SoftPulse

By GoldSparrow in Potentially Unwanted Programs

Threat Scorecard

Popularity Rank:	1,100
Threat Level:	10 % (Normal)
Infected Computers:	26,430

First Seen:	June 28, 2014
Last Seen:	February 6, 2026
OS(es) Affected:	Windows

The SoftPulse software is considered by security experts as a Potentially Unwanted Program (PUP) that may change a number of system settings. PUPs such as SoftPulse may insert a key in the Windows registry to enable their operations at every boot-up and modify the list of start-up applications. The SoftPulse executable may automatically download and install additional software as well as change your settings for Mozilla Firefox, Google Chrome, and Internet Explorer. The SoftPulse PUP can be installed via free software bundles and less reputable software downloaders. You might not approve the changes made to your system by SoftPulse, and you may want to remove it with the help of a reliable anti-malware application.

Table of Contents

SpyHunter Detects & Remove SoftPulse

Registry Details

SoftPulse may create the following registry entry or registry entries:

HKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}

Free M4a to MP3 Converter_is1

Directories

SoftPulse may create the following directory or directories:

%PROGRAMFILES%\Free M4a to MP3 Converter

Analysis Report

General information

Family Name:	PUP.Softpulse
Signature status:	No Signature

Known Samples

MD5: 103cc722b7644dc6ed00afba5c3a5729

SHA1: 79fff2124e52223a2af4741e8242a787998ec4c8

File Size: 1.47 MB, 1465040 bytes

MD5: 8816bde939b154c43ee30524bfb7d487

SHA1: 0b9b831cf33507c862b44f46f7456c04dca8b0d6

File Size: 948.18 KB, 948184 bytes

MD5: 732d0e539bdc8f1028f0d5079ad38e43

SHA1: 1d699d77206f3737c5a1ebd15c84f6390a0dedff

File Size: 483.98 KB, 483976 bytes

MD5: 3d731b186af6b7507b18dc8118e5c1a2

SHA1: 6e7e967a1337569504a9b7cb43c36a6be80baa1a

File Size: 3.20 MB, 3204279 bytes

MD5: 4403ae635dc1fb473194d060e7b4098f

SHA1: 185da593508fb002dbb074af43ff2794dc720e38

File Size: 3.20 MB, 3204279 bytes

MD5: f676701dc14fe4d2a09089166ae36b22

SHA1: d5e0b04399aecefd5714fbd916b23dc1f56201aa

SHA256: 942E587F464AD2A995439579BF51D2B7C74B4DD5A0A608695D49433D198ACFFE

File Size: 3.57 MB, 3570007 bytes

MD5: 603328c11f1812d199f53fc60f05a866

SHA1: ec7fbc35488b336ab9d26c9254b97813c1d0c62b

SHA256: 2FFA6B49272992E17D8A6182C353D1723BD01E1C7E342F4C9904892170F78724

File Size: 1.09 MB, 1086128 bytes

MD5: 92e17d069c98a707443198f7c827a236

SHA1: f6cb1346d45aebef216488d70593c120e0476f8e

SHA256: 4AF53B6AFD68199B02B0ACA19A6A94B1BC7B72E8A71B7052E29CF9C6B78B2367

File Size: 1.22 MB, 1222144 bytes

MD5: ec3db688b458fab28617e1be76d531db

SHA1: d4bc2418b5d6c95aeeae3d9b945718c1812206ad

SHA256: E5E4655293DECA220B4A4D6408C7888AD1B3455A5D61DD4ED1131D5F5DEFAE2B

File Size: 1.63 MB, 1626048 bytes

MD5: 6609cb5f7bc44a626f1e169e3d7055d7

SHA1: b942603bd1fdfcbaf531e1460d80f705b336299c

SHA256: 224CFB4E183332D8AF711D2A830068C6A9E9938C90E9B89D5157C0E854D34FEC

File Size: 1.34 MB, 1344688 bytes

MD5: a3209400a5724636597d17684a0d617c

SHA1: a338d787002bb3e8f90253ea5cb981cbc66bc611

SHA256: 3D395215560F93AAA4CDAD2B8CDF353CA2A4D246A7E72612AAE5C91C2984043B

File Size: 1.14 MB, 1137896 bytes

MD5: 6b0424867ac7efbead1466c26ec4fd44

SHA1: d9ca0e1b231da51ffb8309412098eb6e75b491eb

SHA256: B7B913DD4707B79B29100FDE9A68783A3B8B80DE211553B1575BEA2F27AF6D4B

File Size: 1.34 MB, 1339616 bytes

MD5: 5324fb09ef84926b0357a5dc992dd3f7

SHA1: 098ee4eb40f2bee652ade249ac111931bf203a59

SHA256: F11EBBE32FA1E48AE47FB3A0DF4654423E776724838E73A208AE77DB850A2F97

File Size: 693.74 KB, 693736 bytes

MD5: 5f25c9a9c17b5c29add5b652aea4c209

SHA1: 2c6e93e1c3bc541fef30a05562cf6b987ec82389

SHA256: 17E4634AA3577D05ECEEBF9BB822DBE9A3532704F5044AFDAD34686237F50F1D

File Size: 682.08 KB, 682080 bytes

MD5: 5e79ead2c7dd9d72cc8cd6f0964cab47

SHA1: a5ecf556d55ea00306d6592966cb371b8c1bf0c8

SHA256: 0AEDBB9ABBF4F317422591431696DB7A01C9F4EE8609CE92F30590161BA29160

File Size: 1.22 MB, 1216512 bytes

MD5: bd1ad782d7967f65d7c54ce9a92b446c

SHA1: 39d3d2743b8796f8680d71694205b4f83e6a70bc

SHA256: 5749DD19FCC354952D4B7A30EC573A0C69711B0219F39CC23F3536A235AF8865

File Size: 3.57 MB, 3570007 bytes

MD5: 4b3dac54644f1b1e08f15cee3528c487

SHA1: f8690028b76df07b42ba8e6950b751085c29cfac

SHA256: 9E82D6E792D6E9C1AF5408F9F1475CC877C8E61E15CA912FDEC4F1AD5CBDA5DF

File Size: 590.87 KB, 590872 bytes

MD5: 4226e54c63f8f29c61167703166b6fd4

SHA1: 45aeb08410de24643b6486107f6d01594eb06b37

SHA256: D2AE32FC642738F51C731B7D059F86D20B579F962D1B7E73424FABC6C1DAFC6E

File Size: 965.26 KB, 965256 bytes

MD5: 54b93804f6f13532824d703ee6b31886

SHA1: a16473c9417dc7bcb5b3ac2d7cd568f2f2039915

SHA256: 996BD805C75D882A69524856DF870E5F28AC820EDBDAE6F082393161FC8DA5DA

File Size: 851.95 KB, 851952 bytes

MD5: d257574cd4d0ac42c975dab2eba4b088

SHA1: 8957d667351d3f656c611333c3e42fa1ddf1c9a6

SHA256: C4D82826772897695173136F68B34206F057DFDBE2E796A3AEAE1FD2D0F67FA0

File Size: 3.57 MB, 3570007 bytes

MD5: 667036810a8452f6e66918815c7d9829

SHA1: 26c3c1e1e3545f36075e25fd05f036407d50344d

SHA256: 77C0BC416A7EF3E12594D8D6ED407624CA719C248C05639D0A2353BA0CC647E0

File Size: 457.72 KB, 457720 bytes

MD5: 35022425abc49767371422f55c653b57

SHA1: d3a8fef83fb0952547c46b1decb9d60a9d29a849

SHA256: 89F39190F7E68208128D6CA5E4EB76334AFFB3B9AA7C04C63DE90A359B5AF53F

File Size: 973.82 KB, 973816 bytes

MD5: f36456fece8af21b3da237d0739a3659

SHA1: fb005f0baca6b59b669fac5e8101b51f6be79603

SHA256: 066C504FC8E97B8EAD9895D3A9E3E07A0AE9C6933057CA4B3F30FD426F4749B4

File Size: 1.12 MB, 1120504 bytes

MD5: 53dd2d17de632a741a613d20c1dadbbb

SHA1: 0ce3bb40ca9d74e58258767459d06783bc2e6973

SHA256: 7BA6C013A590A10FEA84EC1B39098F6D9060801E1EBBCBA2FF1C17A1933384CD

File Size: 1.39 MB, 1393224 bytes

MD5: 40d7003d6e33ef318cbe50fa8c2a30aa

SHA1: 09ad3ae2fc125a20047cf50bafffbd44af0116b0

SHA256: D1D056290979E7F00779DCE7567EAEB9C1CDBAB5DC262E46B69E809850231004

File Size: 1.22 MB, 1219072 bytes

MD5: 2b361b5b7def2d790868f2bf8881cb50

SHA1: 6f585d9d2d4a0d9956f5e5181e98c62d27675209

SHA256: 9E8B3FE799EE1D6EBCBDC688B114EC4DF17441DD4F3DA2107EB0480FEC9B3696

File Size: 1.06 MB, 1062568 bytes

MD5: f55f7d853f40e09ad5ac38ac7707d6b5

SHA1: ba9e353718345c41034673644185bcf3d98a8344

SHA256: 2652DF77D89AF90C2ECB51E7A10AC0DB5B92BDAC2C27F370DB7C35CF37A734F5

File Size: 954.35 KB, 954352 bytes

MD5: f1fcd39d6c579e99163fc17467466e5e

SHA1: 902960c36bce8f1f2c191141113e2c930224cded

SHA256: A53198339DED6F783E92ECCBF0124F1D5586469E308BEC921ED03729D989D58F

File Size: 7.66 MB, 7656448 bytes

MD5: 2a8fa3953208a3252484c7d2fd6f2710

SHA1: cbfccc9b41c4c9fcd5eecfc23754e0b775b56086

SHA256: 3FDAF8E0F57AB681A11AD5F4F55A258563191F4343F79E03FF7B19253BFF8460

File Size: 849.00 KB, 849000 bytes

MD5: 7f19cfeec3ee8b9ea7898e6318f2d7b7

SHA1: 05e5c6676143ddb512af9340722f39e0a119536e

SHA256: 6F42F7C46C0CFB665FB62415CD4560D0896FA5FB3E0D7E94473AC6B85FAEECAF

File Size: 3.57 MB, 3570007 bytes

MD5: 5833d3c0067b4d8e75e7810aed91f4a7

SHA1: 2d243b995d973db48bd6b425aeb89d5752631cba

SHA256: 5DA912EEDA12AB632487324C3F6D99FD344E2E957BB7A9F1E643269B878B105D

File Size: 1.37 MB, 1373928 bytes

MD5: 2f468262951779ceaf9f81bbb0391b4f

SHA1: 76daccbde638b040bcbeff7597828bf9238b7f0a

SHA256: 9A92488DDC5EE30879E335A3DEF5D2CE2F000ED9225117DB7B245D9B3F59D695

File Size: 684.05 KB, 684048 bytes

MD5: 67f447db2f87318dcde2c30963095726

SHA1: 9839ea623e3be11c07a03fe90db317e5103f34a1

SHA256: 3BEDF6A21A554372CA46D1FE8837D2CDFBEAB2529FFE2877A7A67C07F3D7DD19

File Size: 1.21 MB, 1213440 bytes

MD5: 4ebc4f9ade412a0b107341d06da84710

SHA1: a6e8d1e8ffec9d71206b73a89e5754c79c554d7a

SHA256: 744F219CF86A61E58F86FF6D9965BE6E9B069DCEA25DBC7B073ADDBED315F95A

File Size: 3.81 MB, 3809280 bytes

MD5: 43d835aefb6e5b6dee8cf50d74d6497e

SHA1: b783aab0850ea8277aab9f2862067270a7d0b088

SHA256: 7305303C99EACDFCE5E0ECB0D3DEDB14BD50B33EE56C6FB198B9CE88E0BEFE1F

File Size: 366.05 KB, 366048 bytes

MD5: 456b1cf4a1578439ae870dfb3d1fb5c7

SHA1: 02884a4a41231d8e89f82335eb39dc2da661d1e6

SHA256: 2AA8701C847F158AAD60DA2ACAFC63DA596AF750AFB8512546DFFAFD95F59559

File Size: 1.39 MB, 1390624 bytes

MD5: 7172391a047ede817ea5c07f15405e8c

SHA1: f4ff413e7e69156832ad75f499eb159daee705b5

SHA256: 18814DFB8943A2ECE35317CE83DFC4763D06738E83B3B64230A00BA8DC559BB2

File Size: 1.16 MB, 1157632 bytes

MD5: 44a463d05c2f146a06da9de5dbd1fbe3

SHA1: d116e01288e42f54e35f3caf483af75ac2d3fe3b

SHA256: AE1A96E10FCC244B4F4B0AA789FD944840BEA6105F1D491E5D347B5638FD95D0

File Size: 813.73 KB, 813729 bytes

MD5: 7c66ecb4e48ad3e99ada29682bdfaa3e

SHA1: f6934bbf92d201bd79db4c1f6e2203e6acf0bb77

SHA256: A70D9642AB680EFDE23BDBC774374ACB19D3AC59F42FC22767318C9092C19AE0

File Size: 3.57 MB, 3570007 bytes

MD5: e2adf35793284bead38c91a2b9e0e3a0

SHA1: c3381663e30faec29911e389845b66c7c5a075e3

SHA256: 893F3883631A35922C63774FE29AB653D9FD2E348C755A31D34ED2C0C034BA4E

File Size: 7.70 MB, 7703552 bytes

MD5: bb719976b9f2418f45f911bea9c991e6

SHA1: f7daad1b5e3c4f814df7aba02c3febb4e43aaef8

SHA256: BD28C91AF3A7BE448A06AD0A424A8F99C47CD95E55AF459CE2B6593C90B4B700

File Size: 7.66 MB, 7655424 bytes

Windows Portable Executable Attributes

File doesn't have "Rich" header
File doesn't have debug information
File doesn't have exports table
File doesn't have relocations information
File doesn't have security information
File has been packed
File has exports table
File has TLS information
File is .NET application
File is 32-bit executable

File is 64-bit executable
File is either console or GUI application
File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
File is Native application (NOT .NET application)
File is not packed
IMAGE_FILE_DLL is not set inside PE header (Executable)
IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

6 additional icons are not displayed above.

Windows PE Version Information

Name	Value
Assembly Version	1.0.0.0
Comments	This installation was built with Inno Setup.
Company Name	Kotato Skirmish Mode Games, Inc.
File Description	All Video Downloader Pro Radufa Setup Setup Setup/Uninstall Wizard
File Version	51.1052.0.0 51.52.0.0 10.1.6.0 10.0.5.0 10.0.3.0 9, 9, 11, 0 9, 9, 8, 0 9, 8, 6, 0 9, 7, 7, 0 9, 2, 16, 0 Show More 9, 1, 6, 0 2.20.30.11 1. 9. 8. 7 1.3.4.2 1.0.0.1 1.0.0.0
Internal Name	All Video Downloader Pro Setup.exe Wizard.exe
Legal Copyright	(C) Kotato. All rights reserved. Copyright (C) 2014 Copyright © 2014 Stub
Original Filename	AllVideoDownloaderPro.EXE Setup.exe Wizard.exe
Product Name	All Video Downloader Pro BeyondATC Radufa Setup Wizard
Product Version	10.1.6.0 10.0.5.0 10.0.3.0 9, 9, 11, 0 9, 9, 8, 0 9, 8, 6, 0 9, 7, 7, 0 9, 2, 16, 0 9, 1, 6, 0 5.1 Show More 2.20.30.11 1. 9. 8. 7 1.7.7.EA 1.7.4.EA 1.6.65.EA 1.6.64.EA 1.6.60.Experimental 1.6.58.EA 1.5.7.EA 1.0.0.1 1.0.0.0

Digital Signatures

Signer	Root	Status
Softforce LLC	COMODO RSA Certification Authority	Root Not Trusted
Digital Plugin SL	Digital Plugin SL	Self Signed
Plugin Update SL	Plugin Update SL	Self Signed
Software Setup LLC	Software Setup LLC	Self Signed
Smart Secure Software S.l.	Symantec Class 3 SHA256 Code Signing CA	Self Signed

Digital Plugin SL	UTN-USERFirst-Object	Root Not Trusted
Digital Plugin S.l.	VeriSign Class 3 Code Signing 2010 CA	Self Signed
Digital Plugin SL	VeriSign Class 3 Code Signing 2010 CA	Self Signed
Plugin Update SL	VeriSign Class 3 Code Signing 2010 CA	Self Signed
App secure LLC	VeriSign Class 3 Public Primary Certification Authority - G5	Root Not Trusted
Digital Plugin SL	VeriSign Class 3 Public Primary Certification Authority - G5	Root Not Trusted
Plugin Update S.L.	VeriSign Class 3 Public Primary Certification Authority - G5	Root Not Trusted
Smart Secure Software S.l.	VeriSign Class 3 Public Primary Certification Authority - G5	Root Not Trusted
Video Plugin software SL	VeriSign Class 3 Public Primary Certification Authority - G5	Root Not Trusted
Sambamedia llc	thawte SHA256 Code Signing CA	Self Signed

File Traits

2+ executable sections
fptable
HighEntropy
imgui
Inno
InnoSetup Installer
Installer Manifest
Installer Version
MPRESS
MPRESS Win32

Native MPRESS x86
ntdll
packed
VirtualQueryEx
x64
x86

Block Information

Total Blocks:	17,546
Potentially Malicious Blocks:	43
Whitelisted Blocks:	13,076
Unknown Blocks:	4,427

Visual Map

? ? 0 0 0 0 0 0 0 0 0 ? 0 ? ? 0 0 0 0 0 ? ? ? ? 0 ? 0 0 0 0 x 0 0 0 ? ? ? ? ? ? 0 0 0 0 0 0 ? 0 ? ? 0 0 0 0 x x 0 ? 0 ? ? ? ? 0 0 0 0 0 0 1 ? 0 0 ? ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? 0 0 0 0 ? ? 0 ? 0 0 ? ? ? ? ? ? ? ? 0 0 0 ? ? ? ? 1 0 0 0 ? ? ? ? 0 ? ? 0 ? ? 0 ? 0 0 0 ? ? ? ? ? ? ? 0 ? ? ? ? ? ? ? ? ? 0 ? ? ? ? ? ? ? 0 ? ? ? ? ? 0 0 ? ? 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 0 0 x 0 0 0 ? ? ? ? 0 ? ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? 0 0 0 0 ? 0 0 ? ? 0 0 0 ? ? ? 0 ? ? ? ? ? ? 0 0 0 0 ? ? ? ? ? ? ? 0 ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? ? ? ? ? ? 0 ? ? ? ? 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 ? ? ? 0 0 ? ? ? ? ? ? 0 0 0 0 0 0 ? ? ? 0 ? ? ? ? ? ? ? 0 0 ? ? 0 0 0 0 0 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? 0 0 0 0 ? ? ? ? ? ? ? 0 ? 0 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? ? ? ? 0 ? 0 ? 0 0 ? 0 0 ? ? ? 0 ? ? 0 ? ? ? 0 0 ? 0 ? 0 0 ? 0 0 0 0 0 0 0 0 ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? ? ? ? ? ? ? ? 0 ? ? 0 ? 0 ? ? ? ? ? ? ? ? ? 0 0 0 ? ? ? 0 0 ? ? ? ? ? ? 0 0 ? ? ? ? 0 ? 0 ? 0 ? 0 ? 0 ? ? 0 ? ? ? 0 ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? ? ? ? ? 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 ? ? ? 0 0 ? 0 ? 0 ? 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 ? 0 ? 0 ? ? 0 ? ? ? ? ? ? ? ? ? 1 ? ? 0 ? ? ? ? 1 0 0 0 ? ? ? ? ? ? ? 0 0 0 0 ? ? 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? ? ? ? ? ? ? 0 ? ? ? 0 ? ? 0 0 0 ? ? ? ? ? ? ? ? 0 ? ? ? 0 0 0 0 ? ? ? ? ? 0 0 ? ? ? 0 0 ? 0 ? ? ? 0 ? ? ? ? 0 ? ? ? ? 0 0 ? ? ? ? ? ? 0 ? ? ? ? ? 0 ? ? ? ? ? ? ? 0 0 0 0 ? 0 0 0 ? 0 0 0 ? 0 ? ? ? ? ? ? ? 0 ? ? ? ? ? 0 ? ? ? 0 0 ? 0 0 0 0 0 ? ? ? ? ? ? 0 0 ? 0 0 ? ? ? 0 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? 0 0 0 0 ? 0 0 0 ? ? ? ? ? 1 0 0 ? 0 0 ? 0 ? ? ? ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 0 0 0 0 ? 0 0 0 ? ? 0 0 0 ? ? ? ? ? 0 0 ? 0 0 ? ? ? ? 0 ? 0 ? ? ? ? ? ? 0 0 ? ? ? ? ? ? 0 ? ? ? 1 ? 0 0 0 0 0 ? 0 0 0 ? x ? ? ? ? 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 0 0 ? ? ? ? ? ? ? ? ? 0 ? 0 ? ? ? ? ? ? ? ? ? 0 ? 0 ? 0 0 0 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? ? 0 1 0 ? ? ? 0 ? ? ? 0 0 0 ? ? ? ? ? 0 0 0 0 ? ? 0 ? ? ? ? ? ? 0 ? 0 ? ? 0 0 0 0 0 ? ? 0 ? ? ? ? ? ? ? ? 0 0 0 ? ? ? ? 0 0 ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? 0 0 0 ? 0 ? ? ? ? ? ? 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? 0 0 ? ? ? ? ? ? ? ? ? ? ? ? 0 0 0 0 ? 0 ? 0 0 0 ? ? ? 0 0 ? ? ? 0 0 0 0 ? ? ? ? ? ? ? ? ? ? 0 ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? 0 ? 0 0 0 0 0 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? 0 ? ? ? ? ? ? ? ? 0 ? ? ? ? ? ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? 0 ? ? ? ? ? ? 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 ? ? ? 0 0 ? ? ? ? ? ? ? ? ? ? ? 0 0 0 0 0 0 0 ? ? ? ? ? 0 ? ? ? ? 0 ? 0 0 0 0 ? ? ? 0 0 ? 1 ? 0 0 ? 0 0 1 ? ? 0 ? ? ? ? ? ? 0 0 0 ? 0 0 0 0 0 0 ? 0 ? ? 0 ? 0 ? 0 0 ? ? ? ? ? ? ? ? ? ? ? ? 0 0 1 ? ? 0 ? ? ? ? ? ? 0 ? ? ? 0 ? ? ? 0 0 0 0 0 1 1 1 ? ? 0 0 1 ? 0 ? ? ? 0 ? 0 0 1 ? 0 1 0 ? ? ? ? ? 0 0 0 0 ? 0 ? ? 0 0 ? ? 0 0 ? ? ? ? 0 0 ? 0 0 ? ? ? ? ? 0 ? ? 0 ? ? ? 0 ? ? 0 ? ? ? 0 ? ? ? 0 0 0 ? ? ? ? ? 0 0 ? 0 0 ? 0 ? ? ? ? ? ? ? ? 0 ? 0 0 ? ? ? ? ? ? ? 0 ? 0 ? ? ? ? ? ? ? 0 ? ? ? ? 0 ? ? ? ? ? 0 0 0 0 0 ? ? ? ? ? 0 1 ? ? ? ? ? ? 0 0 ? ? ? ? 0 0 ? ? ? 0 ? 0 ? 0 ? 0 ? 0 ? ? 0 0 0 0 0 0 ? 0 ? ? 0 ? 0 0 ? ? ? ? ? ? ? ? ? ? 1 0 ? ? ? ? ? ? ? 0 ? ? ? ? 0 ? 0 ? 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? 0 0 0 ? ? 0 ? ? ? 0 ? ? ? ? ? ? ? ? 0 0 ? ? 0 ? 0 ? ? ? ? 0 ? ? 0 ? 0 0 ? ? ? ? ? 0 0 0 ? 1 ? ? ? ? ? 1 ? ? ? 0 0 0 0 ? ? 0 ? ? 0 ? ? ? ? 0 ? ? ? ? ? 0 ? ? ? 0 ? 0 ? ? ? 0 ? ? ? ? ? ? ? ? ? 0 ? 0 0 ? ? ? 0 ? ? ? ? 0 ? ? 0 ? ? 0 0 ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? ? 0 0 ? ? 0 ? ? 0 0 ? ? ? ? 0 ? ? ? 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? ? 0 0 ? ? 0 ? ? 0 0 ? ? 0 ? ? 0 0 ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? ? 0 0 ? ? 0 ? ? 0 0 ? ? 0 ? ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 ? ? 0 ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 0 ? ? ? ? 0 ? ? 0 ? ? ? ? ? 0 ? 0 ? ? ? ? ? 0 ? ? 0 0 ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? ? 0 ? ? ? ? ? 0 ? 0 ? 0 0 0 ? ? ? ? ? ? 0 ? ? ? ? ? ? 0 ? 0 ? 0 0 0 ? 0 0 ? ? 0 ? ? ? ? ? ? 0 ? 0 ? 0 0 0 ? 0 0 ? 0 0 ? ? ? 0 0 x ? 0 ? ? 0 0 0 ? ? 0 0 ? ? ? 0 ? 0 ? ? ? ? 0

... Data truncated

0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

AutoHotkey.A
Banker.GT
BestaFera.G
Bitcoinminer.R
CoinMiner.BB

Delf.DA
Dropper.Delf.CF
Emotet.AAJ
Emotet.AAL
Emotet.CDD
Farfli.KB
Injector.AJA
Injector.AK
Injector.KPD
Injector.XD
Kryptik.FHE
MPRESS Packer
MSIL.SoftPulse.A
Morto.B
Ousaban.V
SoftPulse.A
SoftPulse.AB
SoftPulse.AC
SoftPulse.AE
Softcnapp.N
Stealer.KF
Strictor.A
Tofsee.BP
Trojan.Kryptik.Gen.EZ
Upatre.WIA

Files Modified

File	Attributes
c:\users\user\appdata\local\temp\338a.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\5758.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\5a6.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ab1c.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\data.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\users\user\appdata\local\temp\installer.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-qgmsb.tmp\45aeb08410de24643b6486107f6d01594eb06b37_0000965256.tmp	Generic Write,Read Attributes
c:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\40c68d5626484a90937f0752c8b950ab	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\c46e7b0f942663a1edc8d9d6d7869173_6043fc604a395e1485af7ac16d16b7ce	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\ea618097e393409afa316f0f87e2c202_c49f9031c3a5febd1fce55e54a2ad239	Generic Read,Write Data,Write Attributes,Write extended,Append data

c:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\ecf3006d44da211141391220ee5049f4	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\40c68d5626484a90937f0752c8b950ab	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\c46e7b0f942663a1edc8d9d6d7869173_6043fc604a395e1485af7ac16d16b7ce	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\ea618097e393409afa316f0f87e2c202_c49f9031c3a5febd1fce55e54a2ad239	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\ecf3006d44da211141391220ee5049f4	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\downloads\1d699d77206f3737c5a1ebd15c84f6390a0dedff_0000483976.exe	Generic Read,Write Attributes
c:\users\user\downloads\76daccbde638b040bcbeff7597828bf9238b7f0a_0000684048	Generic Read,Write Attributes
c:\users\user\downloads\b783aab0850ea8277aab9f2862067270a7d0b088_0000366048	Generic Read,Write Attributes

Registry Modifications

Key::Value	Data	API Name
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475	㔓ȁՉ龡^7紘Ç2獖}9좟Ê	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75		RegNtPreCreateKey
HKLM\software\microsoft\systemcertificates\authroot\certificates\4eb6d578499b1ccf5f581ead56be3d9b6744a5e5::blob	់㇤㹧ৢ䗾鍗૳ᳺứ霞輫穆轙⊩㢅즔Sc愰ℰଆ虠ňŅᜇ〆〒ؐ⬊ĆĄ㞂ļ́ダ؟怉䢆蘁泽ĂሰူਆثЁ舁㰷āȃ쀀ᬰԆ腧Č〃〒ؐ⬊ĆĄ㞂ļ́翀Ā⨀　ب⬈Ćԅ̇؂⬈Ćԅ̇؃⬈Ćԅ̇؄⬈Ćԅ̇ँĀ⨀　ب⬈Ćԅ̇؂⬈Ćԅ	RegNtPreCreateKey
HKLM\software\microsoft\systemcertificates\authroot\certificates\4eb6d578499b1ccf5f581ead56be3d9b6744a5e5::blob		RegNtPreCreateKey
HKLM\software\microsoft\systemcertificates\root\certificates\be36a4562fb2ee05dbb3d32323adf445084ed656::blob	\Ѐ볝蚽㾜ࠛ컯퇄춈ᔻᰘ兘槹镹⍋.Thawte Timestamping CA ਰࠆثԁ܅ࠃ㚾嚤눯׮돛⏓괣䗴丈囖晿煺硩騠ᑑ莝⃚ꗨ뺘芄ﺎ炮ᔑ㔁뉶 ʥ	RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing::enableconsoletracing		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasapi32::enablefiletracing		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasapi32::enableautofiletracing		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasapi32::enableconsoletracing		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasapi32::filetracingmask		RegNtPreCreateKey

HKLM\software\wow6432node\microsoft\tracing\rasapi32::consoletracingmask		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasapi32::maxfilesize		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasapi32::filedirectory	%windir%\tracing	RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasmancs::enablefiletracing		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasmancs::enableautofiletracing		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasmancs::enableconsoletracing		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasmancs::filetracingmask		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasmancs::consoletracingmask		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasmancs::maxfilesize		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasmancs::filedirectory	%windir%\tracing	RegNtPreCreateKey
HKCU\clsid\{758d2268-26e1-46eb-91ee-2968c83f08cf}::	覝늻蚜꫐낝냌출첾蛎닌蚝늙꾙쪔蛎돈閙꺕출꺉꾝鿈閝쮘蚝쾾際ꮿ蛎돈隝돌隝컏낙龍障쾌際첌뾜꺙뎝톻蛎龧隝쯋閝돈첛龝	RegNtPreCreateKey
HKCU\software\kotato\all video downloader pro\settings::lastservicesupdate	⾪椾	RegNtPreCreateKey
HKCU\kotato.allvideodownloaderpro.download::	Download	RegNtPreCreateKey
HKCU\kotato.allvideodownloaderpro.download\defaulticon::	c:\users\user\downloads\902960c36bce8f1f2c191141113e2c930224cded_0007656448,1	RegNtPreCreateKey
HKCU\kotato.allvideodownloaderpro.download\shell\open\command::	"c:\users\user\downloads\902960c36bce8f1f2c191141113e2c930224cded_0007656448" "%1"	RegNtPreCreateKey
HKCU\.download::	Kotato.AllVideoDownloaderPro.download	RegNtPreCreateKey
HKCU\clsid\{758d2268-26e1-46eb-91ee-2968c83f08cf}::	覝늻蚜꫐낝냌출첾蛎닌蚝늙꾙쪔蛎돈낙컋출껐蚜鿐閝쮘蚝쾾際ꮿ蛎돈蚝놙閝꾝隙鿌障쾌際첌뾜꺙뎝톻蛎龧隝쯋閝돈첛龝	RegNtPreCreateKey
HKCU\software\kotato\all video downloader pro\settings::lastservicesupdate	楼	RegNtPreCreateKey
HKCU\kotato.allvideodownloaderpro.download\defaulticon::	c:\users\user\downloads\c3381663e30faec29911e389845b66c7c5a075e3_0007703552,1	RegNtPreCreateKey
HKCU\kotato.allvideodownloaderpro.download\shell\open\command::	"c:\users\user\downloads\c3381663e30faec29911e389845b66c7c5a075e3_0007703552" "%1"	RegNtPreCreateKey
HKCU\clsid\{758d2268-26e1-46eb-91ee-2968c83f08cf}::	覝늻蚜꫐낝냌출첾蛎닌蚝늙꾙쪔蛎돈낙ꪙ꾜뎑꾝鿈閝쮘蚝쾾際ꮿ蛎돈蚝쪐낙늕낙龍障쾌際첌뾜꺙뎝톻蛎龧隝쯋閝돈첛龝	RegNtPreCreateKey
HKCU\software\kotato\all video downloader pro\settings::lastservicesupdate	咪榆	RegNtPreCreateKey
HKCU\kotato.allvideodownloaderpro.download\defaulticon::	c:\users\user\downloads\f7daad1b5e3c4f814df7aba02c3febb4e43aaef8_0007655424,1	RegNtPreCreateKey
HKCU\kotato.allvideodownloaderpro.download\shell\open\command::	"c:\users\user\downloads\f7daad1b5e3c4f814df7aba02c3febb4e43aaef8_0007655424" "%1"	RegNtPreCreateKey

Windows API Usage

Category	API
Process Shell Execute	CreateProcess
Process Manipulation Evasion	NtUnmapViewOfSection ReadProcessMemory VirtualAllocEx
Anti Debug	CheckRemoteDebuggerPresent IsDebuggerPresent NtQuerySystemInformation OutputDebugString
User Data Access	GetComputerName GetComputerNameEx GetUserName GetUserObjectInformation OpenClipboard
Other Suspicious	AdjustTokenPrivileges SetWindowsHookEx
Network Wininet	HttpQueryInfo InternetOpen InternetOpenUrl InternetQueryOption
Network Info Queried	GetAdaptersAddresses GetAdaptersInfo GetNetworkParams
Encryption Used	BCryptOpenAlgorithmProvider CryptAcquireContext
Network Winsock2	WSAConnect WSASocket WSAStartup
Network Winsock	closesocket freeaddrinfo getaddrinfo inet_addr recv send setsockopt
Network Winhttp	WinHttpOpen
Syscall Use	ntdll.dll!NtAddAtomEx ntdll.dll!NtAlertThreadByThreadId ntdll.dll!NtAlpcAcceptConnectPort ntdll.dll!NtAlpcQueryInformation ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtApphelpCacheControl ntdll.dll!NtClose ntdll.dll!NtConnectPort ntdll.dll!NtCreateEvent ntdll.dll!NtCreateKey Show More ntdll.dll!NtCreateMutant ntdll.dll!NtCreateSection ntdll.dll!NtCreateSemaphore ntdll.dll!NtCreateTimer ntdll.dll!NtDeviceIoControlFile ntdll.dll!NtDuplicateObject ntdll.dll!NtEnumerateKey ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtMapViewOfSection ntdll.dll!NtNotifyChangeMultipleKeys ntdll.dll!NtOpenEvent ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenKeyEx ntdll.dll!NtOpenProcessToken ntdll.dll!NtOpenSection ntdll.dll!NtOpenSemaphore ntdll.dll!NtOpenSymbolicLinkObject ntdll.dll!NtOpenThreadToken ntdll.dll!NtPowerInformation ntdll.dll!NtProtectVirtualMemory ntdll.dll!NtQueryAttributesFile ntdll.dll!NtQueryDebugFilterState ntdll.dll!NtQueryInformationFile ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationThread ntdll.dll!NtQueryInformationToken ntdll.dll!NtQueryKey ntdll.dll!NtQueryLicenseValue ntdll.dll!NtQueryPerformanceCounter ntdll.dll!NtQuerySecurityAttributesToken ntdll.dll!NtQuerySecurityObject ntdll.dll!NtQuerySymbolicLinkObject ntdll.dll!NtQuerySystemInformation ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryVolumeInformationFile ntdll.dll!NtQueryWnfStateData ntdll.dll!NtReadFile ntdll.dll!NtReadRequestData ntdll.dll!NtReadVirtualMemory ntdll.dll!NtReleaseMutant ntdll.dll!NtReleaseSemaphore ntdll.dll!NtReleaseWorkerFactoryWorker ntdll.dll!NtRequestWaitReplyPort ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationKey ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtSetTimerEx ntdll.dll!NtSubscribeWnfStateChange ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtUnmapViewOfSectionEx ntdll.dll!NtWaitForAlertByThreadId ntdll.dll!NtWaitForMultipleObjects ntdll.dll!NtWaitForSingleObject ntdll.dll!NtWaitForWorkViaWorkerFactory ntdll.dll!NtWaitLowEventPair ntdll.dll!NtWorkerFactoryWorkerReady ntdll.dll!NtWriteFile ntdll.dll!NtWriteVirtualMemory UNKNOWN
Keyboard Access	GetKeyState

Shell Command Execution


							c:\users\user\downloads\79fff2124e52223a2af4741e8242a787998ec4c8_0001465040.exe


							c:\users\user\downloads\ec7fbc35488b336ab9d26c9254b97813c1d0c62b_0001086128


							c:\users\user\downloads\d4bc2418b5d6c95aeeae3d9b945718c1812206ad_0001626048 "c:\users\user\downloads\d4bc2418b5d6c95aeeae3d9b945718c1812206ad_0001626048"


							c:\users\user\downloads\b942603bd1fdfcbaf531e1460d80f705b336299c_0001344688


							c:\users\user\downloads\a338d787002bb3e8f90253ea5cb981cbc66bc611_0001137896


									c:\users\user\downloads\d9ca0e1b231da51ffb8309412098eb6e75b491eb_0001339616


									c:\users\user\downloads\098ee4eb40f2bee652ade249ac111931bf203a59_0000693736 "c:\users\user\downloads\098ee4eb40f2bee652ade249ac111931bf203a59_0000693736"


									C:\Users\Rtpenbhz\AppData\Local\Temp\\Setup.exe


									"C:\Users\Djvhchcm\AppData\Local\Temp\is-QGMSB.tmp\45aeb08410de24643b6486107f6d01594eb06b37_0000965256.tmp" /SL5="$40258,717903,56832,c:\users\user\downloads\45aeb08410de24643b6486107f6d01594eb06b37_0000965256"


									c:\users\user\downloads\fb005f0baca6b59b669fac5e8101b51f6be79603_0001120504


									c:\users\user\downloads\0ce3bb40ca9d74e58258767459d06783bc2e6973_0001393224


									c:\users\user\downloads\6f585d9d2d4a0d9956f5e5181e98c62d27675209_0001062568


									c:\users\user\downloads\2d243b995d973db48bd6b425aeb89d5752631cba_0001373928


									c:\users\user\downloads\02884a4a41231d8e89f82335eb39dc2da661d1e6_0001390624

SoftPulse

Threat Scorecard

EnigmaSoft Threat Scorecard

SpyHunter Detects & Remove SoftPulse

Registry Details

Directories

Analysis Report

General information

Known Samples

Known Samples

Windows Portable Executable Attributes

Windows Portable Executable Attributes

File Icons

File Icons

Windows PE Version Information

Windows PE Version Information

Digital Signatures

Digital Signatures

File Traits

Block Information

Block Information

Visual Map

Similar Families

Similar Families

Files Modified

Files Modified

Registry Modifications

Registry Modifications

Windows API Usage

Windows API Usage

Shell Command Execution

Shell Command Execution

Submit Comment

Related Posts

Trending

Most Viewed