xred | 02c8fa008710affd57be5c6d79f68ee66ee43e742243679d7af3dbba1d4c95f8

Analysis

max time kernel
150s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/11/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WinHex20Pro/WinHex_v20.5_x86_x64.exe
Size 3.0MB
Sample261101-e5gp3asxbz
SHA256 02c8fa008710affd57be5c6d79f68ee66ee43e742243679d7af3dbba1d4c95f8
MD5 c2d6190998103692a506a80e2aec9ccb
SHA1 7f1858fafbb913deab4764f4d1b8b8badb9359b9
SHA512 ed7ad952820ea67fd907bdc3fa710e398f147cc5e88fd4e2e9cf00df6eeade9e8828fff8fe1eae059e35ceff0232cafc6b53e3c18f7d2b16034d4939aabad0d1
SSDEEP 49152:XnsHyjtk2MYC5GDeOiSfk/hmT3ifRjgRXNTAlQoseRc3bg7hLSYaQ6f/lgWag7yl:Xnsmtk2aZOiScUOfRKXdg1LzaQ6Tu
TLSH
T1CEE50232F2D29437D1321B3D9C5B93A598297E512E38794A3BF41E4D8F3E68238652D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery xred persistence upx

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Family: Xred
Xred is backdoor written in Delphi.
backdoor xred

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	._cache_Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	._cache_Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	WinHex_v20.5_x86_x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	._cache_WinHex_v20.5_x86_x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	Synaptics.exe

Executes dropped EXE 8 IoCs

pid	Process
4428	._cache_WinHex_v20.5_x86_x64.exe
1844	Synaptics.exe
4916	Synaptics.exe
872	winhex64.exe
1384	._cache_Synaptics.exe
1108	._cache_Synaptics.exe
4292	winhex64.exe
3560	winhex64.exe

Loads dropped DLL 2 IoCs

pid	Process
872	winhex64.exe
872	winhex64.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	WinHex_v20.5_x86_x64.exe

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	winhex64.exe
File opened (read-only)	\??\X:	winhex64.exe
File opened (read-only)	\??\X:	winhex64.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\._cache_Synaptics.exe	Synaptics.exe
File created	C:\Windows\SysWOW64\._cache_Synaptics.exe	Synaptics.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000a000000024352-5.dat	upx
behavioral1/memory/4428-61-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/4428-63-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/1384-270-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/1108-404-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/4428-510-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/1384-536-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/1108-545-0x0000000000400000-0x0000000000429000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Synaptics.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	winhex64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	winhex64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	winhex64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Synaptics.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	winhex64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	winhex64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	winhex64.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinHex_v20.5_x86_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_WinHex_v20.5_x86_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WinHex_v20.5_x86_x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3296	EXCEL.EXE

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
872	winhex64.exe
3296	EXCEL.EXE
3296	EXCEL.EXE
3296	EXCEL.EXE
3296	EXCEL.EXE
3296	EXCEL.EXE
3296	EXCEL.EXE
3296	EXCEL.EXE
3296	EXCEL.EXE
3296	EXCEL.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 4428	2864	WinHex_v20.5_x86_x64.exe	84
PID 2864 wrote to memory of 1844	2864	WinHex_v20.5_x86_x64.exe	85
PID 4428 wrote to memory of 872	4428	._cache_WinHex_v20.5_x86_x64.exe	88
PID 1844 wrote to memory of 1384	1844	Synaptics.exe	89
PID 4916 wrote to memory of 1108	4916	Synaptics.exe	92
PID 1384 wrote to memory of 4292	1384	._cache_Synaptics.exe	93
PID 1108 wrote to memory of 3560	1108	._cache_Synaptics.exe	97

C:\Users\Admin\AppData\Local\Temp\WinHex20Pro\WinHex_v20.5_x86_x64.exe
"C:\Users\Admin\AppData\Local\Temp\WinHex20Pro\WinHex_v20.5_x86_x64.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Users\Admin\AppData\Local\Temp\WinHex20Pro\._cache_WinHex_v20.5_x86_x64.exe
  "C:\Users\Admin\AppData\Local\Temp\WinHex20Pro\._cache_WinHex_v20.5_x86_x64.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4428
- - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\WinHex\winhex64.exe
    "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\WinHex\winhex64.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of SetWindowsHookEx
    PID:872
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1844
- - C:\Users\Admin\AppData\Local\Temp\WinHex20Pro\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\WinHex20Pro\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1384
  - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\WinHex\winhex64.exe
      "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\WinHex\winhex64.exe" InjUpdateInjUpdate
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      Reads the TCP/IP host and domain name from the registry
      PID:4292

C:\ProgramData\Synaptics\Synaptics.exe
C:\ProgramData\Synaptics\Synaptics.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Windows\SysWOW64\._cache_Synaptics.exe
  "C:\Windows\system32\._cache_Synaptics.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.002\WinHex\winhex64.exe
    "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.002\WinHex\winhex64.exe"
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Reads the TCP/IP host and domain name from the registry
    PID:3560

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Synaptics.exe

Path C:\ProgramData\Synaptics\Synaptics.exe
Size 3.0MB
SHA256 02c8fa008710affd57be5c6d79f68ee66ee43e742243679d7af3dbba1d4c95f8
MD5 c2d6190998103692a506a80e2aec9ccb
SHA1 7f1858fafbb913deab4764f4d1b8b8badb9359b9
SHA512 ed7ad952820ea67fd907bdc3fa710e398f147cc5e88fd4e2e9cf00df6eeade9e8828fff8fe1eae059e35ceff0232cafc6b53e3c18f7d2b16034d4939aabad0d1
SSDEEP 49152:XnsHyjtk2MYC5GDeOiSfk/hmT3ifRjgRXNTAlQoseRc3bg7hLSYaQ6f/lgWag7yl:Xnsmtk2aZOiScUOfRKXdg1LzaQ6Tu
TLSH
T1CEE50232F2D29437D1321B3D9C5B93A598297E512E38794A3BF41E4D8F3E68238652D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

01B85E00

Path C:\Users\Admin\AppData\Local\Temp\01B85E00
Size 23KB
SHA256 61626d61f8edab6c7d80ebf0d0bb919239e2f166026605c873365213fc746571
MD5 821c872d37eae65510444b3886459b30
SHA1 efcfac8ee1554cc40f369493b5fff1cf7426888f
SHA512 30bfadd999255d995e218bbbafacc724bd0a9451673369abb7027f674a68b9921e6d2afa121cc16312af9a460d22ccc36aac5d81160aaa7d0401f4959a676648
SSDEEP 384:Mu16wEiNMrxp+o5bEIbdnnxFAB9LywkYDAJvKGvmGVCx3bbyotf:M+6ZiNS4o5bE8dnxFADtkN1zvwbftf
TLSH
T178B2C01C772EAD0FF4D0847EC104A9DAF2A82148A240AD578A6572A43EC5BD6D3BF4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Chinese.txt

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\WinHex\Chinese.txt
Size 52KB
SHA256 514b57238136ffe6eb50ad9e89c7056dd05dd01d6c701d0de045f680c3d15e85
MD5 684a4ab467c4362e1ae8e963c5d65d10
SHA1 467da87e5b63308ea15eda16218d9584ecf2aa13
SHA512 27f5e37ab604e339f01cde5e78d215a737e5c3dad01c341b9fb5cdb66078ae2d55ef1c7d8e0f159ddde6fe2bee8e0ed028227b8d3c88dabc8866eeea9d98b5d4
SSDEEP 1536:LpMoZL/ltyJUz8m+bTrpgCLGrBf9JNGvWv7Rb5aoKh:tMCye8/erBfcvE7Rbcxh
TLSH
T1AF334A394FB7DBE0536695E01B6313AE57BAA74CD52DCB247E828E091BC9A40E090F31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinHex.cfg

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\WinHex\WinHex.cfg
Size 17KB
SHA256 4edf8571875e89e64e4e11ff5f10b009870afff7bdf1db273819b0360db744ab
MD5 14aa4b634f48ff5119384d43e1779974
SHA1 d73563139f57c483ff2cf07ca3eaa5da46b2e29a
SHA512 0b77b20d687f6aed22af24326b0042b1476df169846181ca2aa0c543a04094049594f55de8090c1e5287b03b29c30365c0441c10c7ab6ae77cb4c8a2952e1aa1
SSDEEP 96:vnUYnzcYtjGXScc5wnKLPMrNmSeNN6rOqf3rSg/B:/BlBGXGDMrYS0SDScB
TLSH
T1358295C7BFC1014BE8342E7004B24B582778F690DA9293DF26C5D169ECD6EC05ED9A9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinHex64.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\WinHex\WinHex64.exe
Size 3.7MB
SHA256 412f43499cb20f64aeb36e547845afc319a4e10b9a190db2f8ec72f99eef296f
MD5 97dac1fea6efb261a1b6c66794efb0cd
SHA1 77869f0a5c0620b12191e666c358d16bbc9ea064
SHA512 6d6afb8f2e5c76f342e6f065e4d385701660933bb66defb0834b598722e22613b4021fbdbea72b590597bc8fb80dde14c30d711cd640943dd30eae8ee858d245
SSDEEP 49152:VTNxbLzQz+fXAsZ3o5EvwMJIX56PTLG9jqE+EGbM07zhIBdZaGmg:VT/A7OP0qxJSZug
TLSH
T1B1065D7A1FFD4668D066C17C8A578751AAA2B4113B35EAFF81604444EF20BF0A73AF71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

timezone.dat

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\WinHex\timezone.dat
Size 4KB
SHA256 8bc05b3f5652cce6ca30da7bc146ca193fef76cbd4fd83ebc6935145773b221d
MD5 81433e967d229b42ab4c1b55c01c3f9b
SHA1 6b546540fe77fa5c2cd34d8d2d31469c0ba41f9c
SHA512 84a842162906c92a1154758390eb6c351dcc4c379be8a250bb9a852c32da7061849076c638021a493f0ed5cbfea72bcb03caba52d53f750d28b250fcaca67195
SSDEEP 48:5xKYPZE1wFR3eRsk/AkNJvXHOMOg3o9Z0Ofs9R1o62kc:5xKYP+wFRuvJvXuMuaOfASkc
TLSH
T11AA1B7C270275FFAE46B47F60A04B2B1F77096E9DAA0A59F0C2E0E7C150B3A58F2C151
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

user.txt

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\WinHex\user.txt
Size 216B
SHA256 cb6bb0c14ab8362e3f5c9eb8df76724f67a3c7fdd5c0608eb9e04972fdbfb5cd
MD5 4485b32fcdfa7d1700543c11fc6e3e2b
SHA1 6f57faec65710d94c4ac53dddc2905ba0ffcbc92
SHA512 6a5207b9caeaa6b7f1938221225ffc377127a43fdcca2b6799534da763d2a189b80fba0cf921ac26bc0aa224842f85359e6432a15783961b92bbe2314270b719
TLSH
T144D0A74E054D505F43BD84901A7EF4561CAE0044C35821A925997D149E388E171DF140
MD5 SHA1 SHA512 TLSH

Submit Download

hash2.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\WinHex\x64\hash2.dll
Size 194KB
SHA256 2c31e7aacba30ad7113e2a66fe0966e4bf66026bd39e782fbe5e66dcf3dd7e3a
MD5 c4f650621c159aede7bbe9569d03ac16
SHA1 b3858ede91d874d7eb240b3ecfd8be458cd15317
SHA512 29790a1a3edfeb50dcb82cb21442c15c0606446ad912673a65ce7851bd9b9987cba735e54f81d46a1a873368f2f83b2703f4b105b32ff8f7bfe7b35dcc8b1325
SSDEEP 6144:b1TDYtW9I/C0EdpaPL11Sub3lbhg9UkPdpaPL11Sub3lbhg9UkUdpaPL11Sub3lv:bSZ/C0Edpaj11SY3lbC9UkPdpaj11SYs
TLSH
T10514079CEF8207B1DA2A48F7D2D54AC179B19811D39CF6FF106674B41E132FA542A33A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\WinHex\x64\zlib1.dll
Size 137KB
SHA256 7c4ee77a9f24225d313c9837e0f973072168ab3ddfa2aad546110923f4eff8b3
MD5 81d4a54776de52774772b8236cf45abe
SHA1 b51772b1ecca8f2fbf7aa05b9e8b916f93507f34
SHA512 adbafe82e716e91a34b1a0e4b9ef810d6cc4015d73187c22a021def94d15c004909180d41f9db7a63e805cd2d46924083a4e889bd55ff4f014a82a6b745f4569
SSDEEP 3072:wExaVv/OjQ+DKwrAqT/TZ9FwmSH1rPFTBfeEBRE:vIVt+DtzT/TZ9FwmGrPFTBGkE
TLSH
T116D37A4A32A402B6D5F79278C9F34A19D331746643B493CF529887A22F137E15E3A3F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Boot Sector FAT.tpl

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\WinHex\Boot Sector FAT.tpl
Size 1KB
SHA256 4b16a526faecee899f97547a2fe05b7513de6a6c4f807c9f6623c94ec4d2c5ec
MD5 b62f0723a54d3f41160abc8df575b635
SHA1 67659c0a97f37c5b4a197b93563219b325854eef
SHA512 07e040f8e8498efbc568d36b80d1d05fed19d8a4dd7750e131b1532a9a1d941f7e726fa6e78a71f845b34109015034744e395d67fc47e78b2b816b83dfce80a3
TLSH
T19121ED477E9929800942A3DFB87640E2C7C581D358CF594B3869F5593E8C2AA833407B
MD5 SHA1 SHA512 TLSH

Submit Download

Boot Sector FAT32.tpl

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\WinHex\Boot Sector FAT32.tpl
Size 1KB
SHA256 6a7df566070f7ce6d1778c9932b231e2916ae7e7f26eb009378b6a8db9d169a8
MD5 42b5387be8b65cc1ae1fd77a3fa7c1d9
SHA1 0eaa1df59b9c09e727ee78cfae24578c85c0089e
SHA512 32947616cb8ccca2761c409f5b136de2f99cf4711651fa0b6c43bb0c1493ccf5b35c1d670ed5fef84197925ed65f620b63ff2ca7625962e07afd3dc540156dec
TLSH
T17121CB277D8528920E03A3DFB87600E1D7D653A318DF055B2C39F6982E5D59983740BB
MD5 SHA1 SHA512 TLSH

Submit Download

Boot Sector NTFS.tpl

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\WinHex\Boot Sector NTFS.tpl
Size 1KB
SHA256 c221d32e6360dffe0272ddf5411c853ce7f056cce10e955ab589afc2fcd784fc
MD5 fa31d4e4fc767bda92dd25734629445c
SHA1 9a1893c4dca2b6568816b883a9cb8b78972df916
SHA512 e71775358a57313169d9fd4bfd975bca12f306bb7862057064badbcbe475efe0b4897b2767ce28c4de890929386c5759279bcf1c94a3f03f8db347f49fd42461
TLSH
T1CB3100177648571F1C82E3DE18BA41E0D3C551B7C4E1219A7958EE9C2DCD4A8C3B03BA
MD5 SHA1 SHA512 TLSH

Submit Download

Chinese.dat

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\WinHex\Chinese.dat
Size 21KB
SHA256 bf96bcd2180b7d5f1c5c50d1f3d146160b8a1ad642c0049c8cf283ec5bf1a172
MD5 833ab5b37febb906dbfa095b8793d46e
SHA1 7628d462af363c3714af98b6f9d88f40908304db
SHA512 07913534721c72619504f17b25ab441fa7ca527f67792edbd29186a75d130e7f611bf242d266736ae89fe798f0fb450bc3d5924e848d0921517450785778aada
SSDEEP 192:nqkhd5kGU7tofwjcWvYYadJNAxfCZTrlJbLE9JUUcGTqEwu5uBSaoV/xNKMlrk+:JdadtlzvYYadJsUJ3aJUUcGTKjMrNrk
TLSH
T151A2C6795FC0C731E1699AB81D7257C4673AB32CF382DF06BF806D8E52291A67A25F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ext Directory Entry.tpl

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\WinHex\Ext Directory Entry.tpl
Size 586B
SHA256 2b23038af1df80b7f404ae0c3e03dfa3dece95185ee1275d1be7e5533fa60a42
MD5 7d02e2ee25c47b445bc99777dd279a2c
SHA1 62fcae38012d9795fb20247d358f3573f2b2a732
SHA512 7ba56aa846f9636aa2bea27f4a24dbb2a8dd6f5af38857540e25878151edc17f90f0e5246d9c93cda632194de8b4d315b89ca9686409082d341084bb2f06986a
TLSH
T182F0E12E3FA553A40B0441ECE734A080D4B4C2B50FEF6C5F26C8F764202534952F99C6
MD5 SHA1 SHA512 TLSH

Submit Download

Ext Group Descriptor.tpl

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\WinHex\Ext Group Descriptor.tpl
Size 592B
SHA256 1705edf4117c3c3dfbae8f76d268437ec27ff8ad2ac7fc4dd4c8616fbb7825e1
MD5 ff950548020e68c9ecc737959623d163
SHA1 c8dfac8605aff3bcb76c4d9cbde7553f2f434905
SHA512 4cb0e37914e8e3a022f7798764f6425ed8c8ac45d26d4335fdbee248b109da3f9816da31f325a53b6bfff8fe5234bbf69809226585a2dda61424f845bfe6c8f5
TLSH
T164F0C2AB7E7A3E42088145BD6C3C58E1D0E512AA4BDA4697D2B4F500044C1A9C6AB28A
MD5 SHA1 SHA512 TLSH

Submit Download

Ext Inode.tpl

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\WinHex\Ext Inode.tpl
Size 1KB
SHA256 3bf09a19e830f142ad19525479ee25a1595d1343fc45368975a1435ea9885cba
MD5 1d289762e99b093df7f9cd6290ec997c
SHA1 0cad3f6d9be081d5d32846b438f21fb726bf94bb
SHA512 83d7604d41ceee8aa069fbf438b9b38e12e76489435c88118d4864f951e41dfb647b4dcce7e79a27a3378a81d33b26f0c0516236a120e01b57313bbf2798ac6f
TLSH
T10D21E3D6BE9B9CE74D4428BE4A3250D2F1DD00E20AEED14AACB0B3284519110D6FF67E
MD5 SHA1 SHA512 TLSH

Submit Download

Ext Superblock.tpl

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\WinHex\Ext Superblock.tpl
Size 3KB
SHA256 4706b2def17ed1e91e559aa920998fc461a7d3bfc7c37707f04636f2798ca056
MD5 b99ad269c6201cf7b897375ebe330bbf
SHA1 7fd023ccb1737fd25d7a4c9d5051c193418ef9c4
SHA512 38a0b2681f7e61b04c7e7c2a450a583030e4497875846799de5306e93666c09b0881abf937bb8cac900fccc7185b62d85c3608a5e8a58302d4fad87a21a4ecc4
TLSH
T10A61EE6A3EB61AD34C8605BF2E7454D1D1E901664BEF80D2EC74F734110F11A82BAEAF
MD5 SHA1 SHA512 TLSH

Submit Download

Ext4 Inode.tpl

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\WinHex\Ext4 Inode.tpl
Size 2KB
SHA256 70b5887f078ab832423969c64ae32df2fae7da295001792cdaa530f9e9221a05
MD5 8c759ebbd3d1f9e2b2f2520d727689f9
SHA1 5796b5506562d53e5bc5f3c171ae7bca4a9a5954
SHA512 da634625a64dc697caa7b13db742f47e466aa2b1a942a74dd50af0a35d5031f96f7f06296264068ca93694515c9b174aa5df400ad4324d9cf1981536eb51cec3
TLSH
T11341F2967F5F9AD70A8014FE4B3181D3E2ED40B209ED90862CA477181593115C9FBD3D
MD5 SHA1 SHA512 TLSH

Submit Download

FAT Directory Entry.tpl

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\WinHex\FAT Directory Entry.tpl
Size 912B
SHA256 832039763cb2e837cd48f24b9a44c6a928702a472c77d4ca847f140c2cd83c84
MD5 dff5148c4020973c538331501435a137
SHA1 092c2f940047d24dadc42da02025be73422682a3
SHA512 e0ff8de198e5d54a510f3078323833259751744994d44393e0118e1c8cc416cc0601508e869a4abe66146a4f09577f8f787fac1fb8cb0bcbe1c466ac5315e3e5
TLSH
T19711001EB76A5A6B9E89A17D873054C0EB5493AB088F119A2DCDD32038B140C92DCDF9
MD5 SHA1 SHA512 TLSH

Submit Download

FAT LFN Entry.tpl

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\WinHex\FAT LFN Entry.tpl
Size 711B
SHA256 4b36dc865d28928f030b5ef58139f5ae61212821a283a5147c5fa6ec1683d5a4
MD5 fa99067fc052f38798d55aa520b56eae
SHA1 68e08fe75c98ec15d19cb87d94699e98d860f309
SHA512 91c2fb4f6f2204bf3b723b751accd349b8e550b0d772174a62937f8bc2e9b923c953220d8c3704c47ae0feda85db66fdf034028ba262ce117434f18795c85226
TLSH
T1A90115217A6F22B7A149A3045D31BC84D74CC39B1A5F6C4C3AEDF24118525C052B0CFE
MD5 SHA1 SHA512 TLSH

Submit Download

File Type Signatures Search.txt

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\WinHex\File Type Signatures Search.txt
Size 24KB
SHA256 187e24223fbfddabe7a1098c1c6901234c95e7aa91c84c059faf006e3d1f733e
MD5 93f3412c3fb9c362fd885cf76ef1f018
SHA1 a4dcd69ffddc62e9491587780d6757756a38bd3c
SHA512 94b6c0ed61944139dcaca10c7be30a3162dbdbcc5acde211bece1e032cbee194a67e43e2dc89e5a9cfd09c85272513b5fae796be2c4575158280765d1bd79eb4
SSDEEP 768:y9N0pysRkP18ClmJ0g2YCUn5jAzBu02NbLRP1:2N0pxR218CCN2Y/5jBNbLRP1
TLSH
T10EB2C6C79384E516C998EC4A0B70F4B10C8EB9478AF8A7C5D71ADE933F6165F26E444C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GUID Partition Table.tpl

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\WinHex\GUID Partition Table.tpl
Size 1KB
SHA256 997d492ee269c23576037bec2fcec0df71a464c51ee5e851e565de24afda50a9
MD5 af38485b532c05e033aa3594f072373c
SHA1 9f5d14b09bd8eadb452f0a2b8c1466e755c432f3
SHA512 729290106ed752919018d64b3fef3340f11c4a5ecefd988a91a2e9d2d5e14156a86787c56baf73e9050dc46cda8b732f016dc272ae1814df6c0695f68b822f4c
TLSH
T1F2319E72FD8979BB097EAA7B903525C240E6001147FD80E17C69F306394726083BAF3A
MD5 SHA1 SHA512 TLSH

Submit Download

HFS+ Volume Header.tpl

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\WinHex\HFS+ Volume Header.tpl
Size 1KB
SHA256 8cd31e3896894153574b810172e6d88a5d6f035baa83a31a0d798b5cb94043dc
MD5 50885aa828c69ec6e50211ba33039084
SHA1 da96f65c7d788d0725be3f1f9453fcea831f33fa
SHA512 0fc91ab8b2b7fb8b752bb0370708f86e7a968bb6b8b7c833d8ec295a781dfe5e3d597a23526eb575d3056a0fcb069b4d244bc05b9d80fad9ed56963f6b231cf7
TLSH
T1014101105EFAB9F45E46798EEE39C25D822F101AEC660E843574FC41318F6BE9249D16
MD5 SHA1 SHA512 TLSH

Submit Download

Master Boot Record.tpl

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\WinHex\Master Boot Record.tpl
Size 1KB
SHA256 92d1f63048c0518b04a7e417d9a6218a9e08643490938bb0034b706d6fd55dea
MD5 2994b4fd513a4bd3aeeed65abcf169e1
SHA1 732035bdee3d9b9c7bee7feb8cf36c8a5658ab4a
SHA512 e87eb82982b1d65004f7308f36ec69f8df46de29a25bed0523b57ca3c863d9cf96b916b61ba1e67e0ecfa17db09db764e56c0450f6df21b063516afc7e189215
TLSH
T13711F0613E417A67160B93FC907B12D2C55742921DEE504A7C00F74C390A290C37B3BB
MD5 SHA1 SHA512 TLSH

Submit Download

NTFS FILE Record.tpl

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\WinHex\NTFS FILE Record.tpl
Size 2KB
SHA256 6ecf91001a559202201f8ba1f59fe39140772e5b3c0f7db500ef9240549a4f21
MD5 c93fd6f1834abee78a70a5beb584d754
SHA1 b2f3ba88d8f114014b368e55157f7a9e4ece4fc2
SHA512 d7f9090449ef60209618ba61bbc27017ed1e18e25ec8db52cd163f4c716e914979c43cdbd3f5a0459b29c65b8d11f952c0de3117a2680c031f97b564beaa6a13
TLSH
T164411277F94D4773AC12026ED93A44D1E29EC12B47EF899F2428E3753446850D2B2AFD
MD5 SHA1 SHA512 TLSH

Submit Download

Sample script.whs

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\WinHex\Sample script.whs
Size 2KB
SHA256 7ff8c33efcb86d159bc0c596256463cd825c61ecde3242d4372a0df2f52761af
MD5 cfb2cb5eeda9faea0ca4cddd02cf357d
SHA1 89c041844e0a1fb1fafc982b946e3551d78cd454
SHA512 f867a2a77330a79ed4b554f6d4405ed4ab847d82cf41bfa67537e4205f8eaf7d5f5d1885a1110ba5ae9bbcaf6b7f7e85ea842519f94a6713818083171b5eee86
TLSH
T1ED41E12A6AD21B720AD286D97F1E72C0EB5981BD471F2744794CC238B2254CD03B9ED6
MD5 SHA1 SHA512 TLSH

Submit Download

Text file conversion UNIX - Windows.whs

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\WinHex\Text file conversion UNIX - Windows.whs
Size 267B
SHA256 df97e3931040e814981ce5df601cd6c8e717c7dbbfd2de852a9fc61ecdc48df0
MD5 f0ebf536a6fe6138cb8c1ae093a04156
SHA1 4ce2e2fa289b792b83f267282102f594af97adf0
SHA512 5b3842a265cc2795ceecf4a50b132f072aa64b972e2af761608d7cb73add47c3773a88a4a9bbe39c866f0bd782d7a20ad824da2cbd58903a69f4b926678633d3
TLSH
T1C9D02B48494073F7911B2817279A70A6232A7DF8467492076994C568348888D1FB69EA
MD5 SHA1 SHA512 TLSH

Submit Download

Text file conversion Windows - UNIX.whs

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\WinHex\Text file conversion Windows - UNIX.whs
Size 267B
SHA256 69ad006980223c3b5200fbe2e72763b7b198a95b1bfaf7d62c969f4585319942
MD5 514123ac4dfebbe07203caae3666d7f7
SHA1 8afa9782e01ac1632a617250aed2cdec624f4176
SHA512 f791db78baabcfb9a0e69450e7f0303d46dbf0827a34ad341afd8d170fb30eae71db7ba6c72701da1574d4aa54fad7ba2968ed1f63a47b6dd28f158321453040
TLSH
T18CD02B48494073F7911B2817275A70A6232A7DF8427492076994C568348888D1FB69EA
MD5 SHA1 SHA512 TLSH

Submit Download

language.dat

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\WinHex\language.dat
Size 395KB
SHA256 f52d006bd687897b8f793dd84d4b53aa87094fb05a5ba9846ff56e128e9393bf
MD5 229e9c18a2d0d47be3ff66aae1afe01d
SHA1 e0f4ab9663aae4879ca3f56e7259c8554db704b2
SHA512 2771a366e2e2f8576babf63e571bdbb4c819c396bc04dbc29850c6b0db475141ef9aff2d4f8b3fd632972bea105083da5aa8a1d1e0b2746966e2bf06c2084d2c
SSDEEP 6144:I+jBDv5PHU5fZoVHvfHGkUcvFs8fAVGgl7Uuq2GniweDUIj28KEHv56Om/mO7VUD:vJv5KxoVIRsg7czv5qF
TLSH
T171845C2B9EC41112CAC713B1B701D247FB79C1CD9709F355589DC24C318BAA9A3EEAE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winhex.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\WinHex\winhex.exe
Size 2.7MB
SHA256 61e33fce74af432f019c725660f041e76f911b59e26a2730e84a37c6ff610d1c
MD5 7b1a2705d6b7ee4bb0f68929c27f29a2
SHA1 eefbcdb454231ffd878c768974b488fe40acf2cf
SHA512 62f0321e4d865d194ff39af6e529fe3b0a757a006a0b5ddd729cbacb5f165c6d3fc9abfba85d775211e9ade4b5b19a5a2d5eacb671585cb1678426e528c8b3f8
SSDEEP 49152:WXxHIa0xa8ZiK2nH8ZpRVq+7sDtGBINHhAeyeA+DXTQQKQGmP:WhHIPa8ZgHeRVwpoAhAeyeA+DXTQQDP
TLSH
T111D58C226F9E4472D8931730155A83A77A3CBD307734A6AB92A63E0CDF71712B911F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\WinHex\zlib1.dll
Size 98KB
SHA256 6fee3797819384b70bddc8868c2b8a1112900206a21ae8b85588f62bb41b82e1
MD5 1a4ce8c5d91c65c8a557f55960340911
SHA1 959253b12640ca55058efd636ccdc94009b95344
SHA512 153e3d648ecfd57d42cc88eee28f2c28b2834c2809e58fde1b320351c82c7d4d381fb02f3cedad2250aad430372035d3222f651efb48c218006dbf5274276c8e
SSDEEP 3072:t3aScbu9ZFMCYdHr9oKQJyEbgYkagTBfVcY3OdA:tKScbu9ZFMhdHxoKQY+lkLTBNcY3G
TLSH
T1BAA38D45EBC742F6DCBB077280E3AB3F4AB2B0148815CCCBD58C6D5A9D63952764C2DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

._cache_WinHex_v20.5_x86_x64.exe

Path C:\Users\Admin\AppData\Local\Temp\WinHex20Pro\._cache_WinHex_v20.5_x86_x64.exe
Size 2.3MB
SHA256 f4d82bed74b07cd39c27ed2e6eb8fe52448bf97601f3efa6d2c7619f56210bd6
MD5 fd5a8d4d490aa0dbfb5b1b4a05e1df7f
SHA1 b54e08df95fd4b4f92d4d0c70b38e2102c0ec3d3
SHA512 41ed329e909b448554dbd1ebf3a8d8429de2e9e04913c9c37331d508eef991857ee091ec45fb2a17ee706726b655483f7f2d153c72e24770378f08265a45c6a5
SSDEEP 49152:fOiSfk/hmT3ifRjgRXNTAlQoseRc3bg7hLSYaQ6f/lgWag7yTt6K:fOiScUOfRKXdg1LzaQ6TS
TLSH
T1ABB533A9428E708AC35CE33F65960B0AB4F4291B5B826E146CB1E7FFC557407E0F6E52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

afjhuLMU.xlsm

Path C:\Users\Admin\AppData\Local\Temp\afjhuLMU.xlsm
Size 17KB
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
SSDEEP 384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
TLSH
T15482B009E788FC53D03B503E442E18B5270D7186724BDA0C384A365A66DA79F47AF6CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/872-534-0x0000000000400000-0x00000000007DE000-memory.dmp

Download

memory/1108-545-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1108-404-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1384-270-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1384-536-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1844-548-0x0000000000400000-0x0000000000707000-memory.dmp

Download

memory/1844-133-0x0000000000400000-0x0000000000707000-memory.dmp

Download

memory/1844-533-0x0000000000400000-0x0000000000707000-memory.dmp

Download

memory/1844-531-0x0000000000400000-0x0000000000707000-memory.dmp

Download

memory/1844-601-0x0000000000400000-0x0000000000707000-memory.dmp

Download

memory/1844-612-0x0000000000400000-0x0000000000707000-memory.dmp

Download

memory/2864-0-0x0000000002490000-0x0000000002491000-memory.dmp

Download

memory/2864-1-0x00000000004A0000-0x00000000004A1000-memory.dmp

Download

memory/2864-130-0x0000000000400000-0x0000000000707000-memory.dmp

Download

memory/3296-322-0x00007FFEFA2B0000-0x00007FFEFA2C0000-memory.dmp

Download

memory/3296-323-0x00007FFEFA2B0000-0x00007FFEFA2C0000-memory.dmp

Download

memory/3296-385-0x00007FFEF7EF0000-0x00007FFEF7F00000-memory.dmp

Download

memory/3296-384-0x00007FFEF7EF0000-0x00007FFEF7F00000-memory.dmp

Download

memory/3296-342-0x00007FFEFA2B0000-0x00007FFEFA2C0000-memory.dmp

Download

memory/3296-321-0x00007FFEFA2B0000-0x00007FFEFA2C0000-memory.dmp

Download

memory/3296-383-0x00007FFEFA2B0000-0x00007FFEFA2C0000-memory.dmp

Download

memory/3560-546-0x0000000000400000-0x00000000007DE000-memory.dmp

Download

memory/4292-544-0x0000000000400000-0x00000000007DE000-memory.dmp

Download

memory/4428-510-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4428-63-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4428-61-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4916-407-0x0000000000400000-0x0000000000707000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads