Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    156s
  • max time network
    163s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/03/2024, 23:58

General

  • Target

    d7675fd593ef2c42942787ebf9f35b1a.exe

  • Size

    274KB

  • MD5

    d7675fd593ef2c42942787ebf9f35b1a

  • SHA1

    a24022f1e69eb487c313d47b9308e41d4d9e79a4

  • SHA256

    2497676cc466ed3ec9d862a92d96c53941cfe40f00574908a447dec02eaeec8d

  • SHA512

    a7fca31263e0eda569c512ba4b459f68dc80a5ee2ba5f7e7b0589d2540f7d2365aab03ee09ae4b0dd9ddc9bf52036bfb75676e97972108616cea562c7fa2d2c8

  • SSDEEP

    6144:riMmXRH6pXfSb0ceR/VFAHh1kgcs0HW1kyAp08Y:ZMMpXKb0hNGh1kG0HWnAO

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Renames multiple (4454) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • ASPack v2.12-2.42 4 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Drops startup file 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 3 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d7675fd593ef2c42942787ebf9f35b1a.exe
    "C:\Users\Admin\AppData\Local\Temp\d7675fd593ef2c42942787ebf9f35b1a.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops startup file
    • Enumerates connected drives
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2976
    • C:\Windows\SysWOW64\HelpMe.exe
      C:\Windows\system32\HelpMe.exe
      2⤵
      • Modifies WinLogon for persistence
      • Drops startup file
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops autorun.inf file
      • Drops file in System32 directory
      PID:1564
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3776 --field-trial-handle=2496,i,15897292497548307209,13920214570023230813,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:5564

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-1904519900-954640453-4250331663-1000\desktop.ini.exe

      Filesize

      275KB

      MD5

      19e780246f84173028eae457a847da9b

      SHA1

      b95ffaa24799bd2c5da431b3ac6ac2a5a72d4ae6

      SHA256

      f8d4428a59061ecff3311586db9e8342d38a5269fa5a65d896354cf620c64bca

      SHA512

      d3f40c129594a2346ea27328e067764543fc7c00109a394fa100f63e5e5e381058f698e140d7a4911778e2bf9e151812b0f4f80d9b5f083a9742f3379e85e7f3

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1KB

      MD5

      2001e7662017d548c2bc09bd78b6a362

      SHA1

      49c0f2bac7c88d5a45219e14f18eb9acb04b3838

      SHA256

      101f21b21af059a22e7c6f9efe6eb6f2160c5c2f2b849259eb18bb8fe59ea4d5

      SHA512

      bcabc3175a5c4f932ba254ffedf0307b2ed4639e85a27f25ec143d9d19bdd6b1ebb62af81e6e2ef594c5d61e4dcb57a66ff1eb4397703529b86324253a137f97

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      dc33ee273071c0f874928d96f963408a

      SHA1

      74dfc0d14391d6342182b3df9a23a2c679421c31

      SHA256

      e8cc5db404397cff4636bd241fe7372a69bd7811b44f2543a9312601718679f5

      SHA512

      1f81b409b5b1c368c3d24f294e0038cd013b3d524993dcd3065d7cb083e7980c88d0bf18a6936bbbc128f8639932824827ebde41580f7df927ac968d4ddcb1d5

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1KB

      MD5

      54e071796bf125ffc8abd917d514551f

      SHA1

      fcae5a67a2cd1e636f5501a93107469beac13f60

      SHA256

      39eee82d1b22ff039d5b0f6a116afc85dce98588e4d0ae75738bc60ebbd14090

      SHA512

      0f6cff1f4e9d97b0b0df03084ba3ec5744c3dbf2b3002351ee03138fbc73f0d0cf1025d976911560bf180211829ce91d07668a095d56b5abfe5a6cdbe42ea9ef

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      53ae419f6275d1cbf58cd8fb819a55fb

      SHA1

      d09d043bcb4d84d8454506ad07cd4c8338678c90

      SHA256

      18edb9b6d826b748a73008c6165943b7e059e60cb8043a1acb480caee0103f78

      SHA512

      5306dd5fbb95fc14a64a26837aba4fced3cdfda14016af617329a7fadf89acefb58ce919a69a4e7219b0952b844266f0fda65513c3b2677871ea81046680d025

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1KB

      MD5

      8389d785c93edbe589900182a5c04027

      SHA1

      da43a6f1b241021a16df47f6e6f13732ef461ed2

      SHA256

      1bcb9f6b35ea599f9655d80880a6e68abf8c9a58d5138521a8b1817fbfa44dd6

      SHA512

      e0745bbdfcbbcd66d5f20f91a6e225d303edb7c77f27c2102c1b3605950746898b37a27d27f4f5632a8623702d7fa014afd9012df1f0bf2375cb7ae4cc6136ce

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      f763141ebc5ea63ff818e58451c5cd49

      SHA1

      54e31122df644f38dc9ec2011ae84564957db8d3

      SHA256

      1f3f3ca8c218ca87867e990f717346df13d486bb4c2cd83989d123be8daaf898

      SHA512

      fe6eb68658e00a3d9df722c298a984350f3692854681876311e45fb9d0ae8b904e79995d1912bb26270d6d5ead8c21ba6afd3cb473f098810b28064c8a71fa0b

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1KB

      MD5

      7bc4c0a07f56f6594e90c4cb38c8da23

      SHA1

      dc990fb062a42aa10db369a8c9c26d5e2f319c64

      SHA256

      281bc4b8a8ec0f9560c4a0e48f1eeb9b06c4036ff380f9d0982d28ccecb3ecbf

      SHA512

      72e2c7afceaeb38ceea71ef623c8c2a22fbcdd8ccf2af407df1e51473082fc80e56730cadaa64c8b0cbbd12c1626eee991b00323382ac646d9c5613df98c74af

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      e40c238a23a0209ca49079a7bad8463b

      SHA1

      01915302d33c233b85d6cd0a59a31a7815471cb9

      SHA256

      449f14301dac48229edd86bdd7c3daa6921a9310110d4aee8748d6b00c4ca5cb

      SHA512

      18fb79dc475efee7301661838721a233349a1aa8bf12413c465c6f865e47a13c6ff5d74e9f8736aec29014b062e937932a7c052f757d9e25dbf03085635afce8

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1KB

      MD5

      a23744782066704d5894857dfd0df767

      SHA1

      2a62c686f751431a6ad631dbcebc48be09650628

      SHA256

      dd02ea8dd41d6cac5a97b8a0e1309d322665f2cb7d79046dcd26f558ccdd7d97

      SHA512

      6068e0df98879f3fca324c6bea76729d47c9026fc140231037f3aa8175f65830d0a1d559b745613058485045ba415b3113a28758b36bdd6da348bf928a94465e

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      108aa073f9e31aaa79e34d832357abe7

      SHA1

      5548e95b3d6c2323bc5ecc17ffc559a130426882

      SHA256

      326edb6ab5026db937e2b2fa65eabaa7d15ada56ac12557689732d3d03b0f628

      SHA512

      94d925dd8df9cef0fd6b771c186b49c9f4b0540e7dc7c3d6ccd2efef7b2e7ca8b27943d2ec7df9ff8f93405f9fcc9d2c43ddfebdbf6c9d5aefce5ee910206576

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1KB

      MD5

      f87dd2066bd169cefe092eb35a99cf68

      SHA1

      a0e46c4a9ed55dce45f9adc74d451cd78424e6c0

      SHA256

      f29d151f8a9f43b4a1314e6c41e299f16580c0e2d35ba228ccc574ce04c2fcdb

      SHA512

      97b348e1ea84a7869b9897d6e3d1dd975ed3557ac1540bee81e4e054b76c7c2dc76d4fdf09fa63ea79bfbcecba90b178485fdeadf397dc7ba9d05413d626219d

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      97845e3db7ec4cbc2ca3d56f3de2302a

      SHA1

      4c5e8abc213af53271f3508a17a5c4afc3be88a8

      SHA256

      aaa7cc3c64ff3fa02cf238d8fc6fe07674b6d635a8bf15b81c1325d87736e9d2

      SHA512

      75ca13f67b157e39e4ae5710d9bd6be15ae5bec73aa1d321b74c9380778f73f9aab639b70a3bd50ce2815c7102c31bde956a52415a0d9eae0b221601e1389963

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1KB

      MD5

      a82486af9478673f5486cbc7a9ba55bc

      SHA1

      a84c6d3fca4f42ebd1d6a80e853026342d87891e

      SHA256

      177e89ee3c2a00335439ecdb206ceea51db044f74bf8487bbd21652ef34a77fd

      SHA512

      7bc27878e8a43351eafb721e464e70365b002afb79d8b8370ec417c4bf7667afd9a633190de16262ef345a5a69bfa671c25ba21b3f30e7ef5b9f369cf5062b9e

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      c4d6f486c16069e40d49412b88bd894d

      SHA1

      a84414cca9286794539222b728f62aa44e236579

      SHA256

      b1b2c165201efeac1be90adebd81cfa37db2490aacd03f339dd8418d26486b12

      SHA512

      46419dd0d32b0ec5e7facefe403e13a1f630620bef8ee359a07f22ff058ef400e29c0015354463ac4a738856481d30439d27a008cc9d8e439de67bf2e3aa2b54

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      a45f2e93cade3ce58847c365e3f4ff07

      SHA1

      d75ae667220a91acaefef73783cf2330093e4728

      SHA256

      cabc70ce43016ca495f033fcf56bae5b05e356b4ff7907982037a4c7e1445624

      SHA512

      268293a06027f2109589a319a98c4c3137377fcd782d2489bf9adc23873b252b2e6ce40517536a79b83a16e3a5adc3f9e96ce4f4a7f4ad4c9dd37d2477c2b9a6

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1KB

      MD5

      ccf80aa69501ec7e5df1bb88f82389ab

      SHA1

      a2de940f3e89ab2fb5eb0077b6ff0cfd81befd6f

      SHA256

      6068c6958eee6c6af1851737256ed6a3dcc2650ece2a8b7401ee1dda2598501a

      SHA512

      8ccac4e6cd19e7a12be4cebfb6914a9300cccc502e2e1a109d034140fd01fa468b5055cb252affb9cc2ea7c5dea59a0a6f8a59266b926a2234445fe3b803ea1d

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      45259bfe6e6f779916944238699965b6

      SHA1

      9d51adf263d5d01743ddd5c16b3b73c9bb3174f3

      SHA256

      58d2704571dcf0a0d8a1dfdc0c7e3dbd46f180adc5e4369e48c652f8b828a7dd

      SHA512

      e7ea34677151504efa5f1d83ac50c4681b636da4f09ae443e81eb758cfedeba82e9921ce94ce1d6373d99888c3d7e65cac24f52d12611f098561070599542cd4

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      6a6705ef7020a61e1cb99c9b3421eb4e

      SHA1

      dffbcfcdb2e80da5f197e9d550ec45db685e98b2

      SHA256

      a97c1ae8b1d78d5fb2998ae12742e7db8f8b3e2ea832a4f41930eb37989911ca

      SHA512

      b67a8a6ee83bc9fa9e9224de61a7c0a7e6aaaa2a895f30db851f495fd83ed3eb87297976c4357fbcd03589d3792fdc0d33ff2570a3884bc8a531d1392de32980

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1KB

      MD5

      b006bbb9af4a39c937d536d159e505d3

      SHA1

      9e63d5228b36ab93a5da5c7141a214ec9b73bb80

      SHA256

      6020288f4f8511337b126a91311397ccd750386c7a6819c9c12ae12df767ce10

      SHA512

      05d4979cf9717d858c76f3e8ce8d1514bc8d46b261450374e8f3802d27d4d11a48a38dfcffd6755bd9f8b435cbbb3ba595fd2cd8f72fb6897ff46d44588cf294

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1KB

      MD5

      40431b5d43d08d986b447eeef5b43da5

      SHA1

      4cd120bd1286be7ba8ff4b190126ff3704417228

      SHA256

      f62075a90d2f80294c70a2003852a1de26f85a39fee45f7856e035af8a26defe

      SHA512

      2eeecfb3f19ab17c03b5d3a11a37aae66b005cbeb011816d95526722ed25e3c735a2d4646be80f223be3e4d80e27f53f942eeb3952adc80858913da3e59c65bb

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      e173689745abc08e66afb33fde9acdfe

      SHA1

      1b749bcb3b66f22c787e60aa82c06dc85c5bf630

      SHA256

      928938182d9f82e61de4674ed69947b31dc03328b9eeb43577c36537b2b95b29

      SHA512

      04c03a35223e6be28ee93a9d89e27219949ca2efc0e670357dd10ceb6155a349bcb2870792585d689ff57cc5c42119cdda9b338faba47e6428f9c993cf691d31

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1KB

      MD5

      b3346934d85aed541af4d3565e882eb4

      SHA1

      87249dfb471b0026c86c3b12bb33fde5c006247c

      SHA256

      dd7198198f150c0989e4cb01ca23e63aeedb20956ad7f63ddf5d07f69a78965d

      SHA512

      bb44b68eb66ae3baa9c0a33d87dec47c30eded1b0da16b8d9c7da8642953366fbce930e69b3106313bf86634470ccf92b9554326b506ece32b46842b7108fa4d

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      34299bc0182a86119efca89a59e91706

      SHA1

      26470f619d07d9269a8e26f71847a92e37944517

      SHA256

      a668a37daf54d31fdbd68076123a7fb1409feb3cc581e23185e97212fe5e3804

      SHA512

      04aefdf43c3f49faaaae8b614eb6bb24c303760c67ccea8ee8726842a9393a4f4343d6442ccffbadf656babf257d7a3e8d8850b6ffea69156c19a21c4b085afe

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1KB

      MD5

      e2ebed0393b1c38091327af0865e814c

      SHA1

      0c8781cc40125d446eea8515b38e06b87f065716

      SHA256

      265665f7d5a209e9b21fb34f749dc36d11efde84637e0efa74ee0eb48f02d1be

      SHA512

      45ed407f59dcbaaad5ee8e424e3953db8862cbd28542bed005af325d228a744c6d7872fa2420331d24c894b39daacc330e71d96df6587d441316bdf530258948

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      92c252d3d9437ef9d603cb5f870b703d

      SHA1

      52bd1f79396cd6ee5ee417a11bc3ea94e2fdafda

      SHA256

      1ba4cf54eec61f38f1a6ec86a1ec3a338db1316611c75801a77636af5738e385

      SHA512

      6f51b7cf2c904716fc6b2d546b10e3167b90d03836f9a3085954a3fa592e7e45630d2d5eca11dba718b550240177572842dd6b9369cb8c14db47b2f7dc23ddf9

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1KB

      MD5

      50d42f28958883a549e8821d45751c87

      SHA1

      f2774c7c702d9288ff7b104795d67f8495f6eb2a

      SHA256

      71e86b3e0358f81b95dda9bd7798fec7b2d5ff4a88092352ab56e3bd080dd7c5

      SHA512

      085d2e2903dec1f79765e0207d9fff9ffb706b7ae41ccf25ecd663babe4d047164bff76774de199b2f6c4233fb6cfe0144074646e7142db5009ff361499b6e0a

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      16f81902142ce9d24a3262b95285cb77

      SHA1

      db558b142d6945f42253418a7ab0453c84c4dfda

      SHA256

      6c8131bb62b4a4d6f0476f92ecf8e0c5956f297a1f6f4812c050110c4e0d8611

      SHA512

      9c564fd89ca0a2f29fd409b8133ee2c2d8b4a33d9371d06ed13de0cebb0e110a9766425c1f260166fe61347da2209fadabd4dd88e1c7fd4fd2978d0c63bec96b

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1KB

      MD5

      f1fa2d425c483ce8638297e6472a006e

      SHA1

      145e4adcf56f2674ca138658a6f3f4f92c0c3c14

      SHA256

      9523733cc1eee5ac40f8a50483354d893ad74e6e2a6d054721f008ca91146252

      SHA512

      66f08ad8b09f26f6ec889d3a4d5b2b65fcfcd8d5b8c2902536786e47da2cf55b9b314d2c8ec69c77b3d35b17fa04d35781ebf13f1f0db5b5f68eb11a71b0ba7d

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      22e79131420960a2d07615de7b63bf00

      SHA1

      8732018b0c9d5b85496ce5206d99307c48bc288a

      SHA256

      ffe2cf6e42e8d394c677a928e54650c2221b36ac6b2d67f843a7b975887a86d1

      SHA512

      403d9385387b432f2f5fcc51296e1bf8277c07a9fa8f605b620a50e0704bcc76dc71783b728886092a37e0191519cc407fb0033c6f4f441a0496526812242144

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      a019e9298777f87ad740e67177cf93f8

      SHA1

      48d26f0b48de67e05f453a2564b1451d6408a9b4

      SHA256

      2b7133331ae579fe866e9d8f2e38fadd9b4057b87c904067245698b969dccc29

      SHA512

      6f22b53cc6b99d6b6448373f9093dfbd8817bee4bf9966be87a5bd2689feb5316211594c2123012f226c4e401f7977992db9edf745adf1ef8bf6794b8b7f4d39

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1KB

      MD5

      8665d6d7c60f6b8138f96584cf0d24e8

      SHA1

      45e3954877ae502c83c046a8f9d1e55c52c238db

      SHA256

      5535939d7df5b7ec7b8990b65b80e20654502f0060f2994bc375c99799bb6277

      SHA512

      ede12a0d7f337e690a4d075a668c40f33feaa0c5a3ffcdb677d46578fa04978b90c12c26f3615c8b5ea5c3518731596455ea200dcdc5ef648ca373f92b49fc1e

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      6558d4628124a402f3703903b5c95d07

      SHA1

      5bee6e993bc45c2b3490cca2220d1b9a99e6dbf3

      SHA256

      3d23bc158747fe7eec7dd380a09deab02ed7a0a9f0d62a06653c68bb25af8f70

      SHA512

      e14fbac7bab8342123b47b55d3c3d9919f5e7c96de686c5288c6b704f198ba9b04b72658ab35afb5db3dab53564309b2f21e792dcf6aa7c2c37676c0e80293fe

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1KB

      MD5

      f7b5a31f4100552c90ea5aca707f9dea

      SHA1

      a65b8c41834fad7719f35f8ddb0d6d3fd1bbd3f9

      SHA256

      5f18ee0e0e0176059a0e2332a1882dfcdddcdc8196ce007e0943f8c4c7ebd878

      SHA512

      8aca55a16b5dc1be089b93f86e0d06981585c78bb1dfcfc13577d1351030d7065053f814403dbdf8f962dd189ec607c24a79235d8e81e517db67e7e7becbda3d

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      646e068a20e507af7397466f84a2f88b

      SHA1

      173c404267217ee43e26061cd8aba2aa7b52e1af

      SHA256

      688b64b5ec4bab1ebcf38dea0dec6e0c7372d977d4c8d80da2e22b4271cebabd

      SHA512

      710bc5c0dbca1f138e6a73030ac15c2e7192dd3d67d8e2b618816476d12c8120b59fc0a93bfb56f26225630dcff88ed041ec610688bec4867ddb9572cf0beb02

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1KB

      MD5

      32b3128e076634bf7be5b0649ba29fc1

      SHA1

      d1ef1b221aa5a538f8e11299267dfc7bf31e8320

      SHA256

      672cb6eca6bba52a595f03a30d5b30e59efb86f583ea16ee7971c30ae8673fa5

      SHA512

      6ea8b9fb8f4975b2d244e3367fcdc1a522d1365ef5f8ecefd9575c29f505c9c67df9e0e2209476d4af92f1cd1b9c36a0a6cd896c5f9ebea13ca350c9f7c563dd

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      7760f865407b70f7f5093c0faf894bde

      SHA1

      f2f61ec5ecb19ddbc0a0be47dc4508162ec2a9c2

      SHA256

      78e499469ae2dacceb7134e50ba176bf249931d5b90bd0f3919b28a24a039786

      SHA512

      d9e6bfa5202bf354881e6b3a35f5a66ec85e2d222c93ba6b20516286fc39e5f30b50984ccdf53459ec00d572d57452c5e14a70d56dd45d7383af764012c1cc84

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1KB

      MD5

      e27eefa1a82bcbd07f33fae3ed136f1d

      SHA1

      bc55ba873f552ebf9fdb1acbdcb97ae9ac866da4

      SHA256

      126231066abbc473ff874e828a7f2d56559b63835217d194538338df8cb1850b

      SHA512

      b38a17db547595a74df47b2ec596a91d4259f8c4a086126410293d350586fb5bba31388cd3160b458c1f05bb5037b26db08220bc2d41202dfc12b85a17d142d0

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      6ff87c7215c5887a707343354373229f

      SHA1

      931085718fbd6c435bf9b0d0151575ea520455cb

      SHA256

      f0745b9239b62a773a66254c4a908fdf912c0f96274d9ee0afdcf28bd31b5bf4

      SHA512

      f213d0e6afaaa6bdb54bbeb0a648617dd219559949410990fec71f4446418c6198b7990143fcc56fe4a9c5135fafcd9f84ea194fe057de9e88f2598e34fd2985

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1KB

      MD5

      01f2cf3e4c389c5214f88ab1d58a5c91

      SHA1

      92945b6a51a3aa11e62678f9f4d6743368e935fb

      SHA256

      dc5f78d7aada081bf77d5da9fee3d4ac8aeed5857390be40f44547dc9a721c3e

      SHA512

      cb1ca1b7ead102ae432218327fb993f58aa45f643904c8050b1b2a3a8ee7da892bd40a8e69d55b6a5f0324a0a5b4aebc8e6d98720d7c6e3f1b126b4c1baf31e9

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      c189a828462d097800687b7c04d121ab

      SHA1

      6917c21b39c8bcbc4cde9d0be06e42c53840e401

      SHA256

      d91f9a6722cace6e58fc4ba9072bab784ce154fe96683d214f5d6f920d20cb88

      SHA512

      3f3b3cb3b5fc29f7c839a67c76e514acb5caca628253b3a1a7582389cb9aadfe03fb0eebc99213e6ad0399e77b53ff4b3e326ddc4de63cd1d07f59d7d6732bff

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1KB

      MD5

      a9e4a054b7bbf4d483c0ffd66cbe8e5c

      SHA1

      1122dcb7a0e9511c6539debc5a2546b5c3291618

      SHA256

      282056e195249c48f78bc89ef31aa65edbe2548a6469da4f5f422e344910a8fe

      SHA512

      2b6172dbba96253f0bf8672c82c8c18d6c43d0921379e0db83838f27776e307a45de82d7496649aac1e7142d684cea8a8a6d520d56e609378deffe4aaf40f5af

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      8b1b73d4d170971b46d06fb30a60b851

      SHA1

      594bbaaaa0361006dfdeee585c06d2c52e55ca7a

      SHA256

      bdff3a754797d9a780b4fccd4ed347e9034e4eb7f1db27a72583ba6f9cc4d672

      SHA512

      22601f5384bd8069d18000d1672a3713c3629fcad508b9b90152484e1dd5b43ce4a3f76a9d4fd35bae356bb8f94a99795bf5ea8e37bba546f8e6b29441646ac3

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      58fd02b30d573ae15b8dc7cd4ba3b574

      SHA1

      9abdb7e344dba04dd13acacc7ce494bc86f81059

      SHA256

      dae79a4cb5d66f8c9d3233969945293907643848fdf53c8e409f1580fb28252a

      SHA512

      120fd910b1bdff2948f9e9b5d21fbe30238163ec3066b4d56e7a328a4ef86b78c21005354165a21a72ef7ef733d9442f0c6b96868d3c9738c2ccca4d5e21a1e7

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1KB

      MD5

      b9eefc9367712e0ffeebf9ae86c0aa34

      SHA1

      88d13c900818ca492802986284a88494cd15c1b7

      SHA256

      254548d187f1c31f4b2048250fb04e44423d235e86bf33c59ac2cfe84b1f8724

      SHA512

      849bcadec03390c106ffe34e88d4cc1b160d7fcfc937a68db23d64a84e8b3a27508ecca698559b539b4cc88acdda2eddbe82bb7ac610ec8adf8e8ca9414391b3

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      72c23d59fcfa80c0b1767659022052d8

      SHA1

      ff26a696c0b2f8e629aaeac633b5ae056ecf227a

      SHA256

      cb410ba62469bc77e631d4c0c19679bbee1ed3f19b45c7da011fc544e744c7ad

      SHA512

      ae209cbf36157d943f3e720f6ff669cb36fbd00f8e7ba8b6261e0b3d14c53d093015e852eb2f8fbcd89adfe87ccbc7152e20093906100830863f32d21aa99a52

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      fc451da86c2222aefbece6c7dc676426

      SHA1

      0647776d540e08796de8adfc2684458c5af45d2d

      SHA256

      7ac05f1a49a079e8de9ac9e9401a546137d39285151997e56d6dcea751966224

      SHA512

      68f3803222e5e4766c03e9dca676b67d11f31d8100915bcdb705ed470d2b5d88bf0e88de948b40f47985f2c3cafd2f6b012b25e0a93338bd634f93edf67ec1fd

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1KB

      MD5

      0b013b9d39f80fc2f7d1bc8bf0bf999c

      SHA1

      08c7df0dadd77a1a2771224adb7e3d97406404fe

      SHA256

      00364f46026996367b46048bff352157d5dfd1c2cfe3ab79d66ec018092dcf36

      SHA512

      ea9be6a8d68660ca0407aed5c170353ec677fba822994128679dbf1e1a918bd26c059a6205831e776ca7fec4148c35eff0035be8fdafe6bb34ebfa08fbfee1ad

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

      Filesize

      1019B

      MD5

      7ac2e55e545854a58935a29c0324fdf0

      SHA1

      f67518359078e1ea25577df01d3f40cfe66f7b6d

      SHA256

      9843bebab4384833e7ea6c0d1ea13e14dc1079d08b06d8f40635858c8fb8ffb0

      SHA512

      a0dde10004d0541e088fe88f86a5ba738b5148b6e9491896cc537c84026f145768d696d35c3bb034be0923d4e32b43638af448f4a362908ef0ed31163bc4fb4f

    • C:\Windows\SysWOW64\HelpMe.exe

      Filesize

      273KB

      MD5

      2a38138ec8863c64692be7931e0219b1

      SHA1

      aa4fc2a216226d8701f87d35fbabad737f58a340

      SHA256

      35750725047b846160521163bb8d75cbf6268751e0fd056f3dd7b522bcb87413

      SHA512

      865611833f67a9a9f5563ee414512a6a53d843a4d2b944c6d833e6525f4831fc8fc3fd86e29dae76dbf856ebd240816477b730c525ad3a52cb8a5d94e2e299d9

    • F:\$RECYCLE.BIN\S-1-5-21-1904519900-954640453-4250331663-1000\desktop.ini.exe

      Filesize

      275KB

      MD5

      efdaaa1b094d4c2766837c24a58cf00a

      SHA1

      549f1b4c0e2bdd3bcad604b997ef80a47012f1f2

      SHA256

      a2bb2388756ce5353077561ba8d776572bb18d8d45c5d84bb8a69562ca39421f

      SHA512

      98fe7b7a93d289e6e780035c5ea30789718c4ab0a8f1bbcf4694b247e2427cb886196d69906ab6c12fca76fc96c1beb77b2174a74fb6b8c9382bc46051d60ddf

    • F:\AUTORUN.INF

      Filesize

      145B

      MD5

      ca13857b2fd3895a39f09d9dde3cca97

      SHA1

      8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

      SHA256

      cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

      SHA512

      55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

    • F:\AutoRun.exe

      Filesize

      274KB

      MD5

      d7675fd593ef2c42942787ebf9f35b1a

      SHA1

      a24022f1e69eb487c313d47b9308e41d4d9e79a4

      SHA256

      2497676cc466ed3ec9d862a92d96c53941cfe40f00574908a447dec02eaeec8d

      SHA512

      a7fca31263e0eda569c512ba4b459f68dc80a5ee2ba5f7e7b0589d2540f7d2365aab03ee09ae4b0dd9ddc9bf52036bfb75676e97972108616cea562c7fa2d2c8

    • memory/1564-5449-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/1564-9055-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/1564-6627-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/1564-9319-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/1564-369-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/1564-6043-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/1564-4877-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/1564-8065-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/1564-1667-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/1564-5-0x0000000001F90000-0x0000000001F91000-memory.dmp

      Filesize

      4KB

    • memory/1564-9281-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/1564-6329-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/1564-3187-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/1564-9035-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/1564-5571-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/1564-2044-0x0000000001F90000-0x0000000001F91000-memory.dmp

      Filesize

      4KB

    • memory/2976-6486-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/2976-9310-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/2976-9048-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/2976-2043-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/2976-9064-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/2976-3730-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/2976-5522-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/2976-8464-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/2976-6-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/2976-5322-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/2976-1668-0x0000000002310000-0x0000000002311000-memory.dmp

      Filesize

      4KB

    • memory/2976-6146-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/2976-668-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/2976-7574-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/2976-0-0x0000000002310000-0x0000000002311000-memory.dmp

      Filesize

      4KB

    • memory/2976-5968-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/2976-9516-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB