Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/02/2024, 12:41

General

  • Target

    a3cf3f2c96208b3fdd58386a08e71ea4.exe

  • Size

    3.0MB

  • MD5

    a3cf3f2c96208b3fdd58386a08e71ea4

  • SHA1

    9ab2c4894cd8bec073655181bae5db6ffd28c707

  • SHA256

    30226dff651f19f70cc1e594fc0232ea73059d7fe163d63c27673258d8efad44

  • SHA512

    e298375492acc4962052d97319351f1a60116d9d7e67c3d20d647f77850c6b34a123936a2fc8231016de0b634dd4d7379d74e8a8d99f94d05e8d98b510d8e406

  • SSDEEP

    12288:Cp4pNfz3ymJnJ8QCFkxCaQTOl26ew+VsLkjrVlQB9FbDTF53nlNFRpO50w9XCfyx:8Etl9mRda1Ww3HA

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Renames multiple (5410) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 3 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a3cf3f2c96208b3fdd58386a08e71ea4.exe
    "C:\Users\Admin\AppData\Local\Temp\a3cf3f2c96208b3fdd58386a08e71ea4.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops startup file
    • Enumerates connected drives
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:460
    • C:\Windows\SysWOW64\HelpMe.exe
      C:\Windows\system32\HelpMe.exe
      2⤵
      • Modifies WinLogon for persistence
      • Drops startup file
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops autorun.inf file
      • Drops file in System32 directory
      PID:2292

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1414748551-1520717498-2956787782-1000\desktop.ini.exe

    Filesize

    3.0MB

    MD5

    31e3965268e4c9c4ca625644530dcd8f

    SHA1

    07ab82ea9856eaf9b09c71b5e475cb57cf71456a

    SHA256

    82b9a1ac7824baec36de731140ba5b1a298bdae919c982637169a1d8c0923961

    SHA512

    ce7c0fab3d77b7737f808d72a699ae25e666c79aef20d6d18a8f8ee269ff9a55b20f53d57b064da69c25c25cf97d140cb615cf1052309aea5f18330f053ddd3a

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    419fa6a6234cc7abf871d0a04fdb47a4

    SHA1

    d99b34cc608f57d8514c1f56a8aa351c5ade3072

    SHA256

    3fbb79b61bddda05addee5e8f889a059c0811d311f101e36712f2c2781f7c2b1

    SHA512

    3f18c4913850bb503d5f0e0cd3ab9e36ed88e7bfa5bdfa1e02d96139913fc844c36a7a9c8fc3e1acdec05ec366a23e032e666e4402d2a0126b479943caade5d8

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    539f1ba25d91fa5bf8bfe1cfaf4c223e

    SHA1

    7b2018595bcfcebebab04ae458037c0ab95a28ed

    SHA256

    2bf0bf2e4aaa5682b9a7001f9cb1cf56a3de5bbde306b57755a2cea555f53096

    SHA512

    7f0ce3be4f894ea0e04a150bea8560ab2206c5b91b57b43810ad5632af44638328d600bbf1c19b5000fa223023b42d5623edbe033f7d5cf6dba90e6a7809bdf9

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    904ad978bd1ef4baff39fc653d79b6c1

    SHA1

    e89aaaab9502ce5fad50195cc1c26f29e413f0cb

    SHA256

    07249efa920041c55b28081ca1453cc58ccadec646bcf02ca59c6e531bafeefb

    SHA512

    d67e7df42abe29d87f234abd8fd16f9fd82157d1b1f4479fa06863ff481bdb5ce0f3b26cdbafeb371bf8a4be50792a175f7d294915544fbf6699b7b912f82a07

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    1c37cc134e718067484544f45b1b8639

    SHA1

    74ba79ca3d0368f5218682faea4c6c6dffb6ce21

    SHA256

    714daa8cae7dec40e30701f381bbd3bb3e809b8f0442d3307f027e795119b7b5

    SHA512

    bbacc94ecc55d775e7714f6bdee5ce79b713a65480026325ac50acc18edd0c9264c68771486f8c6cd3e08544320ca484c3f9f472321d7607e9b12685f351a41c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    718c55bf579aeccdf990aee62ff05dad

    SHA1

    5ac8d6d9b036bfc4d4ee9dc8472355ef6c35aa0a

    SHA256

    ae8b6b94d1130a5042f3d5808e5916b91a4c68fda04a81e34a15c0b96ab4e26e

    SHA512

    8bfe2076976ecbd0a4090ca41d2ac7451471e4f8d66beba74be30fa43eb87b24c64853909930c19d3d3ca9af5962a6a3164013280e0c4bcdf78ba270c134c840

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    2abd55db9538652d9c6578fd08ed3ce2

    SHA1

    2f86c65700618f2508ccdd7ab0083859e7e69923

    SHA256

    841358251f75f162cc35fd07543b3498040c518f5530e66e9472cb5c1fb2921b

    SHA512

    c63e363aaac6ddcfb2e8e77c5ba027b2acdeae6d9f93c4ca4090c8d8e030a7107712f3bea13c6ecbb434fd4769c42a0cfee6a3e23619b91d8c352fa2d8a91411

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    1885a0551eda8e6d39720436a1f1b8d8

    SHA1

    65aabbb1a3cf117c3236bb49890ff912394859f9

    SHA256

    5c2e2dd3b9798ff060c67339a48a4bdb3d84949a75c2ea6c3fbee872aa5ca9d5

    SHA512

    34228011a64341de13a3278524ba89d6d92b09b75d7327ce890a607a03847f46fba04890e9590613de896f87cb4b9149dd28232b2a69f8316c1fcadc6dd9e32c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    d9c50a2ef47b620005dc72dabea421a5

    SHA1

    cf7258137ea5232cd97ea30de1f02707bbe444e6

    SHA256

    49cb99f41bf2d9a321d7d4a1eef3ac6798625581c0f2622f005f03204c2bf914

    SHA512

    a71db2b061e3c686eb9fdf7b9db6da376667dd6b63b1dd5e4abc4ae2692a63587eca1c072a8e57b5f835a82089dd0a40f9d18e0938424c316690113e7fe701d5

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    13ad09a492ae5ec4ebdae8b125479293

    SHA1

    a82a114ae430888e2179f1990d9b44f29ab494da

    SHA256

    6faed6c07b9308e4b98fb0a2e72bc5c24a0e90f7525aed75459546e4eb5c92a6

    SHA512

    1342017da132f95a16b139ec6e644a70b2694d9b0ae45040328eedd2e5d1f5a69dcfad3f2e01b3571c9863d62650ba89861b5208c58b7f3ce02c2e1fa37589de

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    ada8480c4824455166c4d432d4ef59fd

    SHA1

    f3e3d3242005b84e57e5dfea6f63186cff3e914d

    SHA256

    60ae4acd863c2fddc96569ba5ce5bd7d6c01bc1cda21d123b4979284fcd616d0

    SHA512

    16bec961662e05eac087ef9880980567060178ef7ff64c9351aebd3ca5035720e15a860170ad33823a23c0c5512e2894ec21716d998d38dc8fa2d530dec4828b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    a5e647bd27c5ae6b12b1b9ed73ad54a9

    SHA1

    7568366813f819df4d19a48316fd58b3da907bbb

    SHA256

    dbebba4c5f8e7a28793f2cdde53fb0827de0b5264958ae3e00594e8d10c17f69

    SHA512

    471035544717997ccf4112ac8e0499154281090a4c118145fe8854e4be621ae328bfa40082921a458cfce6b5be7f9aa44663bd12c71946bcc0df43d8cd3da1a0

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    5d6b5f99af641c1f862c72abb5dd7f12

    SHA1

    acab0fdf4b46b337e66283bffe68ba72fe5e3ea4

    SHA256

    ed12af68d10db6e4ab3f029903e881769bac13bc4544d3619d762fe2a75b1104

    SHA512

    16a1df3153fc9f69a4e73f4a5e8f78ffdf597d35f6e1da5efc123fbc14fcc83757a0a2834d03b2659bfbba67c226bd97de80108568d2d06248bbfeadb7706a43

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    b004322b52d6555a1b4101c2773459e9

    SHA1

    a781ebc0324022a047643accb70e06472de0f2f0

    SHA256

    bb128a4c36fe129b73eb2e00a182e5fa7fe4ab0d3590ff074360ac5bad616df5

    SHA512

    0434b016e1611cb5397ee1df6a219c7d0f1fc2c8bc10cd3053aa26ea17d4b78af16f408750102440d81eeffff242795140f3ba42dbaed8fecb15a029e6c59c86

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    13b10b437afee90a48ece316241a2c26

    SHA1

    12dcded27e6763f6fced8e25b3ca5aa27d92a9e7

    SHA256

    73b4212ed122c23234bfdddf596079e5d9a29ec591050cf2f8e0e27cfef974df

    SHA512

    8531c82525e5b28a081220ae141aad377992c53a1f108643ff7b16693e3f21cce6f62237612354e16ef6d35824d442c1b309f0b0c48c702924d7b708c1b7c30e

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    d62b9dce547e074e20e54580c2a0df11

    SHA1

    4716fe1307bdd09f13ed66df10375659f4185d45

    SHA256

    2c2b61db47165b140191145aee3cb10fdc3ac06f5a69a3d1713d0166f07bc35f

    SHA512

    1313a6828fc6c774d2ca5a4f83b9b1691c2b0b83c368575a5e8af53eed2e1952750c915a70e7ea57e1ca3ec60afcbb1e9337b02bf71fd0d2bad011742422d6b4

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    da09ea16a81d5b78a554d64eb9ced399

    SHA1

    abf94bdaab8c6562dd6e88d4902cf8e372342f6d

    SHA256

    a6006de91c82d72a9f8435d925ac11eb405b6a254c955565ece9cd28b222f6ae

    SHA512

    e6bb177dcf8c4c25ba953b9d03d05c9ab3f8a2c52f445b7a1f0e3eaf3de49acaaed8c685516433e64b51e41621d83f720d14bdc2bd1fe562081bbe5d6dbcbcea

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    f0a55fef8baac4d023547523db1a1e40

    SHA1

    e454f37405f5e38a891d8bd35efc39a915069823

    SHA256

    7e72f5e74ff841ae99361f1da5c4bf871094885c258a5413e9953342f8ddc1ec

    SHA512

    ee6dec2422bbfbcbb2dde9205933aa92167c2c89aedab150a05fa4f8977f571d795d77529842a05e03c72e6978e7658c2e4729864226aef193dbc5abafb0bd8a

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    1b70b0a2cef5b4b05f0942d30d9dc8e0

    SHA1

    834920e15845c6cabb1084f95abf741b83f58c5c

    SHA256

    dc7e9289bab4fb8eca6305cc336643f9204b20e79fb23f2b3a255388aaa1287d

    SHA512

    825b81f27c084055343a285ce48bb1393077a1508941d324caf7ab7158c4b49c0cc182725403163002b43aefd6677be294577924bb08308f02ce8baea38bbd59

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    aeddf61704e3041b1556ed720e20c93f

    SHA1

    ebc9d85700fe2378240460cb545a8a4b4e8a15e0

    SHA256

    28a91fe359fcb00169fb6066d4fe5fbf252dbb66a436fdb95458eb8def9f0eb4

    SHA512

    4dc503f2e33f2a0565010d892409d4f1f2ed72660b8cc3cf45e4a7894afbff03502acd82a6fe50a8f06f9b51f175489a719c30ceb6d77c93d5457dfc02cd5b52

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    f3af4514cde25bac59deede7202128df

    SHA1

    ac8bf416e85088a04ff9cd4025dab91893386cf7

    SHA256

    fc88de3a7defaccddecb3ea904c649e6c28b6b42555139d215561079f45f351c

    SHA512

    57a1984033f91f1c2f7b9f9b70d1923e2955c924123d52282a18950528de4ef74cf4730fa35856b0970a241d94ec9599e9f089e2e23894c63619cf91d81b8654

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    65b57d37e764768d26518779b6475be7

    SHA1

    a39b9efc8b324270f279c0923673891b2ee906b6

    SHA256

    0467cf58a428b521b6789456c93f9bc92ea8fea2c0fb70a50e77a2823640d054

    SHA512

    c41ee1b9b729409832fe98a45fa1b7e05f3ed0ac65fb7899f116a0c4a309751e635be70bbe9245b78b978914e1f5d21717da21cd0488e63feb31c11a794ac503

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    21f975b4c2b15cd347d4276091bd172d

    SHA1

    62ceb9db5a45cd2e3a91e7aab6d9b727f4d29bbe

    SHA256

    1da33442a0b654e9d381f763543401a200de32242e9a8dd152585f26d5ec99f9

    SHA512

    838828b8c222871373bf9aae6f3ab2bb90bceec33e5902e21a1cc8eca6496dd8b4c52ea0572970ecb807ab4e9fafe8234daea8436640d367f596be9a5dfef826

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    d700fb226d76941b382051023daf4a78

    SHA1

    8f6f026147e21ea18e4ce3cafc439e666eb71320

    SHA256

    9a408ff88fd54d7d43ef3983f8bc7e2d4897bd6e2ed6732b753a40fb0df3717f

    SHA512

    6a0d32deca056d7968d7f1dc88f1dad7e788689304cf3491e84c03f365937a1d2e79118736cd4dc0cb20ccb8c9b1ed504ee5086ea9b3d14107a46c94ffe1c4c1

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    728033e29841524f3eb3c648fefd97ff

    SHA1

    33143a8ed66cb160742a60fcc18f59a062be1174

    SHA256

    a7097971050c09e05b4a2c83f89a6e46eddcbbc18ff8d46a4e04c1e629f7dbcb

    SHA512

    0cf7adbd521cbfdd23aaa970c4d5b8bfc9f5a1c231768bbc0d612600d87c4dbee8efdf9cfaa7b2e395e0acb74a18f111630d298a41ebd5d796ca6014c86a258c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    8e97ca39a3e120ca9059cc135032722a

    SHA1

    4d9828068b7d75ac51d94c45fdd4ebae04f43b7a

    SHA256

    a0a9e75243d1a0d1f1aa45407a71126c8e2c8519834b7f165cf876465cdbf85e

    SHA512

    36f5c83fbda03dc71a4e1ae9ec3f3b770073bb1854b72b1e01d93f7daeb6ac8768503d559909880a90110645a44afe426127c5e8729d6c9d6aa41e16539dc823

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    ae86e3dcc935f2ddfab4a8b7d577b486

    SHA1

    e65735da49a58be9d0a9d7f2331a74faaafec47a

    SHA256

    acc77f88db7160f6e2439e51daba6fcc7b7021de55e9dbe9a773996c518c1b4e

    SHA512

    40e3c7c1e10291b3609f556a2998bb84a0381c921d25b48666a1f5819ac05a254ce2366190559b700514fdb7ef23768890c6144306930b3a8a6a212cfe189be1

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    e1ec54057935d89085cae5d7fd7fd2e1

    SHA1

    85d199eac03befbbad02f4177adcc8039da25dc8

    SHA256

    a2480f8f7a7bce42a8076b125ef1e76b45f6b8a02ff96de757176d96c9f2bec2

    SHA512

    fe2b77d3f23995d40e06709ace94afe79d1b6d9dd5e610a99d8e527a70409afe8e92393cbf3f2d556404b76a955c7d5f51155745d373114f7c4033af517004fa

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    244421a194b4628ef50b4ea34c0d5064

    SHA1

    0150b26d5f2847a48997abc429e51f808469eee3

    SHA256

    20f5584c79a34730ad264dfe6058836aabf6c0a58006c79ea750fad436840549

    SHA512

    655f4488edd0f059e623906c897727b21881a65cf5da5b645786b7729e8cd4c3b2e0be351e729863cc2c03aaaf26eed87659228d10667ff3f87fb6542ae67e1c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    43620d7a6055482ae169809772f63536

    SHA1

    3d315b370936bf984e9eb9b9bb15c298a18c0c75

    SHA256

    a65e111caf3d734afcbed30ee14fb5912246ab36fbb9656810d92abaf040c818

    SHA512

    844cea5acfcd656931f42deee3a4448f8118a1697f8b152b7e5c6bb6ef8e4ec8cfbf7e76784e9867247abfbc8e6e8251a671256e80a02e841a49ae85c973a1a0

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    4355f0fc75c88f74a3391e2f7cb26c6b

    SHA1

    534a1cf05a60fbae55ccb3bc5a4bc5b5c8675889

    SHA256

    de664e3018125694218eef34c3bc686a7dd1953a172c49905294df63f31e5abd

    SHA512

    812892ea1334f185434f7a307e960eaa1c480f0d750234b6dfe09b710b55f147f5c79ced623b4cae8dfc6687ca1827e234561e740b1d43a01037f010df32ccda

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    cd9959ae7407104ad6db6f5ba01aeb88

    SHA1

    da9be90299d331cabf127b35824644f9b75527ea

    SHA256

    5aa8d841e15c77d41dce321df437062e126aad5c8f1bda799472542d705ea66b

    SHA512

    19453f970c0f9449fca53d1e67b21777816b0fb56fc3e9cc7e03d6bb9b4c8ba56bcc3c0ee746242a70bfe6f3641d18623b21b9d78acd6d1621715d680a78aa84

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    b0777f17a65a757f7e49b9e4bd55c403

    SHA1

    c2f8001857931fe79988723578299c8f1c12bbc1

    SHA256

    249516c61e948f361a619e7cf88353fc6da14d9014b2a2bff6f3e137f21da157

    SHA512

    d2f005ecd94281c42517b9b772a8cbb0999ff6aebb0d09c66eee246388b3bc368c07d8032fd5c59bc79974bd5a34238181ada69b63024c0717237daa7142a4ad

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    01c59d4cf901b7b18174b2a97587364b

    SHA1

    3d9d9ab59d72c81ab14e15ea6595f0f8fba5193e

    SHA256

    dc1ba438b8874b4ee45eee9a7a6579c9c46dd0cfa5d03180dc40b5f5bd9ab576

    SHA512

    d8f7857e2e1015461dd4cff119eee46584aabbe6a08a607bc210fadb2e7278065a700ccb58ae0913ea1fba5c09f575151cc9653eb6eb9c1ae55e6cf5ed515fcd

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    68753a0052773550cb3d0dda31cbe3b5

    SHA1

    4308753d13655e3ade327648aacbf68c3107c442

    SHA256

    3d2465520856164a628cd46a64e4ca429b0ab61beb479ac60f2313fb975385f3

    SHA512

    ce7c10217604ae64efda12308b9a13ac18d5b5222ab168f0e5e84ab33fe451d79484d93f38a4a05941446243356a1631659c55a4f0aa6f355b4f216029525003

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    bf9bc9610ddabc8af66803095b47d8a9

    SHA1

    e97fe1fdfd640ad99e8ddcbfb03aa400ba12ce10

    SHA256

    906add9780f8c8fa8275f777604f442f05201ee8e297604de408c6020d864c89

    SHA512

    799bf896237d4d42ea56636f845efce34ba4352f8195dcf0c7bab87db60b644314fa805cb37a88d2d3e91e90c4536c04708672cada424cfedc9baacfdac3e4ef

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    57c38e6eafea1965433b607516d29d66

    SHA1

    0b3f183935944f854bb589eefa5ba55c7f110c9f

    SHA256

    4da0aa8c1cbc7e614a8e45caf40e36a4c9dfd12652063ad852f42e0d2a188b36

    SHA512

    9afabc15e21bca615bb803000d87ea1f7fec6275c0b5bf00c6ccc25c55aef54ae0e4aca6ad9c0be72e4392065651c4e4e3e5ea8240ed61246c4e472827793718

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    559a8706289325eb9d2da0ffd6da2a1d

    SHA1

    87a15bfc0aa16f869a271f84517e693d287149c2

    SHA256

    a5684391dca7f6fd7fc6441e88d0dcf1c83b86e2bdd16cb8751cbb2585a41d9f

    SHA512

    1831fe059470c9e7ba549755220d69e17a94c0dd18374db86b9b83e54b7033467b061d42b23b933f0b0a13b3a7bd66b0efa508d42a3c6cce166b684472dcb71f

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    1eeb6a8a6e256c57bb639ff927edea63

    SHA1

    74fa4478fd11b126a3a38a5dbbf6597f9822d0f1

    SHA256

    9f760c851067bb6058bb0567f4448936fc8dc2d28ee6f72cdfb1e6dbce912ac8

    SHA512

    56e84da3bf676a0360ef0a4bbcd11957a8bfba9c576627794da1f7c35ddbd62db609b0ba2388bf7dfd32f290086b9e58e66b5d4457e5764f5c9590c9ad29326f

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    99f012cc267599a801ee860637fde01c

    SHA1

    eaf49e45623ca40a9554c70e20a4fa3e8488419a

    SHA256

    326964caed851d836d4e00d0edfbaa17d64f508e966d2ff7e6b604ae4fca7ffb

    SHA512

    d0413b375cffa0876ae48f851bee3e254fb097efb02e816dbac9cec43a1168fb2b8e7d87a82634b49070e4356704100b9b7be881814aa3a2477b877124d3a6cb

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    83af9be567df0607af1e696670d8238e

    SHA1

    e3dc3a3a1771051efd47a8b325bd6aa5c64491b9

    SHA256

    0ecd4009537316ee237c3d1e3ac69be1aac83bd2f1d172b4721efeb223a8dc69

    SHA512

    07fe450c76e67a8e4f4b65e3f84e05552b5386efa94a8f9b5c43127651c4772f147f4ab5f5329b0a9f097e3f48461edc983f945362dea909b6ebedda795ae3c3

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    d1c02c38428a7bd55dc76d193e80ae23

    SHA1

    6504d44e9562e71d7fd5ad89342b109a34130830

    SHA256

    f9480e5bb2695bed266f281094c2b3a5e0baa814f9f96a5a450b9605a20643af

    SHA512

    6d4570934ec65ecad9f3303308a4240caa8bd480790f13ee020f5f0af5a69fcd612c997bea9ae668bc4f6911de1930af2f57b60d8f89765ec5e77ed015f6de95

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    09949714c4e4ba50efe240222b73c6ca

    SHA1

    63a21a26a797cc6b1b68653090d234828c21ebe8

    SHA256

    d4c2bc22b586dc16bc15e1fd41594fd727e7695b0999ccf4bd8e3efd993f9ec3

    SHA512

    a984c038c00468bc6672abb6633f67e43631af3b2a001508718a068ee301faed1b3519bedfab68e967ac8b00b7d7888f7b16b0407e36e76de6d0ea9449e75e8f

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    5c32e04a85a54950cd2f685c06cf0945

    SHA1

    df6119ce14bfebe1c649e8e32cb623c5d56d1d13

    SHA256

    63679747205bde0caf9121d88398fe3939feb546e47f6a983c2af977091d4398

    SHA512

    876a9d63fecd10a269b3d62ce0245e2df8e8448e7094b6810461448bc0003f61fc1ee935842f72f8120cb09bce1fcd3f6e4945ea054e14de13912a120e700688

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    3d020a3f5c4eae0a7b46a6f70a1b6b97

    SHA1

    8929223a10db9b2bf5f6351d89cd0125d3c639fb

    SHA256

    fb19b756e96ddd7de4191a8650800739a9c5e1f3b3a4274acc7ccd12b21f8c00

    SHA512

    6cb1b51a12665c20ca96c5a3a824f12f98aca01c9011b51292758227760882f981d1e498188b098cbb839e70f9e390a20055ee52aad38924c311d7e843a2560a

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    fe1c8c7f211b103f66285c6582325f3a

    SHA1

    224e471e78c8a4ec21cb60b21620c2a9a41e2252

    SHA256

    081b670e6562688445c29ac12c7e170244f33fd9f17c630e3e475778f42bd9d9

    SHA512

    5e5f7c4941f0c32ea4666ee372ff70f7cb12787bfd3bb51941163cb14624ef0c22cb1be78372a04e2030a9751b154b0c00a53ed8fbc064b22b43b94fb4629798

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    2625505d26d7ff6a60a93c50476ec2f6

    SHA1

    61ea5dd6b6123485f8a39715b3c7921e05a0ccd2

    SHA256

    af0cfa2753d1ef943ea21f7aad23e8e1fa327f99e3bd50300f2c48b0622c9e26

    SHA512

    be58842e2e72cf6db79cd93de8c2ae25f3a887fdca2276031cfd55e8a400a1232b4fffce01e73a04d8527d037be27ed874560d6e975576a1d56ee301749aa4b1

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    b9e19b75bc3399eecd53d76074fe5052

    SHA1

    c10864bee464725d447f364525d70daff18d5a4c

    SHA256

    d7374b30fe6813a08cd05ae61fcafab6abf777499bd1e7b4b3e46a742c5eb3c5

    SHA512

    efd4017d55947f378de592905ddc1aa74fdb14144e4f48cad72f32c7f36a3bf3f75886eedf9680c766b4f63fbb39401767c603b1950cb356284479b2df5baa40

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1023B

    MD5

    c4e916cc0c72aec817c984dfde4b9e72

    SHA1

    b54b7d2afc3f8fff27866527aac72c1e4d6ed20c

    SHA256

    1bc73a908c8b74c90b40e07f12cd36e681497f5ae8f3e100e32994c6dcd4ed86

    SHA512

    2a3bc9a7786c6f8c42c02fd2b8369aeb01bc016b2e2354b5e3ef707b616a38f9cac40cc683922016782f97b316f5b2c9d8b9cf7671413d9db0843f24447791c6

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    e15cfd7f8f9c3d45413f9e36a8acb420

    SHA1

    ca1cf334d1a08e58e91aa4281b4df6c500cf5bed

    SHA256

    cb4424fc8cc72bc225ecdefa06c492784c8a4f05380c064b96a9438633a934a3

    SHA512

    6073ca0c56fdb9c9b62d763915ec3b83f9478914ad4950634b4fba24481279e3adbcbad6540c66b8fd65ffb224d41b4efd5655bb3d6d07a036db3e8ca9788750

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    09d751e7f6838564073359f441c986cf

    SHA1

    695182e1588d0bc373ad7f35d990782a89ef9f57

    SHA256

    136d82f7a1eb94cbc122b722df4066d14124eba66030c3b60288039400f594dd

    SHA512

    d8bd5c6534c564b790a4198a8b630a70ef55d5f42c193873ce8e1b01df3e9c914434cc13993a78de1e129d5317c314f79109b1b4d8494ae9527b809691c7d26a

  • C:\Windows\SysWOW64\HelpMe.exe

    Filesize

    2.7MB

    MD5

    94939e78adcf865c92449ae84bf12b1e

    SHA1

    095e6ed01f8bf0641621eeda0fc7ac2954ff0538

    SHA256

    903475e4ef7d19afbac3e30b98491fc314be56f5c4075605c4f34cd8345e09f8

    SHA512

    3c85707b151b56aacb005a00aa95b6c86ccaa02358e9eb1db859bdd13c45a91621f46a39dc8a59df1d1b469c46b68ae1cae4f895a8d1b57f085b4a119efe9002

  • C:\Windows\SysWOW64\HelpMe.exe

    Filesize

    2.5MB

    MD5

    6d088bc1b487679811150bcddcb90c8d

    SHA1

    3d19ffab71bc7786a59542c8890cf08061a13140

    SHA256

    92e9f601e41ff3433f65663062d55790249c09f683a4b2e03b85316bec3ca2d1

    SHA512

    246161dec4d91c23828b70b850d4aaddcc27e464569f2f92e90392d5b5db66ce0448f9bc50ea50191959544d7174e851c9d019480f75bac1be2e16a035284fbe

  • F:\$RECYCLE.BIN\S-1-5-21-1414748551-1520717498-2956787782-1000\desktop.ini.exe

    Filesize

    3.0MB

    MD5

    03e71d3c9ac79d670973d56835648030

    SHA1

    733f4b87bfed6a4b35f3330a0c180fdc412316ee

    SHA256

    d62a88577cd4d08363f1bd4a004af02123e06aa01c396e8ace0e7773e8454fce

    SHA512

    bc86817e90204402c2987f56aea7f4c47b5d983429da2e5e7fac6a34e242fbcd7e2f8c6091db5008b6ec563f9fdf14099e45c95de676730abb97b7a9bc810ab1

  • F:\AUTORUN.INF

    Filesize

    145B

    MD5

    ca13857b2fd3895a39f09d9dde3cca97

    SHA1

    8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

    SHA256

    cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

    SHA512

    55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

  • F:\AutoRun.exe

    Filesize

    3.0MB

    MD5

    a3cf3f2c96208b3fdd58386a08e71ea4

    SHA1

    9ab2c4894cd8bec073655181bae5db6ffd28c707

    SHA256

    30226dff651f19f70cc1e594fc0232ea73059d7fe163d63c27673258d8efad44

    SHA512

    e298375492acc4962052d97319351f1a60116d9d7e67c3d20d647f77850c6b34a123936a2fc8231016de0b634dd4d7379d74e8a8d99f94d05e8d98b510d8e406

  • memory/460-1265-0x0000000000770000-0x0000000000771000-memory.dmp

    Filesize

    4KB

  • memory/460-0-0x0000000000770000-0x0000000000771000-memory.dmp

    Filesize

    4KB

  • memory/2292-5-0x00000000021D0000-0x00000000021D1000-memory.dmp

    Filesize

    4KB