Dharma Ransomware Files

File Name Size Detection Count MD5
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,703 674 4d50c8866fb52c4b7907893542c71dd7
%APPDATA%\Info.hta 13,635 556 44d93d15807455a527283c6fedf65762
%SystemDrive%\Users\balcao7\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\setup.exe 140,288 392 2d138fc8252563e50b8d6c6cfb7d6989
%SystemDrive%\Users\pump\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,959 387 e8ae7561768ba31d683e7b3a055554e4
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,736 387 6f2a4f6e82daf5d4e54727b640ec549e
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,720 370 8b97f81d9e555f8631249c17ef7da683
%APPDATA%\Info.hta 13,633 363 2ccd7292f368c322950c29df1a05fb63
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,643 362 a991e4c49bc8552bf2f44d5ac71a7b9e
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,929 340 9087b4f6b5d4dbdd24fe8fdd4728dbe7
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,651 321 79905ff33773f2e97a1e440443449e97
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,645 319 86a184dd9ad4124e9088882c5c32c2c4
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Information.hta 13,637 301 d0f94ea59e72e62ea6e6f058a5bba1a7
%SystemDrive%\Users\marcio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,647 280 53989dacf7463b407edde8999bcb73cf
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,635 251 175d4ffc3d358ba9b6a344bcc64a0e7b
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,633 224 b7bcc252c69fe774179bd9fea7fe4dea
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,641 212 f0836c3be1ac677ab6591fe20bfab7b5
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,639 203 e356b9806e43284510c6dfc978997d5b
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,643 197 ed2dbd6699213e00fe3526633fc04b0f
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,787 194 a685790bd7c3b9cc4c573e64e333845f
%WINDIR%\System32\Info.hta 13,701 188 5ec5f7e6b6420ba5c34b99e833955d0b
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,788 177 489ded8f0eca3d5e21cb572357847eaf
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,713 152 848d988f4fdd0642dcebb59b339f22b5
%SystemDrive%\Users\remoto1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,637 149 d3f0e8be8582b066e36b37fa24365d21
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,633 133 73557da1189f2ca46a77912118ad407c
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,633 126 e09183039a265d04cec8cb186f56423a
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,959 124 c2e5c761a017767eb5bd284bd62ca449
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,643 112 ec9e3a9c2f66b3ae00b06d9b20856170
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,647 106 d0485f412723cf2ef51403022dbf5079
%SystemDrive%\Users\info\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,635 106 2df5a461498e11a117a2513f22d203b6
%SystemDrive%\Users\marcos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload00.exe 335,665 104 faccdfb32516a9c2dbe714a73712b764
%USERPROFILE%istrator\AppData\Roaming\Info.hta 13,919 101 2a0baeb6949ecdaa30c526d56023b87f
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,789 99 97a8e199089f290b1e69c2b50d9cd3c4
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,697 91 41eefffba6f054e80e4ca2c90da47bb3
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\MRLK.exe 90,112 88 20a218209aeeb09a1c26a68794685a71
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,788 88 8875510c8991f6776ab6e7f541a7df7d
C:\Users\Administrator\AppData\Roaming\Host Process for Windows Services\svchost.exe 6,584,832 87 d077c92a3e3e7593c0f990e7130d46aa
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,635 82 eb5d47a79ff03fa57bacd72891784b54
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,641 79 60d5f110849b672644149594e33c08b9
%SystemDrive%\Users\Totalsoft\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload_c.exe 348,979 77 ba1cd67ce0a0b9f53d0016635588cdbc
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,784 77 4ee67cdc0c9ddc01817ab976f4d9e8f7
%SystemDrive%\Users\Natasa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,724 75 97370e23fdf8937d89c266bc5eb90b90
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,919 74 2beffe8caa487af3e9aa6b0a57b4a32e
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,787 74 63b3dc77467299f129c7f0583cdfc6ee
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,635 69 d6abe5bdc9aa6efa0b52f70c27c810ce
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,653 67 2c1bc5223641d7ab63b6f88215fffd0c
%WINDIR%\System32\1stk.exe 311,296 63 ed03c6258d3550c4d15e5dc5ba109597
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,633 56 9feaf0bc10cef1fbe9604cda13ee7a93
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,785 56 13c9a20db91edbb52fc7c823c864a4c1
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,635 54 25a925c7cee64192f109af2669edd41b
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,919 54 7bbc60f2656e1a3dcbce73abd0e46ab1
%SystemDrive%\Users\muh2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Information.hta 13,639 51 16ccedd463222fbfa8b7e2678d892a7c
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,959 50 a478ea09bf8b51db3ffa50e41eae8abe
%SystemDrive%\Users\ACE_15\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,647 50 d7896bada005d2be5fb88ff45dd55f24
%SystemDrive%\Users\TAC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,913 49 4ce413bbee9948e78ffcd00fc70ceb40
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,726 49 465b9edec67d53671e01d4668b588996
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,795 49 5bc3d8a99b5815ad30803f77923c2be7
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,959 49 ed65cef4ad1407ee138b7de38df1c85f
%SystemDrive%\Users\Claudio Mu?oz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,959 47 d8869a1370a5a18e0113fc46823e39e2
%SystemDrive%\Users\Diogo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,795 47 cc43886fbb0201cdc3651de531492685
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,787 47 1578fc0561866b0d2b621cbc11dc863d
%SystemDrive%\Users\wan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,791 47 a40d712498e54ccece2907e2287766b3
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,784 47 1ba9c2a4954a815a90ebccb7079f1b16
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Inf.hta 13,641 46 1bf867566ccfc201dcf9688a9a21d80b
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,790 46 fba46076b273c0ce7d7ade4cdba25425
%APPDATA%\Info.hta 13,913 46 bfef7e12712487aa2741290330e397ad
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,959 44 661ce7513ed02795cd2d0161eb4e0bd6
%SYSTEMDRIVE%\users\administrador\appdata\roaming\host process for windows services\svchost.exe 6,564,864 42 8130a78b40fe01664dae007a4ad3dabd
%SystemDrive%\Users\rdp1\AppData\Roaming\Info.hta 13,797 41 ea42f36a73ae1838f52d4316f64ac111
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,799 41 4f95916f1e797442382215f68e330512
%WINDIR%\System32\pld.exe 90,112 40 f583191dd74da9fde815e79f7a1c1fed
%WINDIR%\System32\setap_c.exe 247,296 39 d51ca5d7d2dc98e1f26bcb8ea43f2e42
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,913 38 72b099c86ca40e7733f99a54b47a7e7c
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,791 38 d953ec0fd42383f1d1a7ca02a11b51fa
%SystemDrive%\Users\tuser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,791 37 87a399cafbbc405b80dfbaeaad1daa3c
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,639 37 5f811667fb88ae46929ea0d99b268f51
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,689 36 d247a029e5f4fb721f2c37fb2065b238
%SystemDrive%\Users\batalhruser3\AppData\Roaming\Payload28.exe 353,039 36 36e72dea18a1b5a490190bb56c67c710
%SystemDrive%\Users\cht\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,787 36 ce5451a17a72300ed0f75e3d8de29708
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,645 35 cff3702e92ff81de5f9146a5152f0b22
%SystemDrive%\Users\teste\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,911 35 52000f0401a69be65d1177ae2dd55a47
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,803 35 ce0ff969ef49ea718ca9d85dce7676c2
%SystemDrive%\Users\remote\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,937 35 c69d18dd42196ed496fbf7b7557aeab7
%SystemDrive%\Users\HOME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,797 35 58a93aa9dcbd009d4069b65c54bcd80f
%SystemDrive%\Users\HRD\AppData\Roaming\setap211.exe 340,820 35 68df2ef104a88857b38c7d64b94f11c9
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,789 35 ecedf62d579f4e3da12df323bf5561dc
%SystemDrive%\Users\admin\AppData\Roaming\Info.hta 13,795 35 44b7a71cbd4a2afa8ffd725ba2eb3c8e
%WINDIR%\System32\setup1.exe 214,045 34 c4c74767ddd35728f381b6ae64de107b
%SystemDrive%\Users\Invitado\AppData\Roaming\Payloadn_c.exe 248,629 34 a0f160585267d2835682c1a39aff6371
%SystemDrive%\Users\admin\AppData\Roaming\Info.hta 13,795 33 bdc3fca6533c4b1bccc953e7b02137d4
%SystemDrive%\Users\Moheb\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 13,920 32 a9c86b9b7d469e1295b52cc93bfc3b76
C:\Users\Elizabeth\AppData\Roaming\Host Process for Windows Services\svchost.exe 6,593,024 31 091665a0a133e958e343c191b38f1b0c

Home > Threat Database > Dharma Ransomware > Dharma Ransomware Files
Registered Office: 1 Castle Street, 3rd Floor, Dublin 2 D02XD82 Ireland.
EnigmaSoft Limited, Private Company Limited by shares, Company Registration Number 597114.

Copyright 2016-2020. EnigmaSoft Ltd. All Rights Reserved.

Mac and MacOS are trademarks of Apple Inc., registered in the U.S. and other countries.