Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    23/10/2023, 17:02

General

  • Target

    NEAS.2023-09-06_46cbdfd8071a9b98291348537f82812a_ryuk_JC.exe

  • Size

    18.7MB

  • MD5

    46cbdfd8071a9b98291348537f82812a

  • SHA1

    e557e852b7449608764ae50cc3ec25760895bf0d

  • SHA256

    335d423cbdace888958796c1d23ca98217be3118fb421498195ec57f10d64b1e

  • SHA512

    de3f2308df02aeb00d4fa140246de05c80d2504ddca83c91ccd0163b3ca534f0df52b60e012789de4069a6f549dfbcaf90a7e7affa4aabf0e7de453935b4ba32

  • SSDEEP

    98304:9E2RpMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMVMMMYJMMzM2:9nwngnwnX

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Renames multiple (91) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 3 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-06_46cbdfd8071a9b98291348537f82812a_ryuk_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-06_46cbdfd8071a9b98291348537f82812a_ryuk_JC.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops startup file
    • Loads dropped DLL
    • Enumerates connected drives
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:1952
    • C:\Windows\SysWOW64\HelpMe.exe
      C:\Windows\system32\HelpMe.exe
      2⤵
      • Modifies WinLogon for persistence
      • Drops startup file
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops autorun.inf file
      • Drops file in System32 directory
      PID:2200

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-274829-3448035668-3231875956-1000\desktop.ini.exe

    Filesize

    18.7MB

    MD5

    79dfcb2815f2619e7b46b13e69cf320c

    SHA1

    a6a8d9745aae872a079108cfe54672cc56f5c045

    SHA256

    d2230e03ac2007e6f5a04bba0dade3e36d98e72d65f15f552733db76fa4c440a

    SHA512

    5b714d10787698f3e7144611058ff0f0de212d41d4edfbfd6a2899623ff7647fb6c694c5044c03757c858bf07a7a23fd7540b02be39414c2fbd81aff6fc20c12

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    4ecc9effdf5991b1acc26250e8b9ead5

    SHA1

    45362f190e502fcf1b4121eeca59ac79de4ea87e

    SHA256

    a11686b7fee08d691ebf9b5eab55dc10077f85e878288b8cd7ecaa83997d5c83

    SHA512

    a051209b8266eb636a9acfe633133f7e45b847da4563512c477e0138179d077aa931a8dbc29ea2ed044b7fe8a45a193d386d48c609ebbbaab03ed3cc0fefc6ee

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    4ecc9effdf5991b1acc26250e8b9ead5

    SHA1

    45362f190e502fcf1b4121eeca59ac79de4ea87e

    SHA256

    a11686b7fee08d691ebf9b5eab55dc10077f85e878288b8cd7ecaa83997d5c83

    SHA512

    a051209b8266eb636a9acfe633133f7e45b847da4563512c477e0138179d077aa931a8dbc29ea2ed044b7fe8a45a193d386d48c609ebbbaab03ed3cc0fefc6ee

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    946B

    MD5

    711fb7d94f1ef107fe955cca85f920d9

    SHA1

    fda61907f4860369fbad76f80b755dbfddf22cd2

    SHA256

    3c8066881e1c7a894b743cbb67de9cae3e24c870bf3ac4ff66d3f3baa077ff37

    SHA512

    57514d35ee8da2e55e10057cd6921efad3b98250603ce836b71514cccdf3875a679ea25a7242a7a6872838b05e92a54f468b79ff3db34d0ca4cbe974d68850bf

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    4ecc9effdf5991b1acc26250e8b9ead5

    SHA1

    45362f190e502fcf1b4121eeca59ac79de4ea87e

    SHA256

    a11686b7fee08d691ebf9b5eab55dc10077f85e878288b8cd7ecaa83997d5c83

    SHA512

    a051209b8266eb636a9acfe633133f7e45b847da4563512c477e0138179d077aa931a8dbc29ea2ed044b7fe8a45a193d386d48c609ebbbaab03ed3cc0fefc6ee

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    946B

    MD5

    711fb7d94f1ef107fe955cca85f920d9

    SHA1

    fda61907f4860369fbad76f80b755dbfddf22cd2

    SHA256

    3c8066881e1c7a894b743cbb67de9cae3e24c870bf3ac4ff66d3f3baa077ff37

    SHA512

    57514d35ee8da2e55e10057cd6921efad3b98250603ce836b71514cccdf3875a679ea25a7242a7a6872838b05e92a54f468b79ff3db34d0ca4cbe974d68850bf

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    946B

    MD5

    711fb7d94f1ef107fe955cca85f920d9

    SHA1

    fda61907f4860369fbad76f80b755dbfddf22cd2

    SHA256

    3c8066881e1c7a894b743cbb67de9cae3e24c870bf3ac4ff66d3f3baa077ff37

    SHA512

    57514d35ee8da2e55e10057cd6921efad3b98250603ce836b71514cccdf3875a679ea25a7242a7a6872838b05e92a54f468b79ff3db34d0ca4cbe974d68850bf

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    4ecc9effdf5991b1acc26250e8b9ead5

    SHA1

    45362f190e502fcf1b4121eeca59ac79de4ea87e

    SHA256

    a11686b7fee08d691ebf9b5eab55dc10077f85e878288b8cd7ecaa83997d5c83

    SHA512

    a051209b8266eb636a9acfe633133f7e45b847da4563512c477e0138179d077aa931a8dbc29ea2ed044b7fe8a45a193d386d48c609ebbbaab03ed3cc0fefc6ee

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    946B

    MD5

    711fb7d94f1ef107fe955cca85f920d9

    SHA1

    fda61907f4860369fbad76f80b755dbfddf22cd2

    SHA256

    3c8066881e1c7a894b743cbb67de9cae3e24c870bf3ac4ff66d3f3baa077ff37

    SHA512

    57514d35ee8da2e55e10057cd6921efad3b98250603ce836b71514cccdf3875a679ea25a7242a7a6872838b05e92a54f468b79ff3db34d0ca4cbe974d68850bf

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    946B

    MD5

    711fb7d94f1ef107fe955cca85f920d9

    SHA1

    fda61907f4860369fbad76f80b755dbfddf22cd2

    SHA256

    3c8066881e1c7a894b743cbb67de9cae3e24c870bf3ac4ff66d3f3baa077ff37

    SHA512

    57514d35ee8da2e55e10057cd6921efad3b98250603ce836b71514cccdf3875a679ea25a7242a7a6872838b05e92a54f468b79ff3db34d0ca4cbe974d68850bf

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    4ecc9effdf5991b1acc26250e8b9ead5

    SHA1

    45362f190e502fcf1b4121eeca59ac79de4ea87e

    SHA256

    a11686b7fee08d691ebf9b5eab55dc10077f85e878288b8cd7ecaa83997d5c83

    SHA512

    a051209b8266eb636a9acfe633133f7e45b847da4563512c477e0138179d077aa931a8dbc29ea2ed044b7fe8a45a193d386d48c609ebbbaab03ed3cc0fefc6ee

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    946B

    MD5

    711fb7d94f1ef107fe955cca85f920d9

    SHA1

    fda61907f4860369fbad76f80b755dbfddf22cd2

    SHA256

    3c8066881e1c7a894b743cbb67de9cae3e24c870bf3ac4ff66d3f3baa077ff37

    SHA512

    57514d35ee8da2e55e10057cd6921efad3b98250603ce836b71514cccdf3875a679ea25a7242a7a6872838b05e92a54f468b79ff3db34d0ca4cbe974d68850bf

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    4ecc9effdf5991b1acc26250e8b9ead5

    SHA1

    45362f190e502fcf1b4121eeca59ac79de4ea87e

    SHA256

    a11686b7fee08d691ebf9b5eab55dc10077f85e878288b8cd7ecaa83997d5c83

    SHA512

    a051209b8266eb636a9acfe633133f7e45b847da4563512c477e0138179d077aa931a8dbc29ea2ed044b7fe8a45a193d386d48c609ebbbaab03ed3cc0fefc6ee

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    946B

    MD5

    711fb7d94f1ef107fe955cca85f920d9

    SHA1

    fda61907f4860369fbad76f80b755dbfddf22cd2

    SHA256

    3c8066881e1c7a894b743cbb67de9cae3e24c870bf3ac4ff66d3f3baa077ff37

    SHA512

    57514d35ee8da2e55e10057cd6921efad3b98250603ce836b71514cccdf3875a679ea25a7242a7a6872838b05e92a54f468b79ff3db34d0ca4cbe974d68850bf

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    4ecc9effdf5991b1acc26250e8b9ead5

    SHA1

    45362f190e502fcf1b4121eeca59ac79de4ea87e

    SHA256

    a11686b7fee08d691ebf9b5eab55dc10077f85e878288b8cd7ecaa83997d5c83

    SHA512

    a051209b8266eb636a9acfe633133f7e45b847da4563512c477e0138179d077aa931a8dbc29ea2ed044b7fe8a45a193d386d48c609ebbbaab03ed3cc0fefc6ee

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    4ecc9effdf5991b1acc26250e8b9ead5

    SHA1

    45362f190e502fcf1b4121eeca59ac79de4ea87e

    SHA256

    a11686b7fee08d691ebf9b5eab55dc10077f85e878288b8cd7ecaa83997d5c83

    SHA512

    a051209b8266eb636a9acfe633133f7e45b847da4563512c477e0138179d077aa931a8dbc29ea2ed044b7fe8a45a193d386d48c609ebbbaab03ed3cc0fefc6ee

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    946B

    MD5

    711fb7d94f1ef107fe955cca85f920d9

    SHA1

    fda61907f4860369fbad76f80b755dbfddf22cd2

    SHA256

    3c8066881e1c7a894b743cbb67de9cae3e24c870bf3ac4ff66d3f3baa077ff37

    SHA512

    57514d35ee8da2e55e10057cd6921efad3b98250603ce836b71514cccdf3875a679ea25a7242a7a6872838b05e92a54f468b79ff3db34d0ca4cbe974d68850bf

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    4ecc9effdf5991b1acc26250e8b9ead5

    SHA1

    45362f190e502fcf1b4121eeca59ac79de4ea87e

    SHA256

    a11686b7fee08d691ebf9b5eab55dc10077f85e878288b8cd7ecaa83997d5c83

    SHA512

    a051209b8266eb636a9acfe633133f7e45b847da4563512c477e0138179d077aa931a8dbc29ea2ed044b7fe8a45a193d386d48c609ebbbaab03ed3cc0fefc6ee

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    946B

    MD5

    711fb7d94f1ef107fe955cca85f920d9

    SHA1

    fda61907f4860369fbad76f80b755dbfddf22cd2

    SHA256

    3c8066881e1c7a894b743cbb67de9cae3e24c870bf3ac4ff66d3f3baa077ff37

    SHA512

    57514d35ee8da2e55e10057cd6921efad3b98250603ce836b71514cccdf3875a679ea25a7242a7a6872838b05e92a54f468b79ff3db34d0ca4cbe974d68850bf

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    4ecc9effdf5991b1acc26250e8b9ead5

    SHA1

    45362f190e502fcf1b4121eeca59ac79de4ea87e

    SHA256

    a11686b7fee08d691ebf9b5eab55dc10077f85e878288b8cd7ecaa83997d5c83

    SHA512

    a051209b8266eb636a9acfe633133f7e45b847da4563512c477e0138179d077aa931a8dbc29ea2ed044b7fe8a45a193d386d48c609ebbbaab03ed3cc0fefc6ee

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    946B

    MD5

    711fb7d94f1ef107fe955cca85f920d9

    SHA1

    fda61907f4860369fbad76f80b755dbfddf22cd2

    SHA256

    3c8066881e1c7a894b743cbb67de9cae3e24c870bf3ac4ff66d3f3baa077ff37

    SHA512

    57514d35ee8da2e55e10057cd6921efad3b98250603ce836b71514cccdf3875a679ea25a7242a7a6872838b05e92a54f468b79ff3db34d0ca4cbe974d68850bf

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    4ecc9effdf5991b1acc26250e8b9ead5

    SHA1

    45362f190e502fcf1b4121eeca59ac79de4ea87e

    SHA256

    a11686b7fee08d691ebf9b5eab55dc10077f85e878288b8cd7ecaa83997d5c83

    SHA512

    a051209b8266eb636a9acfe633133f7e45b847da4563512c477e0138179d077aa931a8dbc29ea2ed044b7fe8a45a193d386d48c609ebbbaab03ed3cc0fefc6ee

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    946B

    MD5

    711fb7d94f1ef107fe955cca85f920d9

    SHA1

    fda61907f4860369fbad76f80b755dbfddf22cd2

    SHA256

    3c8066881e1c7a894b743cbb67de9cae3e24c870bf3ac4ff66d3f3baa077ff37

    SHA512

    57514d35ee8da2e55e10057cd6921efad3b98250603ce836b71514cccdf3875a679ea25a7242a7a6872838b05e92a54f468b79ff3db34d0ca4cbe974d68850bf

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    4ecc9effdf5991b1acc26250e8b9ead5

    SHA1

    45362f190e502fcf1b4121eeca59ac79de4ea87e

    SHA256

    a11686b7fee08d691ebf9b5eab55dc10077f85e878288b8cd7ecaa83997d5c83

    SHA512

    a051209b8266eb636a9acfe633133f7e45b847da4563512c477e0138179d077aa931a8dbc29ea2ed044b7fe8a45a193d386d48c609ebbbaab03ed3cc0fefc6ee

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    946B

    MD5

    711fb7d94f1ef107fe955cca85f920d9

    SHA1

    fda61907f4860369fbad76f80b755dbfddf22cd2

    SHA256

    3c8066881e1c7a894b743cbb67de9cae3e24c870bf3ac4ff66d3f3baa077ff37

    SHA512

    57514d35ee8da2e55e10057cd6921efad3b98250603ce836b71514cccdf3875a679ea25a7242a7a6872838b05e92a54f468b79ff3db34d0ca4cbe974d68850bf

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    946B

    MD5

    711fb7d94f1ef107fe955cca85f920d9

    SHA1

    fda61907f4860369fbad76f80b755dbfddf22cd2

    SHA256

    3c8066881e1c7a894b743cbb67de9cae3e24c870bf3ac4ff66d3f3baa077ff37

    SHA512

    57514d35ee8da2e55e10057cd6921efad3b98250603ce836b71514cccdf3875a679ea25a7242a7a6872838b05e92a54f468b79ff3db34d0ca4cbe974d68850bf

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    4ecc9effdf5991b1acc26250e8b9ead5

    SHA1

    45362f190e502fcf1b4121eeca59ac79de4ea87e

    SHA256

    a11686b7fee08d691ebf9b5eab55dc10077f85e878288b8cd7ecaa83997d5c83

    SHA512

    a051209b8266eb636a9acfe633133f7e45b847da4563512c477e0138179d077aa931a8dbc29ea2ed044b7fe8a45a193d386d48c609ebbbaab03ed3cc0fefc6ee

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    946B

    MD5

    711fb7d94f1ef107fe955cca85f920d9

    SHA1

    fda61907f4860369fbad76f80b755dbfddf22cd2

    SHA256

    3c8066881e1c7a894b743cbb67de9cae3e24c870bf3ac4ff66d3f3baa077ff37

    SHA512

    57514d35ee8da2e55e10057cd6921efad3b98250603ce836b71514cccdf3875a679ea25a7242a7a6872838b05e92a54f468b79ff3db34d0ca4cbe974d68850bf

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    946B

    MD5

    711fb7d94f1ef107fe955cca85f920d9

    SHA1

    fda61907f4860369fbad76f80b755dbfddf22cd2

    SHA256

    3c8066881e1c7a894b743cbb67de9cae3e24c870bf3ac4ff66d3f3baa077ff37

    SHA512

    57514d35ee8da2e55e10057cd6921efad3b98250603ce836b71514cccdf3875a679ea25a7242a7a6872838b05e92a54f468b79ff3db34d0ca4cbe974d68850bf

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    4ecc9effdf5991b1acc26250e8b9ead5

    SHA1

    45362f190e502fcf1b4121eeca59ac79de4ea87e

    SHA256

    a11686b7fee08d691ebf9b5eab55dc10077f85e878288b8cd7ecaa83997d5c83

    SHA512

    a051209b8266eb636a9acfe633133f7e45b847da4563512c477e0138179d077aa931a8dbc29ea2ed044b7fe8a45a193d386d48c609ebbbaab03ed3cc0fefc6ee

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    946B

    MD5

    711fb7d94f1ef107fe955cca85f920d9

    SHA1

    fda61907f4860369fbad76f80b755dbfddf22cd2

    SHA256

    3c8066881e1c7a894b743cbb67de9cae3e24c870bf3ac4ff66d3f3baa077ff37

    SHA512

    57514d35ee8da2e55e10057cd6921efad3b98250603ce836b71514cccdf3875a679ea25a7242a7a6872838b05e92a54f468b79ff3db34d0ca4cbe974d68850bf

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    4ecc9effdf5991b1acc26250e8b9ead5

    SHA1

    45362f190e502fcf1b4121eeca59ac79de4ea87e

    SHA256

    a11686b7fee08d691ebf9b5eab55dc10077f85e878288b8cd7ecaa83997d5c83

    SHA512

    a051209b8266eb636a9acfe633133f7e45b847da4563512c477e0138179d077aa931a8dbc29ea2ed044b7fe8a45a193d386d48c609ebbbaab03ed3cc0fefc6ee

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    946B

    MD5

    711fb7d94f1ef107fe955cca85f920d9

    SHA1

    fda61907f4860369fbad76f80b755dbfddf22cd2

    SHA256

    3c8066881e1c7a894b743cbb67de9cae3e24c870bf3ac4ff66d3f3baa077ff37

    SHA512

    57514d35ee8da2e55e10057cd6921efad3b98250603ce836b71514cccdf3875a679ea25a7242a7a6872838b05e92a54f468b79ff3db34d0ca4cbe974d68850bf

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    4ecc9effdf5991b1acc26250e8b9ead5

    SHA1

    45362f190e502fcf1b4121eeca59ac79de4ea87e

    SHA256

    a11686b7fee08d691ebf9b5eab55dc10077f85e878288b8cd7ecaa83997d5c83

    SHA512

    a051209b8266eb636a9acfe633133f7e45b847da4563512c477e0138179d077aa931a8dbc29ea2ed044b7fe8a45a193d386d48c609ebbbaab03ed3cc0fefc6ee

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    4ecc9effdf5991b1acc26250e8b9ead5

    SHA1

    45362f190e502fcf1b4121eeca59ac79de4ea87e

    SHA256

    a11686b7fee08d691ebf9b5eab55dc10077f85e878288b8cd7ecaa83997d5c83

    SHA512

    a051209b8266eb636a9acfe633133f7e45b847da4563512c477e0138179d077aa931a8dbc29ea2ed044b7fe8a45a193d386d48c609ebbbaab03ed3cc0fefc6ee

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    946B

    MD5

    711fb7d94f1ef107fe955cca85f920d9

    SHA1

    fda61907f4860369fbad76f80b755dbfddf22cd2

    SHA256

    3c8066881e1c7a894b743cbb67de9cae3e24c870bf3ac4ff66d3f3baa077ff37

    SHA512

    57514d35ee8da2e55e10057cd6921efad3b98250603ce836b71514cccdf3875a679ea25a7242a7a6872838b05e92a54f468b79ff3db34d0ca4cbe974d68850bf

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    946B

    MD5

    711fb7d94f1ef107fe955cca85f920d9

    SHA1

    fda61907f4860369fbad76f80b755dbfddf22cd2

    SHA256

    3c8066881e1c7a894b743cbb67de9cae3e24c870bf3ac4ff66d3f3baa077ff37

    SHA512

    57514d35ee8da2e55e10057cd6921efad3b98250603ce836b71514cccdf3875a679ea25a7242a7a6872838b05e92a54f468b79ff3db34d0ca4cbe974d68850bf

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    946B

    MD5

    711fb7d94f1ef107fe955cca85f920d9

    SHA1

    fda61907f4860369fbad76f80b755dbfddf22cd2

    SHA256

    3c8066881e1c7a894b743cbb67de9cae3e24c870bf3ac4ff66d3f3baa077ff37

    SHA512

    57514d35ee8da2e55e10057cd6921efad3b98250603ce836b71514cccdf3875a679ea25a7242a7a6872838b05e92a54f468b79ff3db34d0ca4cbe974d68850bf

  • C:\Windows\SysWOW64\HelpMe.exe

    Filesize

    18.7MB

    MD5

    f930b9a5be278eaec8ac6671d7df88c8

    SHA1

    23d52d0fa05dc95f9ccff59d96436a6e29c39ef2

    SHA256

    a23473e7d506ceb7e12013ac1c75d443e02b5edd7398e8f5da083415b7bf1177

    SHA512

    eff2e8132ab32cd68e6ab8f78d9ee16ae8a65ea596b80ab8582383b4ca458adf6b5b9fb52d40af0231fc86bfbb496d4c10590a3338ed08ccc73bc56aa3fcc823

  • C:\Windows\SysWOW64\HelpMe.exe

    Filesize

    18.7MB

    MD5

    f930b9a5be278eaec8ac6671d7df88c8

    SHA1

    23d52d0fa05dc95f9ccff59d96436a6e29c39ef2

    SHA256

    a23473e7d506ceb7e12013ac1c75d443e02b5edd7398e8f5da083415b7bf1177

    SHA512

    eff2e8132ab32cd68e6ab8f78d9ee16ae8a65ea596b80ab8582383b4ca458adf6b5b9fb52d40af0231fc86bfbb496d4c10590a3338ed08ccc73bc56aa3fcc823

  • C:\Windows\SysWOW64\HelpMe.exe

    Filesize

    18.7MB

    MD5

    f930b9a5be278eaec8ac6671d7df88c8

    SHA1

    23d52d0fa05dc95f9ccff59d96436a6e29c39ef2

    SHA256

    a23473e7d506ceb7e12013ac1c75d443e02b5edd7398e8f5da083415b7bf1177

    SHA512

    eff2e8132ab32cd68e6ab8f78d9ee16ae8a65ea596b80ab8582383b4ca458adf6b5b9fb52d40af0231fc86bfbb496d4c10590a3338ed08ccc73bc56aa3fcc823

  • F:\AUTORUN.INF

    Filesize

    145B

    MD5

    ca13857b2fd3895a39f09d9dde3cca97

    SHA1

    8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

    SHA256

    cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

    SHA512

    55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

  • F:\AutoRun.exe

    Filesize

    18.7MB

    MD5

    46cbdfd8071a9b98291348537f82812a

    SHA1

    e557e852b7449608764ae50cc3ec25760895bf0d

    SHA256

    335d423cbdace888958796c1d23ca98217be3118fb421498195ec57f10d64b1e

    SHA512

    de3f2308df02aeb00d4fa140246de05c80d2504ddca83c91ccd0163b3ca534f0df52b60e012789de4069a6f549dfbcaf90a7e7affa4aabf0e7de453935b4ba32

  • \Windows\SysWOW64\HelpMe.exe

    Filesize

    18.7MB

    MD5

    f930b9a5be278eaec8ac6671d7df88c8

    SHA1

    23d52d0fa05dc95f9ccff59d96436a6e29c39ef2

    SHA256

    a23473e7d506ceb7e12013ac1c75d443e02b5edd7398e8f5da083415b7bf1177

    SHA512

    eff2e8132ab32cd68e6ab8f78d9ee16ae8a65ea596b80ab8582383b4ca458adf6b5b9fb52d40af0231fc86bfbb496d4c10590a3338ed08ccc73bc56aa3fcc823

  • \Windows\SysWOW64\HelpMe.exe

    Filesize

    18.7MB

    MD5

    f930b9a5be278eaec8ac6671d7df88c8

    SHA1

    23d52d0fa05dc95f9ccff59d96436a6e29c39ef2

    SHA256

    a23473e7d506ceb7e12013ac1c75d443e02b5edd7398e8f5da083415b7bf1177

    SHA512

    eff2e8132ab32cd68e6ab8f78d9ee16ae8a65ea596b80ab8582383b4ca458adf6b5b9fb52d40af0231fc86bfbb496d4c10590a3338ed08ccc73bc56aa3fcc823

  • memory/1952-0-0x0000000000400000-0x000000000047B000-memory.dmp

    Filesize

    492KB

  • memory/1952-1-0x0000000000310000-0x0000000000311000-memory.dmp

    Filesize

    4KB

  • memory/1952-9-0x0000000001DD0000-0x0000000001E4B000-memory.dmp

    Filesize

    492KB

  • memory/1952-61-0x0000000000400000-0x000000000047B000-memory.dmp

    Filesize

    492KB

  • memory/1952-68-0x0000000000310000-0x0000000000311000-memory.dmp

    Filesize

    4KB

  • memory/1952-73-0x0000000001DD0000-0x0000000001E4B000-memory.dmp

    Filesize

    492KB

  • memory/2200-11-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2200-13-0x0000000000400000-0x000000000047B000-memory.dmp

    Filesize

    492KB

  • memory/2200-76-0x0000000000400000-0x000000000047B000-memory.dmp

    Filesize

    492KB