Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/02/2024, 21:56

General

  • Target

    aa41a7e306181cc69cd2af015229a883.exe

  • Size

    8.2MB

  • MD5

    aa41a7e306181cc69cd2af015229a883

  • SHA1

    9ec71cb5e799f502f7ef17b9a64caebfde34684d

  • SHA256

    16eb0beec9d5c8edf3bf8b7ac436b45ea02d77751676177d403922113adcfd9d

  • SHA512

    bd44e708aeb4be0dc72cce1fc82c03f0aa476a1d73f0bbf1eca1344a5cb05b6b6d173d85f1379fbca2801e0e0a487ccd63c5c8725a01009157dfa449d90fa680

  • SSDEEP

    49152:iEs1JSJR9x8B8NIMI8Sfpwotkzaxc1OGz88B8NIMI8Sfpwotkzaxc1OGz8G:iE2WJIMzKpXOMGQFIMzKpXOMGQG

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Renames multiple (631) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 3 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aa41a7e306181cc69cd2af015229a883.exe
    "C:\Users\Admin\AppData\Local\Temp\aa41a7e306181cc69cd2af015229a883.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops startup file
    • Enumerates connected drives
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:4348
    • C:\Windows\SysWOW64\HelpMe.exe
      C:\Windows\system32\HelpMe.exe
      2⤵
      • Modifies WinLogon for persistence
      • Drops startup file
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops autorun.inf file
      • Drops file in System32 directory
      PID:1252
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3880 --field-trial-handle=2588,i,14229658658073991926,6938034815163866135,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:5072

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-1904519900-954640453-4250331663-1000\desktop.ini.exe

      Filesize

      2.1MB

      MD5

      43219da02253ce3db5988e59809e6d58

      SHA1

      e4f98cd5aa6f7c50c4c9af7d5095c629a9986a73

      SHA256

      ecf0efbb77459de6a4dd2d1df9f509ff1225fe227996b5e5a9e1efc202d9539b

      SHA512

      4ddf28bac7c7417f9963ca106f496d453e1377d6af8002621138729f98ad59f5d6949366c5cfe0505cd584100b0dc5a3ab2955c0427bf6ef9c62e1b699a687eb

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      0e45fbebef5b9519e2f5bee9e9a2a1d2

      SHA1

      de6af83e5170a40240879233f7ce3a2fb4573771

      SHA256

      4dafd97b7b10d62f17dc40198b3cba72bb9454b565ece033a6a4c63af40000d7

      SHA512

      82b80f189e26a74b1ec28724b69fc32cc8d82222691ae265d39bb53ae5bdb79bc9fdb007e72d278e0ed478e510766fb60608cb1a68ab108d69ca715b0916468c

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1KB

      MD5

      564e10a7da7eb971f5a0f9be6dcce2ee

      SHA1

      191d83400111751e47f473cbc04e5c7786b0ce70

      SHA256

      02286a7558028b2f0d7980dc38c8e16b44184b5e06f2c8c61572915aced03de0

      SHA512

      00239d6b484a7c0eff895b856a16fecfb17b2107a93b536ff43ab26986a27accbf7a8b887d097cc7fac16ccac2baad6cbf8beffcdbb046bb70b06905eb5087c3

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      383a85538771c59d52f59b8782354073

      SHA1

      72ada99606c71ee2fc15fdc722e7d533311c8f52

      SHA256

      6dd873f3132de119394d6be4c8f69e353cae367625c6833df1c89bffed2e8496

      SHA512

      baefdbef0e2df755f0d1adf276356e195d8e2457665feb1be97c2524638ea41c50d53360d29c3aab4a3e0024e0485f7c32e71e6c1629f069c85ae948a0a8a28d

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      f9a4f44631bba1dd6f883ee2cec21d14

      SHA1

      2983795e0c1b2672207a5dc49058a8a2f5a61947

      SHA256

      23c4d271abdc2be68dfea9148bf6e0c93b022bdf54ebc448cdd0cf5458767030

      SHA512

      8d16f6d37a3968987fb20017e95569c59ed0d42f6a5d10fef9dc9cffcc79306e338b2227a02a2bad94c4b47352856b10a9db70aa1e5ac2e0eb86ef835a483332

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1KB

      MD5

      0c58a071bc16f81f4e1975799890924d

      SHA1

      dc60dcd053f4e9b0a9e0b23b6410a2d18b84e256

      SHA256

      8fcf88993f419fd5d573a443f159a8c9c83c2b6dc7a330dcc5196f6600b8dc32

      SHA512

      199536b78d1bf62e9328830edc2cfc1d9c89c28a20ce56fb6cabff3be2b2bfbf0d67b803b2f6ff36b587f839b5b1b57375babe4c4bdfe64e7a585c28c4ccc0ed

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      b8e0e5ded297c8ae337b7944d373c173

      SHA1

      dce8bf3719637ff034f09e04f644eaa9d798c08c

      SHA256

      7fbcc96a659f28b11d62cbe32a7f336e708bdc39a3bf94c9844533b42e515b46

      SHA512

      a8326bd7e245a81ac972fcf679e51a70911513c1702a6c4408ef0c0e6d7f4fbc4c45ee8bc64998f5d1bccab35d3fec2e06efb5ea997858bfd0cae2846c3522db

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1KB

      MD5

      63bcc824057edeb2f30d1fab51f63db3

      SHA1

      aa825a39d60a21c50696f351398026c35c807aa7

      SHA256

      4bbcf0f53d0d70c7846cc5f923673e9c190bb676afe85117db7a6fb8ffbabef3

      SHA512

      360243e79dbba82357e207141d36fbe422df4b1e5fd9c80c31c43162c2e25d5308af56208ee321e8721b4a60b508cd9b0746a0cc1066d253a3324ccadafc43b9

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      384bf58a2d3a5146d8376cbd2142d125

      SHA1

      7952cd2260123cab01221c4df9711e3e343446cb

      SHA256

      fb5f0758ed0a61197eed71a28a973184a4ae6d35adac5b6f6303ef32e7c2247a

      SHA512

      6a09c536e1c6bf0a21c2bb06cf14167c8938241ea3b2d1cdd36210f1f13d68527f2ebce0272ef353a4e473e1b3265c61c01fe0997cd6081b380f4a608286fb7d

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1KB

      MD5

      9eb899ef6c700e6721000775061b8250

      SHA1

      7c2b030e43f53a3e38d94b878286b7ccfe904479

      SHA256

      d87a4e8d99d52dd4cf9f5e61c40925d54374d06970a142fd9fe2eae3a8c5cc4f

      SHA512

      dd46165d9787107f9ed11f4fc4b0cef4a3d015507a20ccaaee72397f9d4fa94531cbd086011f3c0bfb4a4f6c8d0d9f6e70d8bad5b4499bec0351b26b2674983b

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      0ca72c09780a1b3c777aab9cf2169302

      SHA1

      d0370de6c55bfae58bf8e18a181ada2740268b7f

      SHA256

      7b5e988b60902c2cd6f643f71da1d4e9041ead729c8c98dc1dc3c37331afe422

      SHA512

      f8954ddb7676227839c9d6c311839a607dbbb572499f7506917e5e2b294fe2b192793fc03143950c0d8e62ab038ad63f55a038f6a2764438669e2b61afad1843

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      cf1940e565410424f2fe519260ef4919

      SHA1

      ad5263545d3c03ae393c7190e50a9cfe861e5820

      SHA256

      1c603ce5a19508d4326a6985730b41784bcb967138fee99bb3282111cd477a55

      SHA512

      1b05425389b3c0832aac345e561c6286b90d73ac405c6b39a92a5077afa57701e80fb14e70c84c7e177101d3a065ac131f86f011d029f971520723cc63fbc336

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1KB

      MD5

      b4df35c12c7e868f00b3a0204f9e8ca4

      SHA1

      97dbffcda609de3e7784a87345e041a513a8e14b

      SHA256

      7e854593d133bf4a3387864a1b0f15ddeb7230c5ae34405693ec8f484fdb04c3

      SHA512

      c635dfa4017d0543926b023976d8444025718e07a6e3c79fc6848fa6d417bcdf48051c93cd6ed35876b3a4c705dc9677932166f2190cc36c80fe9d8faaa8b9a0

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      917432157ad41cf4e5458dc401e24ee1

      SHA1

      eb4dd99a8e010676abfac1905e43f28a248b5e4d

      SHA256

      39eec48c3409f63be93549edcca13f16b38b4854afc393bef79b8aeace7d804b

      SHA512

      e121d88119979bbb5a2e966d37cd5689e8356650dbe3954f31d31b88dcb3d020e995d4ba96db994d916e806cbd53f7df551bfd4fbe5dfa58f2defbaac312e7ff

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      f5fa1cc8f336e22117b304aa635a3b56

      SHA1

      3f6e3f03b5ac9723399b23aa4155b48f516e5cd6

      SHA256

      2031584f97638a780809033bd563a755288d5bb8bb9b964ebdf5a70a707cb4ad

      SHA512

      4f8934d689736d072b311bad123b0b11acb04cf909368ebe620bcafe557048bc173d3b15b72eea31abbaad495179c95971334b3b72fef9b245e6288b12910258

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      c93f07833b863d3f99e592e3bf84c2c4

      SHA1

      497ce89beefc4e4ffd1d725dc59aed55b8ec97cf

      SHA256

      7f26d86805dcecfae8bc827d5a763cc78d23b00fbc18128384f93049b948487f

      SHA512

      772ebbe2ba566ae61fde4462a764622359b00d0d9bab0a9acb371fc9b7141677842d8b1783b66f670a6c0e1cfd1f2df1f64061b8d5345c5e7897e7afde836bec

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      77a7e6d49be0720f56d124cca7128331

      SHA1

      09c51f55125ce04116b754c99faa5b5d5ee8e362

      SHA256

      feb827be9d60ed61176dc05b8077070e43cf3052b30819f5cab9f43b90f5444b

      SHA512

      a58e4a2da5c8657504bc58cc264e6b42b6b97ddd0d78df3df93454eb74f1ed005c847ca63ca6b577fc32dd354f44ec2396eb3a32ae7858ab4f9a0837fd21be27

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1KB

      MD5

      7cbaa5121889f0c0eb452a402466f99b

      SHA1

      b1ce6bfc615e915967f05fee5331ccd4f0ef3d86

      SHA256

      399a2d1bab396c29c9db7c89b9d6857af2a2ce5fe1358950198bc2d415d56193

      SHA512

      c4a9d243b6deb2696cf1cb18b3292efa76fe27849b41b7cb44f1ed2276defc42b5d9c6044031ef2fe8bcebf5419fefce00acc243d024972c763fa2e4ec831b4c

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      b23e9f2293371a658e835f0a14934f83

      SHA1

      5b6eaea3497984884acd2bb9a925c0272f90216c

      SHA256

      f191d1c196dc7769254422684322e2c71faffa598b36cc2e34b6b4eacf10c25e

      SHA512

      eed2d4c964b1aeac740d74b22be04120266d90053cc42add0b6c9b50de68bca5808342ed2e760258896c14cd47e64e8d2a5ac4dff129238b5cf621895ea71a29

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1KB

      MD5

      b7fa2e0bcd2b9e9ae3bb2ae24e36b47c

      SHA1

      101c41c4657a98e4c13fd71c6661692fd2e88367

      SHA256

      35c0a61a1ae63144bf9a7c2ee83552601792ab282c1c1080d400a053e153044f

      SHA512

      be70bb76b2523e82de4df25575cd3d16ef99c5225caccfe7783aabb98d4e1c51a3ac7a9c09a16d32b47580470044e55c8caf740bfab643ba2188cda7b93b3c60

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      ddfbf555ac2dc6602b5f94483b7ac218

      SHA1

      2a881ce648423c03e5ffdb0ae6959d88fee24f28

      SHA256

      77ff95576b9cc0e088ca3a1df6446fae941470832d591304f6b669ff321039d5

      SHA512

      90c10caa096daedde0dfb4849db921199284706a275c8b7545fc0e0323fa5404acf4c93453eff9a23f9217334a210b7b229dda188a400a8222938e4a83b6ce29

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1KB

      MD5

      fbfcd54cf92f61cc939e984a82ae172d

      SHA1

      37094b0dae8349afeb8892f37fcf8d2a5e9da268

      SHA256

      3eb291c2d027eb95a9b2ad2a1a8898b320ab023a94aa4eef811b4e0c06af8b9f

      SHA512

      16fefcfcf54adbe5bba34044369b9e0fe4896c17e813c7dd49462f5c336d342ba5937d3383fb2c6d2663e5ff6033443c7fb9e81aad5455b908b26cefff9ced0d

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      087d2d18216b3a79d5feb36573cd9f86

      SHA1

      15fea10d30286464c98b3a33bb5935f2e33f4994

      SHA256

      937a237623574422f32c3ac0ae0a7092e05adbfbfcee10430ea02fed38f63730

      SHA512

      62d5c868926b58fef23b266f6800a3e00435bbd8cbfa31a389d0ddb5e67f39f844963263fada14c82c20a0c83e707215198beb172e0285a57008a1b1eb2da8ce

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1KB

      MD5

      ffcd14bf5b17afa27acbdada2ee4dfa1

      SHA1

      b6ecefbec70c3d83f2fd63fdd7f4cac95b1e3c18

      SHA256

      7e4d57f1ec7efe30f1c8b39e436fa51eea94dee01f4fe9a116258c7538da153f

      SHA512

      860e8a25b1783030ba9c95f568e43af3860ba0fea2dce5276b4de78d6d22ac4f4a6a2b2d24f8ed70b8d41e1b70aaaac97b22fe5b2e00cb1d38e87a5dde9a95dc

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      b95acbdff633c53f2d1622f43ce6fadf

      SHA1

      0317098f79d902e44c8b2e98212d1fce3bda4c90

      SHA256

      7c714802c10bf7ef55617b8d2674b911c8b2020028b202c0b84662215ff053b5

      SHA512

      0076d944791b54ad7f32d3087673443fc995fab0943d5312c21f57179e90231f21924faa24696f838ad2d0b011e5e4d42eb1cf87f0cd4bebfb49a061d5c86c5c

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1KB

      MD5

      27d8fa74f9b434f969c61aac70cb314a

      SHA1

      fd123202838d86e9a6c425d0dee6b18919f3649d

      SHA256

      dfab7940a3333995072514cf6ed58cc3df621b5fe04956ce1a211cb8d65d8982

      SHA512

      c9d66dc8306e9eab9bd9f58704ed89dc833048f23b40c889786eebda90bcf5cf09cc0ca5ded4a71c24ed841cc8c7091b5328e5829ee3db33272cdc3fdd98037f

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      c1310f4991f6795c4d2495d7520ce0e9

      SHA1

      19bd227e4ff62cb97136c600335253a1eda7de5f

      SHA256

      2fac23ef384d6828d98c443663d3b450b41105b7717284f4a8509f6eebff1e59

      SHA512

      1d63fbe781d5b7b2b9cd21bdef3c655f65c5b4eb5143da603ce957fa66134da16c52917f34b861869b70a87cbe5f739c1f7a4650f99765d43ca81241a9e20b48

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1KB

      MD5

      cbd45f888ff80b6527c73bd0ad593e9e

      SHA1

      b651fc5ae52e682af586fc7566ae964c4effa6ff

      SHA256

      2acb6464e78155cc2dd785a9959de834755f9a5ea31f6f62148a4a9470b4a1f7

      SHA512

      846dc6125baf0fdd6656d4db6c3a08bf8540f21b3e130e846a07af9fcff65fd24ef3b96a004d750716e3efe6c5914221eb0648de0b5f4fda15c7dcf9ecbf3fb4

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      a281fbb8d1f6078374475b5b6eadc754

      SHA1

      1cc14debc99d0e6fc090a7a06d9502be51cb764f

      SHA256

      bc1a7ed28221da97dfd169de493304546cc1bd0481485993bcb2915449710869

      SHA512

      44f6be60a7dda8d2f542edfca374c1ee57ffa04a4126d942222c387fbf91a19d7b83b7bb62334e7a42bf95ebec40762dcd387cb2a18c5f6ffb511f14c8d62812

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1KB

      MD5

      b86636fbb08c01adb76a03ce73e73bbf

      SHA1

      a0e6aade3a0a4f9a0e15ca99718263cceab6f27f

      SHA256

      37c3bafbfdd35b8695bfc8704db9fb06fa25db49fb9816f9c1043936ee0ad634

      SHA512

      c4936c367219e6baf704ebc83647a0fab91d595778bc56c44a96d807345caeed8f4af1da52283ba495afd80f6d352e5952a672cc44bf6b869f830f200aa415c7

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      25830ff1f62cc52c5f2afce8f638f70a

      SHA1

      d7cd7cf0495a0aaea60b8e7f71204efe7b211fbd

      SHA256

      e861cb71dc63a3fec942b839c68828f54a3a8cf06f595f99d1df42b874a8c937

      SHA512

      9df50dcb3bd2a51d0840daadb3ceac0f7379a7bc99f79ad06f527375d0b5b2d5838e920cf29e8dfa12fb77900101d07abaab4f83c40e9703b70c54a93df03f54

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      3c1f6d9a2c86ca75cca6cc0bb1a20c85

      SHA1

      b77e730707e0c7933aab20b970b8d1f374c33dab

      SHA256

      34f8d459730061a118f6c8994d06368965194f63d01a9c53e14e3548f8aab88e

      SHA512

      dc81c0fcd313b4772b8bdfa4d343fbfcc9fd29f2dec2e1f5e357cb77a7acd5cf21f36070f66f56b9ac8de45f7f3b1ed825986e54d181a7a857fa1e3aff7a701f

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1KB

      MD5

      17adfd887a6cf04d34ace5983b5a722a

      SHA1

      b15bcc689495d791167941ac307344303394bc62

      SHA256

      d59ee24a63edf2309c5ce2477ee6da0c92d1b89a9bf208af45b61ccff88f398f

      SHA512

      f1159dc9ad07521b5ab63e54f07bc267bc44e96f567ed8fa9dc36709ac8e08b2cc9024e343e4f118073bb0045850f221b8ec9f7d3b743ca7eacee830dbfe5125

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      64aa0445e4d91638990aec8b21224eb6

      SHA1

      bd37994cd46baf77c1b9c1987136a647e8d9685b

      SHA256

      961a4e956552be1fbfbcf82a012cb72c44b56074280d6f351b24a5e6de8a1bd8

      SHA512

      1719e309401dee44a5f470a1cb8af34395297fcb4c040f093f338d8f0d42dc797bedf8a7508bc7527eea9b6de9c1527ae0c4be6ba969d4da89ff180813ab7854

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1KB

      MD5

      af5230bae0f59814d276eb3b27eaa436

      SHA1

      dbad95ec5b87561511af9ff5c8c49b374feba764

      SHA256

      7187d8635c1cda616be144b4f60b28e97500d1637ce90787b38066391a9cabb5

      SHA512

      e2000fe17604ca77330094418c1d3a963a65aac26e26190f483b2e4fd38b611e0f540f6acab95059f1834d19fc2f1bb71e30b93d7d3bbf0fd5ab1c8c5fa7f045

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      4e1739804422c38dc56524e46e683b58

      SHA1

      06e496c22bb02cebf33e09f3c84521d82850b11c

      SHA256

      c292b38d378e7fecbf0e5c45cac7094a21235570df7cadc01f9e50fb6843ecec

      SHA512

      50ea8dd8f31486b8e6c537a3af2b21ffc01f93faa9da8f1cdfc2b7f3b410285dcd6fd1e95602ba73f2aa0bbc0dffe5181d31a5552c21d94241c72b4917d870fd

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      9c7bd897486b6081a6ed8af68dad0dc6

      SHA1

      75749670462cafd7b31d3e50b005cc9ac452832a

      SHA256

      b590ff99b24124a276b05f74d5567635b61edbdb686829c8cbf084010cf393c8

      SHA512

      ed32078a7860caaa4186425adf79ed5186e83be5aed00f43945de4586755a26e9cf55887ad0b79aace10dd6804030be76f2e3968ca0c8a2b08ecec5b0ebdd2c6

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1KB

      MD5

      f50e7e4502c3d5c9e9c2e73b25583fe1

      SHA1

      2ab0a5365e86793e014c3722d63b05241078b7a9

      SHA256

      0c39d278e61a2498204b9ff5a9abe936056971c54f2defd60f0c9d017acd45a2

      SHA512

      69fd0a3af7463c8775135fca03d231204000710e7a07727b592370d22ca05143608d0716643813ea673989a51d8922b25c9eb327852c7f897d261f883892c448

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      a26cbba1c6faf86b51f70a04c433290b

      SHA1

      094796ae59ce4396cd5b0887a1485fd157d13a30

      SHA256

      79fdbf29bf2253f6f556e49452f061785d5e03bf36b99db8cbcddf804089668c

      SHA512

      aa502d062a7884ba1767aada3344613fa7033f70fe0343e00de5273c9a17baa52e8fec0edcb7fd86a327b5d73e148a4239d32df6d8fb5996802ba207829347f4

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1KB

      MD5

      d442b1692f856e4978d8a7bdfe03c06b

      SHA1

      ba1575bd2004fb278e1c68208d1fb5b6f63a6405

      SHA256

      50383dfee2cdf9a6f65204cadce2ec92c41addf1665b3ac24059ac4caa4198a4

      SHA512

      25b1b3c78969c54790694fd71f927d087a3789e364cfe2ad6831ebc28c39f4217032277cea8aadbe603cd4970812d83092e63cd6865f8175a66ee7d793c96418

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      8e4a506c3b8354000ad04a9eba50cb6a

      SHA1

      aeafd00639b564fba190549ee3be0f6d3110c761

      SHA256

      6ed2504fb9380e75ce5d66a355777286618d1be960b25fe84647840f2c6d5219

      SHA512

      5dafd07f3e862406bed0f89700b0404042cf43ee0883d815fc0c42e0603938824bc7a25bd0381f08ecbdb051ee5cacbcdf222a507d97645dfcf1668673a9bb6d

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1KB

      MD5

      593923a863b06a552e7088abf13cafc9

      SHA1

      4f77817a39f9fdc614cff6af9e8344636ae4ca42

      SHA256

      fb00490722d50d19a2122f4ac719301d0f44a01156bc47d57a49a615fd26b3d4

      SHA512

      92761925f134a8f1dafb73fa6eace8da597a48a56df2e62f8d5bc0b6c1b6bdb2b957244509ea43ac90160b3a054f137970f1254355b2070606a7ed0cb4483b97

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      1abd34a3bf4714e7a8d444b38fc80cb4

      SHA1

      3e4ad50193bfd268ac200910aada10a145984009

      SHA256

      ab67ec680b41398311137b00c606aff6c1542b28af65a6e08b3230b88737efe1

      SHA512

      8b13688f67ceeddc2ca707fd11d7cff32da2d4cbbb792aafbec957531cea25a1f8c4684c5cb8b4a612ec6454bb94343a26736a54c7296b93a9d6f9fb7391d30a

    • C:\Windows\SysWOW64\HelpMe.exe

      Filesize

      8.2MB

      MD5

      29a1469e7763aaf30f17b95f7ac8f9c6

      SHA1

      8f15241382844d99f32fac425e5781e67626eb05

      SHA256

      5e9f8db10a1a1d5105f40e66f0caaddf140b2d3a209edae4cb33e916670fe393

      SHA512

      c450e6d2faf833714243b3fb591b9938b894f4a92ce9540170a4c84b5285d1ee9641490d723780293ddeb40e76d252a4c3474cac6d8ea8e43a151f1ee611006a

    • F:\$RECYCLE.BIN\S-1-5-21-1904519900-954640453-4250331663-1000\desktop.ini.exe

      Filesize

      3.1MB

      MD5

      3c5c3a651678ebc94007444a662238b5

      SHA1

      94868c223f622f79bf8226d63bcf7f65681f4f8a

      SHA256

      c7ffe919adf122d2010e37d256f7c99aed70e89c046d2c90d253f934bb8af4d5

      SHA512

      a15ec8c448f7b12ee703de8cc9c3538aca652b351006259616f5961d9ef986295a508b244e4042385ea28bae6f62d93d9d7c0cdd93f846c9ca32db8c2c401a67

    • F:\AUTORUN.INF

      Filesize

      145B

      MD5

      ca13857b2fd3895a39f09d9dde3cca97

      SHA1

      8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

      SHA256

      cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

      SHA512

      55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

    • F:\AutoRun.exe

      Filesize

      8.2MB

      MD5

      aa41a7e306181cc69cd2af015229a883

      SHA1

      9ec71cb5e799f502f7ef17b9a64caebfde34684d

      SHA256

      16eb0beec9d5c8edf3bf8b7ac436b45ea02d77751676177d403922113adcfd9d

      SHA512

      bd44e708aeb4be0dc72cce1fc82c03f0aa476a1d73f0bbf1eca1344a5cb05b6b6d173d85f1379fbca2801e0e0a487ccd63c5c8725a01009157dfa449d90fa680

    • memory/1252-412-0x0000000000630000-0x0000000000631000-memory.dmp

      Filesize

      4KB

    • memory/1252-5-0x0000000000630000-0x0000000000631000-memory.dmp

      Filesize

      4KB

    • memory/4348-407-0x0000000002210000-0x0000000002211000-memory.dmp

      Filesize

      4KB

    • memory/4348-0-0x0000000002210000-0x0000000002211000-memory.dmp

      Filesize

      4KB