Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    6s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2023, 22:17

General

  • Target

    1e3a04c6a1b9a3569a656a45fa2ff15a.exe

  • Size

    6.2MB

  • MD5

    1e3a04c6a1b9a3569a656a45fa2ff15a

  • SHA1

    1e5ee399066ea2284ec7325c96d5bc73d6ac7544

  • SHA256

    191885b5edaf68153062c17e9ed14fcd0189d78af052135351d5c0bffd5d2e8b

  • SHA512

    a7bc8d9effdd7c402f656889f39efc9224215624d5827c37ea4209d14d31aec98d89c2798eb73397ef6c50023391c397c5b90a80cca4184b55a43fcd0f8100ce

  • SSDEEP

    98304:mE2ji0F/LR5Wj+hMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMM/:mn+0ltNI2lyH

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 3 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 36 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1e3a04c6a1b9a3569a656a45fa2ff15a.exe
    "C:\Users\Admin\AppData\Local\Temp\1e3a04c6a1b9a3569a656a45fa2ff15a.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops startup file
    • Enumerates connected drives
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:752
    • C:\Windows\SysWOW64\HelpMe.exe
      C:\Windows\system32\HelpMe.exe
      2⤵
      • Modifies WinLogon for persistence
      • Drops startup file
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops autorun.inf file
      • Drops file in System32 directory
      PID:992

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3803511929-1339359695-2191195476-1000\desktop.ini.exe

    Filesize

    113KB

    MD5

    3b1f5440daa30ecb0fe69ad19a2888de

    SHA1

    2a5fcab31545af415b39de6560514438627856d3

    SHA256

    477f0b2c287943e62db62b9fca114d29703cb6fcf579a81a95a36071cc547628

    SHA512

    e334be850f2e626585eda6ac26e15db984150483caf40e46342f4f36da1c92c712c41a304903a3afd64ce42984fde47664b36fc59209040d20a125dfe41bddda

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    8297e80aaba0bb4b33e13d99037206ba

    SHA1

    b6c9b1e2a23e7e11e28d57b2e290dd19df69b5fd

    SHA256

    6962e3dffb371576f06d3a2b81b5f937c5d811e2a84e3c85b0cbf2c07194f203

    SHA512

    e85c49349725384976379d6ec6ede549769161ed49631554c181371759a13a3f0bac52c50c2784600d17d9c1f56c0aebdb355996f54ba682b7c96964d53e8ef3

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    56b018e14cf17aa224c39812c8ff31f9

    SHA1

    fa25f93873f431c738df9263f4a6cee836f3dff9

    SHA256

    76dd65bd60346249572536ea5ff5d707a815f5d247cc18f459db686da2db71d6

    SHA512

    badd794b161a82214d45d033f5c71240676364ec029c6e710133f6d99c8f7e5874a8700f787d6acce7ac4874b227c5bcab840c81b64763895cbe782f4e4e28ca

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    74eaf303b6fab9f6ccc5e7dd646f9e6c

    SHA1

    291ca4ae3b0d974cc446f500c1e1a936725ea5e7

    SHA256

    3ef591a95c3fda587a2f0d0d45c2dfe312f864ccd039e39e98767f7c4355633a

    SHA512

    42715032763e792faf7ce9c44c0c76d15e01dd434fdf518c2293b19fcb2c5cddf76faf4f2a9f9d6b1f3b8f6db8b8ee393baab3c9d7b1837011a3717f0a9024a6

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    5c19fd2c5ade66a4b7b2c2de1ba8aaa6

    SHA1

    7dacce686ab07a0bafe4c06e0a10a1fac3c3273d

    SHA256

    0261eee6fca29b22828657c552b77aa015c4fc089d41082fb06f097f9704df55

    SHA512

    2d74c16ea1fb930e57d8d91c572e3b0e68faa6cd3df865c73e7cdb51b78457c5415a74f82e47d672bf57b884b2699dac972c9cae7d2d7a5dd8a152de71571376

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    9818872392982ff0ad6d6071a644a9bd

    SHA1

    e02eda3e75c611bd199d19a96dcdd1239b6c10d9

    SHA256

    a82954a093cb80d62ff728f8f4a9d0fc1ad2d02a0923cec13098a891e778d8d8

    SHA512

    0b72e0aeec2daa604698fc343e4cc9e43a374b8c3663940430248fd47ee60b014721a72285cb7afc143f72105e8d611410b14d0ada164cec2233d4b0b08906a0

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    0e06f9a47d262933e1091ec9205ec979

    SHA1

    88476a9c6725d67d05e105c2c1e1688ee7c5132c

    SHA256

    f6f25fe557052cc02b7bc06b9eaeb44d8844c496375aa87546634d4f978bd40a

    SHA512

    7bc6238e43882bedb8f1cb943613679c6e0fa4aa94c1e83a1788c72871980fdada65b63da109180bd464ab6df09dd08a0308b2128d29d0daf1ba4cb918fd3dd2

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    ab808fd1b4cb7e5c8614484222e60e44

    SHA1

    174c48a4cbac08aa8dc4ab9ebfb7429cf04038fc

    SHA256

    a6944c6a20023df48b92a47cf6bd3916cce714365994a1198c160fc8483c8e9c

    SHA512

    188ae7d3e8c5f0797b39764a78e286a85ea2b1db2053c910e780e8893a5373915bc1a5d2c7f24903bbf2339526fe979bfb757dcd69f12da5f4e5d792480d00f7

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    15b96d2e982409f6f14fd0ca781e6a61

    SHA1

    ec2c0dc970f021a8fcf6e24fdb4959a9ffda1081

    SHA256

    2038ee88b0ef1bb9c4b4cca55303819f58c8275b125ad8f218728ad92cdc892f

    SHA512

    cdf48ea43a9669590e04c087068b0c5969091c1e922f96dcf5dc52d05bc2eaf9145531a35b959382b408f9234ffce82ec6a10fcff6f18f8587ad06ccea31a50d

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    f70b94bd3f83418bba63e2bfade842bb

    SHA1

    dd99a52dec7ad9bc64c043095f4b7b0a0b8e8885

    SHA256

    c105077eb13429d7b97ab3bfb9dfb57cd3d63d3b5fb94ca0e52c5986ef882ba2

    SHA512

    2c125b8282e3c0a4269c0062eff820947c74bdd508d1c708b6dd26a3b883a2c8c215254f93f7b8b1113f22782ef63f416efa872a4e5adbee43f5116cd77f0c1f

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    12911f5be67ac2e846e54d5deeed93c8

    SHA1

    5ea38e2938ef38720ebfda8aa373e55275bb3ec4

    SHA256

    9e2d3042b675becb156080e8a3fd506ec19c557b88bcb897165d2b1cdd24772c

    SHA512

    7880e49b7a3d34b5e490e8221180dc6a4e2d4f01addc90b67c1d25e1b064c288c3bf2b24ca577d0452f1bffd02996aae6cd712be9c612b933a0701172fcdffa5

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    e811ad7b67459b5e1e0f4a59694fd1aa

    SHA1

    624298067a43db6caab80d546f9b60ad3201c815

    SHA256

    dd4e9ea8127d83228dfc57e12b86d9979e500bd9a235a1d2498bd7de050642f8

    SHA512

    c4f9cc82f89f4f26be5b4a696e03f4a7b1bc824f869e9230b0a49c4430822585fc008dd0e5022dbc3350e48795037c2864205cb0448aeb0fe9f2df15b73be448

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    50a75c1357b6689d9919c1887e0e9610

    SHA1

    75d362dc2b22531ddb304fefb0035b0eb4908fe3

    SHA256

    ca75d0b4e737e9b592f64da977072ec3a85e66486ee2ddcafc1803e7cf997236

    SHA512

    ca0bc60424b29b6479bc81d420e830ec48c065a8ac1b628ce522439664be4df48f74fc77503be715d72eadb4cd9d5d47cf530ea0912213f19d9370f15338377a

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    4c37f8d9bdfbeaa7afdc656e81826544

    SHA1

    fab0a9566a15db86fba3dabb65470d195a348c4a

    SHA256

    1ae6fb86c4cec3d9fd36493c002d8c3060a5bc73fd81ee2456ed0aed9189a644

    SHA512

    c72cb3cc9b3c234d669fe72264ba22e83885fb5a717ab488d97b271d045ae752febedb1c40f6c3c812f59f1c365dbdedfb5457b13b9ec46baa99609df0c45f0d

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    f0c1a3571802d8056ebb7408f65f87bb

    SHA1

    7e29106fc129d8d284fb28a9c0d4c9b2ec94f360

    SHA256

    9c40057460c7312a6d1860fc6342876324b4068e989367bf8d35efd248df2553

    SHA512

    72ed2c3267af208d0d29380e6ed7d15498a0dd89e32ed8db767b4851cfd49c3741e3b022c0a24fc92286bf00def8b663e9cb68408588dda7a661d0c7a50784b5

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    5a654a9590da86a1b967bce796a20b3f

    SHA1

    697cec6ffc597aa11f6b4fa27d4ac0123382002c

    SHA256

    d43235fcf2b19537a54cac5cced4368e754de3f32b8901cdf495bfe0db45c10b

    SHA512

    7878882ab79d5ffa2c54780e7aebfc842a6de2f857a97855d1c44312f7d12087343d4517386948bac40ff0200552b213c230ed89cac6d2c449e95c539e0bbe13

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    5d524dfae3cd0a0cae327d0519c305d7

    SHA1

    697406e13220568bb60d7d511035a58cdc72162d

    SHA256

    1dd5890b32c7f425a02584c79390dbd72f3964573d82b77b6f06824f8cd91194

    SHA512

    7c5e5ff3fd1b6709ea7d685cea64a378baa0d02334bd2376c0be5ecf8908be7e3090e9ca4f7357eacdb33700ee2200b2d0c0aab45f4ebbc45a78e615ca8e2b56

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    7554ff505eecf9856758a1409ea487f3

    SHA1

    cb18091939e886ac7ab8da19e4045484252705a7

    SHA256

    8e958fa62451df403791f676297609adf758b72a8da5b3be23c959f100850a1d

    SHA512

    2e797dfcc1fc6a74c7a0ba9477bddad6b3c61c4155b8fed283a81bcb36f690794efe7e5923ba350ad2267b1f57c5d89dcc325ece66378a3385a3cb1682230622

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    0206944294688909cd747d90ddd128b7

    SHA1

    149722f9c6bce38552a8cef930657eb2ed584054

    SHA256

    cbcc75ce305da07cffdb63f423be2c1f2ce4c860f40af06729579c902142abfb

    SHA512

    156da3b25ef425d0271dab0543e528917256df75396e4bc5ee84230f90c7dd34d1d61b949f22670d5d9b861ecd82b98a8423b9bdd9fe39972207379b0031f8ff

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    df474334f6bbe53119faa8ed5c87d881

    SHA1

    6950c0b6309ed9f3d5108d505487e1a17998c9de

    SHA256

    0ec71f76be383a0cb01cced8ca7fc39f497575190963bb5d733bb0863ba01b5b

    SHA512

    22d216627115d5677d3e29b8daaa615d8676d30b7d4dcf6f75365254286b03066f8a1b3bd9b5ce7668043cca36957b0e4c9600e9b6ba8aa58ff962ae60380412

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    7b8f7b3cdec0e0791c2ecb5c27c6fe7c

    SHA1

    6487aab75a84af1bfafb2777ceb5f5950d5b87f7

    SHA256

    8d85dc0e967223450cb1bf2baced64e66c321285102a689eca7a82a87deba06e

    SHA512

    c36d21994898fe4f9bca3b57f7288646996d9c73b8236477606816a969b62a364b09185eeed5a64e14ce9d3e38e546d235c3751541e332e6cc800f2d30405427

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    652b6ae15bddbca4acb4a7ba445a2704

    SHA1

    cf368ec3b9d3e9f242c477b60909fdf1393310e4

    SHA256

    87a699886e066646aca40cc2926634404a0fb5b2657b9e2beec57aef2d0078a1

    SHA512

    a92ae70c069fb7ad49fe608c7838e697ca1a77c5af8d03d6f821d336b6f9b46ee24817c3256e5d0b3288b8743a74db8333943785bc4eac11d7d330303794e2bf

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    0c669fe0826c190185576b8517e87e93

    SHA1

    f9ead35e1d3c3ef414def09462a8c48e0e9761ba

    SHA256

    c74d8e05aaa89f1d6532dba40205bc3a8b6fcb21b5d5c49b116b95e533bfb94e

    SHA512

    c4f37f8cd5a6ac10e350a0f639d78fa211672132630d6096cf63cba211ca79b26587eb8ea75702b3c4d742b8c92ecc954529cdd4b8c6ca4f65db8bcfb74418f1

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    f31bb5b45f806c71d48595ca8348a606

    SHA1

    b454edd4cac5303278ce78a587e0b5e00d1fe2ae

    SHA256

    d52e139266ac09c323cffcb05a99ed36e2db4ef3b22b035dbd50c61bc6ec5d83

    SHA512

    4dadaebbef71cb30e53d879c488270e4a3f1826348c3ed263f5db7193893ff0b0f9d37536e45e5bb3eb898e44422b34e1a776f9e9e2936f42ff6787587f65e3c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    9f35019527c8a97763aa2d2c6a4d9e7d

    SHA1

    fb11b2a18050bc13209a0e8583614b0b79e8fcf4

    SHA256

    b2dfd1bfa5203976cae33ff6a99daaf2e982860b47b3c455d546db36bd6dd89d

    SHA512

    782f036938455480c1a37b864b461390e988944b0910f5f68078f0c7cd5a2144ce5febe907a6bafce8e015f1d3df8fb9820f4ffa5ccb5e34ecea359f9764b219

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    debd068701a6699d06be74287f691148

    SHA1

    4dfce134ddae2dcbb8726ed559b55a9348fc4d58

    SHA256

    d0c5d450dc586222155e8eee1f0778ded9d8206183fee24b2e4edbff2b7469c0

    SHA512

    8a8d7df309ab410530cc6da001126f9b79dd0d040f03f592b08ab053fd3041d38c103282f3449ff8efdcbe153a34539fc3a1e08e78ce82ff3767bb4baee86f23

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    826d445867c5e752b180e109f6699fab

    SHA1

    9daafd83e3465aa5a6ad2c78c2eb22263daff919

    SHA256

    2c118e73d5351700dff171dbe957e3fcd5cd950b1eda49e41c25d72f4f9d6df6

    SHA512

    4416c8ffbb85cd40c48766859535a56dabd1681510a68f7935b1bd2fc46563a66624d9880bd4fe9861990bc576ab65b827bd719765a6849bebfc731a05400228

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    5b262dd81aea75d89269ed6be1c3d2ab

    SHA1

    9f418018e834f437b1e46827b8ec95e2b44fb4bb

    SHA256

    fd7a0879186701e9ed253edaffac97c40d273f59193da6453527d9e89d6d8804

    SHA512

    88929af421169a00642dd23c5708bf31045869f63ef639ebca2ef08fef48502d1d920492020950b0b75ca84eb02fa66491fad8d8b497a9572958fce06b474fd1

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    241d24edf506f6c020d5cd56b90d8932

    SHA1

    592ccb668f689d1d930bc925faf35bdc41e0cd51

    SHA256

    71ef03df80a234d7339cb43ef09d3be676dac9354a8656f5beedd1ac1edeaf44

    SHA512

    ddf3fd024c589401fb232790b5783ecc45ae284be0630e58e0fca4ded916b33940299873f77539ac03fe3c881670592206cd9e7fc14af9a4667d4f7a69f9b03b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    05826b3052191227f3acff0434bde6c1

    SHA1

    894595affc5255f4169899d17f02410adba294ab

    SHA256

    a4c0ee1c5021e5f301e307c505c5d7c14237a4d4d27eb1d74f3dcea53bf43be3

    SHA512

    986642cf031793462e98bcf211f5f26e909815e60b04c1ad208bfde665dccf753a467528d91c2e3e17756dd5e9880e390c3dd7989f4789fa7a6ad567dc2943b1

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    f2c744ba9f46875a3e426e8bd9be10fd

    SHA1

    38112b55ba7ad1fc5ab617700a9a103007044a25

    SHA256

    4e39bfabed50497797a9110ca5c904e8b52efeaeb2d7aadbbadbe45886bb2777

    SHA512

    0d031cf8cf6df7e5fdea7cb6acda4672e8f48c0fa73bebee651bf3531e22851bf900e2a68720d0cdb53e544ba7702e1c985f2371dac0f2d641e9337415a61576

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    2122866b2fc97842e421e07cf3c3557b

    SHA1

    645dbef716f32b6b9d5b687c5641facdde3f002b

    SHA256

    0cb0d6d38d213843a9fe68dc661ebe2df77cad9aa3b4fbd45d554f89652cfa17

    SHA512

    bfbdf6ab382650f4a372e090086d04ec2da80d14bba59fad3a6472ca0473cd50802e3d150b9692b45012ef4dd93bb4a7f83555c52c82c1260c4de8772a14c34c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    5eb3f2b56ad39e0ae940cc8494ddf7d3

    SHA1

    767ba0bda4907ff4d572ee6751d08e2fa8552745

    SHA256

    368775c2f4fa0d2b4f92ae8a0b15efa39f21219aeada6e8d3947222ceab74219

    SHA512

    4f40ac9741c4d2dfede65939ff757bd8d22805f29ff93342eea9c7361da939bb8bab593d0afb3b987b4f872d5e0b4ffe7d10439e1984e037f3dc9eea034a6b7a

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    d5f55063c33871d1c9c759949d58b9b6

    SHA1

    0c2ad21ca8a2df64db6b661ea90377a40989e5fa

    SHA256

    f15b89e2738b4adcd065eebb00460411f3ee43fe1e4d11d447879c8933f52045

    SHA512

    562670d2b1daa79ad2037c6c774607392c82cabeab9c70fe065b8ddb183a32a7f6ae96ac913317fec7657bb1fbd5b4b5fb644e9671e9ea04eac19972bf0a3a49

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    eaf636f33e0dac7b20109a766aa441bb

    SHA1

    31fa9b99805771f89b5d027a7de7aecf4759a53f

    SHA256

    cd27a05f09c1402a6781b68087295d131b2913189b4917df890588eaf3ff16fb

    SHA512

    e42ef5b0483d58b6be4beb1b1e2b849402be64fbcd93c043605b45f15aa7b6a7152fe973b5a9e2e4e96f027ed17586958826ebb9263fbc0f1b68c32485a21d00

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    8ebe0afb5f6ca0ae205e7db605f4557f

    SHA1

    61e036ccc64f67bb526db2eabd527aaaa9db2cd2

    SHA256

    c63266598a497fc882a1e8de88f4467b5e7e4cb08680e1074903d3c673f399d2

    SHA512

    b83c851e2d604bc30a250819005970aa9bd22eb787504617db7d29c3ffae23f2cf3de064b0808b45bb2352be39dad7a05cb7e43ff8be799d28a4351ced1b3458

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    9e657210b779a57a43a76ac8fb959e64

    SHA1

    fa3211dfabfe810f862f9dd557e263c1a37e5f13

    SHA256

    238cc15dfb6a2b8b904b36a4280a4b59a966106f60192a418f198812eff3e899

    SHA512

    6958d8c9a12c7bf3a39e5ba40db4d6f39286147cdf3098a74b76add417260ad0b0b0213585cc1b46afe6dc536cab296daf9034cae6c33a72ff871f8575e51dba

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    9e926a1fe6ac9c28934e1d4ea8309109

    SHA1

    2eee60c44280131ac7f1c362b89b069029ac65a5

    SHA256

    5131adf702ebbee12384be82fad1ebf1fdbe8041336600770b348a59d7946a22

    SHA512

    aac9f9aec7bbdbaa1562f1f5e00fa7faa94bd9f28b4767ba88a65b4fd8f75e94d1282f9da778e11935a93ccf45a36bbfe83f3939aad2af707622f87bd64e02ed

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    0df1f9880cbc923a8656f57e0bd53421

    SHA1

    3318dd8abc08f01be924ead8e943556c76075751

    SHA256

    4d170bdff2895d7f9078a1cd6df147b73299a7dbff3aacc849460f46c215490b

    SHA512

    4946b479095d9332a58849aa7360fb169caed8c468ae6c28a69d7d7cd248634792795c2638062f3119a8930b0356b8c283ed16f2d3d0cf5305c151311759f8ad

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    560debe43d6b65dce568c393cb9b9d38

    SHA1

    63668fc167691255b382f099e64739982112c5b6

    SHA256

    186c4d52053ad0a460acd48eb2572c8d17d9dcbf08cf3ca7a3a61eaeaf779e0e

    SHA512

    6fa8ca602ba9f5680efa942d12207df06646af3f355a70b5506405b53d54c5581a1d674ab7b02cde3b4d76e74321acd45afe66b84f5fa267e4bddcec8aa76a2a

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    86a4ee742314bde8b445028a11c766ca

    SHA1

    966052d58cfd9d43c714e9448d04bcb5de23452f

    SHA256

    3f63f7501ad3ae7197ac089a69a04ba0dbb13fede27aab5e921aab182254b33c

    SHA512

    e692916c7aaa4666d59aa444f8579a2ef1c367919d81caea03fbc93e3c1e3c76cdbd4c8eb154804a073bf9f7dc97f501121e65b4ace88244218996839842ab07

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    fe106c55edcbfce6039cc7de866d1d07

    SHA1

    ff4b8128e0738cec8f9557a528ce57cb9407ea6a

    SHA256

    5ab8e9c56c11be2205e0008f01df7edd322019204f88d8315ff46c858c306a22

    SHA512

    f552862dd5f8fe435a3f34f90109c813d3fe7d08a0655987df5cd0da086061d549b44e43495cb969593fbcaca6c4b4518ebe77015ba1bc1be195b32bafcafdfe

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    c9267c533e1c1327f1d162877483390c

    SHA1

    2c57ad5357e6d7a3e187d617deab9cdabc1f24e9

    SHA256

    e9ee9dd01fa77861275c044e67e9e21788473610bd7736dfddc6fd18361f0bd2

    SHA512

    bc092a179824d49013dd05e9521edda3d73b4ab2fdc3328af3c664a2395f157776eff98c47a8ac264f1b2b1959a95ea93b353fa765efc06f82de15c7b0886428

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    ecacd153defdc829fa0f4e9bcde4203a

    SHA1

    6f28aa91de11dbf1ea0b7e1d28aca348d750af69

    SHA256

    f65e6bd4d20c2e245375298c3d04844850f16a049fe4ebf9e5b6577f83c08499

    SHA512

    1054e41e0a80dba07a957b9b0076fefa2d49d2dd68d8041b9d87f7527b72ea62a995b7261e75ebaf956ff172dcc6ad3738023f0aee369089769f329e7887bc7c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    02fe0c7f9be66a824252a969cc1a1b99

    SHA1

    5bda1d76a35b78ae3693b82a5609218e8ea39526

    SHA256

    f2223ab7cb953d559139fc3b477b2e2a2f037851b2794104212212db9dcddad8

    SHA512

    0d09f19d0c17f2c079bdd67bd8fcfe1a2c2dfab65e5b57b85090426660837b88701f0daa550fddb58b78e88baa38d93e53a3e21e7641bbc7fc0fd95f0a509018

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    4675ba9b916cf8031c4d12f875adaf82

    SHA1

    2fa530986646c9154b2a294e09b6c29312532ac4

    SHA256

    c2cdc7e386adcdfa68c58e905d832bb47d9f6cf82bbded184867f2a247a72392

    SHA512

    957a95995a04d38cf75655f257bb15ba0dbab9e45147dab0f691ff7bbb885955f7f2b07033542ecdcf10426fdbaa2e4da4acbeff768b61eeb6a48dff2ae56fdd

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    7244dbaaabac2fd949a834d81d5f2027

    SHA1

    574f3d98f9ae102ffcf7bf89ab6015113769983e

    SHA256

    0dad1188a93464fc52414182d06e647ce750d002ae554d67c47a3c2b2e7eff9b

    SHA512

    ca6262ed39030470dd6ad3fc240d8f86d189b98a51800ea9cdac29771605a6839fb88e6092a2c8bdf4cff904938bb40bf15274ae2dd44e3cd1503e2aded7da47

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    f82bd5aaeae4e80d231475aca898bc08

    SHA1

    d70f31801861fcde0eeac10625e67be24d2e405f

    SHA256

    01390da858a9d3d2d429ba8c0b362653d106656804c4e10b697806aac541080c

    SHA512

    1266f9068061946efeb1610961f4026b38cb3924ec8f441fdbb15b8c123e1cde03d195a6889aa447f91683c18e2b18739c74618c04f0c5adb95a62ef347e4918

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    73dfec22b68bf810cf503cbd5e011a3c

    SHA1

    0b9095bc51114ef6994c7fbc360262d68ab16bfa

    SHA256

    0349700f1cfc4730d5af10ca24daf419e9d1335f9cb6eddcdd2fb30a866b27a1

    SHA512

    d8a4a8546fdfdbb7ec4a88c993e33ca7b9ea8de81e2784d71a3d86ca4be5b56f1b2c705111bcd2760524b4d6fd67fc05ab0998bdeb1d69b52d789aed61fa602d

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    7269ec744957379a4f140387ee8de0fd

    SHA1

    c900f705596e51006c0225ad9f838747597fe280

    SHA256

    4905cb2d5f2c7d7f5785697599c8150821026f7d8b4bfbf9c1a8783b46af437a

    SHA512

    1d14e258fc9b6d92f6fa03acd520413be00b57d15efbe9986e1615501263f10d94935301a9ba618c57c3b1a5bc71bb796537699e9fc48e0512ff566dbb595dc6

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    9a6f2b41e1594617b594d4db13e7b037

    SHA1

    3d995e2d42db6b6695b1b8fccc3644b2224f4611

    SHA256

    5e60ec85bae7ebf986ea9a453af30e9df64d52f1e35a6abdb3c3d68472050ee1

    SHA512

    9f6b91ec9e5d6fca6b85ad6fcaaec62c6969856a3ee58eb8251cc35c3d3ea2ed8090e6d2812cf567c5652a72a1dc16542abfceec3781674f625553f69eb98b15

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    942ae62c43d539ee9f2c68a715876e8c

    SHA1

    b77839b8f659b50d13045a2eefd02c7dc55e433a

    SHA256

    3ff8f26074e3cd62dbcb70930f008fc9cc3ca321d364f9ef63ab63fbb05db921

    SHA512

    a102d2e620d572f600dc96e121011c45a235c726497a2477fbad4802f74516da1ce4bda5a2908c07b0a0d2f6767bc420e29bb097104ac08cbcdde3ecef5eed32

  • C:\Windows\SysWOW64\HelpMe.exe

    Filesize

    110KB

    MD5

    4198c407958e71acf2b4b6108eb4bf61

    SHA1

    7423283147fcf2511f8fd8f76c7441dbe99afb3c

    SHA256

    0e9a6c16c47e3e4cbe4b67889290751910c2e3cc1af002f64003df59f0d7d28b

    SHA512

    74f298d2aade22fab6e2fd9cba1c120927c8eb6d9055bcda943736fa363e9a9dd64f6750d6bea24bd660c7916728fd65a035ddf9346e58298d7e8804b1b1e775

  • C:\Windows\SysWOW64\HelpMe.exe

    Filesize

    246KB

    MD5

    04b5cf2fdb409f919c0f2dbcd73bb1e8

    SHA1

    860e8b913b4527dd72b18c206995fe621e20a409

    SHA256

    5b97b23e3f67fca5549af55039fa50cd1d4da11a9d8f472a46ec7eb657610386

    SHA512

    3337b1a6a637c40ac9c6d8ac6e7ca782dc3c182bba612cb7c4509af075ed2dc01281faa92fc9d98f718269cfec59dee7e1eae3eda86d58f22235f172eb4a3504

  • F:\$RECYCLE.BIN\S-1-5-21-3803511929-1339359695-2191195476-1000\desktop.ini.exe

    Filesize

    10KB

    MD5

    794648ffb887d59afa87c69314968b1d

    SHA1

    69a23546685c456ea73dcf1dd904cb809e4c47a9

    SHA256

    aad72838933a5aa183e387966dbf11437339ee10a1d3663bd25355ae81897f47

    SHA512

    85ff3e97a15c8c4b28d3cf6d9efa91aa4d645d4cc7d98d7a198f3c3559ee260a3782964f342921d1c12430fee495d1502851c15a5e6b75230a495c1d4e6a2607

  • F:\AUTORUN.INF

    Filesize

    145B

    MD5

    ca13857b2fd3895a39f09d9dde3cca97

    SHA1

    8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

    SHA256

    cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

    SHA512

    55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

  • F:\AutoRun.exe

    Filesize

    57KB

    MD5

    9c69120fde25a9e58cc19f6bc27dec76

    SHA1

    c5e05b17140bc055dd6a2134afed68fd2804ca33

    SHA256

    21f92acbf432c878dd8b1aabbbc3bb14a3dbd2558f246e1698ecd297ab61824e

    SHA512

    ccd7a387e974f4503c5abd759f8bba1bf7db45971528325da3a6d389f93c015dda372d5be5f8bdc4614ce2d67d5ae4bcc5d0f2bdb75797657c11c230cadf8a14

  • memory/752-0-0x0000000000610000-0x0000000000611000-memory.dmp

    Filesize

    4KB

  • memory/752-2003-0x0000000000610000-0x0000000000611000-memory.dmp

    Filesize

    4KB

  • memory/992-2436-0x00000000020E0000-0x00000000020E1000-memory.dmp

    Filesize

    4KB

  • memory/992-5-0x00000000020E0000-0x00000000020E1000-memory.dmp

    Filesize

    4KB