Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    163s
  • max time network
    171s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/05/2023, 02:52

General

  • Target

    2023-05-11_cf96dc24ccb78aa865d9569a28da9168_ryuk.exe

  • Size

    2.5MB

  • MD5

    cf96dc24ccb78aa865d9569a28da9168

  • SHA1

    c03b4338537fbf27aac2e0abbc26f27b9337e8b7

  • SHA256

    fcacdbc16d4a101aba2204a0bd7553f2102d435a339edbd2f1b699697a6ac7bd

  • SHA512

    263c7d8ba66605d9f5030f73a188d00039469092ea89fc5cd26412f089086adb9d187ec8f1ed0ae7961cb1c4cfdcf5162c77c2ebb0243e8c9fbe7101fe4badb5

  • SSDEEP

    12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCH:eEtl9mRda12sX7hKB8NIyXbacAfk

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Drops startup file 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2023-05-11_cf96dc24ccb78aa865d9569a28da9168_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2023-05-11_cf96dc24ccb78aa865d9569a28da9168_ryuk.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops startup file
    • Enumerates connected drives
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:4012
    • C:\Windows\SysWOW64\HelpMe.exe
      C:\Windows\system32\HelpMe.exe
      2⤵
      • Modifies WinLogon for persistence
      • Drops startup file
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops autorun.inf file
      • Drops file in System32 directory
      PID:3008

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-144354903-2550862337-1367551827-1000\desktop.ini.exe

    Filesize

    2.5MB

    MD5

    fc7d59610a7cf37201c183d60925177a

    SHA1

    0630c93f4540689a45efa75ce842cbf39bfbef46

    SHA256

    97fb9caa5d809893d7d46d860f63dec9e829e23feca8192c3129a72bd9627f2d

    SHA512

    ebcaf800410f6d59c3d90c0af6dfb1f7238a44cf6778e98a522101bfb2fa1ce703b816824f96f7c94e75d92b0b51b5fee3933661c1d479237c0eb179d98d8528

  • C:\$Recycle.Bin\S-1-5-21-144354903-2550862337-1367551827-1000\desktop.ini.exe

    Filesize

    2.5MB

    MD5

    fc7d59610a7cf37201c183d60925177a

    SHA1

    0630c93f4540689a45efa75ce842cbf39bfbef46

    SHA256

    97fb9caa5d809893d7d46d860f63dec9e829e23feca8192c3129a72bd9627f2d

    SHA512

    ebcaf800410f6d59c3d90c0af6dfb1f7238a44cf6778e98a522101bfb2fa1ce703b816824f96f7c94e75d92b0b51b5fee3933661c1d479237c0eb179d98d8528

  • C:\AUTORUN.INF

    Filesize

    145B

    MD5

    ca13857b2fd3895a39f09d9dde3cca97

    SHA1

    8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

    SHA256

    cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

    SHA512

    55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

  • C:\AutoRun.exe

    Filesize

    2.5MB

    MD5

    cf96dc24ccb78aa865d9569a28da9168

    SHA1

    c03b4338537fbf27aac2e0abbc26f27b9337e8b7

    SHA256

    fcacdbc16d4a101aba2204a0bd7553f2102d435a339edbd2f1b699697a6ac7bd

    SHA512

    263c7d8ba66605d9f5030f73a188d00039469092ea89fc5cd26412f089086adb9d187ec8f1ed0ae7961cb1c4cfdcf5162c77c2ebb0243e8c9fbe7101fe4badb5

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    1d457311d56e72d5d5b713f5b57934de

    SHA1

    4b82e01b138caa153ed59de0d88356abc7891956

    SHA256

    83ce83544606d7503583fbebc2ab6fbae158dc16fb5b21cc3f3ac68afcdb1eed

    SHA512

    64be3f915b58ddc407fc60b22c82b82959a96c77ed28f6b756940192f75bfc7f584a2d4bae8e9305bc3185da6b6680f66f782689a2c9ec6cd4fd2ff1be6aa870

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    412e82708614174c1fbb742f8119bf2a

    SHA1

    b2126e96f3fd80159df7f59ed0be175f7058a849

    SHA256

    3e78d8df39800dbafc7e6db9e85f759f4d8da29e123ab2fe6cc191582f0436e2

    SHA512

    bc2a49e49e388f71a13b5d4cd27a5c6bdca6d588d7d24e3d0865121835fe589f9a21e73c5d7b03229e8e7627b3ecc5c0d25e732c1ae769857426c63310a5d2c7

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    412e82708614174c1fbb742f8119bf2a

    SHA1

    b2126e96f3fd80159df7f59ed0be175f7058a849

    SHA256

    3e78d8df39800dbafc7e6db9e85f759f4d8da29e123ab2fe6cc191582f0436e2

    SHA512

    bc2a49e49e388f71a13b5d4cd27a5c6bdca6d588d7d24e3d0865121835fe589f9a21e73c5d7b03229e8e7627b3ecc5c0d25e732c1ae769857426c63310a5d2c7

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    47429b432b36821e9d37af0b401fcb32

    SHA1

    dd5e25bc1c3f1191e88d38f67cc222967e269af0

    SHA256

    5420da44d76d53e3d64c75334bc0880392c36396e56d094e0083723909dd3639

    SHA512

    d0ce730ca31a1c069f7ec6b2bdc5c1fe20477f9a5d8c64193c3a365687841c45f1461e124f54e6bdd655623d3f467f57b5a66f63e44eb0a9a84ec50f4dd16d89

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    54b23f65c49cd0f6bd73304c3ec662da

    SHA1

    5942554440c2b928043e70b96bf616d8f0ca749e

    SHA256

    7280b015b1164aea26c73cd428537fdb2da1dd43e379c140c4ea3fa612e5b017

    SHA512

    7a33700fb48638826e00e65e50cb9aff32d461edf7bdc56c518023029aee805b6abde53db1d1b731160b7af976f716d02cb0428e543c086e26a7b119037a34e5

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    0a8a8c78cd07e2ca0f608e4351fe539a

    SHA1

    49a01a106b5b23603385f4696c49b5b6629297d4

    SHA256

    3f86f1df62c21dbd0f186003f11b207a012478b933e486a4733dfd6eaaa53b09

    SHA512

    c58964a23e4625e8dbceb4668628eaf3ebedb62eb17215bdd08beabbb4ba9744f916c5b61f9f4d4a4519309fc77d6c71702e6a787fd49aeb08a1a1d40e888f83

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    7e0c7a65f6f95eb32ac8bfaea555810e

    SHA1

    292a3fdbe4fe85f9d9bd43ca0770b86eb85df765

    SHA256

    1b0f5142b7487f01a31dd0cd1c3facb9a9ae54bbc943c6ef615c2db38c182d1e

    SHA512

    74b2013d83e9291343ae955ee655b5f2b549ed861a86a9996d50046be78c67ff06cc9ad1d21a398331e0231da42676ec8a0fa1d9790a1b1be8b50893ff073221

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    99f2f0867b497b5de4130408c8faeb08

    SHA1

    09269782b12dd9459821f25eada3d34ac08c7003

    SHA256

    c3b56c325adb9873f91bd7da0b887e0e11d40a5fe293738fd052edaa179e2f9e

    SHA512

    3d100a8794393c61b591af3e4b63b076fb74fa7b21abe1b724db18eecc663c871aac78cbf3b1ce514344c2e0fd889c18d178e3b91890e02d3afb0e30deb2551c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    c7978d91e0ab5a8b4cf4a4af0783787f

    SHA1

    099cf9204ecea1e66f80327d821c94f0075c717d

    SHA256

    29dab16062497b5c3b38a3d72277101bbe26f23488d2aa6e7b86fccfebef8656

    SHA512

    ccf3bef751e49e4874166f432800dd1fc6135daa41650b8d055e255104eed04dd192b766bb0f4727581651b0827a6b6ed0390dcdcdc5f40591e973ab6bf81961

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    d8227cdeaff1381582781660ac6d20b6

    SHA1

    bd477f154946149326b43742dcba7c2be5e2a7ec

    SHA256

    d2083173656331eecadbd208c9a697a194b93e79bc55a8050fa9cdf5f522ead3

    SHA512

    a1c2a9e3747bd9d4eea14ed5447ae89def44307673ed7680312f02fec8d86920033e068f596a666f8a56502043835a82ff085696da1fc9c07d17c9ed46659aef

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    b2924110a08fb906969f38864a086c12

    SHA1

    29e25386b4e8b0df2ec22e9928dad683f222d60c

    SHA256

    aa6015ef656e73c36f29d4e08dfb14b84afebfa7ac0ed6a9010e6177d3e5de95

    SHA512

    564dfe819d747209135d8d09d1c2bd05b9229bfa9f697677e610becfc0308a3bbd7afbaea8b2d6fbbdb030ea0468a68caa266e4ce5d991958081e3cc5d68747b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    a5132714e87f210bd6e840b4d70e22bb

    SHA1

    91dd30f2ac8e971839d3e6f18d8cea9b7ca05635

    SHA256

    87f54ceada7682d7df3ff69529621330c01c61ee97bd15243472e292e7778020

    SHA512

    7243652993ac6053313f010751b04948054247a325ae47c6691ad48e0850e45fefd2e9bab53dbd8d8847e213f27e87b34dbd6b6593635703742f1696049e8040

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    a653887fdd4acbb4823899ffaba98ae8

    SHA1

    ac57b94e9687a42b276df5c471e2be85b2721db4

    SHA256

    074f68d26bdb5ab8837705e004e50b7b5095d8477604791d9edaf486d2289a5b

    SHA512

    36d3d19b703c95cb0846ba8b770e4b22568b58a03d3f2a122d006546e8f75c3b9e8af57100b30169c6d10539adfec688cf55adaebd9aa6023471ce9ad2ff43e9

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    947f03b3a69f2482669d90cd1cbf2c0b

    SHA1

    d78c62493a5b4059dc159308c549fd4c1b8dee7d

    SHA256

    e8f3d45fba598ed99eeb8b000c7ed923b79b17de5232bd3f40c22117a9ca6045

    SHA512

    454ef8f5af47c6c41c6b4590e14a49132d83829f0c0d590af6366c2079def32b615fd82a148b57c842e69ccf5bea44fa0d1f39f21971d1352c2e4005c75c6feb

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    15e412504216ed7f881af64c441fce0b

    SHA1

    55bef13736083385236b788b4b12263babc649dd

    SHA256

    6cbc97cce0544dd1b2b3b8bb123276da12da044c99f1444683121a3ce46b4903

    SHA512

    d1a37b7c4159c92aec11b21da425e27a24d0368a1e72099782e84b20272436e34cb21705073f2a0b23fa906d8d0509c205d5868648b533077b3c43279728ecd3

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    939cc7d64a1ba5e9ee9094c6a3ed3fa7

    SHA1

    b6f395e05740e7ea3f663995d8a955833df42bd7

    SHA256

    6c4259018c588b643fb00eba7cd4df08a60a00db68ee01ac5b926a682bda2cca

    SHA512

    4be5ab84bc779fa26f77b06201f935ff4d18df2e745641775d01721adeb238d4c8ceffb47be1adc4a8e6fa3ecd0c26778fb49f58faf525176d267a36d38cb81c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    e48483ba93da5b81a4890e1afa5c8c5c

    SHA1

    9b7efcd7bc33ee4261162973c360ab78495b5e5d

    SHA256

    d4b8c87d88a96bd9a3f805867ec711407fb1c8d48c6c2d51e3c9f80dd39e51cd

    SHA512

    2cd31672c7789e31067da8ed9c6ad76fcb3dc776805ae9d31bd02a472ad799ed2f72f45fc77c0a3fb50022fb6c7374b007296cef49802805400be1548a7d67a5

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    36272062ce5d7d9e35af17fca4a16a09

    SHA1

    6fdb2d352cb943ba11394e53bb2263be8e1454b7

    SHA256

    f632902c9041b705a634c7bf79738e1565c0c67514177c335365a40a4c996b4d

    SHA512

    de5292e14032ed4192daf695f68d07ce6b92e46ccae2ce193eb8a16d16ac4cac85b0471e8e94b807771804f2832e9ba25b8d0f07a4ce5e775916fa9ec67f2652

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    c8ff51b4eb6f76c8b441d1f30c9f5f89

    SHA1

    6d5d61fc51e11aaa8c294fb2ae78e2c4836216ab

    SHA256

    5a7947ca65a1a063c4a6ad0d6048a381ace117490fa790048a25437d3517d7e4

    SHA512

    3a87c49be015d5e40fa4f013adb22101f71df03d470c602860ca9934c44f3b3c18c39f3b7e215bdf299ca13fe51b500e5f29fce84c7931ace32d56c4770f3c35

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    bc33c90d6720c8d0d6e0d995383a6663

    SHA1

    1a7a174ca582dc40eaf67f09209e53baa651317f

    SHA256

    c0d07fad94b9696f9bfda473a8683f8b1ffc4e8f8a908acae43f2f70c5803eb6

    SHA512

    d350551b280dd9ac27fd1b6005d74b2b85e3d5e6194a3fe22d5a1dbe22fd0447eb436363b9dcd525ae74c014e5fb6de1323a488911a796e220b96be230ce4008

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    c17682f1ea4aadc8485e3b7fe03c1a8f

    SHA1

    744fde87270b4deb57eb5bf87f142a39704842c9

    SHA256

    338e63efa4433e23f30c76a0e31b2a0103380be6ed9f943268f6d4f568f72d52

    SHA512

    7addacb5f8c91361cce896181d790e63ec1d7f4b699b6fc76b8385ba5a120be2ac233664cf88b223bfc9374cff8213882323ab00812f69fcc4074a2f8c33c626

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    4864402a680cb04bc3b6ef69b35de0dd

    SHA1

    e45a36744210634748781f048f032e980cc37df2

    SHA256

    6f97853f2833adb89322fea9501c7b38841bc4b42440c60edcc040ed6e97ec37

    SHA512

    165791c7b9dcc98a39ecc8fc3562be430831b4f56285a0b9a5afe43652d71ef9f628a9ee77776a6da9039906a467bf7925ddec86edf6078d6bff44c2a9ea1e27

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    eda4d1880a4c13dab205ca9b352e0aad

    SHA1

    8fa81be3a2e3efb598102822bb91cbf7d8a633f7

    SHA256

    5d1742aab06c6f46ecaed90f8f5c12cb91252c5e86b92f9650809d7976af9df3

    SHA512

    127218c53636e057180d6cede6a873e39121506d1bc8dba71604e2980bf1419b604f698ca6ba88e79621ed5d1874a2198277f60cbb5ff575ae2ec21e135a98d9

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    3d026a6b1acf1442ae4c262168b4790a

    SHA1

    93b16cf087bf21c1582186f6e8ce2515fab1d422

    SHA256

    b851608b1f75128eab253b3330f39954a4f17502e7961f18d321ecbaae2066f9

    SHA512

    d1861f322f2e8b68dd37c565d41b8360e71769770bce37ab224a95d0016d1ed9cbc4307856a8ace878e0ba575668d2cb64fb5acffbe51b88fe2da5996a011b7f

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    48258746d9003cba515713c44010f6f9

    SHA1

    a003112a654caa206d93bc0afca44e30627c79cd

    SHA256

    9bb8be9bfec1d3633e840eaf4a5facc3fa23fc3965a565d95de3d040511b09ba

    SHA512

    d3d78a75e15247ff603362a01957a1bcbe172ee18d60671b7bb6fe49a2165ab215741a52fd4395801a8f9e3ae96d4b491cf04c666262690ce5e468912d7bd79a

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    28760bc8f675bb700c74f13b00d1ce60

    SHA1

    5bce83c84b61b9a58d005ca365dc02c4d2736999

    SHA256

    77356f7e25c61919d0e55907319b20b857cb1d060b6ff237922c29492d13f910

    SHA512

    58e420713fe7da0ac292be2a345438f6f1da57562b5b8aea6d0c4fdc6e58a7634c9293c5876e4c6c8ea1910418d2d47d0c022a09330b8c8c515db2b6c95b2534

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    2d1592e110de22353caefa37a5ecc0c4

    SHA1

    050a3d8766626ed1c1bf7dd23ef57e04142e67ae

    SHA256

    175c801af222fb2dda7e4b1152f328b6cbb0cd562a481a608c88ba0b82c6882b

    SHA512

    f5640a0b2f5fdf882f95d15ca85d9850d01229192fe626e2a48ebd4c79bd0842d801e63a8cf539b8c2d11228099c1f90bfda52aa87ccfbbd10809186e4ccc850

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    b53a6439092d20493035e30e92a281ff

    SHA1

    7296b751d43dfb6f4b05f25d8cc6e6eb0d6bf8b1

    SHA256

    08dff659ca2a4ff847572e5bda57d0b9357cf4756a41293cb5385e74ba9ec2e2

    SHA512

    f9ab19c42b0fe30aeb8855c1938319957beb5b17d9af3d7b17db088461b950af67165696c9b3c1b3873b09fb81b4047409bc99ca915861f487c1d9d85c8684b1

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    b53a6439092d20493035e30e92a281ff

    SHA1

    7296b751d43dfb6f4b05f25d8cc6e6eb0d6bf8b1

    SHA256

    08dff659ca2a4ff847572e5bda57d0b9357cf4756a41293cb5385e74ba9ec2e2

    SHA512

    f9ab19c42b0fe30aeb8855c1938319957beb5b17d9af3d7b17db088461b950af67165696c9b3c1b3873b09fb81b4047409bc99ca915861f487c1d9d85c8684b1

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    519892a73567d2ea4cf4b170f18de84e

    SHA1

    1de5a0e6b02ccdfeca61a3532f81586d699f8336

    SHA256

    a3719d1ad6bef875e4fabb77d8ab90e082f36896056904f3b0d7b84bb8224b60

    SHA512

    2e4d88ddbbf115eb4f472a9f31ff7154a3eb8bf147e90e02c430e55985cf2d4955aec06506099750430deb3dd3bcad5b289ca9b2fe11e172d677b992b89053ec

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    f1950d6231eb6cc865c69c4fa6223971

    SHA1

    cd159a635a2f0742d525c90df666590dd85a209c

    SHA256

    2e2052df90c6b5d916ffe2b57cf2c35ba4ae31fbeb906465ffd9ffd7168a8a3c

    SHA512

    2feb391d552c0b4de6646b5dae46641407d6d25dca78fae8ccaeea208ca83700ed34766a69873998165bc65dab2c8939a76912a130bf81bf036eaeae2cf5745b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    5de488e457a6219bae064cc078cc61f9

    SHA1

    123a23c8d2041043ef165ab99fc982607f0ba4e0

    SHA256

    aad62b13083e9c163022e4a79f35ce15d4118c8e778ec3aabbf5e21738df5c65

    SHA512

    74bdfa4edd3c49be9ffe3c57b855dad0bf5f61ccb133f3c83dab973d667cf55a6487567d5bea33f100023893d85380e6379d79ae2ad250f356517f31779b1388

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    7b32b74f94d38d2ab0c3e3377b2b4167

    SHA1

    389e40732055accc1743e2cee69e5a137398f8e0

    SHA256

    28fdb8db4cd69ddaa7dd83755916574d405a247c1ba00b0b780853a6cc550332

    SHA512

    1e51666309b5d2337c66d16598d8803c3d23991dcd359ab35e4bf4ce18ac1ea91120df59fb488e1a1cd502bf6bf88d4912a920601e1ed7ef513aff20055c4fca

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    cc5c23b2b0477eb9710a807eb18f5bbb

    SHA1

    a1dfefda5721ede864b1d2769c77af509ccb75d6

    SHA256

    70506676c0d53f1be5bda16cb25506e6350578c2ae65c87df5176610baf4beab

    SHA512

    4079dd862bdd3423af4fae5c589eac638e044899dff2175e9f005e2116adb874569c7f58887cdfd62305175b8c78ff46f08bddddd9a35ce7f6af6fcede56c415

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    2c8b6a22067c409810fd6d6928fa5c64

    SHA1

    89da63a14c0b579cab620d0434d7f5b8d2a53428

    SHA256

    dd7e57eea6bb3ee3e8152735857ce62d54a53350ca065738b1318194ab5207c8

    SHA512

    f56c8b1660790cfcd3fea85aee3c98d58358843186fe2365012f66d32fbca453dda56bdf45b3f6b6f3301093e19ca31fd06685dd50e02a80655902d716abe18c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    80b4a12615fe96c4bd6d246385f98fde

    SHA1

    d4878beb55bf77e6085c280e9084dcbe646901da

    SHA256

    38d9234015eb20dce9fb84d3579f7cfe1f0e83302ed2fd760900836cf92fa266

    SHA512

    86c478aeb6255419bbcd67583405aafb49653294ac5a604873d58b1f08df0786f8431d3eea7c5a2bc0e826e481f58e2b5efb43d7c13dc60388a2d6e576d0d784

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    905f8b30c2d4cc3cabe3272369fc35ad

    SHA1

    d08b5ddddae610ca09b66a2336efe020e4f60504

    SHA256

    151ebd80c098447204eeab65e50f57c91e4ad9057aa01c1b17382a778e24732a

    SHA512

    e016db966929953f246f21282db79dfcc33b6944b38692e020d700b55d70e514fd4aa2af0072923b02ccb5ca39b0fc7157ef7178dec4380438ac6837b14e1965

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    7836166ccb2a852052e2909c9e71a69a

    SHA1

    8b1942a3a25390e1645ca23d2b69c2c60170de9b

    SHA256

    ce874b9b14946e820cd94f28da462dd62b971ed0bd942e6927e469d1f7121445

    SHA512

    6303e30deb231a7effd456211da7eba3c361a789cb7b93b26889384b2b98f57966ca137baf71166e315b00a71b65f9940e5efada1be56ce7b12bc452bcdc5cda

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    c732c76f06d7eb149c8fad1cddc3ae03

    SHA1

    f5914c98de490f3e0dd63c46008e087b65dbe0d6

    SHA256

    d8abcb0d3823eba1ea351a8c7fd38edb30558c1024fa3cd7a3b9340e0f8df9a3

    SHA512

    eb44374cb1fb71e5e0d1627cd52165cd004cf8c67634d8a3ae89d2e0465e87d82a8ceebef8daace45b8205c082aa28943d025b5559474c0ed19bfa1d243991ab

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    24dcbb97b55fd7a282ab8c1b2c5885c0

    SHA1

    3c62acc0e59270ce92afd10b14df01ab9a9d1076

    SHA256

    2e378a9cbc879c6f169864c6929989ffd6a585b960bf05909cfc261f822c4448

    SHA512

    6ecd3b09c34971d611258ac267785a153107d6022db113ea17823382f5d406a8ecb1c5abcfbe316a59f2862077c69405fc07ec6cd9f42a8ea2d0ba2bebadfc53

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    6e24340cefbc54431fe028b575b6a7af

    SHA1

    44c12a845a5222626153fb878b22859356d43d0e

    SHA256

    03973d152f0c2c6481ccae3312e8f5aa3f76dfa926be4e3979d7a056936bf748

    SHA512

    0ea95f9fc6018c65df0a72ca9e10fba51e4bcae1a4ad863db7172b39f8070bae32485bf7fe17b070dd6e2f087be913e0226e5e4d4a9d28c559ea1fbaed1163dd

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    7e6dd4693ac3594030540b307ea6b537

    SHA1

    73d5ceda2e2b53622c66f7eaac8e1a58609abc64

    SHA256

    2256e8d8e12a51538c7b5c53f23199fadd3f7499230b1d82ad23080675e701aa

    SHA512

    b39fadde25b68aea3abf86ad37311cecd54bcf228123a8bb8428be4be28e303726d55603d79fa67af27603454e6ea39a0375b4d1e81459d58ac7bd5ce8c592a0

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    0d33bcf947864cc8b4a82f2bfb476175

    SHA1

    b4061773a740b9953476bf0244ded6e4038a164b

    SHA256

    744a29d6a258f0d7289727534675fe3391824470f6e371d8ab1e3ab978746037

    SHA512

    e9a7fe53aa1cb093f6cabcec1bfbff07aa573f59ac79a594e1baa88771a86ed580d29d29100fcbcd63e082377f5922c2d168a8f145381bf94529ef5bd213301d

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    a5f16e3585136fcf9b90bb1b73a32fcb

    SHA1

    3064a31be619f6a1a6d63ea0c81598477f231b71

    SHA256

    41cd823076215a1228e454f6b859df5ff355fafb04a86159c9e1a122685615c7

    SHA512

    1bfb72e403df65d9205fea9dd3659d50a5308187b2c5b9039672112317e6153a9047161119e583bd5a803e9a38dff398c646644da47c8fd272a3a80853402aa1

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    aa749e6a85d052c3f5c42036fa4be74d

    SHA1

    b4fb7128733cf192dda4c556a2892c7c664aff9a

    SHA256

    39707eded3e4a625c0c6295c8b40e74cebf212e7f1e2244d5df9b40aae9034e2

    SHA512

    3d93c69b450b0f5beb5007427abab63f9e2547710729e0d9d0ea767ce833a8cc860bd117fb132ced3253bffea8bebc6443a6b5d3810e5b4976a2dd42cfe1cb2f

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    56936c63b5fbb372e0fb2adfaad4a004

    SHA1

    8fba95fbf2e1dd3c22b081fd665cc627c006efcd

    SHA256

    af4dfae93f9f901e6b3d9548669604c617975b88266f16ece3b64ec1a4270ab0

    SHA512

    25ccfc889e7e6245a974514fa2552a7e9c280458d973ac82ab79c0f15a504a2b94505b3ba3db460c61d678aa5b7880c31a8b6455db032c25df1db6d38588aa19

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    729f30a02f6448dbb6062fddfffb0898

    SHA1

    96d897144381c35fd004d7eac83115cc84ee8f3d

    SHA256

    dbd6d95534744ceaa0952d0fc896d4baaee66da38cbd44a1afc75fe7a0f86ad2

    SHA512

    1a018375f05e26c2cb096c60878403b7dc6edb693b7d8b444567d1e83dc9e96045c0cc0aea9152de8de47e2d0d51886c6a58d14c794bcac4fbab128b4f8ad308

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    0acae2716d0370f0afa0e9363d5780a1

    SHA1

    34dcc65e45e43cd0fa1553e5897f79b639921934

    SHA256

    7deab200c0d3a51a36625e765de4a11b75357a880c2fd5ccae551048b9be2a16

    SHA512

    eaac0c5e96a205ac9eeb1da59ccf82f2e249415aae4ab4ebb660efa41edddb2f5f5624225d52018e8629a0031a62d83412c5a37bcd9d8d359b708cd95ec964b2

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    d9b24db441703548935add12375ec4ed

    SHA1

    bff35148eed88d332f3d91b57a9eac63c546b6d4

    SHA256

    af08fbabe2a09821a23b1f228568ec00fa5b847409afe5864300478aa1977243

    SHA512

    de28a87caec0473b360c1b67abcb559bd9d91991bca07dce8f055d12f2b7c8ceaba7c20d06b202ed7f895ccc6539c8146e7f4309e4c96af42603f2204fc02227

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    fd7d0aebea97bbd7a6f34816d6e84896

    SHA1

    6cb0899174c344496cbb60dd032cb3ef152f12d1

    SHA256

    2b7337288a21c1a336b693b4d8f2ff1f2a7bbcd46216156a0549bdca0c05d1c2

    SHA512

    1491b2b1ef158b4fb8f5392504756eb2f2e13d234c3228b73768453c4eeb557e55c51aaf2cfd2b68bdb652406dad8251a8af3d9c2407d1bb44ebd2866974062f

  • C:\Windows\SysWOW64\HelpMe.exe

    Filesize

    2.4MB

    MD5

    a9fbffb01fce87079637c0bbc225dcfa

    SHA1

    3f9e2dce5534a9a93e3aef5d1f88cbe8a68581ec

    SHA256

    da3ff4dab527f1cad77282509e3056240880d4e0aacb1fb3df8fe15d95dd7e58

    SHA512

    9256794a01233c189bd7a962424ae56546cd7e94322b6ba7524896cd23520c17b7928af00259e6f02172d8041813959504a500c5fd59f7bd4e2b0c4ebdbda131

  • C:\Windows\SysWOW64\HelpMe.exe

    Filesize

    2.4MB

    MD5

    a9fbffb01fce87079637c0bbc225dcfa

    SHA1

    3f9e2dce5534a9a93e3aef5d1f88cbe8a68581ec

    SHA256

    da3ff4dab527f1cad77282509e3056240880d4e0aacb1fb3df8fe15d95dd7e58

    SHA512

    9256794a01233c189bd7a962424ae56546cd7e94322b6ba7524896cd23520c17b7928af00259e6f02172d8041813959504a500c5fd59f7bd4e2b0c4ebdbda131

  • memory/3008-458-0x0000000000400000-0x000000000047B000-memory.dmp

    Filesize

    492KB

  • memory/3008-140-0x0000000000500000-0x0000000000501000-memory.dmp

    Filesize

    4KB

  • memory/3008-139-0x0000000000400000-0x000000000047B000-memory.dmp

    Filesize

    492KB

  • memory/4012-134-0x0000000000400000-0x000000000047B000-memory.dmp

    Filesize

    492KB

  • memory/4012-389-0x0000000000400000-0x000000000047B000-memory.dmp

    Filesize

    492KB

  • memory/4012-135-0x0000000000610000-0x0000000000611000-memory.dmp

    Filesize

    4KB