Analysis

  • max time kernel
    155s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/02/2024, 09:23

General

  • Target

    ae2b7b9558ccb84393dc9805186a90ce.exe

  • Size

    656KB

  • MD5

    ae2b7b9558ccb84393dc9805186a90ce

  • SHA1

    cfcf022cee54d70c28a44ec82fdb2b151bf29a46

  • SHA256

    39c67c0c86de0db51f75149ae415b71251c63ac42c763588d36e8f091000e064

  • SHA512

    5acd90e04741dcc9c7324106d916fab298480329a7215526a79e9e08d2344b2ec61120eb8cbe4520d659a1e952428f988caf473c0f2594b590e1129b44a15919

  • SSDEEP

    12288:Pp4pNfz3ymJnJ8QCFkxCaQTOl2KCsltHI:xEtl9mRda1MIHI

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Renames multiple (4936) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 3 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ae2b7b9558ccb84393dc9805186a90ce.exe
    "C:\Users\Admin\AppData\Local\Temp\ae2b7b9558ccb84393dc9805186a90ce.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops startup file
    • Enumerates connected drives
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:4680
    • C:\Windows\SysWOW64\HelpMe.exe
      C:\Windows\system32\HelpMe.exe
      2⤵
      • Modifies WinLogon for persistence
      • Drops startup file
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops autorun.inf file
      • Drops file in System32 directory
      PID:1360

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2727153400-192325109-1870347593-1000\desktop.ini.exe

    Filesize

    657KB

    MD5

    d123175b8c2b764c28d779119ddcb963

    SHA1

    ed8cf765367ab378f228d2e60ed85fb4932f6f72

    SHA256

    96c16b809799f4629b50f14343ff74bd69412990aa0e8fd0d8d6048c026e1e78

    SHA512

    1eeb9c6ef703a4c33154fef6379ed1facdc4f31351a6bb802e77d4564ba27163a32760ff588a5396a5a8790867ccd03cbb4d0445d921a45933bed1fc7f6efc29

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    0fddaf175704fb6c2ff741abfec8e8b9

    SHA1

    43e04a1f698861becfbceb88bd3b365791488d1d

    SHA256

    8c1ced279531a6dfac19e053cdc4fc512ceaa3658afdf6c68a92936e158e259f

    SHA512

    035b4c02f27b06c0db3f7888dd9f25d0f236dc08bc89f7ec59a7a908ee49ab10a896cb51532d83bb2c548a7b6acf09a28388ab73300438f787ffe39fb9a2f3a2

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    b39d56d18c87f5a9053fcf1d250d5f91

    SHA1

    e418f24cfe33c6c5c3300ad85ad25a579a7ec9b3

    SHA256

    c8bda6ca55193eafbbb96af0ae4a8cb9df7dcba308329cb896deed67056fa9b3

    SHA512

    67278474bba1a8f67f41b3d3ae875fe5a7069e2e4b94e1750ef728486695c810eccea85d155a3f4cc61ece362f7e0b7bd5fdf111244d3ebe00134c558ddf185c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    d8710f17df7d9abb9682508cbd78d15a

    SHA1

    e385ec8151f1fd9b572d865d4692ec56c43183fe

    SHA256

    93cbeaa31a81ed176c18b7c85abc05f566e45a5733335c46ca6d6a0f3d33af81

    SHA512

    172be56613db602ea1c0664bbe3afbd823e7b1a3c8a6e4ca45346c4b1b0676c67481917a7ddc36fe10cf6efa0fda34661831e1b7b7c06287e13ddd0d77c4803c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    60a88f260f4ea304c18bd6917d9e2331

    SHA1

    4cae9501244be4f314597c68e8f2ce5a3e9773e2

    SHA256

    bc283b3c0b7d021e3440aaf99f82007388f5da4d462e0fcf51e89baa78c53aeb

    SHA512

    9a0593ccb0d6137845b9be9a2cc2d6a69360f4ce132cd1ff75444ea40b909aa3bcdcf5a4383e5f3c1b20f1157c9225ebf0fff433039ae67d8faa601fff60aa35

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    e7c4b4f5d81c29f376d3907102c9a323

    SHA1

    ee3c4b75e39f99443a5a4c389d2dbfd10b3e07e9

    SHA256

    83cee218e539536539837bbdc7ea6f77604f85f162c8f1c5694da54856b1be88

    SHA512

    dbea6d7b1d3e027d8916858ae6433a45a4aced0b06d3f28624d117766523a94699187338832f201b7453384a58d4382e26de9cd404066b58b4bd757ad7f7ab26

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    0a1f1a4cb12e2f3bba790952073be8f6

    SHA1

    f3e6f4848a5f62c3976e2ea89eed1aaad710086f

    SHA256

    5a6f978f47d57b0f129a9c6e7843f45361977fa026f1988cef917a0190975b61

    SHA512

    ddd9b3f1734c14ddb5861ac25c287ce968bedb1eaf0a313a2c61036abbc6ba21157583c7484b674dac87d20dfc085405e6af9a956864141754829e0779f93a45

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    0c7a2555f7c903e0f9be882d33f019b2

    SHA1

    da5566e966364d70e0b125c552371105b4df5b2d

    SHA256

    09d56f291305a238b12f02cbf73380a443e4401967d5515e5646cad72163cfb1

    SHA512

    a4e94a357cea4c6a335e20508c4debbf9cc32bea73779d8092a9eff8d7a50f8c6d2b41ae07e245d8ea9833042502ddab9e806e0aa06df7a148d806f81bae9d56

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    4af6e787896efde2d2d5d060521f6117

    SHA1

    c0afec5e5c1183632da467973a5aeb88eee163a6

    SHA256

    b6e57a8d43844f03426e4510677541b270af06e55b7ecdd006a22eb480f5b8d1

    SHA512

    9e9c9c8b8db9433871f3e9881639ccbcee701e9e93a2a11c4fdca78b2fa7b46f0e293895af7e11f099efdcfda0aa2140570ced84ee0b3f840b4d32bc630ee56a

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    01be8d2f6defce629c47b9b87a1ca10f

    SHA1

    314e05c186b8af52805200d8e0058935d6cd73c0

    SHA256

    e4167440ce168c439edb03541c47ec3cb00f152c5a1b817e7032a20b6815d312

    SHA512

    968852531dcfe70d795423291558807163d3a1688d14a65c883417e38225d0fffad9375de2f929cdc9a53fc9e72132d966f0db340b242b72ef744a8e4a604b22

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    6e4791472914e1fcba6fe1353486781f

    SHA1

    a12dbdfde408b40c2e1cc4e6493bbfdadd73b4ad

    SHA256

    2471a92e632843c37d1f4822932c963328edd0ed9b7c58ee00b98ca4bbb59393

    SHA512

    c9526f45ce7258b11946f8447d7ae37719f69fa438abb39ead61521aa74ac8154337ad1a79a7bfa9b9cd7f33da5f7dbd031028d0965b058b01a6d2dd592753ff

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    09ecebf9d56d349858b241c90e2d1cb0

    SHA1

    3e2b2b188931d1abce2ceebf7fc2ad7ee9b5602c

    SHA256

    b410469ef24a0b52930b43539d3e501ffa8cc91146f7487f0ef23910ea44fb66

    SHA512

    d2027b43df3ec67eeff9d1ff226d2926acb73a228802923612ad999661ee3acba3dca832cab9d86343b3f78b60775211c3e1e2f77cc162714f4fe1cf1b113505

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    4c16135e12d90d00018ed5545fea2d08

    SHA1

    66eb39501c739c4e8e719700e540b99f9fb47c60

    SHA256

    3e4b071e152cb38a227be116ff337ef2daa05baeebfe3c96b29f289150751181

    SHA512

    6c4b031758e6cbc9850a2cafbc3d22ed7c6ae6244c4c6f8de55e97a01519aab921dbabe2d5a550426cb33d2e984649ccbff257a50971ce7ba509469241c38cd2

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    a2ce480b04e4982dae0c2e6f691d211b

    SHA1

    399f2421bc4a353002f77d6a0029c6058a412092

    SHA256

    e6a0013bfaaa703776fbdf5eef38a88621923f346d7a45936af55270daab8a55

    SHA512

    e3a8740090f978dcc83011dd8a60c40e91370d2101207ce80eabc181e93959f9c43420f7edfb3d26ef58146e3ac11b2af5c1afd5aad5215fafd232e450a320bc

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    9efee911981ad8616d2d75ffd988fc13

    SHA1

    63c63c32bad30be16d8b72c74e1e2120487396e8

    SHA256

    bb276958b27e27e555f2862ddf794f2f775ab2a39583852f3c5021892d516f26

    SHA512

    fc086d304a41edde7c8095e79b80ad9292e77c27284fdf9c7b1dda55f60bdb809d39b66317605c56b11d8d4195e33683f31b784fc8e23765992cfcde8488531e

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    46bd9e9d5e60c0c4ec97ddf1b1e63b4f

    SHA1

    69de1d4e7f4f71ef7db3f8471162d41a28ed90d0

    SHA256

    3eaec0596ec3120fc18a6b78429391cdd4289a7a523cb72729d3be0c9b079cdc

    SHA512

    2082525d7e955ed7647abbceca2c2e01b0e5d38513b4ae8225d4b7898784f29f0bf6ef5d56728e3b70cf5932248e5b285bcb1b52f4186cf64adbb86656a2b6eb

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    b08e265c461be9013768b5abf51927bd

    SHA1

    407806137cf34c50a36ce1295d61a32920d5c6ea

    SHA256

    bb0e98c002b599b83c5041902ff580b4bf5a57b89f40f578f10d1134e499a818

    SHA512

    a1d619fdc04e404103e3590dfb64067dc3b6b1b3766b69dbaef6b6493b1472541a6a5a7065cc6858eed337d446a2967e16347e055563aec4620137b0014187f5

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    35f503c5b3c0c7556e89556337d6f28f

    SHA1

    15926f30f2731c09f5c6726ae31f5e91b0405c89

    SHA256

    eb7b591b92779cabc7b7e913b000069de84e243cfb2623880138a2f5845d84bc

    SHA512

    f63503b73b136cd1e56c507dea6081feb5e427a61ec5d96dac3327ccc74256cd62c044bf5cc6e85249061fc0700059be6d2ce82918e3c529c95411f20e631065

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    8efb0c5eeb04f45e4f49c1a7b9b2d943

    SHA1

    65bbf5cd4b3bee0f53047330fecadeb79545bd95

    SHA256

    b13279dd399f6d512d7360cb237568356f28685c421779f63c121cf91e83a044

    SHA512

    05bb8ba894d07f319ec02b91a833da5f98ce0cfba962d1f452250847cf0511108b53001e466b90e7caadab5db7f53fc2e41bcf600a62ce6754d59ce0efa5cc94

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    0673aa590969416435f7f382f478ffcc

    SHA1

    302b4a2211ea98840a3252bdfcf743f213e37113

    SHA256

    237b32c9bd1e2245be5d05d9301363d76798e77fd39373ec62333f4f00ab0bcf

    SHA512

    b3162af845a426b65c64c0b99f180a07377bdfabb082485fa7ed2977b3bd0599070f75b00003bd8fd48ba5549fafb4034b4e5a64b2490fecc62253cdad0eb4ae

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    99d4fffb492727148c1bc9791534179d

    SHA1

    10451880e58553b15d83b04fe52942a62aa25e8d

    SHA256

    3c6101ca37a362a73ed6829819d9c20e6bbd9f4394e4d3c633cb049763ee7e32

    SHA512

    00845730848fded5765f1bc73a8484a16330eaad3c29e6ee5a5071c5ebc79c74dfb9ab82d22f6308e3b5d2700e767af3553957d5d17a7c5d2944468639660623

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    255bc369b2bd410261ffd0dcf3a4e4a1

    SHA1

    66a858a0e384458b1f2962629b1cdcae358e906c

    SHA256

    1b1e5eed187f4b57720e349b670008da34b0ac23347d52fb6cd184ecd618d802

    SHA512

    101ad39f0872dfc0c5eb5e615ede1fcad00094e9943dcc02c3f1c634c2ba5fcdd0335860d54e48d704c70117fdd6c59ac0b96d6cd1e1adcd90bb43b1c285bae6

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    0cd95c2bd23c9c42c8e3a3bf37e93f08

    SHA1

    a877b4c6c997ceb0f3bd6ff932cee0000628b83d

    SHA256

    bd179a65cc897228ee6cba9273ddebd4351d649d869b197279c1bc97ae01dd81

    SHA512

    7cfffdae37966b247d0291934eb4cca4f7c5fdf861197b45aec620d615a77470f5bb190ef9ddff7c076e8dd1d03c6b354f3bb66b5c3cd03dd3ae6aecc8299664

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    ab5c5f41c0acd22024326540fd577b6b

    SHA1

    0053ea3a188a76cc30078259564620d854309433

    SHA256

    1d60c6e4d2c1568fbc6c419c8a7512906233983d51337897a9d30ddefdad8b9c

    SHA512

    e2d7e87459df3a26ebbf1d9715e7a9c70f0237db48ec3c5fefc32ec0ea2dc335e1bf5660e2ba75d0edefe8cf2d98c97c18a89db4659d334e523d7ea5fb000250

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    1ca08895977ac9b713086a4861fa916d

    SHA1

    74b3c3f64908524298e1e3ec1aadd29fde5a356c

    SHA256

    099a8af93970d291bfbf1505a360c2210655dda89c6f940863ed00404a5bf37f

    SHA512

    98e45da6d39039f07e9ad24387a81396018972b968732a95f78114492139af6f22b3a278f8344950de422cd676efbb759eb46abea62e07f5f33b60901cc8229c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    fe36291ce96d1c05c3f2dcc6d730dc80

    SHA1

    b9cb8f84b23f3b44e775f43215ecc065074a0fb8

    SHA256

    76de6920706006bfa9da840b052e261dfc462363a20d6e60ab7176b8aa0763a0

    SHA512

    9e17426d5311125318ff83b266929d6bd5645b3cf9bff8aae29f39b0b08ef8bc91589bae478911fd9a0596125a4eeaa03c6e758a6987e4be491a61e2f193995b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    8415ee20e257b688ec3d4403becb0dd8

    SHA1

    f883fc93f0adeeb22c2892e167b770d880675a7a

    SHA256

    f94388eca62a32d0dbb20d673f23957910c1a4d89ea2c3d50f6da35ad136703d

    SHA512

    171fc62b9cfb60aa9fe8da451a6b7e4ec1b07cc74e5258a80e244f8b16fab0904a666107cbebf7a0026e34b548b1760ba14643e8cd8f8fc64fd5753ecede877f

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    75e054b6e794eaf71f8638827254f0f7

    SHA1

    81b09d69dc064845e7e9b471757315fbb9ed2390

    SHA256

    d6c2a77c77b45359e8ac9960e743a423812c4fa37831dd0b1850d3a995fda0fe

    SHA512

    74e85b4d77ec53f314216d46a11d9aad3994b96f4c79aedbbd258ff9638799c65d8a6ee1e81a35636ca70d89b60dd657fac0cece829d9f6d28381296e714784a

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    a962cde04bdc2f0fb71055414d10ab94

    SHA1

    7830528a75f104cd97f1f927a802f3026133e9a8

    SHA256

    2d1c1c6d304a2dc6da4d56d6dc885bde2a543bd08df927ffc8fb29f5b93305a3

    SHA512

    dd5067fe6423d103cef3bad88eaf5ebf1214f658063ce0ed9efb6f15a0881207f709caf5b7455fab82fd446f91ed24473514a01bfdda4bccfffccda5c74cb1c1

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    eda9abf6cb233c6a015643e6050cac28

    SHA1

    3725869b7cc7509eaf6ecd4b805dad8cbef05b7c

    SHA256

    1236a53a880c4ac005de636ca94e4f73f586d088a184594963b636ccbaceb39c

    SHA512

    f6f85e32c4d3033b4789c3791564614e8af3fe1f77eff60bad3852ded3a8392dc29bf4a83bc274eefacf6062ec8f9182ce9a6692e7bf4b71bfe374dbaf74a56a

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    2a291aaaf64ff4caf8645f19aa950f5f

    SHA1

    5dd32311def87173c05a5e41143495e8b7c0bce4

    SHA256

    bd4d3cd97ee9d828803c7c79ef903eec8bb577299fd2183ea4f572a2866c249e

    SHA512

    2d73082a644a191d94c4479a0e628f9485836642982e94e81c73439bebde7a3efd8839691ac0cf4451a0375dd8ab15528c09465f07d9d2c3a2289ed681e2b347

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    95e79394c590676b680610b05bd7fac3

    SHA1

    19060db013a15437143d703ce1044d616546ff94

    SHA256

    60092bfc68f60d6f49a4a2f412673f129a11aca896afa6f731b0444ba931465a

    SHA512

    0fe80f708e1c860d83bb0d389fe9cb06c567d61e97d0be9a9bcdc65887f24e624d463e4b92065197c87dfed3a1675352e35313eaa0195d2a8b52ed7ada300569

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    bf73dbfd1804c0438e61b8b7adb479ad

    SHA1

    838daecc7afad924695c0a6a68c0e9add53cfb57

    SHA256

    57cdea1a67baab1bd9b97d1298e59eacc82f357d36eea7bebf105f81a8dcae40

    SHA512

    4e8cb76eba29dad736ca998b704aa25f8dfb21ee01c031d2f46148026001805392de42b061e276bbb5e6d6f05556bddb508f992b323a8f26a33ee388512922ca

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    f58fd36687b40170124482454a37e4a7

    SHA1

    1a2608c85add7c6616cbcdd50e918ee84668938b

    SHA256

    587d4d6996b654bd798b8b13ecba7a69585273d98af36697ed9d8bbdd2a2d817

    SHA512

    6bdeb1af7c56c4f69aff2ab3d2cd7b28feb1d2d2f330e00c0ff98abe0976462d3ec4171852ae7e8712798522a211bbe3528c18c83ab9aae8892b4f13148f1dde

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    e41aa131d7813716cee519c04d985440

    SHA1

    bcee509bb8c002dd135e5a4463f4b2390ca75cb5

    SHA256

    1a35b690dba983c229d86e4a72b61c7ba709d854e0f927fb0695dea813c65e30

    SHA512

    ff840533cbe99a930578d5377eada4e397ad6d4507a0a20b596bf1b00c90b05818df174f66f481ec610d02cb900a376fd3ef79a6bf44e08f1d4e35dd07d4d838

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    5b072bbe55f0b6a908956a80e0ba2dd5

    SHA1

    59f4c27b788f61a84a093318c80fa2a432845f9e

    SHA256

    a009ac9bdfc97190ac0e4977839b4f53dd681608a79c37a2a8490ebab3602ad1

    SHA512

    f5df8aa0c4c3106cd160deb128f54136e9d0f249e707cac1a6d81297a22bc64f51754f6cb704bbf2b67a8a4d21a01e52bcb93b56cf5c6b1900b59d7794574f6a

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    bb6ed63a6e5709d3676edef4b12d84ec

    SHA1

    cfc18baa5efc25b562a7ff5d070c5beccdbf6671

    SHA256

    0c8fb139c5ab25e2e38d464bdad30c5710ae8ea5a4e62ad46824dd447bf88aaa

    SHA512

    9a60782e4b400136b3f8bfc184efaa9f38ccde8c1ad1ef17eb9a3adaccd25af9f77c8bc87f1425ba8ba56bcd163d38b8fded7b2bfa4c2c0a2e2d3e1b7bb1d36f

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    f67dc7f0f9d5fa072f2ad866257fde73

    SHA1

    aae140dec8e32a49a5d9318947f2807cfef32c6b

    SHA256

    7def76735a7c4e03b1ee6371ef1eaf39d52d1e679049e3aea1b3b3b26c18fdfc

    SHA512

    1824d73fffe19b58d0fec523b93011a00e60a36d1b4e67a590e90a148577b759a864ffb492c6c31afd544845bc1ccd5849a656c502cf876699060e07e1e0e9c8

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    650a9e50eca74436e69ed35091114077

    SHA1

    2f586338f31c5e9b8c98421ac8beab20d969d5e2

    SHA256

    a83ee659bf867920f25794f7aa03b7362f6ee6194e4a061f4a4d366b193bdcd7

    SHA512

    c5c08273fdf704160b27b12b70fc8f7f18a8bc3c2daeccd04f30b794d7dcddc06249bfffd4481c1302c28fb6052e8fffb1192f9507559365c0f778a821cb920b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    030384b1069aa46114997efa07d92bba

    SHA1

    e0d15d516f54bb7af34282cec61ffbdde2767b4c

    SHA256

    8658099140e665bb17b7db2ec760e499a5328d7b32c1913bbc65c064aea3559c

    SHA512

    376dc051fed9e498e1ec8ed9ef8921f6f2f9e707eb12b68a542aa4f496a4937208d714782f19bc189f7cbc4be90421a8057747b4f906b7f704748323cbdd8e0b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    0ce7bd446485d8e9991c08064315c4ba

    SHA1

    78fa9ae45dcd1c337c3d128ee41976737aa92ed3

    SHA256

    26c3705d83b624caa34db4c815ab822f7d822901710ff30a2087d884cd0708bc

    SHA512

    788c5053c4f14a2ae92d0c1d70ff81f34b40f5f6f710621ffedb789906803bca2274006533f2c15098391773367175ec4fad26dd967b848a0ba08f90fae17d8e

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    a954289bcd02e945c08dd394dbe59843

    SHA1

    7647b28b7c8b90c2eb693795c9742f4b1d1ea50a

    SHA256

    6228de2f03d73d7918fa959b7881dfa18f1560366294689709056a95e812a60d

    SHA512

    d7db51e17ed9487f060c8d10d20fe76558b65bfce12ff88b074d2d6aeaccac7a392833b3130fdad700df402de572390984030f6dfc85c00063c6573532a87414

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    d7edb1f26fa47929e626f26afcf4184f

    SHA1

    41902c59318e4dbd602591e126abc6f9838a36cb

    SHA256

    cdecc22458ebcfce86b8a1e606b2ffa4fe95b16efc9b370d3bfef510fb898397

    SHA512

    4341b27235312874b55f590f5431080812ea76c8e592c6bdcbb39351bea7684785f103acb3b5dc8bad54b8c1ae32cced3fc18d15df49e0d12c70ce18d931abb4

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    15c6a9f1d1b5d0df63dbcad300625a1e

    SHA1

    b3152d579ce1aa3a24da89536fda6869b38d1928

    SHA256

    99540b261753a7aae52f6779c350df10edc14834b72e8340f8e940d9b47d86db

    SHA512

    90ec7996059b17629450c45b8f7a492dccfba84e7c52848fb2714b00e8b75072b4f8508a96ce8d50293ba2166bc7fe91af57c6f07c152284b7bee752f3c997f9

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    0702158119bd2b76d61407b00a482cb1

    SHA1

    c7a32471a687779b6f2869ab1edb3f12405cdcc9

    SHA256

    96aaacddaf49ebe9a563fdf2d265427f4d00fa1f71aefdf529bcb1b00a0323da

    SHA512

    e987488b1ac4287a2a4777bd58685b483409a4931496111919d3b23b89280c9d9bd91ba0e3b21ed66edda338971f2227dfd5dd00f8b438d714c6e1da1e111213

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    26bb7af4430d90d88e059dd769af192b

    SHA1

    5681e14b1db818cf6383e20ff09d7e6d28e18e01

    SHA256

    6e4764df2f7f3136271670e25074d3ebd91c92fb1726c12e397b07d164c6d8e9

    SHA512

    daaa9da80388ba5ec62d3679db090bd871d72da4ccb6c0d10ccde3836bfcb90acf7170a2375a4ae9ec7080b64ac9cfa7fc29144a06739972c3212551e4a56aee

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    66ac0e67c76c5f96251faec734a3bac8

    SHA1

    bda24f8d0eaf25261d9e250997991effd87d09bd

    SHA256

    1d23cc65aab74aadaf21c582c035700fe11707be99d7894e4c4fe0cea545f43b

    SHA512

    9ef854130ded55c2ee83c98fded3d2deb1bff39d9a33d8a76b304c2e94020abef2be5f528f673dfe196aa8c3c7712512ffeae9d0e8b4af8895fd2b5ad175edd3

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    e5cde655c049606e1cc9e2419b4dce7f

    SHA1

    eaff8f86593274cd8ef7a94c567db409723bc4a0

    SHA256

    76f4bb7b3e0fad2f39f087487628afef9d52ac262244eb171095a4c5946d3b8a

    SHA512

    e3a7870ccf982fdcacb6a2c890a6f5a476a522655731ae8e4f47ae58b947d181afddafa51a1852bf5d6028f92642af2249709ddf1e3d82e2b1af905266a1430c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    7b0cba5268e63de5c62ca2fde270813f

    SHA1

    e2062ffc97b8d8c0c63691e9e464d2951e8fb480

    SHA256

    8babc405fa67be4cf31bcfd3b23db91afd2fd46f6c0fcd93782a8a71c54cbbbf

    SHA512

    2de606eb38b51abe95fb1fb19f8cdf5f84bbf1184c8af239332124bf031a476a8cc1ed80be38d82c68ae3ee29f66fed0613d4d2d8963ffa36f4a7e62bbcad133

  • C:\Windows\SysWOW64\HelpMe.exe

    Filesize

    654KB

    MD5

    f176141eb3323a810d85eacfe5a16af0

    SHA1

    237bdecda2e88ffb67ea3cba75ed888e1364377c

    SHA256

    fa5d6049474d71f0e97dbbc6d2600055b5e5f5a3daf2a90896ffd7cfe500851a

    SHA512

    2fd155c8f39438beff4085d50a9abbc82762bb3f836d2d09eea077b5fe9568093bd45dece348ff80456ae8d68e30fa7e7044f80558ed71bd7a2ebc7fde79e737

  • F:\$RECYCLE.BIN\S-1-5-21-2727153400-192325109-1870347593-1000\desktop.ini.exe

    Filesize

    657KB

    MD5

    f7f7ac61b4cfce9ed449bdcecdc6c071

    SHA1

    da0795835910700aa94faf44152919daffde8139

    SHA256

    6574190ca9405b8f684936a93d05d536683f4193b96c60a33081dc878a498588

    SHA512

    91beeed05796b4937c50ecfc0a188aa5ec9b36210ebc96b3e053ce30d224354c918df9ad5efc10edf5e95a185c237ff843213f2f95580bf7d1b9340b3cc2b8d1

  • F:\AUTORUN.INF

    Filesize

    145B

    MD5

    ca13857b2fd3895a39f09d9dde3cca97

    SHA1

    8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

    SHA256

    cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

    SHA512

    55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

  • F:\AutoRun.exe

    Filesize

    656KB

    MD5

    ae2b7b9558ccb84393dc9805186a90ce

    SHA1

    cfcf022cee54d70c28a44ec82fdb2b151bf29a46

    SHA256

    39c67c0c86de0db51f75149ae415b71251c63ac42c763588d36e8f091000e064

    SHA512

    5acd90e04741dcc9c7324106d916fab298480329a7215526a79e9e08d2344b2ec61120eb8cbe4520d659a1e952428f988caf473c0f2594b590e1129b44a15919

  • memory/1360-2351-0x00000000020D0000-0x00000000020D1000-memory.dmp

    Filesize

    4KB

  • memory/1360-5-0x00000000020D0000-0x00000000020D1000-memory.dmp

    Filesize

    4KB

  • memory/4680-0-0x0000000002210000-0x0000000002211000-memory.dmp

    Filesize

    4KB

  • memory/4680-2050-0x0000000002210000-0x0000000002211000-memory.dmp

    Filesize

    4KB