d260a72e05b
TLSH
T11611122C29C13B67D7B1563A50E3171293773C02F5D1AF6A418913819C49322D994FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 61d7119d52d416051cd94bfaa9f7b1b28e84daec89506b34bc9888a98cd0d2ca
MD5 7ca8632eda08a333042bbb91fcd09254
SHA1 824ac6f3d676369b3636ea0e84f84cbd70b2e1cd
SHA512 f3ee8e47bc1f08ac3e360b759ee8d2a7caae21ef9f8312aa9c84baba8a1ba7929201d0ac1aff8a9553d57d69407d9b88111728c79f8dd38df34781ec46405a03
TLSH
T1E521DB386CC21F27C2BBD6378AE65997E279785272026F0E00C947441C1B7476AC1F5E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 51046bc52ef2b9ea987647458228b661b76f1975aa4c05e72d40ba74f9cd39ba
MD5 869fcc6521bf33980956415c7937234e
SHA1 680cb31f1fc1c2df60e2ef1835533a1baad3f0fa
SHA512 f8b28fa7ac8fd2c779781286c3d083fb07305701280e6a7aed7b912fa953c464dff9ec4218e4be6e75c84adbd15218cd5393c0630dd5719b500dc85d73cff6d1
TLSH
T13711122C29813B67D7B1563A50E31B1393773C02F5E1AF6A418A13819C49322D964FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 feee7631f296528bcb2954dedc6db01fe8c152e19d091d67930a0f8d7ed8d778
MD5 5499cabaee5d87d9f51ed59fd16db5d4
SHA1 68683eafd67061e2c8b25f4c66ecb45ebacadf61
SHA512 02e3826ae2b14a1f438f06abced9932bf11ba3307a071616a15bfec77a84a8769b061d3f4b68a63a7482ae6c30bdd4943a912a41b599f0f6a8cae8ebed0e77d3
TLSH
T16221DB386CC21F27C2B7D63786E65997F279785272026F0E00C947441C1B7876A81F5E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 3d44af9369faaf26db7e98166fe8bbc54d41e26629445636d82275a107798267
MD5 8f25d2cb9a0f5d05c49e8511e03efdad
SHA1 21868659b1f54e6a578d67ca041b4c823d72468b
SHA512 653ef903d06988f894a11226fc75e9a092708aa837a18bf30e8026404c794fad305260c1439b48fabfdeb48ecbb7b7ae80484637497c5359e6f945fabf9a241c
TLSH
T1D611122C29813B67D7B1563A50E31712E3773C02F5D1AF6A418913819C49322D954FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 0c7ec5427412c6e80201091ddfa7c1b0b29ac1877d8e8ba0fb05247c144a9d76
MD5 2f502674c2a9657e87df06c73c540032
SHA1 ca42390ecc9d2583a2d48f288631e67aea6946e5
SHA512 8ec9585bf742ec85ebb1465dfeb7361275182ef5cc3ccebac3eb46001f94a8db013e6e2e75292db72f3ac22e9901171ac3a33eca5f71bc42097f17d742bcd206
TLSH
T19911122C29C13B67D7F1563A50E3171297773C02F5D1AF6A418A1381AC49322D954FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 be429fbac238c4d7b72ca4ea66a0444e38183848c101e25f45dfb5fb58167f88
MD5 b452696080db64ffeac71305cbf9563c
SHA1 7aaec56ad4cd9926d0dc20d686b565f841d3af20
SHA512 c47806c58029a9078bb5c60d2210512421e081ecdb678b4475f8b6a78b2ce40449526ba1b227cbe25f00c87f87a8cd8f7844130f1ceba875e28c4f77699bc55e
TLSH
T16F21DB386CC21F27C2B7D63786E65997E6797852B2036F0E00C947441C1B7476A81F5E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 7f174a4438e483b8de529c58d4924b94f6f0608ae42860a1dd0c712faf0d79cf
MD5 e3805ad7768cef4c1bd89349a16a4817
SHA1 e092e0762e90029b39e6dfc6c4393f6029aed03f
SHA512 646b77e337175603ac456c40643e2acffe2b8d5a7df9d59f018482a4679a7cdac445d59173c6ddc50ab9b73804c77cc9aecf32f88c6191a0995d4787e2a5eff9
TLSH
T1D811122C29813F67D7B1563A50E31712A7773C02F5D1AF6A41891381AC49322D954FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 08957ec24c83ece7d1cb8d252fe8ef7f9589cfb70cf00ff975b6e7060eb60ea2
MD5 6756f2124cb1356f8f1ba1f07e62853b
SHA1 fc5aea8c24dd8b1be73878c71415b46d77701e06
SHA512 461e9aa0991d01933931076984d532a9f792f93e290a4e3594e5d377820e92f32ac5df9dc71079687a66980fbf4c46f41af872c8d4a9faddaece35febec6aaff
TLSH
T13D11522C29813B63D3B1563A00E3171293333C02F4E5AF6A418913819C0A322D950FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 d679959d2df48a2fa3bac2281a3d59ebf75c850bb66126581cc3985203d89127
MD5 cbb1b720da155e5602de6e02f985195f
SHA1 b4b56c2bf014d2417c5e9d84b9e7f905daf66ce6
SHA512 6295713052b4de71a9583ae1e389212b2dc7f7a011e92f6cb287a5b1d9d20fb7c7cb94eb275743313249677e505733bbf0b7fda56dc2770a236da4e9632bca63
TLSH
T1D521DB386CC21F27C2B7D637C6E65997E27A785272026F0E00C947441C1B7476A81F5E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 36eb8b90fd17d27f3da6210cd5a398ab521e5142df99bfeabed3b8bb514821ec
MD5 846f755184227fd8bdc00ef17cc8ad0f
SHA1 80f6218a731c443f97aa4e599a2ca65eda5d6245
SHA512 1fa518cf675a3e3a89acc079dcde89e8e56cc517d52f1f17e9e032aea09385deb1bfebd7b6c675d97cfbd0864ed20d01ba1860f30ec6072aeddb370d56b27b46
TLSH
T1D411122C29813B67D7B1563A50F3171293777C02F5D1AF6A418913819C49322D994FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 db3c53f5ffcc20f796ad539e605a566f82583efdaa9b135e550650c9fa1d1e76
MD5 f164e443811de4a0942e8f0b9cc00c6b
SHA1 ad1ecced752af76de10062b06caf574535e4c716
SHA512 3152b84227a37ad7c71da6083244cdb04bde2b11c32d3a7e7e973f3b67035115e651f8b4e1ba9b26f1663046b3e36404fc1d379e94ad6db7207104c6097705d9
TLSH
T10821DB386CC21F27C2B7D63786E65997E279785272026F0E00C947441C1B7476A81F5E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 26451abc9dbad90872839bd4dcd0f13022f556531294e29fc5399dc66cc2b351
MD5 e617bf870d3c753c1ca6fd5bb769e26b
SHA1 6010893f8374e95a21ca4bfd9fb93ced4acce1d1
SHA512 36e174815350044895a0c525f254cf195b1f2a825af60fc31cc83da14fa5aea4fcc5041e8b471df865fa284b62c9cbb07021086eb09aca9bcc087efcf37b8034
TLSH
T18B11122C29813B67D7F1563A50E3171293773C02F5E5AF6A419913819C49322D954FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 ec417f42c71703d1b4271e4b0beb9f9b768b164b6238ce6fb885cdd8dc30d84a
MD5 c06f660f8bde32ea0db1fb04063d86ec
SHA1 15ef9c8da260bd4d743c5f0c08d0d1cf64de9d49
SHA512 0ba11e7a473cf09f5f02fec73def374f4ddefe5fbe0c19d22d3daa642ace66767e884b5bc5a71daeaeabb59f7968c8818847d95bf5d2da6ffe3e98948fc872ee
TLSH
T1E111122C29813B67D7B1563A50E31B12A3773C02F5D5AF6B418913819C49322D954FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 f4a7c2741c0ca0d9f696d479a4555c32be695cc045327dbbdd88f65394b744db
MD5 faad2ae1527fea4b8cd2d1cc8dc199f6
SHA1 6f67640506b688d670ab4e5c60eacd28a6d8a45e
SHA512 9c53c8c69d0239f3b43919e02325c90e2d42cc6601600a0bcba3dcd24c0ea3d6a9ac76efb7494e5b772eda271567d23c9c5bbc4c6e16c6442579e85fd68c1a82
TLSH
T15421B8386CC22B27C2B7D63686E65997E2797852B2426E0E00C946441C1B7476A81B5E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 725b3c93ba7e394b46255d826a6b37a001b914a04b7d0ffa5ebb706cf5cc019a
MD5 bf083a4962ce6909d94f00016f0240a5
SHA1 84980c31b6234fb25c7b55240bc6c1ca4b66ff54
SHA512 da149aa478b4922e7693925b064d521d6a77374c55842b57f69937f49e9a796985f0c8723133e7a02e6f6cdfca4e8653b50f60994764dbb95ae6e3a486f67c15
TLSH
T1BF11122C29813B67D7B1663A50E3171293773C02F5D1AF6A428913819C49322D954FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 aea9a208a2c255d6c094d0d549f3167574205158afc79e03d9139e11e7dd42aa
MD5 afae276a6a9e627bab9a2960af66560e
SHA1 2508666a37254066e6656d899f81277f1f25f228
SHA512 61d973e9c5809fb779212644cdbe8adae7294e53cf25af1175e58052d0a9a93d1b2d5453f709cb793ea21128354831dec8136be829a9c2c5175ad1781d2375b0
TLSH
T1EF21DB386CC21F27C2B7D6378AE66A97E27A785272026F0E00C947441C1B7476A81F5E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 a600bcaf3bf5900289a68ef7735d1b90bb6204ed0d9988cda1ffcb3eeebe2cff
MD5 ef2f2c6f09bf6be870bb118b2f9fa081
SHA1 32f49c1c7f93e9266efecf43e6f1c3776eaa8cea
SHA512 7c17aee12154f4b6095be6db14f82d71abced6429f53dc376221c9e315da14b4ab50b5ecad627996a9b7f65ec951a36834eff5341171529830ccec7f674ee08e
TLSH
T1D711122C29813B67D7B1563A50E31712D3773C02F5D1AF6A418913819C49322D954FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 ed720937831f849b262fe07a95484af1b95f577e9151323fa615630cbcdf7aa8
MD5 036dddaa152bb4e2893a77c47347902c
SHA1 00981d587e4c562402219d2d4b4435628f20a149
SHA512 e8f3a49783c5e1e9e21a4a216261711368b71695e6164eb20d2c49802bcbb707d63b2e78f6caeb8f27ed6b8c42088653d6e1f443f453eae9b82686b083ca5ac5
TLSH
T19F11122C29813B67D7B1563A50E35712A3773C02F5D5AF6A418913819C49322D954FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 a168dcee0d61c95aef02413e3239a03fc5e6e01b62c2bd109188ad2ec48b43c1
MD5 713c49b92b51a8c2ff87d29589401181
SHA1 f909f0f140a42c9789f08cf4626714fcbb3b2a55
SHA512 da6f2d9a08179b3d9dd199b79ea812866470f7dc7260246a080a2580c098f6a6e245aec3a35f37389b09b73f6802fbdb9919e0f81839a2749dcf3b07f7d788d9
TLSH
T18121B8386CC21B27C2B7D63686E659A7E279785272026E0E00C946441C1B7476A81B5E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 e98e8a3aca014bf6dcebc22309c566965fe1a0599abad7123baa103d2d646d73
MD5 7232fd1774f44d68efd365df1089ee1e
SHA1 dfcb39cf107b53674f9bac6e3272ac58f5db2f0c
SHA512 6e5f876d207ec46220612bf754b5b5baff814e27939bd65805a3e00d5a968ed2fd0e0aaa15229e93291388c8c673717d24fadb8a5e3f9a0bc274e525fb701da5
TLSH
T16D11EF2C29813B67D7B1563A50F3171293773C02F5D1AF6B418A13819849222D954FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 78ae9226f1fadf9e90c46b78cc4f1ff7e7847498f2b1aeee506debb4f8db68c0
MD5 5ecb6f6cd7712feaf3ebc614df72bc21
SHA1 3a856fe49b485cf23d30ac5495f983df08c888b0
SHA512 c9ffd1c6d045ef5356e5b653913ca504c77d383a1308591811bd786e0482277e9517460e324e6797a5cb6d083626f8adf6bfdda950252058e85bca5ba9e35dd6
TLSH
T18C21DB386CC21F27C2BBD63786E65957E679785272026F1E00C947441C1B74B6A81F5E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 ba6b6d44dca0cd0cc97e4859a2a7578a432aea63ffdca090c5e3fd2be54b49dc
MD5 ccec8b06fd8ff4726180febf6f82cd5c
SHA1 2cfbfe3dd34f873908d43ff733b1b2efb9f96924
SHA512 c750903070dcb22d6cf15653cb5f43510817ff0e70018f55f443384df4d95a7cd1be2717a3d1794763b0aa8df65c2c26f9af11b9941f60e32b96a6d91ec1b55f
TLSH
T1AE11122C29C13B67D7B1563A50E3171393773C02F5D1AF6A418A13819C49322D954FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 3985eea24141ff1b4ac3b34872b07443412c6ef55eb787961c7853495b0c0c79
MD5 968706a5dddc6bb03f4b05b8a0b60e95
SHA1 1be6f5034e9ef14607fe3db8d4b13ac4652b13b1
SHA512 395d8407bae5d12aea645703e65c907d332da10d6153e2ee8baa54bcd2d8d423fb8b748ceb24045846fa98e842be0ec56cf667f7fb8fde5e3f2f358ac8eab4cc
TLSH
T12321DB386CC21F27C2BBD637C6F65997E279785672026F0E00C947441C1B7876A81F5E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 456cfb5201612760977aeb4f8c527afbc8663b5cc390e317f4b7719b75551a4c
MD5 155f9dc02f7eb358522fa9655b34e5cc
SHA1 80f6e98d132355d6e522d5a8561efd512f8cae89
SHA512 8d5b5e02b52719d9c136b59270e171ea458d0ae4385b76fa0122df2790a248cd54cce2710c5b1ce29c2e5276abf8a9169901aaaed0b81f9f8251a96511fa9f60
TLSH
T19811122C29813B67D7B1563A50E3171293773C02F5D1AF6B418913819C49322D954FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 76439bef019f6f4746ed76d3af89fd09e7a74782ff4de04cab303be180cfb3e7
MD5 81ed8700442ddb0779878a8db4f8f45f
SHA1 a8785d32e8913ba38b18539c85479e8833508a07
SHA512 9ef015b7a00964d9b7c79ae5d0cce7426fd88945b09dc69e3995f0732f51418c993436870d3e9d9324af4a8a391b854d282c5d5c8b8989e00f939d353236a7d8
TLSH
T17D11122C29813F67D7B1563A50F3171297773C02F5D1AF6A419A13819C49322D954FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 9d46fd271a7bdf96552122977600a408dfcc21d7a102863bad4d69b5627ba455
MD5 cfa21452f6676842f2763cde309453b7
SHA1 ad2c3434763112dca733002129485979b6e88b67
SHA512 fa99ffed7683a85371d6a210192889521bbe70a96c7d37e7da99fec4c72fb0cb3961634ecda5c702cced56c3b3ab8e827b7e88220d68ec161d7626cac2c6e941
TLSH
T10A21DB386DC21F27C2B7D63786E659A7E279785272026F1E00C947441C1B74B6AC1F5E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 d7c0e24ffd1fb6178b089fa76315d94fd664637c08f6fc9f5b452e4928498b9e
MD5 c12ee0e05207bec5c6b0c7c8d89093fc
SHA1 c91e5b7407afba02f30d99d72241b7c2a64f73f1
SHA512 9fbaddde8230a161dd54adf5f18dda7ab31e8d96c59a025c64aa8c36a39c1a4c3bbd7028e72ed628592242cc71d2ddb58cb1aaaea6f6552324e907420b8dbf7d
TLSH
T17311EF2829813B67D7B1563A50E3171293773C02F5D1AF6A418A13819C49222D954FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 ec02d4332e5566436ef7b3f7afbb420a4495d15232926b3549b9cee43653eabc
MD5 aa8e6cf49553ffcdab3d3a78670e3cea
SHA1 db0f68c296044839fe7c9a74963caf7a97b25953
SHA512 3ffc37ea72072e3b4944ca1aeba4505291197be9dc78779ff0c0df6b4ba549eb7e569792aebb112a8247a43a623a5ee31540fb16c4ef89d51859eae2908042c6
TLSH
T15311122C29813B67D7B1563A50F3171293777C02F5D1AF6A429913819C49322D954FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 929515366c174ca24f4e9aa548b5e9f7ada7b4246170da703488bba04f678f38
MD5 8f55e6f482860bd49b7960a3e40b2562
SHA1 c04704ef386155d97b004b3449f20007d395d7b1
SHA512 5a6097b8bc9373831d7ddd38ecaa3dc775a366ccca4fa8a472d647f562848a7d3e35c137ec3a0a250bd0146f45770c6f6495c0699de142d30f92ba834744b483
TLSH
T10D21DB386CC22F27C2B7D63786E65997F679785272026F0E00C947441C1B7876AC1F5E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 53ef3d0b70d28d1a164274b55cab6e0cb91f01c5039c946f18567d08b574716f
MD5 649701a1ae42ae741b3777419fdb01f5
SHA1 3c1a0b65503ffa73b0fe0bef6fc23065d944beab
SHA512 14a4b34c5b029bcae2de64658253389e702803ff165f4720e89ea5ba335d69477f50449b6fe7b69b59ca08e05052559adf451abc86e122387ab6dd1d322ccc97
TLSH
T13911122C29C13B67D7B1563A50E3171293773C02F5D1AF6A419913819C49322D954FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 0088ef64c1db261b2641e2eaca58742f1c7b246c460698a334a73fc7e15192d1
MD5 9f84ab9d35f2597e95f68cef4876db7b
SHA1 c6853806e5ee32587edb473fe6a5b52d31a25c89
SHA512 737c5c8693fd51727e106c8ec8b992c0d41b0e75a54fc1abed08434b17bae9819650e197133acd2d70f9dff8def030815fe0288c204c00a0c3c885667811e959
TLSH
T1DF11522C29813B63C3B1163A10E3071297333C02F4D1AF6A418913819C09322D950FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 80927dfb38b64d6bfdc1e0ddf3c5ee555f82817ba2f1c829ca497cbe54232983
MD5 58255476b05bd795d203608f41976a29
SHA1 88e55e3d35c73e30b83f5a6b197c676485f466a2
SHA512 e1f0ab681a7db5eb6145192909a36d94bee3f827fa45e48ec4e43d652a201230bab7b60727121b14bd1b03c638156266b82886420fa32b4b670d098960587abf
TLSH
T1EB11122C29813B67D7B1563A50E35B1393777C02F5D1AF6A41891381AC49322D954FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 342bcb8102bef71edd30ee34a9ccd1ec3943cb25e5632960bd228d332bf28744
MD5 c0e761e297acfc98f6ef8ebd3cf1a326
SHA1 7c3e8768ab845a8c5e8c20494b4f635f905e85ce
SHA512 01d282d871944117ff5b2c15695775f7ca388de729b4292a329850fe0073b479ea383b31be99bd1ce67645266851c20f92baec5e4729f1673fcc5f569b13deba
TLSH
T1CC21B8386CC21B27C2B7D63686E65997E27A785272026E0E00C947441C1B7476A81B5E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 73bf746d4bdb9b856b144bac7c77815eaf45c77082cb814b9d2dd3395546abbf
MD5 ff3c75e0b25a6ab8a5fcb7a7502d27ee
SHA1 b427abb7d241e3a2a3e433672dbe99de7dd03b6e
SHA512 5c39c40998dc3fcc3f8ac4392ef8c9b319c68ba458918d07e06d89c4ddee34335bca6c4397e159a9531afc14d3e3f18e674efdfa0f7f337b1cc73c4d63dd3591
TLSH
T14C11122C29813B67D7B1563A50E3171297773C02F5D1AF6A419913819C49322D954FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 672aa7a49364265b1b8722b8c195c0fc9b249b412a8408738222bb098b8822b7
MD5 b07c458ea22100d3c000f9d12497f56f
SHA1 a58f586b62087c94adef295387e39813bab7a1d1
SHA512 54893c0950ea7b00f5764e5ce605feaa375946733da03e831fb8cb8abfa14e7a220df590406da04b96e6aa3d3a990acb2f0027fbdc248afaa058b345ad0f8ff6
TLSH
T17D21DB386CC21F27C2B7D63786E659A7E279785272026F0E00C947441C1B7876A81F5E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 a6a67ab5bf8aa15077451616655a2e728454a80191142b0e106ef0d206d5ba6a
MD5 0113ddecc0a9a53646dd7b6c8122665e
SHA1 d82af3efaa7230f182e8023c3e9c5dd45ea2b3b9
SHA512 b26e55646daa407c56413d7eaa6be516be9c51dee71a2f64c55151bcb0c45b7d209fa91174ca93dca04430be121e70914e7652509486e3f31039759bd09e6f9e
TLSH
T1AF11522C29813B63C3B1163A00E3071293733C02F4D1AF6A418913819C49322D950FEF
MD5 SHA1 SHA512 TLSH

Submit Download

HelpMe.exe

Path C:\Windows\SysWOW64\HelpMe.exe
Size 1.7MB
SHA256 f3475a95dfc167e7f0e51bd2bd4613c48b11b05c10e9f8d1477ea231734ead10
MD5 b6c7dc299c3dd51b16be03c76cf8a70e
SHA1 2ffc8d8da9b5dbb82b41a1f74517f5a98ba15862
SHA512 0790e34c081f1618f029369913fbe400b15f883b8506a6ca19dfb71b442c8d2e709e34d8bee3241927806aecba0cfa49bbcfe0c6f24fab5b1e4000345c353e4a
SSDEEP 49152:oEs1hS5W/deMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMVMMMh:oE2hS5WwMMHMMMvMMZMMMlmMMMiMMMYQ
TLSH
T194857B12B7D48431E0B316344D3796644937FC516E748A9F32E83A0E6F76BC2A932B97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini.exe

Path F:\$RECYCLE.BIN\S-1-5-21-4154726816-2055034831-2297277433-1000\desktop.ini.exe
Size 8.1MB
SHA256 3c0e66f82e485a2e3ec0a7ec121117ee79cf3665cfa85c9e03641ff380795c0e
MD5 6e969bf15f1addc06d0d56048d397bf3
SHA1 2796253af65640dc1f148bea2cfb45abf65badef
SHA512 62fd5a766dd126c47199a1011af8091be9532d094f30821f228784aaf91e04e003e126b14c064d4f92157bc16e809d5d547732113569f5100ad36ec2b86b20bf
SSDEEP 196608:ona9+jC/EDtY24xYzXBXqn+uPo7NKP0XSGagLKhzix:oakjCQm1xOXBGSK8iGaOKhzs
TLSH
T13D861212B3E48471E0B316344D379A680977BC612E788A9F32DC3A0D6F767C26936B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AUTORUN.INF

Path F:\AUTORUN.INF
Size 145B
SHA256 cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae
MD5 ca13857b2fd3895a39f09d9dde3cca97
SHA1 8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0
SHA512 55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47
TLSH
T188C04868F16A939D1E0C399093A400237083A208019E420E93DDE4A53DD41084F05188
MD5 SHA1 SHA512 TLSH

Submit Download

memory/260-181-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/260-70-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/260-236-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/260-132-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/260-115-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/260-227-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/260-218-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/260-209-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/260-100-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/260-9-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/260-149-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/260-196-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/260-8-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/260-85-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/260-48-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/260-54-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/260-166-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2888-180-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2888-195-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2888-242-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2888-69-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2888-235-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2888-114-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2888-226-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2888-217-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2888-53-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2888-125-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2888-0-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2888-84-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2888-47-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2888-208-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2888-1-0x0000000000460000-0x0000000000461000-memory.dmp

Download

memory/2888-44-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2888-2-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2888-163-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2888-99-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2888-148-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4296-223-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4296-175-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4296-188-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4296-46-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4296-145-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4296-214-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4296-203-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4296-160-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4296-94-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4296-109-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4296-63-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4296-232-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4296-64-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4296-124-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4296-241-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4296-79-0x0000000000400000-0x0000000000477000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads