Analysis

  • max time kernel
    148s
  • max time network
    113s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    02-03-2021 16:42

General

  • Target

    e45ca467bf76afbc0a6a1501c2a8c7baa014d8c7b9f4957cc6bbe2f44f106e11.exe

  • Size

    1.1MB

  • MD5

    e76812ed1f10eb41d2eb3c0fd5e2e6ab

  • SHA1

    4aba20db38c7cdfb9a069cd336663e5d063831bc

  • SHA256

    e45ca467bf76afbc0a6a1501c2a8c7baa014d8c7b9f4957cc6bbe2f44f106e11

  • SHA512

    9a086a3a9f17449d57534e4cc46adfc918b79c887ace14a5f605dccfa6cbe948093b771a33f01bfa7fdb632c597384112325bf19a6ec764ee883b987853d2a75

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 2 IoCs
  • Drops startup file 3 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e45ca467bf76afbc0a6a1501c2a8c7baa014d8c7b9f4957cc6bbe2f44f106e11.exe
    "C:\Users\Admin\AppData\Local\Temp\e45ca467bf76afbc0a6a1501c2a8c7baa014d8c7b9f4957cc6bbe2f44f106e11.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3928
    • C:\Windows\SysWOW64\HelpMe.exe
      C:\Windows\system32\HelpMe.exe
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Drops startup file
      • Enumerates connected drives
      • Drops file in System32 directory
      PID:1368
    • C:\Users\Admin\AppData\Local\Temp\regfH
      C:\Users\Admin\AppData\Local\Temp\\regfH
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Drops startup file
      • Enumerates connected drives
      • Drops file in System32 directory
      PID:2752

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

1
T1091

Persistence

Winlogon Helper DLL

1
T1004

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Replication Through Removable Media

1
T1091

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1985363256-3005190890-1182679451-1000\desktop.ini.exe
    MD5

    ddbd941c4447ceb57fb2eaaf8836d18e

    SHA1

    962f018a9ac6b8a5ba024b8d7093d50158b25dd2

    SHA256

    a87463e0856006c707641b6b2e008ef7d8242238c3fb1033d58f01034e91e844

    SHA512

    044a123a0eb84debb515673381924cd5af5e4a0fd5951d9778d6294dd603f510491db6af8108d09424131f2ea6155675dfdc5b5bab55a66f0a53da4d4a437456

  • C:\AutoRun.exe
    MD5

    8e2fc50e1ac00645c652f97b8034e76e

    SHA1

    d351b9972a6c6ca730ce5626344bc4ce2c8ed623

    SHA256

    b1e1388f0724306ddea90e937e8bc7076d7969d823118c2f4de940d7e2bffe0f

    SHA512

    65072e20b10afa2073e0d1360fbb70e4ecedd19da452edcaaad398eaba3314e3705ff78e9a6511f606a18371939600aeaec44fc1f8440c536a8355ae2e308297

  • C:\Users\Admin\AppData\Local\Temp\regfH
    MD5

    e76812ed1f10eb41d2eb3c0fd5e2e6ab

    SHA1

    4aba20db38c7cdfb9a069cd336663e5d063831bc

    SHA256

    e45ca467bf76afbc0a6a1501c2a8c7baa014d8c7b9f4957cc6bbe2f44f106e11

    SHA512

    9a086a3a9f17449d57534e4cc46adfc918b79c887ace14a5f605dccfa6cbe948093b771a33f01bfa7fdb632c597384112325bf19a6ec764ee883b987853d2a75

  • C:\Users\Admin\AppData\Local\Temp\regfH
    MD5

    e76812ed1f10eb41d2eb3c0fd5e2e6ab

    SHA1

    4aba20db38c7cdfb9a069cd336663e5d063831bc

    SHA256

    e45ca467bf76afbc0a6a1501c2a8c7baa014d8c7b9f4957cc6bbe2f44f106e11

    SHA512

    9a086a3a9f17449d57534e4cc46adfc918b79c887ace14a5f605dccfa6cbe948093b771a33f01bfa7fdb632c597384112325bf19a6ec764ee883b987853d2a75

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    a3fcb8b43996748c92f0d234d3f7bdcf

    SHA1

    37976c48476f459a03cc012c268f1ef348ef469e

    SHA256

    4f9ee66011ae8123e5bcc915333f2bc2e8fe68240c88495325a1120e8477176d

    SHA512

    5985beaf8937891d1085b0fc675ad622142cca149b6bcbceec4aeee62771d8860b0b6b2c4063dca3cf978a4dac265293511a69e5bfe0b8381748a68e0ff4c13b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    dc1d6104973636be779beb2aead94dab

    SHA1

    29d282504272e50dbec1d6e63da7a10cbcd452af

    SHA256

    2fb3d80e4efe9e3a5e42a1462d721595f8b7b0a7e4650d80d25baa2cedff496b

    SHA512

    e19b2ffed139a73ab0115a1545f29877442a9b0f7b32a7720654ff0c1d2aff76b0a35a6d25ac01a735e47ebdbf533e01afccc60b4432dd4399b3d3b5a5052dac

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    a3fcb8b43996748c92f0d234d3f7bdcf

    SHA1

    37976c48476f459a03cc012c268f1ef348ef469e

    SHA256

    4f9ee66011ae8123e5bcc915333f2bc2e8fe68240c88495325a1120e8477176d

    SHA512

    5985beaf8937891d1085b0fc675ad622142cca149b6bcbceec4aeee62771d8860b0b6b2c4063dca3cf978a4dac265293511a69e5bfe0b8381748a68e0ff4c13b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    dc1d6104973636be779beb2aead94dab

    SHA1

    29d282504272e50dbec1d6e63da7a10cbcd452af

    SHA256

    2fb3d80e4efe9e3a5e42a1462d721595f8b7b0a7e4650d80d25baa2cedff496b

    SHA512

    e19b2ffed139a73ab0115a1545f29877442a9b0f7b32a7720654ff0c1d2aff76b0a35a6d25ac01a735e47ebdbf533e01afccc60b4432dd4399b3d3b5a5052dac

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    a3fcb8b43996748c92f0d234d3f7bdcf

    SHA1

    37976c48476f459a03cc012c268f1ef348ef469e

    SHA256

    4f9ee66011ae8123e5bcc915333f2bc2e8fe68240c88495325a1120e8477176d

    SHA512

    5985beaf8937891d1085b0fc675ad622142cca149b6bcbceec4aeee62771d8860b0b6b2c4063dca3cf978a4dac265293511a69e5bfe0b8381748a68e0ff4c13b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    dc1d6104973636be779beb2aead94dab

    SHA1

    29d282504272e50dbec1d6e63da7a10cbcd452af

    SHA256

    2fb3d80e4efe9e3a5e42a1462d721595f8b7b0a7e4650d80d25baa2cedff496b

    SHA512

    e19b2ffed139a73ab0115a1545f29877442a9b0f7b32a7720654ff0c1d2aff76b0a35a6d25ac01a735e47ebdbf533e01afccc60b4432dd4399b3d3b5a5052dac

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    a3fcb8b43996748c92f0d234d3f7bdcf

    SHA1

    37976c48476f459a03cc012c268f1ef348ef469e

    SHA256

    4f9ee66011ae8123e5bcc915333f2bc2e8fe68240c88495325a1120e8477176d

    SHA512

    5985beaf8937891d1085b0fc675ad622142cca149b6bcbceec4aeee62771d8860b0b6b2c4063dca3cf978a4dac265293511a69e5bfe0b8381748a68e0ff4c13b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    dc1d6104973636be779beb2aead94dab

    SHA1

    29d282504272e50dbec1d6e63da7a10cbcd452af

    SHA256

    2fb3d80e4efe9e3a5e42a1462d721595f8b7b0a7e4650d80d25baa2cedff496b

    SHA512

    e19b2ffed139a73ab0115a1545f29877442a9b0f7b32a7720654ff0c1d2aff76b0a35a6d25ac01a735e47ebdbf533e01afccc60b4432dd4399b3d3b5a5052dac

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    a3fcb8b43996748c92f0d234d3f7bdcf

    SHA1

    37976c48476f459a03cc012c268f1ef348ef469e

    SHA256

    4f9ee66011ae8123e5bcc915333f2bc2e8fe68240c88495325a1120e8477176d

    SHA512

    5985beaf8937891d1085b0fc675ad622142cca149b6bcbceec4aeee62771d8860b0b6b2c4063dca3cf978a4dac265293511a69e5bfe0b8381748a68e0ff4c13b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    dc1d6104973636be779beb2aead94dab

    SHA1

    29d282504272e50dbec1d6e63da7a10cbcd452af

    SHA256

    2fb3d80e4efe9e3a5e42a1462d721595f8b7b0a7e4650d80d25baa2cedff496b

    SHA512

    e19b2ffed139a73ab0115a1545f29877442a9b0f7b32a7720654ff0c1d2aff76b0a35a6d25ac01a735e47ebdbf533e01afccc60b4432dd4399b3d3b5a5052dac

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    a3fcb8b43996748c92f0d234d3f7bdcf

    SHA1

    37976c48476f459a03cc012c268f1ef348ef469e

    SHA256

    4f9ee66011ae8123e5bcc915333f2bc2e8fe68240c88495325a1120e8477176d

    SHA512

    5985beaf8937891d1085b0fc675ad622142cca149b6bcbceec4aeee62771d8860b0b6b2c4063dca3cf978a4dac265293511a69e5bfe0b8381748a68e0ff4c13b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    dc1d6104973636be779beb2aead94dab

    SHA1

    29d282504272e50dbec1d6e63da7a10cbcd452af

    SHA256

    2fb3d80e4efe9e3a5e42a1462d721595f8b7b0a7e4650d80d25baa2cedff496b

    SHA512

    e19b2ffed139a73ab0115a1545f29877442a9b0f7b32a7720654ff0c1d2aff76b0a35a6d25ac01a735e47ebdbf533e01afccc60b4432dd4399b3d3b5a5052dac

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    a3fcb8b43996748c92f0d234d3f7bdcf

    SHA1

    37976c48476f459a03cc012c268f1ef348ef469e

    SHA256

    4f9ee66011ae8123e5bcc915333f2bc2e8fe68240c88495325a1120e8477176d

    SHA512

    5985beaf8937891d1085b0fc675ad622142cca149b6bcbceec4aeee62771d8860b0b6b2c4063dca3cf978a4dac265293511a69e5bfe0b8381748a68e0ff4c13b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    dc1d6104973636be779beb2aead94dab

    SHA1

    29d282504272e50dbec1d6e63da7a10cbcd452af

    SHA256

    2fb3d80e4efe9e3a5e42a1462d721595f8b7b0a7e4650d80d25baa2cedff496b

    SHA512

    e19b2ffed139a73ab0115a1545f29877442a9b0f7b32a7720654ff0c1d2aff76b0a35a6d25ac01a735e47ebdbf533e01afccc60b4432dd4399b3d3b5a5052dac

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    a3fcb8b43996748c92f0d234d3f7bdcf

    SHA1

    37976c48476f459a03cc012c268f1ef348ef469e

    SHA256

    4f9ee66011ae8123e5bcc915333f2bc2e8fe68240c88495325a1120e8477176d

    SHA512

    5985beaf8937891d1085b0fc675ad622142cca149b6bcbceec4aeee62771d8860b0b6b2c4063dca3cf978a4dac265293511a69e5bfe0b8381748a68e0ff4c13b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    dc1d6104973636be779beb2aead94dab

    SHA1

    29d282504272e50dbec1d6e63da7a10cbcd452af

    SHA256

    2fb3d80e4efe9e3a5e42a1462d721595f8b7b0a7e4650d80d25baa2cedff496b

    SHA512

    e19b2ffed139a73ab0115a1545f29877442a9b0f7b32a7720654ff0c1d2aff76b0a35a6d25ac01a735e47ebdbf533e01afccc60b4432dd4399b3d3b5a5052dac

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    a3fcb8b43996748c92f0d234d3f7bdcf

    SHA1

    37976c48476f459a03cc012c268f1ef348ef469e

    SHA256

    4f9ee66011ae8123e5bcc915333f2bc2e8fe68240c88495325a1120e8477176d

    SHA512

    5985beaf8937891d1085b0fc675ad622142cca149b6bcbceec4aeee62771d8860b0b6b2c4063dca3cf978a4dac265293511a69e5bfe0b8381748a68e0ff4c13b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    dc1d6104973636be779beb2aead94dab

    SHA1

    29d282504272e50dbec1d6e63da7a10cbcd452af

    SHA256

    2fb3d80e4efe9e3a5e42a1462d721595f8b7b0a7e4650d80d25baa2cedff496b

    SHA512

    e19b2ffed139a73ab0115a1545f29877442a9b0f7b32a7720654ff0c1d2aff76b0a35a6d25ac01a735e47ebdbf533e01afccc60b4432dd4399b3d3b5a5052dac

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    a3fcb8b43996748c92f0d234d3f7bdcf

    SHA1

    37976c48476f459a03cc012c268f1ef348ef469e

    SHA256

    4f9ee66011ae8123e5bcc915333f2bc2e8fe68240c88495325a1120e8477176d

    SHA512

    5985beaf8937891d1085b0fc675ad622142cca149b6bcbceec4aeee62771d8860b0b6b2c4063dca3cf978a4dac265293511a69e5bfe0b8381748a68e0ff4c13b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    dc1d6104973636be779beb2aead94dab

    SHA1

    29d282504272e50dbec1d6e63da7a10cbcd452af

    SHA256

    2fb3d80e4efe9e3a5e42a1462d721595f8b7b0a7e4650d80d25baa2cedff496b

    SHA512

    e19b2ffed139a73ab0115a1545f29877442a9b0f7b32a7720654ff0c1d2aff76b0a35a6d25ac01a735e47ebdbf533e01afccc60b4432dd4399b3d3b5a5052dac

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    a3fcb8b43996748c92f0d234d3f7bdcf

    SHA1

    37976c48476f459a03cc012c268f1ef348ef469e

    SHA256

    4f9ee66011ae8123e5bcc915333f2bc2e8fe68240c88495325a1120e8477176d

    SHA512

    5985beaf8937891d1085b0fc675ad622142cca149b6bcbceec4aeee62771d8860b0b6b2c4063dca3cf978a4dac265293511a69e5bfe0b8381748a68e0ff4c13b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    dc1d6104973636be779beb2aead94dab

    SHA1

    29d282504272e50dbec1d6e63da7a10cbcd452af

    SHA256

    2fb3d80e4efe9e3a5e42a1462d721595f8b7b0a7e4650d80d25baa2cedff496b

    SHA512

    e19b2ffed139a73ab0115a1545f29877442a9b0f7b32a7720654ff0c1d2aff76b0a35a6d25ac01a735e47ebdbf533e01afccc60b4432dd4399b3d3b5a5052dac

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    a3fcb8b43996748c92f0d234d3f7bdcf

    SHA1

    37976c48476f459a03cc012c268f1ef348ef469e

    SHA256

    4f9ee66011ae8123e5bcc915333f2bc2e8fe68240c88495325a1120e8477176d

    SHA512

    5985beaf8937891d1085b0fc675ad622142cca149b6bcbceec4aeee62771d8860b0b6b2c4063dca3cf978a4dac265293511a69e5bfe0b8381748a68e0ff4c13b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    dc1d6104973636be779beb2aead94dab

    SHA1

    29d282504272e50dbec1d6e63da7a10cbcd452af

    SHA256

    2fb3d80e4efe9e3a5e42a1462d721595f8b7b0a7e4650d80d25baa2cedff496b

    SHA512

    e19b2ffed139a73ab0115a1545f29877442a9b0f7b32a7720654ff0c1d2aff76b0a35a6d25ac01a735e47ebdbf533e01afccc60b4432dd4399b3d3b5a5052dac

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    a3fcb8b43996748c92f0d234d3f7bdcf

    SHA1

    37976c48476f459a03cc012c268f1ef348ef469e

    SHA256

    4f9ee66011ae8123e5bcc915333f2bc2e8fe68240c88495325a1120e8477176d

    SHA512

    5985beaf8937891d1085b0fc675ad622142cca149b6bcbceec4aeee62771d8860b0b6b2c4063dca3cf978a4dac265293511a69e5bfe0b8381748a68e0ff4c13b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    dc1d6104973636be779beb2aead94dab

    SHA1

    29d282504272e50dbec1d6e63da7a10cbcd452af

    SHA256

    2fb3d80e4efe9e3a5e42a1462d721595f8b7b0a7e4650d80d25baa2cedff496b

    SHA512

    e19b2ffed139a73ab0115a1545f29877442a9b0f7b32a7720654ff0c1d2aff76b0a35a6d25ac01a735e47ebdbf533e01afccc60b4432dd4399b3d3b5a5052dac

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    a3fcb8b43996748c92f0d234d3f7bdcf

    SHA1

    37976c48476f459a03cc012c268f1ef348ef469e

    SHA256

    4f9ee66011ae8123e5bcc915333f2bc2e8fe68240c88495325a1120e8477176d

    SHA512

    5985beaf8937891d1085b0fc675ad622142cca149b6bcbceec4aeee62771d8860b0b6b2c4063dca3cf978a4dac265293511a69e5bfe0b8381748a68e0ff4c13b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    dc1d6104973636be779beb2aead94dab

    SHA1

    29d282504272e50dbec1d6e63da7a10cbcd452af

    SHA256

    2fb3d80e4efe9e3a5e42a1462d721595f8b7b0a7e4650d80d25baa2cedff496b

    SHA512

    e19b2ffed139a73ab0115a1545f29877442a9b0f7b32a7720654ff0c1d2aff76b0a35a6d25ac01a735e47ebdbf533e01afccc60b4432dd4399b3d3b5a5052dac

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    a3fcb8b43996748c92f0d234d3f7bdcf

    SHA1

    37976c48476f459a03cc012c268f1ef348ef469e

    SHA256

    4f9ee66011ae8123e5bcc915333f2bc2e8fe68240c88495325a1120e8477176d

    SHA512

    5985beaf8937891d1085b0fc675ad622142cca149b6bcbceec4aeee62771d8860b0b6b2c4063dca3cf978a4dac265293511a69e5bfe0b8381748a68e0ff4c13b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    dc1d6104973636be779beb2aead94dab

    SHA1

    29d282504272e50dbec1d6e63da7a10cbcd452af

    SHA256

    2fb3d80e4efe9e3a5e42a1462d721595f8b7b0a7e4650d80d25baa2cedff496b

    SHA512

    e19b2ffed139a73ab0115a1545f29877442a9b0f7b32a7720654ff0c1d2aff76b0a35a6d25ac01a735e47ebdbf533e01afccc60b4432dd4399b3d3b5a5052dac

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    a3fcb8b43996748c92f0d234d3f7bdcf

    SHA1

    37976c48476f459a03cc012c268f1ef348ef469e

    SHA256

    4f9ee66011ae8123e5bcc915333f2bc2e8fe68240c88495325a1120e8477176d

    SHA512

    5985beaf8937891d1085b0fc675ad622142cca149b6bcbceec4aeee62771d8860b0b6b2c4063dca3cf978a4dac265293511a69e5bfe0b8381748a68e0ff4c13b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    dc1d6104973636be779beb2aead94dab

    SHA1

    29d282504272e50dbec1d6e63da7a10cbcd452af

    SHA256

    2fb3d80e4efe9e3a5e42a1462d721595f8b7b0a7e4650d80d25baa2cedff496b

    SHA512

    e19b2ffed139a73ab0115a1545f29877442a9b0f7b32a7720654ff0c1d2aff76b0a35a6d25ac01a735e47ebdbf533e01afccc60b4432dd4399b3d3b5a5052dac

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    a3fcb8b43996748c92f0d234d3f7bdcf

    SHA1

    37976c48476f459a03cc012c268f1ef348ef469e

    SHA256

    4f9ee66011ae8123e5bcc915333f2bc2e8fe68240c88495325a1120e8477176d

    SHA512

    5985beaf8937891d1085b0fc675ad622142cca149b6bcbceec4aeee62771d8860b0b6b2c4063dca3cf978a4dac265293511a69e5bfe0b8381748a68e0ff4c13b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    dc1d6104973636be779beb2aead94dab

    SHA1

    29d282504272e50dbec1d6e63da7a10cbcd452af

    SHA256

    2fb3d80e4efe9e3a5e42a1462d721595f8b7b0a7e4650d80d25baa2cedff496b

    SHA512

    e19b2ffed139a73ab0115a1545f29877442a9b0f7b32a7720654ff0c1d2aff76b0a35a6d25ac01a735e47ebdbf533e01afccc60b4432dd4399b3d3b5a5052dac

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    a3fcb8b43996748c92f0d234d3f7bdcf

    SHA1

    37976c48476f459a03cc012c268f1ef348ef469e

    SHA256

    4f9ee66011ae8123e5bcc915333f2bc2e8fe68240c88495325a1120e8477176d

    SHA512

    5985beaf8937891d1085b0fc675ad622142cca149b6bcbceec4aeee62771d8860b0b6b2c4063dca3cf978a4dac265293511a69e5bfe0b8381748a68e0ff4c13b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    dc1d6104973636be779beb2aead94dab

    SHA1

    29d282504272e50dbec1d6e63da7a10cbcd452af

    SHA256

    2fb3d80e4efe9e3a5e42a1462d721595f8b7b0a7e4650d80d25baa2cedff496b

    SHA512

    e19b2ffed139a73ab0115a1545f29877442a9b0f7b32a7720654ff0c1d2aff76b0a35a6d25ac01a735e47ebdbf533e01afccc60b4432dd4399b3d3b5a5052dac

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    a3fcb8b43996748c92f0d234d3f7bdcf

    SHA1

    37976c48476f459a03cc012c268f1ef348ef469e

    SHA256

    4f9ee66011ae8123e5bcc915333f2bc2e8fe68240c88495325a1120e8477176d

    SHA512

    5985beaf8937891d1085b0fc675ad622142cca149b6bcbceec4aeee62771d8860b0b6b2c4063dca3cf978a4dac265293511a69e5bfe0b8381748a68e0ff4c13b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    dc1d6104973636be779beb2aead94dab

    SHA1

    29d282504272e50dbec1d6e63da7a10cbcd452af

    SHA256

    2fb3d80e4efe9e3a5e42a1462d721595f8b7b0a7e4650d80d25baa2cedff496b

    SHA512

    e19b2ffed139a73ab0115a1545f29877442a9b0f7b32a7720654ff0c1d2aff76b0a35a6d25ac01a735e47ebdbf533e01afccc60b4432dd4399b3d3b5a5052dac

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    a3fcb8b43996748c92f0d234d3f7bdcf

    SHA1

    37976c48476f459a03cc012c268f1ef348ef469e

    SHA256

    4f9ee66011ae8123e5bcc915333f2bc2e8fe68240c88495325a1120e8477176d

    SHA512

    5985beaf8937891d1085b0fc675ad622142cca149b6bcbceec4aeee62771d8860b0b6b2c4063dca3cf978a4dac265293511a69e5bfe0b8381748a68e0ff4c13b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    dc1d6104973636be779beb2aead94dab

    SHA1

    29d282504272e50dbec1d6e63da7a10cbcd452af

    SHA256

    2fb3d80e4efe9e3a5e42a1462d721595f8b7b0a7e4650d80d25baa2cedff496b

    SHA512

    e19b2ffed139a73ab0115a1545f29877442a9b0f7b32a7720654ff0c1d2aff76b0a35a6d25ac01a735e47ebdbf533e01afccc60b4432dd4399b3d3b5a5052dac

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    a3fcb8b43996748c92f0d234d3f7bdcf

    SHA1

    37976c48476f459a03cc012c268f1ef348ef469e

    SHA256

    4f9ee66011ae8123e5bcc915333f2bc2e8fe68240c88495325a1120e8477176d

    SHA512

    5985beaf8937891d1085b0fc675ad622142cca149b6bcbceec4aeee62771d8860b0b6b2c4063dca3cf978a4dac265293511a69e5bfe0b8381748a68e0ff4c13b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    dc1d6104973636be779beb2aead94dab

    SHA1

    29d282504272e50dbec1d6e63da7a10cbcd452af

    SHA256

    2fb3d80e4efe9e3a5e42a1462d721595f8b7b0a7e4650d80d25baa2cedff496b

    SHA512

    e19b2ffed139a73ab0115a1545f29877442a9b0f7b32a7720654ff0c1d2aff76b0a35a6d25ac01a735e47ebdbf533e01afccc60b4432dd4399b3d3b5a5052dac

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    a3fcb8b43996748c92f0d234d3f7bdcf

    SHA1

    37976c48476f459a03cc012c268f1ef348ef469e

    SHA256

    4f9ee66011ae8123e5bcc915333f2bc2e8fe68240c88495325a1120e8477176d

    SHA512

    5985beaf8937891d1085b0fc675ad622142cca149b6bcbceec4aeee62771d8860b0b6b2c4063dca3cf978a4dac265293511a69e5bfe0b8381748a68e0ff4c13b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    dc1d6104973636be779beb2aead94dab

    SHA1

    29d282504272e50dbec1d6e63da7a10cbcd452af

    SHA256

    2fb3d80e4efe9e3a5e42a1462d721595f8b7b0a7e4650d80d25baa2cedff496b

    SHA512

    e19b2ffed139a73ab0115a1545f29877442a9b0f7b32a7720654ff0c1d2aff76b0a35a6d25ac01a735e47ebdbf533e01afccc60b4432dd4399b3d3b5a5052dac

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    a3fcb8b43996748c92f0d234d3f7bdcf

    SHA1

    37976c48476f459a03cc012c268f1ef348ef469e

    SHA256

    4f9ee66011ae8123e5bcc915333f2bc2e8fe68240c88495325a1120e8477176d

    SHA512

    5985beaf8937891d1085b0fc675ad622142cca149b6bcbceec4aeee62771d8860b0b6b2c4063dca3cf978a4dac265293511a69e5bfe0b8381748a68e0ff4c13b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    dc1d6104973636be779beb2aead94dab

    SHA1

    29d282504272e50dbec1d6e63da7a10cbcd452af

    SHA256

    2fb3d80e4efe9e3a5e42a1462d721595f8b7b0a7e4650d80d25baa2cedff496b

    SHA512

    e19b2ffed139a73ab0115a1545f29877442a9b0f7b32a7720654ff0c1d2aff76b0a35a6d25ac01a735e47ebdbf533e01afccc60b4432dd4399b3d3b5a5052dac

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    a3fcb8b43996748c92f0d234d3f7bdcf

    SHA1

    37976c48476f459a03cc012c268f1ef348ef469e

    SHA256

    4f9ee66011ae8123e5bcc915333f2bc2e8fe68240c88495325a1120e8477176d

    SHA512

    5985beaf8937891d1085b0fc675ad622142cca149b6bcbceec4aeee62771d8860b0b6b2c4063dca3cf978a4dac265293511a69e5bfe0b8381748a68e0ff4c13b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    dc1d6104973636be779beb2aead94dab

    SHA1

    29d282504272e50dbec1d6e63da7a10cbcd452af

    SHA256

    2fb3d80e4efe9e3a5e42a1462d721595f8b7b0a7e4650d80d25baa2cedff496b

    SHA512

    e19b2ffed139a73ab0115a1545f29877442a9b0f7b32a7720654ff0c1d2aff76b0a35a6d25ac01a735e47ebdbf533e01afccc60b4432dd4399b3d3b5a5052dac

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    a3fcb8b43996748c92f0d234d3f7bdcf

    SHA1

    37976c48476f459a03cc012c268f1ef348ef469e

    SHA256

    4f9ee66011ae8123e5bcc915333f2bc2e8fe68240c88495325a1120e8477176d

    SHA512

    5985beaf8937891d1085b0fc675ad622142cca149b6bcbceec4aeee62771d8860b0b6b2c4063dca3cf978a4dac265293511a69e5bfe0b8381748a68e0ff4c13b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    dc1d6104973636be779beb2aead94dab

    SHA1

    29d282504272e50dbec1d6e63da7a10cbcd452af

    SHA256

    2fb3d80e4efe9e3a5e42a1462d721595f8b7b0a7e4650d80d25baa2cedff496b

    SHA512

    e19b2ffed139a73ab0115a1545f29877442a9b0f7b32a7720654ff0c1d2aff76b0a35a6d25ac01a735e47ebdbf533e01afccc60b4432dd4399b3d3b5a5052dac

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    a3fcb8b43996748c92f0d234d3f7bdcf

    SHA1

    37976c48476f459a03cc012c268f1ef348ef469e

    SHA256

    4f9ee66011ae8123e5bcc915333f2bc2e8fe68240c88495325a1120e8477176d

    SHA512

    5985beaf8937891d1085b0fc675ad622142cca149b6bcbceec4aeee62771d8860b0b6b2c4063dca3cf978a4dac265293511a69e5bfe0b8381748a68e0ff4c13b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    a3fcb8b43996748c92f0d234d3f7bdcf

    SHA1

    37976c48476f459a03cc012c268f1ef348ef469e

    SHA256

    4f9ee66011ae8123e5bcc915333f2bc2e8fe68240c88495325a1120e8477176d

    SHA512

    5985beaf8937891d1085b0fc675ad622142cca149b6bcbceec4aeee62771d8860b0b6b2c4063dca3cf978a4dac265293511a69e5bfe0b8381748a68e0ff4c13b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    dc1d6104973636be779beb2aead94dab

    SHA1

    29d282504272e50dbec1d6e63da7a10cbcd452af

    SHA256

    2fb3d80e4efe9e3a5e42a1462d721595f8b7b0a7e4650d80d25baa2cedff496b

    SHA512

    e19b2ffed139a73ab0115a1545f29877442a9b0f7b32a7720654ff0c1d2aff76b0a35a6d25ac01a735e47ebdbf533e01afccc60b4432dd4399b3d3b5a5052dac

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    a3fcb8b43996748c92f0d234d3f7bdcf

    SHA1

    37976c48476f459a03cc012c268f1ef348ef469e

    SHA256

    4f9ee66011ae8123e5bcc915333f2bc2e8fe68240c88495325a1120e8477176d

    SHA512

    5985beaf8937891d1085b0fc675ad622142cca149b6bcbceec4aeee62771d8860b0b6b2c4063dca3cf978a4dac265293511a69e5bfe0b8381748a68e0ff4c13b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
    MD5

    dc1d6104973636be779beb2aead94dab

    SHA1

    29d282504272e50dbec1d6e63da7a10cbcd452af

    SHA256

    2fb3d80e4efe9e3a5e42a1462d721595f8b7b0a7e4650d80d25baa2cedff496b

    SHA512

    e19b2ffed139a73ab0115a1545f29877442a9b0f7b32a7720654ff0c1d2aff76b0a35a6d25ac01a735e47ebdbf533e01afccc60b4432dd4399b3d3b5a5052dac

  • C:\Windows\SysWOW64\HelpMe.exe
    MD5

    8e2fc50e1ac00645c652f97b8034e76e

    SHA1

    d351b9972a6c6ca730ce5626344bc4ce2c8ed623

    SHA256

    b1e1388f0724306ddea90e937e8bc7076d7969d823118c2f4de940d7e2bffe0f

    SHA512

    65072e20b10afa2073e0d1360fbb70e4ecedd19da452edcaaad398eaba3314e3705ff78e9a6511f606a18371939600aeaec44fc1f8440c536a8355ae2e308297

  • C:\Windows\SysWOW64\HelpMe.exe
    MD5

    8e2fc50e1ac00645c652f97b8034e76e

    SHA1

    d351b9972a6c6ca730ce5626344bc4ce2c8ed623

    SHA256

    b1e1388f0724306ddea90e937e8bc7076d7969d823118c2f4de940d7e2bffe0f

    SHA512

    65072e20b10afa2073e0d1360fbb70e4ecedd19da452edcaaad398eaba3314e3705ff78e9a6511f606a18371939600aeaec44fc1f8440c536a8355ae2e308297

  • memory/1368-2-0x0000000000000000-mapping.dmp
  • memory/1368-6-0x00000000006D0000-0x00000000006D1000-memory.dmp
    Filesize

    4KB

  • memory/2752-12-0x0000000000500000-0x0000000000501000-memory.dmp
    Filesize

    4KB

  • memory/2752-7-0x0000000000000000-mapping.dmp
  • memory/3928-5-0x0000000000530000-0x0000000000531000-memory.dmp
    Filesize

    4KB

  • memory/3928-10-0x0000000002A00000-0x0000000002A01000-memory.dmp
    Filesize

    4KB

  • memory/3928-11-0x0000000003200000-0x0000000003201000-memory.dmp
    Filesize

    4KB