Analysis

  • max time kernel
    146s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/01/2024, 20:16

General

  • Target

    756bab043d61134b32672f731922b9ad.exe

  • Size

    5.9MB

  • MD5

    756bab043d61134b32672f731922b9ad

  • SHA1

    cd259f4a8e1ff1d0713b03bf6a36044eb94d0e4d

  • SHA256

    7818e559bd7eb1a59e44bae2781519ee345c4213a96eb4fd587f6c31aaa0f58c

  • SHA512

    8984e42b966a057898ce641d892b8fa599efae68fa1f50cf134e2e8dae6eebfe3087b6c5805ab5f5057f3e70a02304fa22548f3f5a6d172ae038a94b87b77d14

  • SSDEEP

    24576:ZMMpXS0hN0V0HZSGB2uJ2s4otqFCJrW9FqvSbqsHasgXhFHDAGtlRXZ+CP63n0Nf:Kwi0L0qk

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Renames multiple (3212) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • ASPack v2.12-2.42 4 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Drops startup file 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 3 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\756bab043d61134b32672f731922b9ad.exe
    "C:\Users\Admin\AppData\Local\Temp\756bab043d61134b32672f731922b9ad.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops startup file
    • Enumerates connected drives
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:4500
    • C:\Windows\SysWOW64\HelpMe.exe
      C:\Windows\system32\HelpMe.exe
      2⤵
      • Modifies WinLogon for persistence
      • Drops startup file
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops autorun.inf file
      • Drops file in System32 directory
      PID:3396

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3336304223-2978740688-3645194410-1000\desktop.ini.exe

    Filesize

    3.6MB

    MD5

    c5a83cb463a76071f52f78329edfa94f

    SHA1

    89192d1c72287ccee7e7dd6997093082d05e80de

    SHA256

    b3ad5e02b42d12932a24a33225b4700b82cc90d05e2956d78423016f65843a0b

    SHA512

    027390f2e1c96dea5a7fdde1ccc357b9bf0f257bb3c94d5a56a822979102174eee7456ae66e04f622111cc6b3d19000b4c9bd5a95086d3c9f42a7cb36a29da0a

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    97cc83475e41a21bbd9f21758a2ccc90

    SHA1

    928c439a728ccd99d5ecefa0afcb3d83192d723a

    SHA256

    225528e60fbc8c1db2cf2bd5c382378607c31f7b211724021021cd708466bb7a

    SHA512

    3f81f6d55012dfd611f1ad38f2929a1cc6d9e81a71f04b9134425b0b19ac08c34b6b3c71ab66f920ca6fe2e0896c6d52088220f1f3bbec3b91c8d77db22c9b16

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    b7cfa845b62fa87b08c1fff99d8f6a97

    SHA1

    0bd9d6633445aed605c91726956be89c2a0a7c91

    SHA256

    cfc2199fdfb2d2034aeaa41ed2ad6a221e8c7c7b179cc45ddde3209b4f14e466

    SHA512

    a1f99f20fc97a7a4938d87b55fbfe630f0acd32579bd7e1fe056b3bfe926938bc88049657ac7de98475237ed44619f4570e98360df419ec76b0757c9cb892189

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    afa73656200b585b2d6bee53389d67ce

    SHA1

    f92670f45f991aeb2e8f482bc89ff7b37e82c4fc

    SHA256

    afa8096b233c37ce766af5c023ed70f59bdc029efe167e2d586de7e4105093a6

    SHA512

    0e59b77b2b1768d5a58a564bc83c62bacd43375662e41691e2ec4532c0e2b15673050eb6b08ca229b411d495df555863e15ddcd67d4a8701e7a9896f3cde4bf9

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    2f5741770cc234a08da97e488360bf2f

    SHA1

    ecb67c2b260f6384e36f9d6a7fc1acb1555be4c2

    SHA256

    d7f02a9643f9ad85698e4d3b22bdff9af6050523db2859187615dcf4fe338838

    SHA512

    948dbfca75b1b70be6e127ae897ae6e5667acbde29437413b4b98549a851f63c8aa0ffcdedf42e90ca8862f495d0ecfbdafcc3a441c6b15f063cb94d4bbe18fe

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    4247d25ef34d11decfc49ec09b6b13a8

    SHA1

    bf3e9d007935580f5aec7e93e9b4989e16cb917c

    SHA256

    98c9decc3ba33151226c7df4d0d6d38e570a38816a5b60bdf2c35675cc97c5ef

    SHA512

    86ea57af5276f0a22e23ee1935318a00ebcf004580d8a547d212048e0e2513cb5c3c4a530a437bb134abb905c652484adf54f68d82d686ff090a9f851d93bd6d

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    cdfc7eaea0c8227c462a00219711b551

    SHA1

    8b299f2b73f310ee9c5ed7159a1bf60bd854d0cf

    SHA256

    578753c9687a1abec258a4fd4452885247f3b0b1c1d8a9ecbb3cb7432d1d05bb

    SHA512

    68590fe9b9071f808546303384a6f40cb0b27a15553484e82b97a8f6738052e40678abafda3add233874760318f21b71af3e79a1abe9c35a5e5a2007c46ec279

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    7a2a3339314ce4f755097279c2cd57e6

    SHA1

    c79b6c015efe935f0ad791c15706cb492c64aae1

    SHA256

    dd6532516f1f727309d3f4101e2ea01c41dd3e70f5d65ef830b828a6851ad0ac

    SHA512

    73b56e75361f4408ea208f0460d446844595e46f2862e4c76403c334cb2fe411a0a5fd637fcd71581285abdf99b2559809e5c2ddd08158cbe19bb023a585d9e9

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    307e3dad07403f527decb28464969dce

    SHA1

    df99981d2b73ef16810711f16fa77f7958ff719e

    SHA256

    70504ea0824b867762bf78fbfbd50c1344e94c13c2dc33a0fa4e6f1869f35a05

    SHA512

    50d9fb36c7abb967b05d53dfc7b09fa56e7eb4571d4465af41453eb6c29d04ae3e4067323a3dc09621d58323aa97314bd1c00308f3a8d74a13d36bc498f62a7e

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    5f657cbc440cf9b629af5859ebd83ed5

    SHA1

    9362eaf9bc9ced80b2e04081be6fb0add8b06c89

    SHA256

    16ef9f729f6a05d374de40019fcfed5ced4deb45c904bddc218349ab549ecf72

    SHA512

    dd066f51cb89b1803ef5077eff377c37c3e3eb268ea64c2009445c73b46e3f78f5fdaaab9b8a5d973eec5fd9e8a09889e79efe1114cb533afdc5975be57baf6b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    33e496d12825bc6fe9728f38a6393125

    SHA1

    03c1cb2f7022ac92ac351c770a3db58e95054ce5

    SHA256

    ac7534f2c1348c57510e0e7a6422c5a852610b076b759f7f110a26e491873a38

    SHA512

    9a04b49f56ad357f062d7a8c0c792611dbf7d1104622e3d059e08d392833e7ad256d2192f2384a0d7b7e8c6ca994596b6431ce4452dc6c6b093441715ad5d0ea

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    7d996da106d1f7a9d4b8da469ba4a2ca

    SHA1

    2599f6415b338e970d31e13f3f1200f506a1787b

    SHA256

    fc8649300d683ce9d2ef026d743dfd21ee828342a8eeab5bea7217fc55878df5

    SHA512

    7e611eeb5c24bfd699c4497ed423972327870b2e17eeb6cc87ea46b32740dbbf3fe51163ea38b8faad80a483057bc904825d6bd6496db831db3c6506d0a5b828

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    98f16bed847e34755665383c37dcf157

    SHA1

    94ebb0b27fc0894ba84959a1ee5ee00aaf8d90ee

    SHA256

    1de804ecc88aade28d6b2ffe5ef85e19330bd94e09eab7f0d453d650b05b1c47

    SHA512

    d15efa3ab3218dd8047349b1b4b428eb5f73c6de7f912a6822901084c5b0e94e06c920a5611031522ecb1da8c3aa2719ed3b9e7c1d7da41d4cb34387bc26e50a

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    a25173fa5011cdc497dc867e64ef196a

    SHA1

    a370bb73f37cfaf91d272af0a74925429805f29e

    SHA256

    bfa6519c13b9a0e9b4c917318b947c0f53325cdb4dcc2ace41dd9fb4eafcb679

    SHA512

    a3c06e326bce8714c3d8667a8a98d80ce0ad0f7117ecd32759171013807c29ccfdcb6e594af59a1c4e763cfb6344a9df5708ad20b74becf95de4e22dbaf33a95

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    2c6c4c052eda665b766f63ad9efd5a28

    SHA1

    77ed211958048791015a7edc2953ae94c96b9d66

    SHA256

    201f6c53ea2648781a2c2a25bf4f1428e1cc437047fb759aee7b9a2337b70a65

    SHA512

    8c7df0612e9001b803523ffc5d84208f505f012ed9de201bbf3596f9483c811bcea5952c849b5d79bf15ed5297fa7441df81c58bb46bacec78790a8519e8eff5

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    bca6f1d85f215dda03c4b937423d68f5

    SHA1

    4a1ec3fa616b8d20d0294be5c7ccc9b8bd60cef9

    SHA256

    d6072140a381f1347487c9f532ab10e845d1b6f43ab03c0420ecb450c2769ee2

    SHA512

    b0c0dcf531c69d5ebe7472c2564695d2fd3e455398a38dc5883cde78e10d58cf0143938773d796202a4c1c43bcb9f06060e7cc28c9f389332d3eb7152f94589f

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    0e3c19a6d302e15b2d956519ad6846b9

    SHA1

    006f71f496dd9c502ce6a97c71fcae56a49b3280

    SHA256

    dd6b0a33e861b26e2115657b45f7958a8b57dd79f41993b1928778dc9116a0f9

    SHA512

    22d81e36410ed6d5701c6d3a34c7b87305a0a9ca5fc47f1df99f107f7602ba8477cf56e6472d6e700352adf65103909ec538574d3a2176545c224b7081525092

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    82769aa04c513d2df3d9a0881884b046

    SHA1

    8ed1c4ad71e2c4f6717a36a7d2c811ab6bebd695

    SHA256

    f069feec7004a41bd913881c6926941a942072868a1219b166ae66406989a517

    SHA512

    a7915e57b027e7e947af0246dee16032b914f5fe8d22e4e3721cc08e21a520f339d38edbd28dd4371fa84a8e76d8fe3e74264bf9edcb40e204f45e71ac68aab1

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    9c4058a7d168e97b8fbc87efe44f195b

    SHA1

    107b7f68822904ea0242e62b6944c90f7608c593

    SHA256

    29b1801ad21a13a27dfa4034536383f79af121a80d43f22f2abf3c42b0285d3a

    SHA512

    a603ff1e73b600d22561f0a3e452c21e1a97644d41e91fa99ecb0698649978213c0e0b23efa72811b681cf40fc9cc292b2b864c10396f5d25ffa396afcfbe7ff

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    b41de88a3f2a618a4691ffa71ccf3e4e

    SHA1

    06ed11f78d9975ddc3582fbc35d56a3b150407a2

    SHA256

    510480f7193de523bac8fb25ad3ea3081227331ee60f21e2f2cdb320827151ea

    SHA512

    4128aafa7a43131511afc5ef4edaa3f353734dd1ed2709c2b283221622c6cef594c859e5af919160f514922cb77de32ccaba2757c165038a22fa533a099ba850

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    ae2e423d554e3332f8374a70dc6f5361

    SHA1

    f02e8549e05fbfa669d1c68f9fc3ec69291eeb92

    SHA256

    c73b21c0624dba42f348241a813d38e05e7c6ebf6188db87dcbe49d79f70faa9

    SHA512

    17681bd2a0b4f4b01c8c3d61162fa0cf33370879d6a25b9366cc1594eeaee5ddc75e7f8ef4034d5769cea786d986f9ae993db9201d1e0070ecc6788b44f2ade4

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    bea3ca50a94a2d730901dc223ae65400

    SHA1

    cfa5102d6ecdca5031f5e7135529abb24cba1753

    SHA256

    818f23a452de2bf9fd931b9d94117ef0b364e76bb4356df948f82e7af1617ed1

    SHA512

    c2b5154f9ec1fe982f5dd6dce5dc24baadff49ea7eceb4990ee40f0077641438862a8163990fc2513adffdb937355520fdb61c9eb2266bc557619a71ef40f40f

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    08cf0aa0b3781b3a2b472ccc332d436d

    SHA1

    adecaef0ea9c52e763bd2a0cb0c91745499cfb17

    SHA256

    15372b7609a4ef98200cc4173b2d5d04ad758b9a92002d5bee69bba503e155c8

    SHA512

    28398fa9ad7f96fd0bd71bccbffed85c83de1ebf851ad0bf8c870afdf7f6ac2c813da4c3b38c87e4c83e6a3c22e5427eb824aec70dd058c183f7dd2923985c9a

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    cc1f78694c458bf813f8ca74f58b24ff

    SHA1

    daed5c75a2dad2c48c4777c0b0f63876bb0bbc1e

    SHA256

    afbbc733b156d6a7ab5d76a4305a54112e763ab2fd1b013b87df43a88fe1bee8

    SHA512

    0e9e98a1717ff4ebfa4edf730affe5d643a1b109977a2363358f77bd72ba8f45d9c23930b8872eba3ccbc359de66d97e53267b1cfd7ed69bbfd28ba21fe4d634

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    93f108ba2e61c4d9f9c7b16db7cc4530

    SHA1

    c7e46eaf181292f5def66b775b32cd8eee1526e1

    SHA256

    cc1e6048fdcc34044aa01843e58d48176600b64c01078592fa7fab505336e57b

    SHA512

    dbcaa988ebd981464fcb386a9db7048ba74e77c162b29837e6d3703c77dee6c30b0b2537b163d614b249b5fa3aadaf34bc3c2a34f419842fdd9d22d4dd847c1c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    463799491d2aa12c6b3bb4f055fab86c

    SHA1

    b43452d18cf1ca73596f06f0fcb960c124c7a2c7

    SHA256

    709ac7fa88336bad914cab90b3f3dd28c5422542d4c41778bd1284131cabaa4d

    SHA512

    e80abe3bcc57291c2cf45ebc432d1b46bf96d588628a5213fe7d53bb87c974ad8ed3dffa0715f8b648b1482b58ff201a4d434bcd42c1f91ee360f7072aaffb2c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    94a45d4201a17763de8edaf8821083c5

    SHA1

    f442baa4c3e37e76035fb25f83078734ebb1b5b2

    SHA256

    a7f661126abe07460c64a76ab818f1946d6dd341becfff216329b853f121359b

    SHA512

    cfb5ddf0180d61bf3997a86d70406447e69dff56d5abc93ebb768ce5c204c4e90b430234496898a678e9864f5f465a63971513b65a296c12b20490a663dbb35b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    5f501054c04dd5c22db567daa11f0d73

    SHA1

    eb7294b5ba788d6adf13069cee82fab1d0517457

    SHA256

    29d069cf0cd3c636f7139cbb3561a1339c76a7fc2bd225151a549c784b2b242b

    SHA512

    a497f055e89f1448b062ff96604b1647caaef98be828e1c0adc381c75f79f4ac2ee2f5476cb8f0d5d93098db01e7971a37b2b93cbcc57e9ccbf15db13d103566

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    faebc2fd14a4fd9bd68288a43d08ba67

    SHA1

    eb067982c36cdb03ebd2e26840517dfb84d37376

    SHA256

    e315ae42443c366d00bf1b9dca55fc3873f7f503a4f772adc549c3479fecf73d

    SHA512

    0a10cc76748e3c22f5647a198ebbca34c8d027e4b9256fb6e91c2730fccef8e63ca261547b1056bf221a72965eb298da46f3cc3d3926e60038654ab0d7de4d4b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    75745472119c136f89ec93fe31176023

    SHA1

    533da61a7b054ee351d127185ae9708efe2ac8d1

    SHA256

    9073fe77b6ee8b2b3caa40913f4d486cdc5cd49164446915aeb530701b74768b

    SHA512

    5c75a3ec8865013664ff07254cda67ee6143e7c5b8e96d230ac9126eac9f0714b8d7ca2786825a04362ee74c7c14b729726e675911927ad33be386887df6c33e

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    7b6e7b933409bb0a006287a3b71a1b6a

    SHA1

    7d128caeaf8f1e98a9bfb1bbcf51972d8f7a6a5d

    SHA256

    0caf6841791ead9f6e452ebcd13d3f28237469ee82e78ac44431acf4481ec424

    SHA512

    a86d7bb9269cfba95f0c7fe3e6e3b48b552b51c7a8dc1481501f14d54ef8ac723dc15f413a911efe8e35b39a55312f99ef52fa1664fcdaac80365072804f131d

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    525301c6248a6d4ac441709e143d22cc

    SHA1

    f1b690815fe7d8e165d2e2b67c483a5b3842682d

    SHA256

    37a3d6ececcd36cbd2e3bde072ae48186a4c55aa71b9d4363ad9ea5e49df313f

    SHA512

    d1895a1aeec30dd19f8e2663034819a10409ce8aba69776b3f774e5de3572e6be944f29669930069239b0ca94c0cbe7cb7200286f92ea430bb7d13d90804f0d4

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    32bdb87402ee5b6dd0e2d3edd2e9e879

    SHA1

    35308c3d283b3ce8e4f4a523f23b6f57ff7baa64

    SHA256

    b44c23befefc3654e5a86354b812243ef329dfdef5c080edc51bd4a23fad9bce

    SHA512

    d2edbaea2f913bcc3a7d77c5f9438849fcfceff8d5ded2815dff0c67065e17df83a13e102513ff0e69ed10b104838f61bf9ed86c8d6ab64b3aa3255b437e9ae2

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    a0ac7080c93aa0288b88f57be8c97ebe

    SHA1

    53c630678ef5120722c8a9a9d0f0bbfd29ece6c9

    SHA256

    944b624a0942b06b63c0d963adbafcdfef631a7fda732abe4343d86fdb11c424

    SHA512

    a867786be4f732e335a71debe232deabb552df837f10f8f7fe6bd90850ab569612b044010371c44f95f19f784d61edf92e9dcef7ad63a74436393852d2447135

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    6dde3824e73574ef726d2f9a67fade34

    SHA1

    8117394c3ee9125868ad98607a8137ea1f42b669

    SHA256

    630ff38b23eca74fe47f3b5c7b2445050db0413332446e6ae8faccef4ce210f2

    SHA512

    a5ae146b9851201f8b4ad392bab64bf403574735eb2c2ec5c01c5b217443ef09efedf3f6ff20cb16b9a3f294f29e605ac61b594375c10139b577820865f37f43

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    657ccc096069b59b2b9c29d85ddd25dd

    SHA1

    91d231447fa4d41f155cf0fbb8700e05967fb45a

    SHA256

    d9f006553af36d9997f19a195fdc02d952a6c2ff818cbb0bc8d636d7cf251923

    SHA512

    b9f8546daf0a16188362fe0d47f80397e716ea6ed260fb04cae772884b5d8c91752f42775d7bedd17e8e90f864d3f6b630eba26f739980085d2a32aab4524a7c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    715a69ebbf9e6257609bf37e5c663b8e

    SHA1

    0a4ae804c90a9f96dd11b510c57877161f487b78

    SHA256

    0f605758fe3b3f659c3211c3baaca3486f8610d807d65292df4fee7697a608d8

    SHA512

    adc107ff652e0704c3c3409c97f290f04481c18fab8241cc79e77d9cc47926b34dfb4ea757acfffbbb595b8e6f98acec1f3b53e3fce13afc341c6f1257f4fa04

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    e173066e5c5f8985dfc6920775007179

    SHA1

    574e02955ae93b4cc6209816da15173f2485b8d0

    SHA256

    d1331457fd32558fa98a6700b206462a31263636acce2cbcc8779bf0297f84c5

    SHA512

    c1aa240e87ba99ba7aad05a54894c9acd19c3bdbf045328191f76646072fb41cb18c54bc34a61dbf8b65bc477f244533af1d6b930278e36c399d0895519197e9

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    e3d4c0a514da6c22aed5881f1f49dfd4

    SHA1

    5c4f2b18d1f18b2e250f20f5cf202d779ed98d2f

    SHA256

    964af5463429c326e8c1ecfd84c0335e617dce6efdc358a743e4b24af28cbf04

    SHA512

    1ffcec1fa193b9a9645fbebbe97a34b3640aad48b193e8dd36ab0aa58d9d1aa6bd2a60b83325ffe9d7eefb76e0b9f2f6bca3bc9fd434e348d9ddb548c174db09

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    8957bf6150fb6635d2868a2666dc2112

    SHA1

    524fe70a6655c2543b7984feb76f4ba34b29b906

    SHA256

    590ead086007690a8e4d04cd806b256c1fd0c0a6cc7e9348bee683535ed04c13

    SHA512

    25643bf613c364b6b91e2ffb6c747db2d99b9f39105c63038b614d6fc56a8c05aee49b83c8b5f51cc6ec9d29e22163277c15c2e603091bc0a1b7e5b5ffd69431

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    fe8c7ae5117f8de99844f2372b2a6ae8

    SHA1

    d53d5b7e9905bacbdddd24343d17174f9a290481

    SHA256

    7269ba1b97d1f57cf175bab0e35216d86f0cd88347f4ca639c46c9f1f0f38dde

    SHA512

    7ff35292369c015f7790bf876e58050f6c526bfc17fca03caf63a1e9d7db9e1b257da25cd85e38f14879a9dfa8c8b93dd834b203f8e83b6a3169ef46b3d44097

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    19fbe0e76fa1ea77a96d823dee0e8d58

    SHA1

    4d6958da93eb3f23d761c122cbe12d320e50100e

    SHA256

    8bd3dcfc4f68e152e46007e753413c40367ced852e1b98980451a01572be444c

    SHA512

    775ee3fa762da7d2affca1d87f608520434e6962b86905b5b0afc8fb5a478914c708dc7c17cb94821f7810e01f17a66f1fad6997edc393db14f28e94b7084823

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    0127d68fb08c2a38452b20647b5ede96

    SHA1

    6af56dd604c031f0c721cfb0d80db5e5a2e72ede

    SHA256

    9c75de9d17c49ce3d719dd5c248d3bcff41b8a5a7d636890834a4185f1d8f226

    SHA512

    4c2879793e49f8a4f376e39bab401096756b85f6d6a3eb16bb4d56d39751d0b085da88bf3c245b1710c5a56d0bb1a442717c6f69b400f6cb8e4ba209a5d83c94

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    b709c00781393d6aa63a15943f105998

    SHA1

    c7f3b09909a944bc07f9251cb8626406a2cee3c8

    SHA256

    9d927f53c930460a2fc19e3e4fd506ca7002eb006de9f0ce5e00c1a00c2e3aa2

    SHA512

    111ae169c4eb066a57c05cf82ff2646f05d9ce3e16631bca1bc7dd97f908c30b18a970360331274ece503ae5f8d61082ae790ea7c38444ba75ad0bb1a1f3273b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    ca1fc9e2728c35b1d891664e6b38f91e

    SHA1

    089c1e097b221b28e04e6ee0d28f36541d345955

    SHA256

    d1d5626e9845f67b2a97beb905f21d52736845dc0458418345366c95e45dbed3

    SHA512

    2e4d34820296e6003f0fefa6fe3c3ab30b4b940234119acc30201a7f1f3ea5e8e6dd2be709ff0b46eac82564d2ceee88b687376f3fb6578f6c72c86954a91c8f

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    95f14429fe7e13ffe3da8a2d39c0f6f9

    SHA1

    b816c667e129a22693d509039340b9b11ddf7ac9

    SHA256

    72be230e2a556751c1da3f6a76f7720c846aead136c0be1f69c84778f7c17c2c

    SHA512

    d2a76f83a456974e38b0a9fc1d0e09fb0246f453d7e0107e62fce87176de2366f505e2291926ed82c68d1d2f4fce84a42cf444ae4f7eb5c8036fab53eda426c0

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    ba8aef65443daaf6e49a74e2a7b53307

    SHA1

    ba5eac3604d352e1f2feab7ee664cf2bfb5d27e9

    SHA256

    10530fc4ad7135a7bd2d88045a369720c37b044d611380acecfe1b50f98c9294

    SHA512

    6746539054649e006051f673ae8da1fd1f445f1269d9d3795e3014f33204115c7242a2c46fbce4e0a56d5a1361f71f839e14302b0ffb3601e1aeb70e94490c41

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    f45131bff5ced0db18ce117a96b1804a

    SHA1

    975aac0d515bc779e5ae1e71a6ac1602fea595f7

    SHA256

    083bfcbcd8e03192903a5469916a3cb3843036076003d19db1fa6bc42cc9ca8e

    SHA512

    2910d9ff2fa7f8395ed08169c864cb4b3bd8ddedde6d5779e3178b900d6f016c77ec4c55516a120b1d140894c2d24ce5a21f589158c08440364919456a1f904a

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    31ea1590429cf5088011512d9ed259b3

    SHA1

    4ed93c14b8693f62c61d0574dfeca398591b730b

    SHA256

    6c6cf8eec5e2fd3b43977fe026c2ef16fb142261640400a289e058ce7201d880

    SHA512

    22fc7051aa4f0d8e23437ad2627559b80c256fc60fd2a39b079fa74de775d4503936fbe5ade5c1d7454f9c365456729de4301b7a863d767141ad1cb5c68d001d

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    cbe6d8e6a1a1af425c58afb325ddf5bd

    SHA1

    7b8964e213de9245f5626983c25a911ce7c69af6

    SHA256

    5d0d69e5dc1f6b9ca29ceb165519ca824cfd67b49005056577536ce32ce2865a

    SHA512

    adeb175b650ea78c8f4646cb6688c43c284e6de91396e6bcfd5047f9bd0d2850ccb97aa5272ba1977e6098444321e541ffc049e3e44bfeb918343e801035ed50

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    4b9009532e3321cf6513a85da9d5d705

    SHA1

    d81d41f38c85ab8b731241feeef1cb1470f48df5

    SHA256

    02c42fc5f2064c78d351eefe7e865fbdf0601fb204af3e459db3c7bc4f6e4238

    SHA512

    1e28d6fe3459918dcc051ef4f7c915d7ec389bdd0b696692e2c1079070b661bf71c043903aa956cc0983c8ddc4bd2a4cdf8aeef5e0f78b6395cad3cf6772543a

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    eb1b45a5003916a48713c53f1c1fb802

    SHA1

    504db1979967056557340cd4c5fd8a7aa5534dbb

    SHA256

    89f2ccba092b3197521b65a42b5b89f1ee53efec68313babd8bd0a8bb8c4c38f

    SHA512

    f97120767416aec87d439fb4c52b1b2c07a34cedc58a090a7fef7f8f561638013ff0094b363b8a4df24f5d5fb6d087403090867068111fc0568ebf2698c7df5b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    5165e4365b6cbf241a86546a620090dc

    SHA1

    b41e2370086d803062a457bdbdf733102ab39276

    SHA256

    4462c6ffcbc6890cc9f5d70cf9d7a987e3cdb5844991ce0e258c674290d63042

    SHA512

    e8b843b1c0b9d1980cb1b37f4ec5ce9216cdf85ae2630327d23c69acf4e59f89e2f5b5365badd9d69986915bedb7e6121aab9dfcebdd867b215d855331cdc359

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    c4be5db742e0bc2acc42f66b9ad0e865

    SHA1

    491bcf17084d12e024f358d43639ee4ff02d6864

    SHA256

    608f1e7bf50d8ef85b04ece0660ffcaa4aa66f03546e6bcff3b1499db0d379fc

    SHA512

    5bcc4d4a73ecf0709f2696bb9954dbd410a185a04849fd0542ebdb7ddc2792cccad1f2330cb851b7832af81ef8dbcb4825b8328667c046532bc4da892cc6c74f

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    1a0f2cdcea8c17309c5b7fb6cd62ce04

    SHA1

    963f03f8a381f865638bdbaace42cff29e9a7f80

    SHA256

    67a54cd8cc4f6a3b22d071099fe1a54ae713dca7b4e3bd6a31be729bb1c85428

    SHA512

    577d798a00272e62eb2f2392a40b8e30e175e33ec63d23324ec9a42c8f09671baf000c3763089d2f7e8721e5cd916fb3dc244f92f5f5a1bd83641531cbc14e4c

  • C:\Windows\SysWOW64\HelpMe.exe

    Filesize

    5.9MB

    MD5

    5e5ac4d3814e614a06bcc3b1af205ee1

    SHA1

    46b385fba18cae90657ed2de82c49cfbb1f4431c

    SHA256

    6e4b36c026217bce117f504fb5cc5b723cc5d543ce1289c10614a7ea3d797940

    SHA512

    fc6570bddcc69565e747529ba8c66ca48c764ce97d17a6ed82ae3003f68a5cef4f62bae5a0edb192fde46ae3bb5388da3541ee166e7061c0febf774523304764

  • F:\$RECYCLE.BIN\S-1-5-21-3336304223-2978740688-3645194410-1000\desktop.ini.exe

    Filesize

    2.7MB

    MD5

    a03152e33236cc84df7b5e996717cf7e

    SHA1

    7e6c76c56b6427c95e9277ae6e45bdfd970113de

    SHA256

    e4f77f46e47f049bc33fe26971bfbb326ce3167d62915926bdaa5a7b30411d53

    SHA512

    315c038b8d69a9fd54e4c4c9d15602607710c3dc9df798a9d021ede1fc7eae7adad6fd1980caf2d9203095d9aaf07e1245382a81453f74e75f09fb98fce64f3d

  • F:\AUTORUN.INF

    Filesize

    145B

    MD5

    ca13857b2fd3895a39f09d9dde3cca97

    SHA1

    8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

    SHA256

    cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

    SHA512

    55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

  • F:\AutoRun.exe

    Filesize

    2.6MB

    MD5

    317f909abebffc70937939abd18745fd

    SHA1

    2ad6166a3013dacb4985cd204a0bb0e131c78533

    SHA256

    588549d26fcebac1122ca569f6d931c893b7f59f22a16138f17dfca9e696dec2

    SHA512

    6f2b6529019b2e04bc3f0d4cd48cabc62763edd21eb72515b951b64a478939bf1997a096e11f7009cee8742a473c6c0a15603ef97228d534a3b5292821e8813c

  • memory/3396-7133-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/3396-2149-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/3396-764-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/3396-7143-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/3396-3849-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/3396-1439-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/3396-4515-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/3396-5-0x00000000020E0000-0x00000000020E1000-memory.dmp

    Filesize

    4KB

  • memory/3396-5835-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/3396-3305-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/3396-2879-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/3396-250-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/3396-6441-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/3396-7117-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/3396-5233-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/4500-0-0x0000000000770000-0x0000000000771000-memory.dmp

    Filesize

    4KB

  • memory/4500-2876-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/4500-7116-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/4500-951-0x0000000000770000-0x0000000000771000-memory.dmp

    Filesize

    4KB

  • memory/4500-241-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/4500-6436-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/4500-3302-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/4500-2148-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/4500-7132-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/4500-5032-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/4500-759-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/4500-3838-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/4500-1438-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/4500-7142-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/4500-5721-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/4500-4514-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB