Analysis

  • max time kernel
    149s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    26-10-2022 22:41

General

  • Target

    IMG91021606.pif.exe

  • Size

    2.0MB

  • MD5

    7c150864ebcad18d185a492b6a9163b0

  • SHA1

    449dc047b26d23874afe311261101cbb754cf2d7

  • SHA256

    de0a8ea18835d2511b6f4345d62743bd7374ab294b9067fbed819e37cb1642c1

  • SHA512

    2d14dd91b6eebd2000af0ed6d89cf2313fe93141a2edff978ddf5676f2320389381e3309567894be5bbc8230be2a59e1d7cf3ea387863addcb6857513b29dcc1

  • SSDEEP

    49152:4ov0SawgSwDYo5Me034nJRxi0fT7SEfxmhnlyIgdDG6D:4oLUS7jcNvx4n8S6D

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Drops startup file 3 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\IMG91021606.pif.exe
    "C:\Users\Admin\AppData\Local\Temp\IMG91021606.pif.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1388
    • C:\Users\Admin\AppData\Local\temp\9_75\gst.exe
      "C:\Users\Admin\AppData\Local\temp\9_75\gst.exe" Community portal – Bulletin board,
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:320
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\temp\9_105\pmsg.vbe"
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:828
        • C:\Users\Admin\AppData\Local\Temp\9_105\akfng.exe
          "C:\Users\Admin\AppData\Local\Temp\9_105\akfng.exe" whofhgk.sos
          4⤵
          • Executes dropped EXE
          • Drops startup file
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:1144
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
            5⤵
              PID:1720
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\temp\9_75\trcwwcfpq.vbe"
        2⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1684
        • C:\Users\Admin\AppData\Local\Temp\9_75\gtfwiwxp.exe
          "C:\Users\Admin\AppData\Local\Temp\9_75\gtfwiwxp.exe" llrtku.jsg
          3⤵
          • Executes dropped EXE
          • Drops startup file
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:1888
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
            4⤵
              PID:1140

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\9_105\akfng.exe

        Filesize

        915KB

        MD5

        303c86d5e26a663bdb09481f93be2e90

        SHA1

        b269a394afcf82a26150a8e16daa933176c1d3b2

        SHA256

        1f13ccb643426fc2b63d2b8492ffd29eb86eb5de53ce3a7f598823fb5311263f

        SHA512

        7c239f299d29ecd4015e8b53da93188dc814d135597e49b81178ac3da7be1faed8cf2eef41d3eb8b6bbd8f06e6e09fd49b3e0346f1bd3a5c5acca1703b6de955

      • C:\Users\Admin\AppData\Local\Temp\9_105\akfng.exe

        Filesize

        915KB

        MD5

        303c86d5e26a663bdb09481f93be2e90

        SHA1

        b269a394afcf82a26150a8e16daa933176c1d3b2

        SHA256

        1f13ccb643426fc2b63d2b8492ffd29eb86eb5de53ce3a7f598823fb5311263f

        SHA512

        7c239f299d29ecd4015e8b53da93188dc814d135597e49b81178ac3da7be1faed8cf2eef41d3eb8b6bbd8f06e6e09fd49b3e0346f1bd3a5c5acca1703b6de955

      • C:\Users\Admin\AppData\Local\Temp\9_105\qcmqueptsl.ppt

        Filesize

        59KB

        MD5

        aa511ad88b62774609eccded56fe6921

        SHA1

        bc7995786dd2f464ca72e472588d0d2f8441cba5

        SHA256

        e1411732032805d54c5c51af508764272d144bb559ca7e45dff1e036049c741d

        SHA512

        7ec89454e2b09cb0d1dc2cfb8e97e9ca3c27ff552e206d5069ad117c961f607644e2512ff7eb76d78c3ee429c4a044f32c44931e710ba8f600ce36e2b516e960

      • C:\Users\Admin\AppData\Local\Temp\9_105\whofhgk.sos

        Filesize

        79.3MB

        MD5

        111689a0b6b4f08522b7b577692c1001

        SHA1

        5e88d66c4e5d21676ed9f7117669efbda2e71778

        SHA256

        92a969067cee6fa37cbe337baaebf53a2a1912975f09be78ef90384eeda6deda

        SHA512

        f11d8d57295ddb7ae812abfb77cbea08227b1d4751e3d93a9e6c6af7e8d130a2621fc8b30a1bcd0a1a3c41220f89289c10591ab8a7a42b6e29657d377678fcf6

      • C:\Users\Admin\AppData\Local\Temp\9_105\xsmiqu.crn

        Filesize

        405KB

        MD5

        81db3971acf8ec7739e75f8861885f89

        SHA1

        2f2b8a2302c29e72a28697afa6b7728819469c8e

        SHA256

        4ce2fd6069f41e43443cc1666a24ebc9e02833b70ba407b6c343cd1c1a3acc3a

        SHA512

        b237c9d227d69a8d3f42428040e6e162f7868a932272ef48ac92616281bb2ec8f28bc071e248de6b9ce4d762f5f673eef2c362cafac4badc54fc8e08e1abef13

      • C:\Users\Admin\AppData\Local\Temp\9_75\gst.exe

        Filesize

        1.1MB

        MD5

        110281413953d3f0417e6444b0004644

        SHA1

        236630dbc2635dbcb704a78278892948ea224c5d

        SHA256

        046d38d00b4703467e142264a3b66bea51ed16ca07da98ccf410e90ddd6e95c2

        SHA512

        a8abd219c73f8742cff7ea7b3ac73bc7276c9040c2f6ba6d868029129fd95c04c5346534bd6a83f0dd32d7ee6b81b45c702958914557cffc87a355648de84f84

      • C:\Users\Admin\AppData\Local\Temp\9_75\gtfwiwxp.exe

        Filesize

        917KB

        MD5

        294044b55415687eb93af43bbeea21b5

        SHA1

        f4e0a4775badd9e031cfb20bdf26be18236f709e

        SHA256

        b39c57ca4d501bdcb98b4e410e8f8d8fd7054fc96353db168e70d2a5ce77ba0c

        SHA512

        c7e787a65c6adf2c719836ca0b7866c4d99811cf22de014e6fe7b7229c111f46cae3585babe578d4916850237154941bb969b2e41ed1f505f58170a18a89b685

      • C:\Users\Admin\AppData\Local\Temp\9_75\gtfwiwxp.exe

        Filesize

        917KB

        MD5

        294044b55415687eb93af43bbeea21b5

        SHA1

        f4e0a4775badd9e031cfb20bdf26be18236f709e

        SHA256

        b39c57ca4d501bdcb98b4e410e8f8d8fd7054fc96353db168e70d2a5ce77ba0c

        SHA512

        c7e787a65c6adf2c719836ca0b7866c4d99811cf22de014e6fe7b7229c111f46cae3585babe578d4916850237154941bb969b2e41ed1f505f58170a18a89b685

      • C:\Users\Admin\AppData\Local\Temp\9_75\hrutbl.iox

        Filesize

        436KB

        MD5

        04e718c34ae801f1bbed8599abf8dc80

        SHA1

        fa4971bfd18bb7a35cc0c33b5e7acac79e3b453b

        SHA256

        8297cad91c6bff0eb9fd14c337bdfcea06d6046f2bee1d390c13156cc454031c

        SHA512

        83ce11fc3638025526146eb6e5d42ae7c4efeef7d660b8097d60701420fef346af1c9de7c1e1590e62c0ca2a3d18c57d4bdf49fc24fad2dbcdc8cf97da6655ad

      • C:\Users\Admin\AppData\Local\Temp\9_75\iaomhnsha.dll

        Filesize

        54KB

        MD5

        4d474bfb885fecce59ea66541622677c

        SHA1

        47aecd8f7aa2b6875fb8f40710c4920cdf6a7e7a

        SHA256

        aeedd4965cbc15e60ca47bf7d0996bcd02860f75cf0608f0e37846abe736030b

        SHA512

        3b8682437cc4332ca6c6c1183a6f6b0b91366086f5183be72450ec5c13563c25eca4326bacbc2bc0ee965cc2ab57f9df535de77d6d0ffd6a5ce776dd80f57fad

      • C:\Users\Admin\AppData\Local\Temp\9_75\llrtku.jsg

        Filesize

        81.2MB

        MD5

        1e2c4aed80160b63b0bf9039916fa59b

        SHA1

        ad2391de4660ede0a7729002fd228f563e527f25

        SHA256

        4f3b571fc9769efe5d49933e996fb1219b47f15b6b2ed897aa54ce6c4e0fd3f0

        SHA512

        08e1d62402c7d23a9b88412b7e3b5ee8d9e41f3fb2e82cc60b0bfcc7c1df9f28fa259aac9de7ac81df324ba2afc1df00e96dc8649a927f0e8e09536e19248bfd

      • C:\Users\Admin\AppData\Local\temp\9_105\pmsg.vbe

        Filesize

        32KB

        MD5

        dbeb963635b0737ceca13c7f9bc566d7

        SHA1

        10b6334645131d81b311c71eca7a8f9ccde127d1

        SHA256

        01299ecd0169896c320e2690a782a45a7e8f2d94cbc221dbe153ceb694febbe6

        SHA512

        b48d909051ecbb73ab47c89fcfee3cbdb9a08c5a246e3e0ec4780e64e402e01d16ff2f2fa3025bc11f2efaaf28b47496aa83f1957db8d131e9ea8e7a20bef3d9

      • C:\Users\Admin\AppData\Local\temp\9_75\gst.exe

        Filesize

        1.1MB

        MD5

        110281413953d3f0417e6444b0004644

        SHA1

        236630dbc2635dbcb704a78278892948ea224c5d

        SHA256

        046d38d00b4703467e142264a3b66bea51ed16ca07da98ccf410e90ddd6e95c2

        SHA512

        a8abd219c73f8742cff7ea7b3ac73bc7276c9040c2f6ba6d868029129fd95c04c5346534bd6a83f0dd32d7ee6b81b45c702958914557cffc87a355648de84f84

      • C:\Users\Admin\AppData\Local\temp\9_75\trcwwcfpq.vbe

        Filesize

        24KB

        MD5

        362072d9c51ef2c35ee2b7cf24e79c50

        SHA1

        2f58231bafa0e38d14ad2fd85e963907ebee8c2f

        SHA256

        92c885c8032dc63bb0e5e6db7d541d81a8ff451e0e7bba38ce6c04126e04c9ae

        SHA512

        9efd9347e5ca1fc5465d7ac2d6c219ec19b43849ff7e95e98ddaa6aad1407d36493b762f0af4791cf2939f763b5bd5341183ad5a91161741fc19bee8498006dd

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        Filesize

        1001B

        MD5

        0ead27b89568f8627efe3fdc49245aa8

        SHA1

        3e800e77b3e159c9c681dcd9b2c7b89c7da38b89

        SHA256

        b8976adb79a99f6b5fc9e4029c2fed527ef814d1a49ad099793d4b65d3672958

        SHA512

        808d792388522c90474dac416ba10a43a1012f3b21bcd1d81ed39354bc01147287c0fb7c65d18304678e83ba4e73d829b30707fcbdb96248c47f493f7362ac1d

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        Filesize

        1006B

        MD5

        62573194f71e06972819b88a824a590c

        SHA1

        c4b10c251e4b571932cc2517e7f14afab5751ce3

        SHA256

        184e252b3e2fa190109898121cef3ae109b51e5ce6e4d9a80ca91e48245a2670

        SHA512

        1450f4eebb9b6a547dc4d959e91bfd9c9eb9a5fcdf7704cbf7a96706ddef3c085ee19cede6fabcbfde3dbd51cffaa7a7a38b2d393c4aec31aa38c345ce60b980

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        Filesize

        1001B

        MD5

        0ead27b89568f8627efe3fdc49245aa8

        SHA1

        3e800e77b3e159c9c681dcd9b2c7b89c7da38b89

        SHA256

        b8976adb79a99f6b5fc9e4029c2fed527ef814d1a49ad099793d4b65d3672958

        SHA512

        808d792388522c90474dac416ba10a43a1012f3b21bcd1d81ed39354bc01147287c0fb7c65d18304678e83ba4e73d829b30707fcbdb96248c47f493f7362ac1d

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        Filesize

        1006B

        MD5

        62573194f71e06972819b88a824a590c

        SHA1

        c4b10c251e4b571932cc2517e7f14afab5751ce3

        SHA256

        184e252b3e2fa190109898121cef3ae109b51e5ce6e4d9a80ca91e48245a2670

        SHA512

        1450f4eebb9b6a547dc4d959e91bfd9c9eb9a5fcdf7704cbf7a96706ddef3c085ee19cede6fabcbfde3dbd51cffaa7a7a38b2d393c4aec31aa38c345ce60b980

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        Filesize

        1001B

        MD5

        0ead27b89568f8627efe3fdc49245aa8

        SHA1

        3e800e77b3e159c9c681dcd9b2c7b89c7da38b89

        SHA256

        b8976adb79a99f6b5fc9e4029c2fed527ef814d1a49ad099793d4b65d3672958

        SHA512

        808d792388522c90474dac416ba10a43a1012f3b21bcd1d81ed39354bc01147287c0fb7c65d18304678e83ba4e73d829b30707fcbdb96248c47f493f7362ac1d

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        Filesize

        1006B

        MD5

        62573194f71e06972819b88a824a590c

        SHA1

        c4b10c251e4b571932cc2517e7f14afab5751ce3

        SHA256

        184e252b3e2fa190109898121cef3ae109b51e5ce6e4d9a80ca91e48245a2670

        SHA512

        1450f4eebb9b6a547dc4d959e91bfd9c9eb9a5fcdf7704cbf7a96706ddef3c085ee19cede6fabcbfde3dbd51cffaa7a7a38b2d393c4aec31aa38c345ce60b980

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        Filesize

        1006B

        MD5

        62573194f71e06972819b88a824a590c

        SHA1

        c4b10c251e4b571932cc2517e7f14afab5751ce3

        SHA256

        184e252b3e2fa190109898121cef3ae109b51e5ce6e4d9a80ca91e48245a2670

        SHA512

        1450f4eebb9b6a547dc4d959e91bfd9c9eb9a5fcdf7704cbf7a96706ddef3c085ee19cede6fabcbfde3dbd51cffaa7a7a38b2d393c4aec31aa38c345ce60b980

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        Filesize

        1006B

        MD5

        62573194f71e06972819b88a824a590c

        SHA1

        c4b10c251e4b571932cc2517e7f14afab5751ce3

        SHA256

        184e252b3e2fa190109898121cef3ae109b51e5ce6e4d9a80ca91e48245a2670

        SHA512

        1450f4eebb9b6a547dc4d959e91bfd9c9eb9a5fcdf7704cbf7a96706ddef3c085ee19cede6fabcbfde3dbd51cffaa7a7a38b2d393c4aec31aa38c345ce60b980

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        Filesize

        1006B

        MD5

        62573194f71e06972819b88a824a590c

        SHA1

        c4b10c251e4b571932cc2517e7f14afab5751ce3

        SHA256

        184e252b3e2fa190109898121cef3ae109b51e5ce6e4d9a80ca91e48245a2670

        SHA512

        1450f4eebb9b6a547dc4d959e91bfd9c9eb9a5fcdf7704cbf7a96706ddef3c085ee19cede6fabcbfde3dbd51cffaa7a7a38b2d393c4aec31aa38c345ce60b980

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        Filesize

        1006B

        MD5

        62573194f71e06972819b88a824a590c

        SHA1

        c4b10c251e4b571932cc2517e7f14afab5751ce3

        SHA256

        184e252b3e2fa190109898121cef3ae109b51e5ce6e4d9a80ca91e48245a2670

        SHA512

        1450f4eebb9b6a547dc4d959e91bfd9c9eb9a5fcdf7704cbf7a96706ddef3c085ee19cede6fabcbfde3dbd51cffaa7a7a38b2d393c4aec31aa38c345ce60b980

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        Filesize

        1001B

        MD5

        0ead27b89568f8627efe3fdc49245aa8

        SHA1

        3e800e77b3e159c9c681dcd9b2c7b89c7da38b89

        SHA256

        b8976adb79a99f6b5fc9e4029c2fed527ef814d1a49ad099793d4b65d3672958

        SHA512

        808d792388522c90474dac416ba10a43a1012f3b21bcd1d81ed39354bc01147287c0fb7c65d18304678e83ba4e73d829b30707fcbdb96248c47f493f7362ac1d

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        Filesize

        1006B

        MD5

        62573194f71e06972819b88a824a590c

        SHA1

        c4b10c251e4b571932cc2517e7f14afab5751ce3

        SHA256

        184e252b3e2fa190109898121cef3ae109b51e5ce6e4d9a80ca91e48245a2670

        SHA512

        1450f4eebb9b6a547dc4d959e91bfd9c9eb9a5fcdf7704cbf7a96706ddef3c085ee19cede6fabcbfde3dbd51cffaa7a7a38b2d393c4aec31aa38c345ce60b980

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        Filesize

        1001B

        MD5

        0ead27b89568f8627efe3fdc49245aa8

        SHA1

        3e800e77b3e159c9c681dcd9b2c7b89c7da38b89

        SHA256

        b8976adb79a99f6b5fc9e4029c2fed527ef814d1a49ad099793d4b65d3672958

        SHA512

        808d792388522c90474dac416ba10a43a1012f3b21bcd1d81ed39354bc01147287c0fb7c65d18304678e83ba4e73d829b30707fcbdb96248c47f493f7362ac1d

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        MD5

        d41d8cd98f00b204e9800998ecf8427e

        SHA1

        da39a3ee5e6b4b0d3255bfef95601890afd80709

        SHA256

        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

        SHA512

        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        Filesize

        1001B

        MD5

        0ead27b89568f8627efe3fdc49245aa8

        SHA1

        3e800e77b3e159c9c681dcd9b2c7b89c7da38b89

        SHA256

        b8976adb79a99f6b5fc9e4029c2fed527ef814d1a49ad099793d4b65d3672958

        SHA512

        808d792388522c90474dac416ba10a43a1012f3b21bcd1d81ed39354bc01147287c0fb7c65d18304678e83ba4e73d829b30707fcbdb96248c47f493f7362ac1d

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        MD5

        d41d8cd98f00b204e9800998ecf8427e

        SHA1

        da39a3ee5e6b4b0d3255bfef95601890afd80709

        SHA256

        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

        SHA512

        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        Filesize

        1001B

        MD5

        0ead27b89568f8627efe3fdc49245aa8

        SHA1

        3e800e77b3e159c9c681dcd9b2c7b89c7da38b89

        SHA256

        b8976adb79a99f6b5fc9e4029c2fed527ef814d1a49ad099793d4b65d3672958

        SHA512

        808d792388522c90474dac416ba10a43a1012f3b21bcd1d81ed39354bc01147287c0fb7c65d18304678e83ba4e73d829b30707fcbdb96248c47f493f7362ac1d

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        MD5

        d41d8cd98f00b204e9800998ecf8427e

        SHA1

        da39a3ee5e6b4b0d3255bfef95601890afd80709

        SHA256

        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

        SHA512

        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        Filesize

        1001B

        MD5

        0ead27b89568f8627efe3fdc49245aa8

        SHA1

        3e800e77b3e159c9c681dcd9b2c7b89c7da38b89

        SHA256

        b8976adb79a99f6b5fc9e4029c2fed527ef814d1a49ad099793d4b65d3672958

        SHA512

        808d792388522c90474dac416ba10a43a1012f3b21bcd1d81ed39354bc01147287c0fb7c65d18304678e83ba4e73d829b30707fcbdb96248c47f493f7362ac1d

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        MD5

        d41d8cd98f00b204e9800998ecf8427e

        SHA1

        da39a3ee5e6b4b0d3255bfef95601890afd80709

        SHA256

        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

        SHA512

        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        Filesize

        1001B

        MD5

        0ead27b89568f8627efe3fdc49245aa8

        SHA1

        3e800e77b3e159c9c681dcd9b2c7b89c7da38b89

        SHA256

        b8976adb79a99f6b5fc9e4029c2fed527ef814d1a49ad099793d4b65d3672958

        SHA512

        808d792388522c90474dac416ba10a43a1012f3b21bcd1d81ed39354bc01147287c0fb7c65d18304678e83ba4e73d829b30707fcbdb96248c47f493f7362ac1d

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        MD5

        d41d8cd98f00b204e9800998ecf8427e

        SHA1

        da39a3ee5e6b4b0d3255bfef95601890afd80709

        SHA256

        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

        SHA512

        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        Filesize

        1001B

        MD5

        0ead27b89568f8627efe3fdc49245aa8

        SHA1

        3e800e77b3e159c9c681dcd9b2c7b89c7da38b89

        SHA256

        b8976adb79a99f6b5fc9e4029c2fed527ef814d1a49ad099793d4b65d3672958

        SHA512

        808d792388522c90474dac416ba10a43a1012f3b21bcd1d81ed39354bc01147287c0fb7c65d18304678e83ba4e73d829b30707fcbdb96248c47f493f7362ac1d

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        Filesize

        1006B

        MD5

        62573194f71e06972819b88a824a590c

        SHA1

        c4b10c251e4b571932cc2517e7f14afab5751ce3

        SHA256

        184e252b3e2fa190109898121cef3ae109b51e5ce6e4d9a80ca91e48245a2670

        SHA512

        1450f4eebb9b6a547dc4d959e91bfd9c9eb9a5fcdf7704cbf7a96706ddef3c085ee19cede6fabcbfde3dbd51cffaa7a7a38b2d393c4aec31aa38c345ce60b980

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        Filesize

        1001B

        MD5

        0ead27b89568f8627efe3fdc49245aa8

        SHA1

        3e800e77b3e159c9c681dcd9b2c7b89c7da38b89

        SHA256

        b8976adb79a99f6b5fc9e4029c2fed527ef814d1a49ad099793d4b65d3672958

        SHA512

        808d792388522c90474dac416ba10a43a1012f3b21bcd1d81ed39354bc01147287c0fb7c65d18304678e83ba4e73d829b30707fcbdb96248c47f493f7362ac1d

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        MD5

        d41d8cd98f00b204e9800998ecf8427e

        SHA1

        da39a3ee5e6b4b0d3255bfef95601890afd80709

        SHA256

        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

        SHA512

        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        Filesize

        1001B

        MD5

        0ead27b89568f8627efe3fdc49245aa8

        SHA1

        3e800e77b3e159c9c681dcd9b2c7b89c7da38b89

        SHA256

        b8976adb79a99f6b5fc9e4029c2fed527ef814d1a49ad099793d4b65d3672958

        SHA512

        808d792388522c90474dac416ba10a43a1012f3b21bcd1d81ed39354bc01147287c0fb7c65d18304678e83ba4e73d829b30707fcbdb96248c47f493f7362ac1d

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        MD5

        d41d8cd98f00b204e9800998ecf8427e

        SHA1

        da39a3ee5e6b4b0d3255bfef95601890afd80709

        SHA256

        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

        SHA512

        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        Filesize

        1001B

        MD5

        0ead27b89568f8627efe3fdc49245aa8

        SHA1

        3e800e77b3e159c9c681dcd9b2c7b89c7da38b89

        SHA256

        b8976adb79a99f6b5fc9e4029c2fed527ef814d1a49ad099793d4b65d3672958

        SHA512

        808d792388522c90474dac416ba10a43a1012f3b21bcd1d81ed39354bc01147287c0fb7c65d18304678e83ba4e73d829b30707fcbdb96248c47f493f7362ac1d

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        MD5

        d41d8cd98f00b204e9800998ecf8427e

        SHA1

        da39a3ee5e6b4b0d3255bfef95601890afd80709

        SHA256

        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

        SHA512

        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        Filesize

        1001B

        MD5

        0ead27b89568f8627efe3fdc49245aa8

        SHA1

        3e800e77b3e159c9c681dcd9b2c7b89c7da38b89

        SHA256

        b8976adb79a99f6b5fc9e4029c2fed527ef814d1a49ad099793d4b65d3672958

        SHA512

        808d792388522c90474dac416ba10a43a1012f3b21bcd1d81ed39354bc01147287c0fb7c65d18304678e83ba4e73d829b30707fcbdb96248c47f493f7362ac1d

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        Filesize

        1006B

        MD5

        62573194f71e06972819b88a824a590c

        SHA1

        c4b10c251e4b571932cc2517e7f14afab5751ce3

        SHA256

        184e252b3e2fa190109898121cef3ae109b51e5ce6e4d9a80ca91e48245a2670

        SHA512

        1450f4eebb9b6a547dc4d959e91bfd9c9eb9a5fcdf7704cbf7a96706ddef3c085ee19cede6fabcbfde3dbd51cffaa7a7a38b2d393c4aec31aa38c345ce60b980

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        MD5

        d41d8cd98f00b204e9800998ecf8427e

        SHA1

        da39a3ee5e6b4b0d3255bfef95601890afd80709

        SHA256

        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

        SHA512

        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        MD5

        d41d8cd98f00b204e9800998ecf8427e

        SHA1

        da39a3ee5e6b4b0d3255bfef95601890afd80709

        SHA256

        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

        SHA512

        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        Filesize

        1001B

        MD5

        0ead27b89568f8627efe3fdc49245aa8

        SHA1

        3e800e77b3e159c9c681dcd9b2c7b89c7da38b89

        SHA256

        b8976adb79a99f6b5fc9e4029c2fed527ef814d1a49ad099793d4b65d3672958

        SHA512

        808d792388522c90474dac416ba10a43a1012f3b21bcd1d81ed39354bc01147287c0fb7c65d18304678e83ba4e73d829b30707fcbdb96248c47f493f7362ac1d

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        MD5

        d41d8cd98f00b204e9800998ecf8427e

        SHA1

        da39a3ee5e6b4b0d3255bfef95601890afd80709

        SHA256

        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

        SHA512

        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        Filesize

        1001B

        MD5

        0ead27b89568f8627efe3fdc49245aa8

        SHA1

        3e800e77b3e159c9c681dcd9b2c7b89c7da38b89

        SHA256

        b8976adb79a99f6b5fc9e4029c2fed527ef814d1a49ad099793d4b65d3672958

        SHA512

        808d792388522c90474dac416ba10a43a1012f3b21bcd1d81ed39354bc01147287c0fb7c65d18304678e83ba4e73d829b30707fcbdb96248c47f493f7362ac1d

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        Filesize

        1006B

        MD5

        62573194f71e06972819b88a824a590c

        SHA1

        c4b10c251e4b571932cc2517e7f14afab5751ce3

        SHA256

        184e252b3e2fa190109898121cef3ae109b51e5ce6e4d9a80ca91e48245a2670

        SHA512

        1450f4eebb9b6a547dc4d959e91bfd9c9eb9a5fcdf7704cbf7a96706ddef3c085ee19cede6fabcbfde3dbd51cffaa7a7a38b2d393c4aec31aa38c345ce60b980

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        MD5

        d41d8cd98f00b204e9800998ecf8427e

        SHA1

        da39a3ee5e6b4b0d3255bfef95601890afd80709

        SHA256

        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

        SHA512

        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        Filesize

        1006B

        MD5

        62573194f71e06972819b88a824a590c

        SHA1

        c4b10c251e4b571932cc2517e7f14afab5751ce3

        SHA256

        184e252b3e2fa190109898121cef3ae109b51e5ce6e4d9a80ca91e48245a2670

        SHA512

        1450f4eebb9b6a547dc4d959e91bfd9c9eb9a5fcdf7704cbf7a96706ddef3c085ee19cede6fabcbfde3dbd51cffaa7a7a38b2d393c4aec31aa38c345ce60b980

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        Filesize

        1001B

        MD5

        0ead27b89568f8627efe3fdc49245aa8

        SHA1

        3e800e77b3e159c9c681dcd9b2c7b89c7da38b89

        SHA256

        b8976adb79a99f6b5fc9e4029c2fed527ef814d1a49ad099793d4b65d3672958

        SHA512

        808d792388522c90474dac416ba10a43a1012f3b21bcd1d81ed39354bc01147287c0fb7c65d18304678e83ba4e73d829b30707fcbdb96248c47f493f7362ac1d

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        Filesize

        1006B

        MD5

        62573194f71e06972819b88a824a590c

        SHA1

        c4b10c251e4b571932cc2517e7f14afab5751ce3

        SHA256

        184e252b3e2fa190109898121cef3ae109b51e5ce6e4d9a80ca91e48245a2670

        SHA512

        1450f4eebb9b6a547dc4d959e91bfd9c9eb9a5fcdf7704cbf7a96706ddef3c085ee19cede6fabcbfde3dbd51cffaa7a7a38b2d393c4aec31aa38c345ce60b980

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        Filesize

        1001B

        MD5

        0ead27b89568f8627efe3fdc49245aa8

        SHA1

        3e800e77b3e159c9c681dcd9b2c7b89c7da38b89

        SHA256

        b8976adb79a99f6b5fc9e4029c2fed527ef814d1a49ad099793d4b65d3672958

        SHA512

        808d792388522c90474dac416ba10a43a1012f3b21bcd1d81ed39354bc01147287c0fb7c65d18304678e83ba4e73d829b30707fcbdb96248c47f493f7362ac1d

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

        Filesize

        1006B

        MD5

        62573194f71e06972819b88a824a590c

        SHA1

        c4b10c251e4b571932cc2517e7f14afab5751ce3

        SHA256

        184e252b3e2fa190109898121cef3ae109b51e5ce6e4d9a80ca91e48245a2670

        SHA512

        1450f4eebb9b6a547dc4d959e91bfd9c9eb9a5fcdf7704cbf7a96706ddef3c085ee19cede6fabcbfde3dbd51cffaa7a7a38b2d393c4aec31aa38c345ce60b980

      • \??\PIPE\srvsvc

        MD5

        d41d8cd98f00b204e9800998ecf8427e

        SHA1

        da39a3ee5e6b4b0d3255bfef95601890afd80709

        SHA256

        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

        SHA512

        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

      • \Users\Admin\AppData\Local\Temp\9_105\akfng.exe

        Filesize

        915KB

        MD5

        303c86d5e26a663bdb09481f93be2e90

        SHA1

        b269a394afcf82a26150a8e16daa933176c1d3b2

        SHA256

        1f13ccb643426fc2b63d2b8492ffd29eb86eb5de53ce3a7f598823fb5311263f

        SHA512

        7c239f299d29ecd4015e8b53da93188dc814d135597e49b81178ac3da7be1faed8cf2eef41d3eb8b6bbd8f06e6e09fd49b3e0346f1bd3a5c5acca1703b6de955

      • \Users\Admin\AppData\Local\Temp\9_75\gst.exe

        Filesize

        1.1MB

        MD5

        110281413953d3f0417e6444b0004644

        SHA1

        236630dbc2635dbcb704a78278892948ea224c5d

        SHA256

        046d38d00b4703467e142264a3b66bea51ed16ca07da98ccf410e90ddd6e95c2

        SHA512

        a8abd219c73f8742cff7ea7b3ac73bc7276c9040c2f6ba6d868029129fd95c04c5346534bd6a83f0dd32d7ee6b81b45c702958914557cffc87a355648de84f84

      • \Users\Admin\AppData\Local\Temp\9_75\gst.exe

        Filesize

        1.1MB

        MD5

        110281413953d3f0417e6444b0004644

        SHA1

        236630dbc2635dbcb704a78278892948ea224c5d

        SHA256

        046d38d00b4703467e142264a3b66bea51ed16ca07da98ccf410e90ddd6e95c2

        SHA512

        a8abd219c73f8742cff7ea7b3ac73bc7276c9040c2f6ba6d868029129fd95c04c5346534bd6a83f0dd32d7ee6b81b45c702958914557cffc87a355648de84f84

      • \Users\Admin\AppData\Local\Temp\9_75\gst.exe

        Filesize

        1.1MB

        MD5

        110281413953d3f0417e6444b0004644

        SHA1

        236630dbc2635dbcb704a78278892948ea224c5d

        SHA256

        046d38d00b4703467e142264a3b66bea51ed16ca07da98ccf410e90ddd6e95c2

        SHA512

        a8abd219c73f8742cff7ea7b3ac73bc7276c9040c2f6ba6d868029129fd95c04c5346534bd6a83f0dd32d7ee6b81b45c702958914557cffc87a355648de84f84

      • \Users\Admin\AppData\Local\Temp\9_75\gtfwiwxp.exe

        Filesize

        917KB

        MD5

        294044b55415687eb93af43bbeea21b5

        SHA1

        f4e0a4775badd9e031cfb20bdf26be18236f709e

        SHA256

        b39c57ca4d501bdcb98b4e410e8f8d8fd7054fc96353db168e70d2a5ce77ba0c

        SHA512

        c7e787a65c6adf2c719836ca0b7866c4d99811cf22de014e6fe7b7229c111f46cae3585babe578d4916850237154941bb969b2e41ed1f505f58170a18a89b685

      • memory/320-58-0x0000000000000000-mapping.dmp

      • memory/828-65-0x0000000000000000-mapping.dmp

      • memory/1144-75-0x0000000000000000-mapping.dmp

      • memory/1388-54-0x0000000075711000-0x0000000075713000-memory.dmp

        Filesize

        8KB

      • memory/1684-60-0x0000000000000000-mapping.dmp

      • memory/1888-70-0x0000000000000000-mapping.dmp