7ca09295652584ac4c0faa24f99df42823474f189e18a8449e6989d14d0cd8f4

Analysis

max time kernel
146s
max time network
136s
platform
windows10_x64
resource
win10v20210410
submitted
05-05-2021 02:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ca09295652584ac4c0faa24f99df42823474f189e18a8449e6989d14d0cd8f4.exe
Size

3.9MB
MD5

d69ccb7305f3c44c9671c24f8c1a2fff
SHA1

9b01a127dc6d424dcd746bd63c23868c66b302bf
SHA256

7ca09295652584ac4c0faa24f99df42823474f189e18a8449e6989d14d0cd8f4
SHA512

54e8b26abf78a9cb06800c883ad51743a0acdc611221271848fd02a70e2f7c9d6deaa73456bf00591eae76aa1c0bb4b44cc6a90595ed4aa48620ced0b44dd608

Score

10^/10

aspackv2 persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

7ca09295652584ac4c0faa24f99df42823474f189e18a8449e6989d14d0cd8f4.exeHelpMe.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	7ca09295652584ac4c0faa24f99df42823474f189e18a8449e6989d14d0cd8f4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe

ASPack v2.12-2.42 4 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Windows\SysWOW64\HelpMe.exe	aspack_v212_v242
C:\Windows\SysWOW64\HelpMe.exe	aspack_v212_v242
C:\$Recycle.Bin\S-1-5-21-3686645723-710336880-414668232-1000\desktop.ini.exe	aspack_v212_v242
C:\AutoRun.exe	aspack_v212_v242

Executes dropped EXE 1 IoCs

Processes:

HelpMe.exe

pid process

808 HelpMe.exe

pid	process
808	HelpMe.exe

Drops startup file 3 IoCs

Processes:

HelpMe.exe7ca09295652584ac4c0faa24f99df42823474f189e18a8449e6989d14d0cd8f4.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	7ca09295652584ac4c0faa24f99df42823474f189e18a8449e6989d14d0cd8f4.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	7ca09295652584ac4c0faa24f99df42823474f189e18a8449e6989d14d0cd8f4.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

HelpMe.exe7ca09295652584ac4c0faa24f99df42823474f189e18a8449e6989d14d0cd8f4.exe

description	ioc	process
File opened (read-only)	\??\F:	HelpMe.exe
File opened (read-only)	\??\E:	7ca09295652584ac4c0faa24f99df42823474f189e18a8449e6989d14d0cd8f4.exe
File opened (read-only)	\??\S:	7ca09295652584ac4c0faa24f99df42823474f189e18a8449e6989d14d0cd8f4.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\L:	7ca09295652584ac4c0faa24f99df42823474f189e18a8449e6989d14d0cd8f4.exe
File opened (read-only)	\??\X:	7ca09295652584ac4c0faa24f99df42823474f189e18a8449e6989d14d0cd8f4.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\A:	7ca09295652584ac4c0faa24f99df42823474f189e18a8449e6989d14d0cd8f4.exe
File opened (read-only)	\??\K:	7ca09295652584ac4c0faa24f99df42823474f189e18a8449e6989d14d0cd8f4.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\G:	7ca09295652584ac4c0faa24f99df42823474f189e18a8449e6989d14d0cd8f4.exe
File opened (read-only)	\??\V:	7ca09295652584ac4c0faa24f99df42823474f189e18a8449e6989d14d0cd8f4.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\P:	7ca09295652584ac4c0faa24f99df42823474f189e18a8449e6989d14d0cd8f4.exe
File opened (read-only)	\??\Q:	7ca09295652584ac4c0faa24f99df42823474f189e18a8449e6989d14d0cd8f4.exe
File opened (read-only)	\??\U:	7ca09295652584ac4c0faa24f99df42823474f189e18a8449e6989d14d0cd8f4.exe
File opened (read-only)	\??\W:	7ca09295652584ac4c0faa24f99df42823474f189e18a8449e6989d14d0cd8f4.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\I:	7ca09295652584ac4c0faa24f99df42823474f189e18a8449e6989d14d0cd8f4.exe
File opened (read-only)	\??\J:	7ca09295652584ac4c0faa24f99df42823474f189e18a8449e6989d14d0cd8f4.exe
File opened (read-only)	\??\N:	7ca09295652584ac4c0faa24f99df42823474f189e18a8449e6989d14d0cd8f4.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\F:	7ca09295652584ac4c0faa24f99df42823474f189e18a8449e6989d14d0cd8f4.exe
File opened (read-only)	\??\E:	HelpMe.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\M:	7ca09295652584ac4c0faa24f99df42823474f189e18a8449e6989d14d0cd8f4.exe
File opened (read-only)	\??\O:	7ca09295652584ac4c0faa24f99df42823474f189e18a8449e6989d14d0cd8f4.exe
File opened (read-only)	\??\Z:	7ca09295652584ac4c0faa24f99df42823474f189e18a8449e6989d14d0cd8f4.exe
File opened (read-only)	\??\T:	7ca09295652584ac4c0faa24f99df42823474f189e18a8449e6989d14d0cd8f4.exe
File opened (read-only)	\??\Y:	7ca09295652584ac4c0faa24f99df42823474f189e18a8449e6989d14d0cd8f4.exe
File opened (read-only)	\??\B:	7ca09295652584ac4c0faa24f99df42823474f189e18a8449e6989d14d0cd8f4.exe
File opened (read-only)	\??\H:	7ca09295652584ac4c0faa24f99df42823474f189e18a8449e6989d14d0cd8f4.exe
File opened (read-only)	\??\R:	7ca09295652584ac4c0faa24f99df42823474f189e18a8449e6989d14d0cd8f4.exe

Drops autorun.inf file 1 TTPs
Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media
T1091

Drops file in System32 directory 2 IoCs

Processes:

7ca09295652584ac4c0faa24f99df42823474f189e18a8449e6989d14d0cd8f4.exeHelpMe.exe

description	ioc	process
File created	C:\Windows\SysWOW64\HelpMe.exe	7ca09295652584ac4c0faa24f99df42823474f189e18a8449e6989d14d0cd8f4.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

7ca09295652584ac4c0faa24f99df42823474f189e18a8449e6989d14d0cd8f4.exe

description	pid	process	target process
PID 1844 wrote to memory of 808	1844	7ca09295652584ac4c0faa24f99df42823474f189e18a8449e6989d14d0cd8f4.exe	HelpMe.exe
PID 1844 wrote to memory of 808	1844	7ca09295652584ac4c0faa24f99df42823474f189e18a8449e6989d14d0cd8f4.exe	HelpMe.exe
PID 1844 wrote to memory of 808	1844	7ca09295652584ac4c0faa24f99df42823474f189e18a8449e6989d14d0cd8f4.exe	HelpMe.exe

C:\Users\Admin\AppData\Local\Temp\7ca09295652584ac4c0faa24f99df42823474f189e18a8449e6989d14d0cd8f4.exe
"C:\Users\Admin\AppData\Local\Temp\7ca09295652584ac4c0faa24f99df42823474f189e18a8449e6989d14d0cd8f4.exe"
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1844

C:\Windows\SysWOW64\HelpMe.exe
C:\Windows\system32\HelpMe.exe
2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops startup file
- Enumerates connected drives
- Drops file in System32 directory
PID:808

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3686645723-710336880-414668232-1000\desktop.ini.exe
MD5
9ac8b704b5a3e8a288950736c230d0fb

SHA1
73cd46215ef8768cc2733fe40fd6cff979736bdc

SHA256
f264ff729ec31220b0846285a39e3e3c2172c555c7e38c017ad4b07211474b37

SHA512
275b73b1c02602efeaa45ee168e55bb1ff1079bd698fc5e96b4bba301da34b8d6045984e5bef023f4fc6370a86a474fbedea48aa96dcba51660564b24beb4f05

Download Submit
C:\AutoRun.exe
MD5
d69ccb7305f3c44c9671c24f8c1a2fff

SHA1
9b01a127dc6d424dcd746bd63c23868c66b302bf

SHA256
7ca09295652584ac4c0faa24f99df42823474f189e18a8449e6989d14d0cd8f4

SHA512
54e8b26abf78a9cb06800c883ad51743a0acdc611221271848fd02a70e2f7c9d6deaa73456bf00591eae76aa1c0bb4b44cc6a90595ed4aa48620ced0b44dd608

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
a2ddcd9ce455438921342d10f684d9a1

SHA1
03a0e7d613d23d473af8c889a1975f07c1c726c5

SHA256
7e81bb70013e7e2bdaaeb3cc99d1b4e48cd42ec48762f97643d97f3d262831db

SHA512
818c8bad3ed646052a2299c362da3d7cba0ffeffefc1ee324d4b6684e021de5c64cc623e35ba452d22a396ae6d462cab2b13badb46bf00b938af77891d6d3fef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4997e3ab5dcddc626e5fc8918a73c4db

SHA1
077fa5b9b7761dfc7c268e7a19904eda8182a2b3

SHA256
f3038e93db9f070380fa547b60608ea70c04ad89ca2991b43f9299ffc80204d5

SHA512
7922cb65a8e8397bd7e10b5c57b81e3d0d77b7ed219c23ff6ebb0b1a38111a6f3bcc2392f45ade93371e8870be8be9aac6eebd958836d7e3d8e20ab0e21b51f5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
a2ddcd9ce455438921342d10f684d9a1

SHA1
03a0e7d613d23d473af8c889a1975f07c1c726c5

SHA256
7e81bb70013e7e2bdaaeb3cc99d1b4e48cd42ec48762f97643d97f3d262831db

SHA512
818c8bad3ed646052a2299c362da3d7cba0ffeffefc1ee324d4b6684e021de5c64cc623e35ba452d22a396ae6d462cab2b13badb46bf00b938af77891d6d3fef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4997e3ab5dcddc626e5fc8918a73c4db

SHA1
077fa5b9b7761dfc7c268e7a19904eda8182a2b3

SHA256
f3038e93db9f070380fa547b60608ea70c04ad89ca2991b43f9299ffc80204d5

SHA512
7922cb65a8e8397bd7e10b5c57b81e3d0d77b7ed219c23ff6ebb0b1a38111a6f3bcc2392f45ade93371e8870be8be9aac6eebd958836d7e3d8e20ab0e21b51f5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
a2ddcd9ce455438921342d10f684d9a1

SHA1
03a0e7d613d23d473af8c889a1975f07c1c726c5

SHA256
7e81bb70013e7e2bdaaeb3cc99d1b4e48cd42ec48762f97643d97f3d262831db

SHA512
818c8bad3ed646052a2299c362da3d7cba0ffeffefc1ee324d4b6684e021de5c64cc623e35ba452d22a396ae6d462cab2b13badb46bf00b938af77891d6d3fef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4997e3ab5dcddc626e5fc8918a73c4db

SHA1
077fa5b9b7761dfc7c268e7a19904eda8182a2b3

SHA256
f3038e93db9f070380fa547b60608ea70c04ad89ca2991b43f9299ffc80204d5

SHA512
7922cb65a8e8397bd7e10b5c57b81e3d0d77b7ed219c23ff6ebb0b1a38111a6f3bcc2392f45ade93371e8870be8be9aac6eebd958836d7e3d8e20ab0e21b51f5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
a2ddcd9ce455438921342d10f684d9a1

SHA1
03a0e7d613d23d473af8c889a1975f07c1c726c5

SHA256
7e81bb70013e7e2bdaaeb3cc99d1b4e48cd42ec48762f97643d97f3d262831db

SHA512
818c8bad3ed646052a2299c362da3d7cba0ffeffefc1ee324d4b6684e021de5c64cc623e35ba452d22a396ae6d462cab2b13badb46bf00b938af77891d6d3fef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4997e3ab5dcddc626e5fc8918a73c4db

SHA1
077fa5b9b7761dfc7c268e7a19904eda8182a2b3

SHA256
f3038e93db9f070380fa547b60608ea70c04ad89ca2991b43f9299ffc80204d5

SHA512
7922cb65a8e8397bd7e10b5c57b81e3d0d77b7ed219c23ff6ebb0b1a38111a6f3bcc2392f45ade93371e8870be8be9aac6eebd958836d7e3d8e20ab0e21b51f5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4997e3ab5dcddc626e5fc8918a73c4db

SHA1
077fa5b9b7761dfc7c268e7a19904eda8182a2b3

SHA256
f3038e93db9f070380fa547b60608ea70c04ad89ca2991b43f9299ffc80204d5

SHA512
7922cb65a8e8397bd7e10b5c57b81e3d0d77b7ed219c23ff6ebb0b1a38111a6f3bcc2392f45ade93371e8870be8be9aac6eebd958836d7e3d8e20ab0e21b51f5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
a2ddcd9ce455438921342d10f684d9a1

SHA1
03a0e7d613d23d473af8c889a1975f07c1c726c5

SHA256
7e81bb70013e7e2bdaaeb3cc99d1b4e48cd42ec48762f97643d97f3d262831db

SHA512
818c8bad3ed646052a2299c362da3d7cba0ffeffefc1ee324d4b6684e021de5c64cc623e35ba452d22a396ae6d462cab2b13badb46bf00b938af77891d6d3fef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4997e3ab5dcddc626e5fc8918a73c4db

SHA1
077fa5b9b7761dfc7c268e7a19904eda8182a2b3

SHA256
f3038e93db9f070380fa547b60608ea70c04ad89ca2991b43f9299ffc80204d5

SHA512
7922cb65a8e8397bd7e10b5c57b81e3d0d77b7ed219c23ff6ebb0b1a38111a6f3bcc2392f45ade93371e8870be8be9aac6eebd958836d7e3d8e20ab0e21b51f5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
a2ddcd9ce455438921342d10f684d9a1

SHA1
03a0e7d613d23d473af8c889a1975f07c1c726c5

SHA256
7e81bb70013e7e2bdaaeb3cc99d1b4e48cd42ec48762f97643d97f3d262831db

SHA512
818c8bad3ed646052a2299c362da3d7cba0ffeffefc1ee324d4b6684e021de5c64cc623e35ba452d22a396ae6d462cab2b13badb46bf00b938af77891d6d3fef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4997e3ab5dcddc626e5fc8918a73c4db

SHA1
077fa5b9b7761dfc7c268e7a19904eda8182a2b3

SHA256
f3038e93db9f070380fa547b60608ea70c04ad89ca2991b43f9299ffc80204d5

SHA512
7922cb65a8e8397bd7e10b5c57b81e3d0d77b7ed219c23ff6ebb0b1a38111a6f3bcc2392f45ade93371e8870be8be9aac6eebd958836d7e3d8e20ab0e21b51f5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
a2ddcd9ce455438921342d10f684d9a1

SHA1
03a0e7d613d23d473af8c889a1975f07c1c726c5

SHA256
7e81bb70013e7e2bdaaeb3cc99d1b4e48cd42ec48762f97643d97f3d262831db

SHA512
818c8bad3ed646052a2299c362da3d7cba0ffeffefc1ee324d4b6684e021de5c64cc623e35ba452d22a396ae6d462cab2b13badb46bf00b938af77891d6d3fef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4997e3ab5dcddc626e5fc8918a73c4db

SHA1
077fa5b9b7761dfc7c268e7a19904eda8182a2b3

SHA256
f3038e93db9f070380fa547b60608ea70c04ad89ca2991b43f9299ffc80204d5

SHA512
7922cb65a8e8397bd7e10b5c57b81e3d0d77b7ed219c23ff6ebb0b1a38111a6f3bcc2392f45ade93371e8870be8be9aac6eebd958836d7e3d8e20ab0e21b51f5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
a2ddcd9ce455438921342d10f684d9a1

SHA1
03a0e7d613d23d473af8c889a1975f07c1c726c5

SHA256
7e81bb70013e7e2bdaaeb3cc99d1b4e48cd42ec48762f97643d97f3d262831db

SHA512
818c8bad3ed646052a2299c362da3d7cba0ffeffefc1ee324d4b6684e021de5c64cc623e35ba452d22a396ae6d462cab2b13badb46bf00b938af77891d6d3fef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4997e3ab5dcddc626e5fc8918a73c4db

SHA1
077fa5b9b7761dfc7c268e7a19904eda8182a2b3

SHA256
f3038e93db9f070380fa547b60608ea70c04ad89ca2991b43f9299ffc80204d5

SHA512
7922cb65a8e8397bd7e10b5c57b81e3d0d77b7ed219c23ff6ebb0b1a38111a6f3bcc2392f45ade93371e8870be8be9aac6eebd958836d7e3d8e20ab0e21b51f5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
a2ddcd9ce455438921342d10f684d9a1

SHA1
03a0e7d613d23d473af8c889a1975f07c1c726c5

SHA256
7e81bb70013e7e2bdaaeb3cc99d1b4e48cd42ec48762f97643d97f3d262831db

SHA512
818c8bad3ed646052a2299c362da3d7cba0ffeffefc1ee324d4b6684e021de5c64cc623e35ba452d22a396ae6d462cab2b13badb46bf00b938af77891d6d3fef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4997e3ab5dcddc626e5fc8918a73c4db

SHA1
077fa5b9b7761dfc7c268e7a19904eda8182a2b3

SHA256
f3038e93db9f070380fa547b60608ea70c04ad89ca2991b43f9299ffc80204d5

SHA512
7922cb65a8e8397bd7e10b5c57b81e3d0d77b7ed219c23ff6ebb0b1a38111a6f3bcc2392f45ade93371e8870be8be9aac6eebd958836d7e3d8e20ab0e21b51f5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
a2ddcd9ce455438921342d10f684d9a1

SHA1
03a0e7d613d23d473af8c889a1975f07c1c726c5

SHA256
7e81bb70013e7e2bdaaeb3cc99d1b4e48cd42ec48762f97643d97f3d262831db

SHA512
818c8bad3ed646052a2299c362da3d7cba0ffeffefc1ee324d4b6684e021de5c64cc623e35ba452d22a396ae6d462cab2b13badb46bf00b938af77891d6d3fef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4997e3ab5dcddc626e5fc8918a73c4db

SHA1
077fa5b9b7761dfc7c268e7a19904eda8182a2b3

SHA256
f3038e93db9f070380fa547b60608ea70c04ad89ca2991b43f9299ffc80204d5

SHA512
7922cb65a8e8397bd7e10b5c57b81e3d0d77b7ed219c23ff6ebb0b1a38111a6f3bcc2392f45ade93371e8870be8be9aac6eebd958836d7e3d8e20ab0e21b51f5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4997e3ab5dcddc626e5fc8918a73c4db

SHA1
077fa5b9b7761dfc7c268e7a19904eda8182a2b3

SHA256
f3038e93db9f070380fa547b60608ea70c04ad89ca2991b43f9299ffc80204d5

SHA512
7922cb65a8e8397bd7e10b5c57b81e3d0d77b7ed219c23ff6ebb0b1a38111a6f3bcc2392f45ade93371e8870be8be9aac6eebd958836d7e3d8e20ab0e21b51f5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
a2ddcd9ce455438921342d10f684d9a1

SHA1
03a0e7d613d23d473af8c889a1975f07c1c726c5

SHA256
7e81bb70013e7e2bdaaeb3cc99d1b4e48cd42ec48762f97643d97f3d262831db

SHA512
818c8bad3ed646052a2299c362da3d7cba0ffeffefc1ee324d4b6684e021de5c64cc623e35ba452d22a396ae6d462cab2b13badb46bf00b938af77891d6d3fef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4997e3ab5dcddc626e5fc8918a73c4db

SHA1
077fa5b9b7761dfc7c268e7a19904eda8182a2b3

SHA256
f3038e93db9f070380fa547b60608ea70c04ad89ca2991b43f9299ffc80204d5

SHA512
7922cb65a8e8397bd7e10b5c57b81e3d0d77b7ed219c23ff6ebb0b1a38111a6f3bcc2392f45ade93371e8870be8be9aac6eebd958836d7e3d8e20ab0e21b51f5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
a2ddcd9ce455438921342d10f684d9a1

SHA1
03a0e7d613d23d473af8c889a1975f07c1c726c5

SHA256
7e81bb70013e7e2bdaaeb3cc99d1b4e48cd42ec48762f97643d97f3d262831db

SHA512
818c8bad3ed646052a2299c362da3d7cba0ffeffefc1ee324d4b6684e021de5c64cc623e35ba452d22a396ae6d462cab2b13badb46bf00b938af77891d6d3fef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4997e3ab5dcddc626e5fc8918a73c4db

SHA1
077fa5b9b7761dfc7c268e7a19904eda8182a2b3

SHA256
f3038e93db9f070380fa547b60608ea70c04ad89ca2991b43f9299ffc80204d5

SHA512
7922cb65a8e8397bd7e10b5c57b81e3d0d77b7ed219c23ff6ebb0b1a38111a6f3bcc2392f45ade93371e8870be8be9aac6eebd958836d7e3d8e20ab0e21b51f5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
a2ddcd9ce455438921342d10f684d9a1

SHA1
03a0e7d613d23d473af8c889a1975f07c1c726c5

SHA256
7e81bb70013e7e2bdaaeb3cc99d1b4e48cd42ec48762f97643d97f3d262831db

SHA512
818c8bad3ed646052a2299c362da3d7cba0ffeffefc1ee324d4b6684e021de5c64cc623e35ba452d22a396ae6d462cab2b13badb46bf00b938af77891d6d3fef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4997e3ab5dcddc626e5fc8918a73c4db

SHA1
077fa5b9b7761dfc7c268e7a19904eda8182a2b3

SHA256
f3038e93db9f070380fa547b60608ea70c04ad89ca2991b43f9299ffc80204d5

SHA512
7922cb65a8e8397bd7e10b5c57b81e3d0d77b7ed219c23ff6ebb0b1a38111a6f3bcc2392f45ade93371e8870be8be9aac6eebd958836d7e3d8e20ab0e21b51f5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
a2ddcd9ce455438921342d10f684d9a1

SHA1
03a0e7d613d23d473af8c889a1975f07c1c726c5

SHA256
7e81bb70013e7e2bdaaeb3cc99d1b4e48cd42ec48762f97643d97f3d262831db

SHA512
818c8bad3ed646052a2299c362da3d7cba0ffeffefc1ee324d4b6684e021de5c64cc623e35ba452d22a396ae6d462cab2b13badb46bf00b938af77891d6d3fef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4997e3ab5dcddc626e5fc8918a73c4db

SHA1
077fa5b9b7761dfc7c268e7a19904eda8182a2b3

SHA256
f3038e93db9f070380fa547b60608ea70c04ad89ca2991b43f9299ffc80204d5

SHA512
7922cb65a8e8397bd7e10b5c57b81e3d0d77b7ed219c23ff6ebb0b1a38111a6f3bcc2392f45ade93371e8870be8be9aac6eebd958836d7e3d8e20ab0e21b51f5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
a2ddcd9ce455438921342d10f684d9a1

SHA1
03a0e7d613d23d473af8c889a1975f07c1c726c5

SHA256
7e81bb70013e7e2bdaaeb3cc99d1b4e48cd42ec48762f97643d97f3d262831db

SHA512
818c8bad3ed646052a2299c362da3d7cba0ffeffefc1ee324d4b6684e021de5c64cc623e35ba452d22a396ae6d462cab2b13badb46bf00b938af77891d6d3fef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4997e3ab5dcddc626e5fc8918a73c4db

SHA1
077fa5b9b7761dfc7c268e7a19904eda8182a2b3

SHA256
f3038e93db9f070380fa547b60608ea70c04ad89ca2991b43f9299ffc80204d5

SHA512
7922cb65a8e8397bd7e10b5c57b81e3d0d77b7ed219c23ff6ebb0b1a38111a6f3bcc2392f45ade93371e8870be8be9aac6eebd958836d7e3d8e20ab0e21b51f5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
a2ddcd9ce455438921342d10f684d9a1

SHA1
03a0e7d613d23d473af8c889a1975f07c1c726c5

SHA256
7e81bb70013e7e2bdaaeb3cc99d1b4e48cd42ec48762f97643d97f3d262831db

SHA512
818c8bad3ed646052a2299c362da3d7cba0ffeffefc1ee324d4b6684e021de5c64cc623e35ba452d22a396ae6d462cab2b13badb46bf00b938af77891d6d3fef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4997e3ab5dcddc626e5fc8918a73c4db

SHA1
077fa5b9b7761dfc7c268e7a19904eda8182a2b3

SHA256
f3038e93db9f070380fa547b60608ea70c04ad89ca2991b43f9299ffc80204d5

SHA512
7922cb65a8e8397bd7e10b5c57b81e3d0d77b7ed219c23ff6ebb0b1a38111a6f3bcc2392f45ade93371e8870be8be9aac6eebd958836d7e3d8e20ab0e21b51f5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4997e3ab5dcddc626e5fc8918a73c4db

SHA1
077fa5b9b7761dfc7c268e7a19904eda8182a2b3

SHA256
f3038e93db9f070380fa547b60608ea70c04ad89ca2991b43f9299ffc80204d5

SHA512
7922cb65a8e8397bd7e10b5c57b81e3d0d77b7ed219c23ff6ebb0b1a38111a6f3bcc2392f45ade93371e8870be8be9aac6eebd958836d7e3d8e20ab0e21b51f5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4997e3ab5dcddc626e5fc8918a73c4db

SHA1
077fa5b9b7761dfc7c268e7a19904eda8182a2b3

SHA256
f3038e93db9f070380fa547b60608ea70c04ad89ca2991b43f9299ffc80204d5

SHA512
7922cb65a8e8397bd7e10b5c57b81e3d0d77b7ed219c23ff6ebb0b1a38111a6f3bcc2392f45ade93371e8870be8be9aac6eebd958836d7e3d8e20ab0e21b51f5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
a2ddcd9ce455438921342d10f684d9a1

SHA1
03a0e7d613d23d473af8c889a1975f07c1c726c5

SHA256
7e81bb70013e7e2bdaaeb3cc99d1b4e48cd42ec48762f97643d97f3d262831db

SHA512
818c8bad3ed646052a2299c362da3d7cba0ffeffefc1ee324d4b6684e021de5c64cc623e35ba452d22a396ae6d462cab2b13badb46bf00b938af77891d6d3fef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4997e3ab5dcddc626e5fc8918a73c4db

SHA1
077fa5b9b7761dfc7c268e7a19904eda8182a2b3

SHA256
f3038e93db9f070380fa547b60608ea70c04ad89ca2991b43f9299ffc80204d5

SHA512
7922cb65a8e8397bd7e10b5c57b81e3d0d77b7ed219c23ff6ebb0b1a38111a6f3bcc2392f45ade93371e8870be8be9aac6eebd958836d7e3d8e20ab0e21b51f5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
a2ddcd9ce455438921342d10f684d9a1

SHA1
03a0e7d613d23d473af8c889a1975f07c1c726c5

SHA256
7e81bb70013e7e2bdaaeb3cc99d1b4e48cd42ec48762f97643d97f3d262831db

SHA512
818c8bad3ed646052a2299c362da3d7cba0ffeffefc1ee324d4b6684e021de5c64cc623e35ba452d22a396ae6d462cab2b13badb46bf00b938af77891d6d3fef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4997e3ab5dcddc626e5fc8918a73c4db

SHA1
077fa5b9b7761dfc7c268e7a19904eda8182a2b3

SHA256
f3038e93db9f070380fa547b60608ea70c04ad89ca2991b43f9299ffc80204d5

SHA512
7922cb65a8e8397bd7e10b5c57b81e3d0d77b7ed219c23ff6ebb0b1a38111a6f3bcc2392f45ade93371e8870be8be9aac6eebd958836d7e3d8e20ab0e21b51f5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
a2ddcd9ce455438921342d10f684d9a1

SHA1
03a0e7d613d23d473af8c889a1975f07c1c726c5

SHA256
7e81bb70013e7e2bdaaeb3cc99d1b4e48cd42ec48762f97643d97f3d262831db

SHA512
818c8bad3ed646052a2299c362da3d7cba0ffeffefc1ee324d4b6684e021de5c64cc623e35ba452d22a396ae6d462cab2b13badb46bf00b938af77891d6d3fef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4997e3ab5dcddc626e5fc8918a73c4db

SHA1
077fa5b9b7761dfc7c268e7a19904eda8182a2b3

SHA256
f3038e93db9f070380fa547b60608ea70c04ad89ca2991b43f9299ffc80204d5

SHA512
7922cb65a8e8397bd7e10b5c57b81e3d0d77b7ed219c23ff6ebb0b1a38111a6f3bcc2392f45ade93371e8870be8be9aac6eebd958836d7e3d8e20ab0e21b51f5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
a2ddcd9ce455438921342d10f684d9a1

SHA1
03a0e7d613d23d473af8c889a1975f07c1c726c5

SHA256
7e81bb70013e7e2bdaaeb3cc99d1b4e48cd42ec48762f97643d97f3d262831db

SHA512
818c8bad3ed646052a2299c362da3d7cba0ffeffefc1ee324d4b6684e021de5c64cc623e35ba452d22a396ae6d462cab2b13badb46bf00b938af77891d6d3fef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4997e3ab5dcddc626e5fc8918a73c4db

SHA1
077fa5b9b7761dfc7c268e7a19904eda8182a2b3

SHA256
f3038e93db9f070380fa547b60608ea70c04ad89ca2991b43f9299ffc80204d5

SHA512
7922cb65a8e8397bd7e10b5c57b81e3d0d77b7ed219c23ff6ebb0b1a38111a6f3bcc2392f45ade93371e8870be8be9aac6eebd958836d7e3d8e20ab0e21b51f5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
a2ddcd9ce455438921342d10f684d9a1

SHA1
03a0e7d613d23d473af8c889a1975f07c1c726c5

SHA256
7e81bb70013e7e2bdaaeb3cc99d1b4e48cd42ec48762f97643d97f3d262831db

SHA512
818c8bad3ed646052a2299c362da3d7cba0ffeffefc1ee324d4b6684e021de5c64cc623e35ba452d22a396ae6d462cab2b13badb46bf00b938af77891d6d3fef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4997e3ab5dcddc626e5fc8918a73c4db

SHA1
077fa5b9b7761dfc7c268e7a19904eda8182a2b3

SHA256
f3038e93db9f070380fa547b60608ea70c04ad89ca2991b43f9299ffc80204d5

SHA512
7922cb65a8e8397bd7e10b5c57b81e3d0d77b7ed219c23ff6ebb0b1a38111a6f3bcc2392f45ade93371e8870be8be9aac6eebd958836d7e3d8e20ab0e21b51f5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
a2ddcd9ce455438921342d10f684d9a1

SHA1
03a0e7d613d23d473af8c889a1975f07c1c726c5

SHA256
7e81bb70013e7e2bdaaeb3cc99d1b4e48cd42ec48762f97643d97f3d262831db

SHA512
818c8bad3ed646052a2299c362da3d7cba0ffeffefc1ee324d4b6684e021de5c64cc623e35ba452d22a396ae6d462cab2b13badb46bf00b938af77891d6d3fef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4997e3ab5dcddc626e5fc8918a73c4db

SHA1
077fa5b9b7761dfc7c268e7a19904eda8182a2b3

SHA256
f3038e93db9f070380fa547b60608ea70c04ad89ca2991b43f9299ffc80204d5

SHA512
7922cb65a8e8397bd7e10b5c57b81e3d0d77b7ed219c23ff6ebb0b1a38111a6f3bcc2392f45ade93371e8870be8be9aac6eebd958836d7e3d8e20ab0e21b51f5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
a2ddcd9ce455438921342d10f684d9a1

SHA1
03a0e7d613d23d473af8c889a1975f07c1c726c5

SHA256
7e81bb70013e7e2bdaaeb3cc99d1b4e48cd42ec48762f97643d97f3d262831db

SHA512
818c8bad3ed646052a2299c362da3d7cba0ffeffefc1ee324d4b6684e021de5c64cc623e35ba452d22a396ae6d462cab2b13badb46bf00b938af77891d6d3fef

Download Submit
C:\Windows\SysWOW64\HelpMe.exe
MD5
ec0def679ac3acd9dec7ae24ef49f264

SHA1
df6e64e8771a4d21297785a302d8f4343483278b

SHA256
f505d82b29f457000e1087c2a4c2da9f2328f8a7e0ced14aa9cd367e9cb80746

SHA512
1ed8425cd15c6c3eec01ab2374c1de1664aaf2ee1fe131749b1724241645bb33243885080816d9820c0af3959055927c2b6351391dcd0b93a3a4edb316adcb22

Download Submit
C:\Windows\SysWOW64\HelpMe.exe
MD5
ec0def679ac3acd9dec7ae24ef49f264

SHA1
df6e64e8771a4d21297785a302d8f4343483278b

SHA256
f505d82b29f457000e1087c2a4c2da9f2328f8a7e0ced14aa9cd367e9cb80746

SHA512
1ed8425cd15c6c3eec01ab2374c1de1664aaf2ee1fe131749b1724241645bb33243885080816d9820c0af3959055927c2b6351391dcd0b93a3a4edb316adcb22

Download Submit
memory/808-114-0x0000000000000000-mapping.dmp

Download
memory/808-118-0x0000000000590000-0x00000000006DA000-memory.dmp

Filesize
1.3MB

Download
memory/1844-117-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download