Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2023, 05:44

General

  • Target

    0900d3c3c10879419b17809610e4b269.exe

  • Size

    2.9MB

  • MD5

    0900d3c3c10879419b17809610e4b269

  • SHA1

    2628631d4907d397c7fff1ef4c4881f3046c7b83

  • SHA256

    9a5b768679a82140e299f3845f53a7156a2c179d4f6e2ba11b883f0e98fb3174

  • SHA512

    bbafbe58d34362890f00b3c979057c4d33c6d211cefedadedf16646650bb3ec7b68581ea61a5c146e9b81d3ed3ea594c3c76fa3f1f1017cecfbcc1bcdf763227

  • SSDEEP

    12288:Tp4pNfz3ymJnJ8QCFkxCaQTOlOb47MMpXKb0hNGh1kG0HWnALue:tEtl9mRda1rMMpXS0hN0V0Hj

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Renames multiple (5569) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 3 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0900d3c3c10879419b17809610e4b269.exe
    "C:\Users\Admin\AppData\Local\Temp\0900d3c3c10879419b17809610e4b269.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops startup file
    • Enumerates connected drives
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:4360
    • C:\Windows\SysWOW64\HelpMe.exe
      C:\Windows\system32\HelpMe.exe
      2⤵
      • Modifies WinLogon for persistence
      • Drops startup file
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops autorun.inf file
      • Drops file in System32 directory
      PID:4932

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3803511929-1339359695-2191195476-1000\desktop.ini.exe

    Filesize

    233KB

    MD5

    5998e35f4dfbd6ac3bd39b1621ca6bd4

    SHA1

    0178a3fb6221fbdc379913877980cb6abc96a95a

    SHA256

    be51fc5d3fde4e7337feb8af97f359e8126bf86332ae34097f8fd89f3213759b

    SHA512

    5dfc4f073afeb19c36ec00cbc5ea17736f9c3046d778a5e9e328c0017f6a60616a636dd9e2e85a8d757a358340abd45e407bd93528b3be671d0289af2520321d

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    876d4e4f082cb78cb6c73258552f6b9b

    SHA1

    16f32bf36797177f689674cfa679da0d975c8737

    SHA256

    c7f6dbcb42a92ef4773e264db29675ddc5dd29cb103980ec2d3ae45a94da1497

    SHA512

    47deab1fa57471a42e19e0bfe050da4a86095f639b6028a2396b9071625a25de2e4870ef14401ac07aeb786f5ccba1e1ef6385da663d87639c4681d2648148e6

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    236c2c8c97c61a0aafe334e5463d321f

    SHA1

    32751362f6c851864db40e9359015940a41c1e60

    SHA256

    ea995d9180251ac65de1e290e6ed4eca3c3435609b707b20e8ef6652359b0d9e

    SHA512

    92e03e333071c2949e98b1937985d0d79c2aeb8ccf5bdba11b1e5ec46a60b443ff34ec88600e140cd49f7219f5fb2b99ee2133a1be6e6b7361627f858f9fb55e

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    e45cd2ee2ce4eee0c86083e531e78b56

    SHA1

    c0b98eb591ec524f8fe23604c3ddc185e5bbcd88

    SHA256

    385377c5d40e2f7e3cdd08cfc2afd8d925ddf42eb3888ca86a33c7e758d00c60

    SHA512

    1b819e3e8b48ca35f3dc7fc39aa240816cccd411528f5124d94267920fdb370df8cc693b38cd94b2d5d3af6123b90533c5cd5b7786e64aae55bedfba360307fd

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    6a04462bcfeca7ecb9e80bcaa9af0d3b

    SHA1

    8419610a32adeb5e780704c214a9035787e110cd

    SHA256

    fdbc51cc9d4178b3a63812ca4001d533f00a2a5e62364e3ca1452b724c9130d4

    SHA512

    a5505309bf0a31985fa40997b67539f7cddc9850afd204a19d640825757a9297ce4ab404623c30096a9d9b23d21ff1a9b12408e1371dda2467c3dd906c9424e3

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    dd8eab3e9b5bfb530fc28deb80960b3a

    SHA1

    4e45b3b77c9f25062bf69ee8da7a4a03d804643f

    SHA256

    627f941fd98f9e32080c29780c42ed130ee3ff6a80652da4752aedde6edf7f74

    SHA512

    7062087abbce498ed3a21691e94b82840282d9ac8a589aecf07965da07a177bfdb0b682efd2b7136e7e6bdc02598fcf783433ae6392682ee2813d4df42f5dd79

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    eebdc7a5ea79f8a039c62a3fe9d4c093

    SHA1

    644577ca858e4963ba7dc79150963667452b1a48

    SHA256

    1da5d28ef3234ebc28bdd6ac329a8a87ee761b18fb1da6aac6e414ce3b311a6e

    SHA512

    1f2295d9e591eaea4f904bda0bb7888f49450c77a1b73cc77c739cc6663423d41af4b155590efef36e82ebd6502483d4bc47fed972a6bd1877423acd1f5f7303

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    fa9cccda9c8ae094041b876f078a7b8f

    SHA1

    adfc314359887fbce00f3bd800731b4629a567cc

    SHA256

    e65b84d0187b777b016629bbb3908a3915bdfd4ae73258584dea630815666ec4

    SHA512

    fe149741c2612f514119d2607e647c163afc71b9dd4ae7cc2472e58864cac8c54a8089b2f47dfb35b773e34a81d5759947d4f776a3200f748ed43192b9874e9c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    cb326b47754657c9905fb65586aba414

    SHA1

    9dd73beaf533500df06a88dd95b0d9776e5dcdb0

    SHA256

    66954c7c45bf85350934cc9134028dc9d8cc511042ac21ddd3472d7e63fa18f2

    SHA512

    962610ecfdbc2fe56834d9bb58fba81666528e08b9336fc1ab9254c4d0378600601a531eaf37628e1429908b4b5bbf84eade00232cfe196acd099b3b34506989

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    920e6c9afc97daf61e3db931b0b90cba

    SHA1

    62429bcfada571a05057fb3b5555c36021b4b5e2

    SHA256

    429841301a7b60c3b633d13d18294009df941e8b2092faddff3030009934729c

    SHA512

    7d28c962874f97130c123216f02e07d71a10453c89691a76391be0c566727d9993e5749f6f1305bfedc74307aada4a181a249e7ca19e51fa74bf36536c29f1b5

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    1463193d930df3a3dcd395b878e84e6f

    SHA1

    125331d4ef4e4ce35f7d2eccbdf3e5c9e8a1da65

    SHA256

    10c4da2970832db4d4809dd416cf94d77e8ae2e8400002ceefb8cdf71a3d5682

    SHA512

    a7621cbb3ea95214b312874a429a813ef8d9fa72272781e1101d5225b04567097399b51b8c06404b8a25a1bf364bb086d8c2945dcb6b034dac2276767ab60907

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    0d5b6e6ab80a849b4e9e7739314da39b

    SHA1

    3f02f2363c77eb9d8564f8832036c09c59d921b8

    SHA256

    a41f9e9b7c1a2c8f9ce54a2a1908650523f326831bd482228b4c8680b3868848

    SHA512

    da5997c1b224abc077a7c711e88c782c219286938c7855eeda470d6f2d80f08d201c01d8e0cba47a95726093fc346feea92679aa24ea7f500b7282451a117e72

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    770277ab70966baf8affcda2d4d3306f

    SHA1

    07619e8aea965a14a1922779e4f2d72af6f84af7

    SHA256

    b3cd1edb96c254c6e3ee7e099f47fb18cfa181d96e3d3aa79842036377d3c201

    SHA512

    233184f7c60b18f8bf1d6a06ee441eaf41b3e6ccda8af580c7cde1cf31a5dd003d87e47cfaa59ca2aef81866adb221136bcab088ceeac235cd60ab236b62053d

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    9111b82560ba556c230d72d872d7dde6

    SHA1

    7247fad3d97a5d2b4ab6725287f5477b91356b0f

    SHA256

    8b85a474b80ef2ff8a78109fb3676ed5da5fbdbc0747103cd5fb53b03451d931

    SHA512

    1840d29a065d445fafa41afa2ae677b48d4a501163efaa2b23c37fab2d83db69b7fde5c9f44768786496e9dfa02034af4f39505154ec9e97f8315cbfc93b09fc

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    04361e55e21fbae2c046af7c714f597e

    SHA1

    93c9123a0bd901cff9538dcd7b274618e2ff6539

    SHA256

    cb7157c763edfaea40a1a33c1a6e26cae192d6ef66fd5d41dac8b66884c5cbec

    SHA512

    0f7477119613a6e42a7984485e0fd625017697bf23bc62c90ced8ab76232e49fe985b941a11f9fccb41ce1730d4b0c8fa8190f2d3040dff0b5020cc144a4a5d2

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    8f7beb4c3bae7d32dc1d78d16ee2ece0

    SHA1

    731aaeb59ae7aa33d8537ae68482de4cf66e0a74

    SHA256

    682f04e0ec2e8c8c80bf0648a3cbe420aaa0cd146fbee5c3a6d8f6ad963ea642

    SHA512

    6f48cb0de9620bc27f4b2aa98cbe053b5ee4d1259a047968e2913f49b661c993495d7f0fa8620d3582ddf506ae34abb2f0ef0db1c1d5953f5b87ad52850cc25e

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    fb0ce47a9a46bf3b765595aab34cdc1c

    SHA1

    8863c7f105fdc2985ffd977070af64bfaeea8924

    SHA256

    bb5e074652a5764d79780c38a00c4963cbf512d584f482c7280ad1e31a7bb821

    SHA512

    60391c68d3728819038fbedb49f83cb1550a0fe5f84fa0e6f82dccd785806629da31ada55575cacd682af753a181c7292f4786e4d68ee7f967ed6c6643836682

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    a2000aa324c5a56e9be14e16c6cbeeb9

    SHA1

    7b3902983d428316214e7f81e36785a18a0f8b4e

    SHA256

    6129f17e5ab3b6cd12bdd8348dd11a177236542f8e1c6f7f4f380b56e285a7f0

    SHA512

    3d1272716299827ec79b49ffbff4bac9d0a5e4009c6c34c4b6de1c90bce169b47aba2fc5d71a43436e7fb2c778d4013a08fb762145c6045471fd5aeeca52ad4c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    97efaf64d6cfa858ddc01bce56fbfb87

    SHA1

    9a15b80567654004373165a897eee6fca50c7678

    SHA256

    9c38dc04dfcd137d8af366400ceb6c3356896c785704fe7027e01d2b95cd74a9

    SHA512

    06b0031f757ce1840ee6f5806b3e9677b2e6b3541e551a4a75d63cff9586489f17e70cac3d68bc7b952ad910b3b9285a0241794bf0f9506969abcc215a58613d

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    1b51a52d5c53c9b03094894ee42443e8

    SHA1

    e649280bc9e66844a9f1aadc96e02ea5cc8c6325

    SHA256

    52f0f00cb80a15e26fc3906a1cd8f3cbb4e9a17299df8138256ec7caeb75f039

    SHA512

    207d47626eea0730428178572e490290efa23aab82454b8729b6aebb0d3d25cf272e1f2ddac1eb892f34e041e921382fa3ce583bd50095cb65771e213e95d05f

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    c9e2ac97884659d2778bc414f6a8ce09

    SHA1

    79ab725f42ec87f1397a31b487f5e3663403141d

    SHA256

    721a6632434b5912bb5da55c7b69e92bd0ba308cd681cb4977f8ce1cd9d4eae6

    SHA512

    ce8df9ee70e4d3064050cada0a607f0cf97d8591674409607beaeecce9a59c8984f02da2156233192b0160806a01bc7483844cd52010df01a26664ed92558568

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    4d951d98b400f7a1876a0d990ff974cf

    SHA1

    81f618da5971ef93eb1d2ffa3712aa7d0f9dfec7

    SHA256

    60de0210616843f8ff17f41f76663b67015cbf8714c0ead5dbb35ef29f6cb7f5

    SHA512

    204174ed0fbeb05d440695159f1778f7f7c4eccbf5a7e0ba49b86bf238791d02ae721f22d0c4885605593246dfd30e1559261c9b986bed578f67f4a135a41d54

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    4d6775a8dc2ec4edaaa27f2987b7aa17

    SHA1

    9fe42cd170777a8396271746264413c494e3189b

    SHA256

    cb110df258b76ef6e3de17aa11b87d7c4d96fd9fdb646b835e93461e80a22096

    SHA512

    75e606dbb8c03ae29a0e0dc720e67c5a21acc25a6842fe71ca95fa63ccbefb0a7519321932921c1d9b80cca607027db9e53c8117fd003c8a1c80c3309ada0f09

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    1739a9553c6850e1fa0ad2c4832c5013

    SHA1

    41ac84ce73d9394f6ba31d404ce931445c619daf

    SHA256

    5ee4ae90e10bfa7f282334f0112bc93c165bb4c867ccdfb5dc11ab4ce7bd2e4b

    SHA512

    99aafc32a305313edf3a2c6b6e6176576dafe9dcd6902de0cddbcccf15e8e7928780cc1db9e017b7367bc1ad17b25a145476f5e405e94dff5170d4c91017c7bf

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    bee8f1076bb7deb1cd36b6f03a5939ac

    SHA1

    753380543dee29d3a78ed151123336a47fafff85

    SHA256

    5b411e3be71a3f7ff274f49c7f0f6e12a3526e90eb4dccabe6b19b634fc1b1aa

    SHA512

    719f4df92a72cecc8789ba27d85d804ec1bf7f36ba9d1410f9262285eceec9f5ee54a9721874ad2d598c7d4db668969831d2c9797c4dba9b022c31ff381be8c4

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    1ffe242282068d8dc52fb0c395a33bfb

    SHA1

    1ecea198d43eb44f154763fe070a1d4ab22609ca

    SHA256

    cfd8efc184dca53fcf069ca7d194e59ffc9145a73bf9463fc2e1d3ce01af23d4

    SHA512

    49faa82d11edfc0ec3ee83e5d5556690765dd5c4a6157c71b5992af695ab8de89c68accd4167516cc26faa40f45741d321ba02716c5b7644796ce5580dead767

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    56fe6aaf1efd30611f4ace060a34b4ee

    SHA1

    a3b384435d725701d0e2fa5d9ca67cbf6bc338f9

    SHA256

    9015e0b83c5f697194475b18a4532adda71951d6610a780d9823db476c4e35f2

    SHA512

    38cbb0e0ebb5d6416aefacf10ea190ecb3abbae2e6123e2f314b066c11cd11eff972963d56ab47d607fc69fac58c542aa4265ff2557245108550178f3a1b83a1

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    2fa4439f65f2bf0b5ddb3bdd97e66bfd

    SHA1

    1197692e487389ee7ac79a7d953f6db5704e1917

    SHA256

    c24272f33f50441595aeb600a31afb05773be89227a0f80e218a174b7bf36ac5

    SHA512

    0e70f5dab22932a64ade0bd70886705a3812bcaf57fb274915c7aef7720df8d907d2c33660870529b970885120adbb763fc258154480341cc6325b354e8971e2

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    f03984870be1487c230154a0d1e0cf22

    SHA1

    dfe60ea9ab8790b8072f566de0d2c8dd01775e20

    SHA256

    1b94e5e0eb9ac73343dea95710b974434697fd91d9b64c92ea30bf0122c0c365

    SHA512

    e8bdff899ad5fba0907b32c6023f6beaa1a42ae958fada795a49f1db4ea8e0df0d07a3c58cca5dc0896041829f39ceedda427f25099a90a2804944f7f4e60bc5

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    c6da461d5f819a8bd5693fc6d577dc51

    SHA1

    cd645bf38a6a12c196d2a9c42c0224e640636835

    SHA256

    3b49095c88083a1af0d1ef97f25dc642a0f7d2d3235468b3809190700289d523

    SHA512

    9f59463a34c42b756f1d4a34d814a93a327145d8a3265ef342c1b87fe41677c304963c8f279a40460a0d13a5d24af637cfa8a7581cc29649e032f74444dd32d1

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    b5aa144f28afca26889f3ee25a5e6639

    SHA1

    aa0e00c58eb8116bc4f93ddd6c5c0edbf02170c1

    SHA256

    aea827f572fd21d55442f470a3f23f80e9d72f60bbc4be761ee8fb8c1d76a862

    SHA512

    a8a0687e4b39ea54647b686f7b30586ac90f9e53e7e91b645720823534adb6762df9ce888a57694d094376c59a78977e1a4804bcc12119a3435a92389e51cae5

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    beb6098b9a00ff5317645378070945c4

    SHA1

    c88fd4b46674c4a431b5181f547c1a8ef0dc745b

    SHA256

    1b0cba0e07ef8c5d94056167658316f0bec3fcbb93cab9122781769934658cf2

    SHA512

    431c7b231dfc7dd2f94094aba44d75a40a941b5ae4bb66388f33809fd6b05e9b899b9a1446a15784f807b13f2a1bbf19658e7a93d2e8c6c20050723e311fee37

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    5b9abbb021f0b4f4f4b39c5deb1db72a

    SHA1

    941f1e052b519c0a018f1cb5d1648211681c3cac

    SHA256

    bc382bfd436262e47bdedca9738b70b0f6b2fabca30d023b647c7fb9ec40b711

    SHA512

    87c38693ce52f1160c87bbc1eb0953df44c1bbe8feb35c0f6fe998701f468480c9ed9cdab84fe3aea6ccc4ebb403cc2c720ab6a3fd3da6a25d29c19ccd07b887

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    90952b45ae6ed56ce9786e766172a6a3

    SHA1

    4708f0bddce1bdf9bfe13b643127e8b5a187a3c9

    SHA256

    cbfb8be5c77859a1c117866b13471c1f3affd92d39a3b183532bf761ece13a9d

    SHA512

    d7b91c96278a33b5308f7eda338780bf54b628de9468f500312ef7b62812a8694339e22d2541b2d10ccfe0ac4d34a41fa67d6300e473ce3428f5861f9ec7b6ac

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    16873c571164f4987ff11dc381adc9d1

    SHA1

    e7c334241d326984d98eba3040885550f98f2886

    SHA256

    8f7ea0749b59c7e48d7aa10efa0ee2748ce54ce53d03fd88cb7ca895329b2539

    SHA512

    9e0fd4edf97fbbb8946ae037c34e227cf0527fa8e4d2f2406b998c3a57ab86a6f72ad3010ae4e8bd214275e81b1d97efaa838ef3570cc35dcc8bd68fd2e388ce

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    fc85f3332613da925bec92db763d619d

    SHA1

    b92e8f7071ad28025722185087792f5ad3fc45df

    SHA256

    f56a9e3c1b308ddc6c5b8a356af95a9d9cbec06b891a7d4c2dea4f1a39597426

    SHA512

    e23e2bb0fafecbee04eb9e93c96636c3b74c64ffc89ec441e04a8b357a68d7144998c9260e1f4e20c65d715eb11c5fd7fe9895a33ac8e081a5e882c3356413fe

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    88b19d2990e486dc305c91fd3211884c

    SHA1

    0f92e114ec1a586984e9ea58c4d2d6e3fc32d4bb

    SHA256

    a50a958b2cf9750fb01bb58110831b1860ebdd196873cf6367e24fab3fe1e2ea

    SHA512

    0dddd08eddb7680062df56faa5942d13ced7dd611fef0a2c840666b268083ce0d0a51fecc9058be3dffc3027025c02d222fbe6dbcc7aef53ace66670da21afb9

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    5165de673ba4bf21e628d39f6b7ef950

    SHA1

    7014465d7091f95027222348b8f240726f07383d

    SHA256

    d0167eda82a5c56048e76b8a1475efdb5a427314e8c71bae8f812e4255f9b0f1

    SHA512

    7b38dbe6c5fd5f392f08adff3df671eb2f6f61fd1d16de176c691ba75406336da54593a89376732fd424d2f33f14011eeeac56a61a331ad0e054dfee97f581b6

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    8cf9091f56af88d6684cb04da9afcf9b

    SHA1

    51d702c7dfcd7deb1273bab4fcc67495e0eee06f

    SHA256

    75135416f5625cfcdb9e9e7ac28d3e9f0857087341a45b788b59d9c64fab5788

    SHA512

    0aa8f76006359644607cfcb7ac54c0d17a280da0428334c528295bf8831c7e31bdaa72f4a92a1564430277c004f7cb9cd3ea0818d9220268c5c24ee6a0dd6d37

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    2094d7f8c5f40bf4b5b306058e283726

    SHA1

    8a7780a015bb77932add2fe070c1f9f4ebb8c661

    SHA256

    7b761edf11b9cfe764474a15eb4f8e9ca23b94c8f6677578dd23e75b3d7fa380

    SHA512

    b96b2126278b85b40dcb4581cc7fc4e8f6140eddc843197900b32dc7927a7d388753acacc9318eef4c47fcf3a630f5c23bb8488c9593c98607b5df96c73acb24

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    f1c338264e6b5a9f3a52810070077cc3

    SHA1

    79ac3d8ce5c06a2fe8c5f004428ac0dd58cbc22c

    SHA256

    55e2c65f2e54b9c31d17e94f2480dd32893d997a4804d64ec7ec85caf7d35316

    SHA512

    1960bf56d8dada218b14f0dc2b2dddf773a288251280305ede00bd8767167a6c667740a58aae77e207dafbd86d51cf74ade42de841b7290d2a4ecd2b605c106c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    e3bcbd92cb50e9e306a7bf5d4c928482

    SHA1

    b94c72ecb7dfe3a2ee33ebd621b1c5e1cfba95f0

    SHA256

    9a056f1b456b259d4ce23e36da154a1f1771961b546d8dfc0b745f7eb5c2d384

    SHA512

    7de40432d72cb645e3de9f46b55b0b863472a60b1dcb67975b433cecd96122c5fdf2bcafb9925a55394679a550aa1a1227361ee87716a6ffa2e1e45234020377

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    7b21873873976666d83cc684e117eda5

    SHA1

    809243c38e35c1cc25871d2adbfd6424e7ba91cb

    SHA256

    afd5514304fcf8e35d5afba74c8eba936bc6c0286fc85d9d15dbc1aa76dbdd29

    SHA512

    f22e61535214aba3b7b038af5ea86862a47c204a934c9c90515a4f65ac219dae5b1b2a46ab95987f7b63c2e6402cc3248199b592618d2a00d7532edaf93b2e7e

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    4362f5453e5cea2cbd4ae3bd90f07da7

    SHA1

    4356ef8b5b1f822769df0b8540d9ba81a2fc5f48

    SHA256

    e8bc892b24d1e39715a0702115e7b3b86b8b4b36113116720a780f8e44f99446

    SHA512

    22dd75b26d8aa2cf0b937b210738811937b05607a7ea22cf63168d6647a566937e10ca59a24be4278f5c87b47300f9670d51e6749ca1dc81dece2509971c390e

  • C:\Windows\SysWOW64\HelpMe.exe

    Filesize

    2.0MB

    MD5

    643622313d114419fa46d3ad218762d7

    SHA1

    f3c83aee77b9b7c62f3d5af3cb4e8634b5c536ae

    SHA256

    e2eddd32c5983815418fc7814aed2e810df315a7daebb2631ce0f836058ffc4c

    SHA512

    6b03f2d0fedd65793216f6a9103aa4437213a87e833c2c8fbf18dafe67f7f7e75df714221a073203e798bf624191ac5917e68772b86ebc04223afc3cabb021bb

  • C:\Windows\SysWOW64\HelpMe.exe

    Filesize

    1.6MB

    MD5

    6ee146d35d23cd4cf41fa2224e8ac9f5

    SHA1

    b1a4964de08060c40d6907cd2ee223f9e7403fdf

    SHA256

    e8a983069a3e4bdce56d1ac6deda49c5ca141fffebb1767683774d83a850394a

    SHA512

    df8c2913b8c1c87256d6f34ebfdcc9f98df68eeddf116738d04a324df62889ab03b117aaeea06cb5c1e2d43954c5c10d936e3b2ad135b4bb4f480d3b33693d84

  • F:\$RECYCLE.BIN\S-1-5-21-3803511929-1339359695-2191195476-1000\desktop.ini.exe

    Filesize

    803KB

    MD5

    a4e38ace13c3aac33d3fd1472e69b833

    SHA1

    70c65c51dc0bb84d2b63a5a07fcae2c04fef167a

    SHA256

    f2a7ff58c93e8cb2a755aec63bd4d9b2a850ffdded77c5fe083ec4db9413cc7d

    SHA512

    aba67a0e61bd9fe9c61874a27f93afcbdb82df1f4cb65e652900f19d9f40a6217892ba71fd855c5a0190218028667bd762899360f004f246109caf9a3797ed25

  • F:\AUTORUN.INF

    Filesize

    145B

    MD5

    ca13857b2fd3895a39f09d9dde3cca97

    SHA1

    8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

    SHA256

    cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

    SHA512

    55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

  • F:\AutoRun.exe

    Filesize

    218KB

    MD5

    ed71d60ffaae33e396be0dd7ee6c37a0

    SHA1

    2c6b876b6933a908ac61566478781a398169e7a4

    SHA256

    1a19191b342ce56f6fbedca9e34ba416484ed6e9c284d82a31e879f153f310cb

    SHA512

    a9a85aba5b3e6daecdff28ad9393c8f233adc1ed49b1a17817d9fa084f585dda616e525a9523241c0c114377d73cea45b56a7c061e225413aec96f661f378dc2

  • memory/4360-4377-0x0000000002210000-0x0000000002211000-memory.dmp

    Filesize

    4KB

  • memory/4360-0-0x0000000002210000-0x0000000002211000-memory.dmp

    Filesize

    4KB

  • memory/4932-5-0x00000000021F0000-0x00000000021F1000-memory.dmp

    Filesize

    4KB