Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    156s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/05/2023, 11:36

General

  • Target

    2023-05-15_eb6fb42514e024e77236476da457c1d2_ryuk.exe

  • Size

    2.4MB

  • MD5

    eb6fb42514e024e77236476da457c1d2

  • SHA1

    c4321fadc4a7f634f278fef8b7b362ba906469da

  • SHA256

    41ff2f980f989002c9ea852fb1f85e13ca49511f4f9ec60e648d0cba3af121a5

  • SHA512

    558b5b855d81e08da0747a43fb04ddb88b509614f8d6c338f5b63a64596e0d56c76b6b0f7fa6b83e23529b7604278181dd3f62087893360c14c0695c7f9b31ce

  • SSDEEP

    12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCQ:eEtl9mRda12sX7hKB8NIyXbacAfX

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Drops startup file 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2023-05-15_eb6fb42514e024e77236476da457c1d2_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2023-05-15_eb6fb42514e024e77236476da457c1d2_ryuk.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops startup file
    • Enumerates connected drives
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2132
    • C:\Windows\SysWOW64\HelpMe.exe
      C:\Windows\system32\HelpMe.exe
      2⤵
      • Modifies WinLogon for persistence
      • Drops startup file
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops autorun.inf file
      • Drops file in System32 directory
      PID:656

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-4238149048-355649189-894321705-1000\desktop.ini.exe

    Filesize

    2.4MB

    MD5

    1864cfbc781f9f704ec8384a2d36676f

    SHA1

    7d9a35307ec4dec7edd6bb8364bd41725fa43eda

    SHA256

    d2adca2875822e02340e183a20110ba41aa5dfa32e6dbf3b01e21704375d5088

    SHA512

    6075717b32b517600c76582887515a002247fb665d21410cfc88a217d302d6fdef93258cc876012240ce5275ee0b0d9e8766af1ef726dfb52d7674caeb8aaf2d

  • C:\$Recycle.Bin\S-1-5-21-4238149048-355649189-894321705-1000\desktop.ini.exe

    Filesize

    2.4MB

    MD5

    1864cfbc781f9f704ec8384a2d36676f

    SHA1

    7d9a35307ec4dec7edd6bb8364bd41725fa43eda

    SHA256

    d2adca2875822e02340e183a20110ba41aa5dfa32e6dbf3b01e21704375d5088

    SHA512

    6075717b32b517600c76582887515a002247fb665d21410cfc88a217d302d6fdef93258cc876012240ce5275ee0b0d9e8766af1ef726dfb52d7674caeb8aaf2d

  • C:\$Recycle.Bin\S-1-5-21-4238149048-355649189-894321705-1000\desktop.ini.exe

    Filesize

    2.4MB

    MD5

    1864cfbc781f9f704ec8384a2d36676f

    SHA1

    7d9a35307ec4dec7edd6bb8364bd41725fa43eda

    SHA256

    d2adca2875822e02340e183a20110ba41aa5dfa32e6dbf3b01e21704375d5088

    SHA512

    6075717b32b517600c76582887515a002247fb665d21410cfc88a217d302d6fdef93258cc876012240ce5275ee0b0d9e8766af1ef726dfb52d7674caeb8aaf2d

  • C:\AUTORUN.INF

    Filesize

    145B

    MD5

    ca13857b2fd3895a39f09d9dde3cca97

    SHA1

    8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

    SHA256

    cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

    SHA512

    55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

  • C:\AUTORUN.INF

    Filesize

    145B

    MD5

    ca13857b2fd3895a39f09d9dde3cca97

    SHA1

    8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

    SHA256

    cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

    SHA512

    55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

  • C:\AUTORUN.INF

    Filesize

    145B

    MD5

    ca13857b2fd3895a39f09d9dde3cca97

    SHA1

    8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

    SHA256

    cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

    SHA512

    55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

  • C:\AUTORUN.INF

    Filesize

    145B

    MD5

    ca13857b2fd3895a39f09d9dde3cca97

    SHA1

    8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

    SHA256

    cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

    SHA512

    55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

  • C:\AUTORUN.INF

    Filesize

    145B

    MD5

    ca13857b2fd3895a39f09d9dde3cca97

    SHA1

    8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

    SHA256

    cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

    SHA512

    55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

  • C:\AUTORUN.INF

    Filesize

    145B

    MD5

    ca13857b2fd3895a39f09d9dde3cca97

    SHA1

    8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

    SHA256

    cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

    SHA512

    55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

  • C:\AutoRun.exe

    Filesize

    2.4MB

    MD5

    0c4fddaef5a664a708f6a382a6f5bc65

    SHA1

    9c7b78e7ad4d574d635452e072a816566db77603

    SHA256

    464ef662288c249036e9d8fbe507e7905e629847fd30e5068fcb13086c32a3de

    SHA512

    e27f84a2d0364870fd93b8e48b9db23d022152a9515b95f89a7b6bc2a19f1aada1078d228361277e960deb6c403c514bab07060045fe20c5f59fc0611e1d32d2

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    88aa872a57c69417b73c513a601be30b

    SHA1

    014bd1de60e6fc8d992bb6d7c01f628ce2f0eb43

    SHA256

    5968acc3b4e346eb0fe3a8b2ab60f70a06c6066f46c346d9978fed2e7f552150

    SHA512

    91758012421471143925cd56fc34c664af3c11ec62013ba35fe48809f9dd3b11c4658f25332d3e99813bbc77958ba5302949d07fd3f57415519a48fb4915a963

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    7794c480221a785811bf5ebcb9bbc7a8

    SHA1

    2a2f70473fce07bcc3291a8c230690478c9dc83b

    SHA256

    609d0900cf81a5449bd0f041d6fa52e51da7e03bd266ef08d824da50e5d6702f

    SHA512

    38dec217b529c8ca71c19cf367d2b52acc94f5dee0c3c9212711c6bba9f11f6163ad45333bc383b3d4ba2a0064bb77f89ed6f88701d8cdaa20457c143155ce2f

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    444ef07fdaf76f381abbcbec3b7852fe

    SHA1

    b030246aee6c19d0dcd11a06dc03281573747838

    SHA256

    b1df1e1284d741af5fe431d2a77a1b91a9ebab5099ddfb542b65cd92c563948e

    SHA512

    a48d7f43e0ac8303a1e20c53bce38e78a0e503c23f5f079480064e40bebde0c552b0afd781b29f618b4bc5c721eef8a0d8717612647696ee00743ff6c4ce2c37

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    eac7c496b2283070d3e2cbe6fe4e81f5

    SHA1

    50906d566d1ed28addd4bbfe39771e43204c8e7e

    SHA256

    493987b9623130f52a4e1acfefee045096d1d507399959a9cc6c9f5b01630b60

    SHA512

    b5462356fdb58b6980d6b49c43d55db3f4c3cb197e5ed7c75d3dd47efcf070a745b96817a305c1cb6736db4b8d7652047610ebd5d5bf8441cee40bd012120ec3

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    5e4fe0e54183286cd5afc84ea2514fa7

    SHA1

    4cf4b09df66522426461f254b338d392cb228aad

    SHA256

    ab720ade8f06d1a87e5cf1a9751622d635d4eae774e5724aab65d1f169b32a93

    SHA512

    d3611c9952017f88c2bab7cf7914689579b2a33ecd44f90eb61178ee829d69bdb9b94df0722b29b79cd4e518474de74bfa4a6e1ec42a0fd6be74c1164759120c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    b15889baa5570a2ab87d98a0eba46e7e

    SHA1

    9d2dbf1cfbca2b3d920bc7c97d2aa7a99e8cf299

    SHA256

    320609abd76eb3ef2a858c20956972307f3e12de223304b66abf9b662485d19c

    SHA512

    ad9d9ffca1f310a46fc096014d359afb4645158a8d824ab60c24ede73f6c39ee25fcc553f64395400e6872f199a9ac36f994dfeb785a3e3360205d9f99cb8c32

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    7807113ddd00a1de6bc14baf6b90688c

    SHA1

    3f8a00c8a89340aee9bdd39308ad8d6276692195

    SHA256

    2d43103741ccbcb254448fec98aa84485e6b6ee7ede191f8d643616e3e00e45e

    SHA512

    5964791274120579a054184275d37c54645195194529b30bfd4a5b98c27106329ac980223d920eca61d5a0e911943f11486cf7cc3ecc6557a2eb282b906e76fd

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    aa516a466cea6babe078db1b4ed1d2cb

    SHA1

    88bbf4a495fac669d47bcc0ebb4ebb2c16b3348b

    SHA256

    5280490c5391cfbccc1d2506d20e07fa449395c449b53afbfbac3c97c6ec8fc2

    SHA512

    2a480f3e79c80d88ea71318edd6d9c948cf7f7449dac1faed40722c00e21c391cff410eb0fa1cae43e03e7ae2b8c4455536e33f1c7004190893c167de9336bce

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    6f780fc256f3af64d31076732bb2a494

    SHA1

    c4176c94ea47ce34c9eeb53733611af9b0db353f

    SHA256

    44389059e635327aff8011ad11ec2da8c2b6aceb4325ddd29f27c18d645cd74c

    SHA512

    4eb28f594f8fb7747f672c2dff71b42807400f8c174b63b19d195e427a9d95aa356f0435e4693ec8c8e85b29137cb71b1b596f74acf9d92df9604e67ac57c899

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    f43db6dce1f877525f9ee9558e6fe8cf

    SHA1

    01a5659298f5317bc16f340df702a7a39ec1ade9

    SHA256

    1f6874e2af81cff8ae4836b12c45bc4bf9d051d1bf863232faf07aa0da3e4921

    SHA512

    41a09aa0db60c11fa680170ca288a73e0d09fb409b195adddb761a190e422ecbb3203f9618e1fa075f2cc29cbf5649088f7ee608235a89c24a3ca3212365884a

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    acaee04bf8b8ac92353aa92a5c14a179

    SHA1

    235b41cbc402145a8119756453fb5f3e619054c7

    SHA256

    0bfb4198032d4d86fb8f20a146824aed7ce0ddbb13d6a85e2e935ce356219560

    SHA512

    9427e245dcb91995bd3724e665d0e8f1834d1701963e9a17d2b63b94f737aedb291ef29775c6f71d00025e3dd806e5cde475d259c8b0c9cb1c3533774f47bc9d

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    09a6fa52490ce72622b6904432d57781

    SHA1

    f2160c657a093b626e1254a2a2320177c74a65e4

    SHA256

    9cd26d49201e76e26bf7de70e828131168bdfacabc1a0ed9a039a465eb3f5e01

    SHA512

    e01a1ead43e37d24741a22f43cb1b0d2c62095f1e79b72d75d16928b33782f5d5b36b3f7f2a3517d98db4518c25279bc778f9191884c2213de73b798842f8e2b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    61d5f816eb92dbd0ac4c86a656315d89

    SHA1

    665311370c9177cf54b5849bd9c0f8587057352a

    SHA256

    fb4679f0e33c079d4cc8af5dd37be011db9459fae0b3ac8e14c0dc0f2bc471f9

    SHA512

    be4c44ff591402aea0f61c9e65d1499ca7bfb9e1cf8ad2e66bcbc973f3142e351a623b243f58659ea815996f542e1ed06d0432fbe2a6bd148f9a183dc1540184

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    175b363e22e4cdc6af2dde5552073cd9

    SHA1

    ed36f146e3eeb6f55832e6b720eb36d7256d856e

    SHA256

    724f5feb8a0d256d1abcf5ac83533655af38e2fa2f5f0bfc2718ee1717746591

    SHA512

    4c9b967d6128bc36291ec38fdc9abd20cc79bb3397bf36093c42b9c55f3bc88865013c64fe15aa46946ef3162842a3ff64802ccd405f848ddd24399b5fa5cc39

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    15905cf09589edb38f6ffa0634fc4afe

    SHA1

    65c0cdf44ef6353c53e077d831ecadf188465bdb

    SHA256

    b206ac3c20f32ed3f58bd8b6569445d244612076dc2fc22a566e8c1a9fd61e1b

    SHA512

    8a476161aeb9b96cdcb21e7dfa4f5071c7569fb9dafa0a14d513636df8cbac435f7db6aad0320475bcadee88d63517a078995c4a5fad71ba04f471febf1eb823

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    008f304b5ebd0823416d60ab9f151580

    SHA1

    dd6b3c4236e67685687dc032382f2e7a34a4c349

    SHA256

    2911327859c4663f6927f2f08f73828570aa8eb8ae3ed048a9e142ff2ef0a353

    SHA512

    55db94b9c8768a2db13bd7d6fb505636bc9437bca49abe3e3fc8029989cbce29d91e92a04abbea022f8a79741ed23aa5dcaba14f14542b71b55bf72ff2a8202d

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    008871d812f20b3217dda3c609c9c126

    SHA1

    b599722e229a3c98302c2d2777071212a7d89972

    SHA256

    b914911fc3942ded9d5f0a12f2b33253fa6b2260fefc79bdffe30c4530591c49

    SHA512

    30187c8c6b31c27666798f9e44928607d786ba6ef45ff4ed4e75312b7a4e11c210142ad52cb7b19c805d0ff7faa1825cdb40eeac8fe6166420b8999f6397f4f7

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    6bd380efa4d164096899c3c4b029b904

    SHA1

    9fc88c080b776b8aa1d70f72ad30106628071b44

    SHA256

    ef23744b02fa34a5cf771af09f322c5a60f09bc9a439ddcae2622c992149cdac

    SHA512

    769011e0f48ebb336cacbb1033664f5591852f86ec408440a8be35467fc572226c4bcf9228928d4a933d0f57ff23724401ce7ebe56da5ae912ab21a2dc188270

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    3c8c24a1a642cfabe2c2f3f4dddd5002

    SHA1

    c259f1d31932a45f52754eb68d5cab780c57c04b

    SHA256

    89df21e6984c281f802ec0eba7b06be16e6fd8d4286608a54153ab5537aaa879

    SHA512

    a6a289ec74e5d451411b57f21d317cfab14bbfc63930a10743d60cc9b923a6f9eedc2b608e5091e40c062ea06759d9179ae4d3d2de66b0a3e6c5958b263df1b9

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    875721445054c50d4250e351272d8447

    SHA1

    82e055c62ee2d16b9f4e4aefd87f5731c45a9f79

    SHA256

    f9c34732f2a209e50ef7a0d9d80de2ef20f79f8c48a9e3b5da02c60a7a379380

    SHA512

    52aa00a807c8e3250e9d19c96fe1a37a1f989a5f166b361f09485614c675f055975ce7231651532410c9a1405e00bbce4dab1d1bac5e581dba0c6cb983cad9bf

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    5d1f5559eee60b674fccf92860a36ed1

    SHA1

    1ec1766dab5be7d26ff8058751f45f56d4f8b49f

    SHA256

    a8abbda958c8478bd5e17f15ead28f8abd80eaf534c0084381d6f1d009065190

    SHA512

    547a929fc51f01277c9ebe9c1441113b6cac14141fde9a4c125fedd5184f4322034af6cf7a480b03919b79cafdc6489cc76c2bdfc0df10674681ac7f971cc0b1

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    07cf1b429eb04d75bdf2e4222968a039

    SHA1

    9a708b98d6fcca97574d561562beb58f633c683d

    SHA256

    ee36121a7ece63ddfb1753116785f2dcae8ec8b0a7f165e8965fe5a4ce896522

    SHA512

    70647da0ea2e24f34a337540a8da904805c59ba8787c03c99ca0ba681e2ded5bdddb09d62e2118fb14533c2a9c729875c1731be8d0db6bf034ac200cb3c8c9ea

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    580d71c266fb3adaa1809d1c86140161

    SHA1

    1f62bb8b99b2717c3e07f2830f57f99fb8213193

    SHA256

    a3606bd4af7df41ced7777c60cf56ca392c3a63ae4743b250e8740c444372ef0

    SHA512

    354d0ee7e49b96af16dad4693a743dd0b5afb8e9317b44f235076a01669932d18a7ebab131cef1bbabf9d1d3b48b3a82b3e024c44315f07a1efa0a95a989f7a0

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    1dc93df5ce4b47e2dadd352f01586f49

    SHA1

    579f3832011a879dcb3255efb53cff4bc65ee153

    SHA256

    d5d664deb462b3fb6ba9ad676a482842ef88bcbdc666571333bf0e4f405d88ae

    SHA512

    b65e9353eb83e0155e2f5f3bbca7092a2c2360ed59fe78b28b0d050bc7cb4a9f46e3a65d597debafe799039e3322f0ab6394cb3890a25e330e7d240c177a244a

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    1d69df0b639cee17bf8323953ad54439

    SHA1

    89d67ac6a2172b91a4a17f04c8bbb04133dea26a

    SHA256

    85ed5703ffa617b2d6221ad6988c2e9fe5a713a7e8e1070e1d8770c9b7b02c3d

    SHA512

    a820afb871ace301f549bb14bfe42eb40509f4e3f0433815139016bbcb75837e1e25633c824ecfde1f215cbd948d664c13cb89b37af83418fdf53e76cbccfe9a

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    4613cb7fc099a840d82fdfb9cf970074

    SHA1

    84a986086232b3107c188cd2db25ed78485b7c22

    SHA256

    3341bd7fc57c6eafa1ee8b2f44121854048e2e0a18eae4a950fd73834bd8e7a5

    SHA512

    dea38044667e3b2b6ef71bf527fb2d8f3b7d1fb2ff213460d3771ea15fa709aa308151d326ce88d820c6877e8449dcc1ae7aba81167f5861b943093682636a86

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    b46597dc3ccfb6f45c5c722553c82f25

    SHA1

    cd600c3d32a791b7e1cb8e1440e9c3e6c1ad247a

    SHA256

    116774c53809ae6b189d0e2be8b29a37eab4e4c12161f3dfdb69c42e50f8e9ef

    SHA512

    233c145f41d0e2e4bc9bccca69c5094b109dd3c727123e7a3dda3fa3ee227a6bc5b3da979914a4ccd73fbe6c5d6fd34cc0f49545c249a0485b6e7076b6064cdf

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    0a114d381163eb79982e12bad2cc49eb

    SHA1

    ebad0b8b62c8bb1ed42fc5d787b8fdcd13b28a1a

    SHA256

    63e9471d986339289d77169cceb932d0dd6b1ede025a4305c93d851813ef564e

    SHA512

    a41d2a54c346b04a3676bf441126967647b9e58b82bfd18cfdaa39faba7401e0de4b57a72c28c37f859de9a4cdd50fd5d404fad330de30d2180f2e99089af670

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    286d152b347b5d2a8965894787d68f88

    SHA1

    b8492491bfc2ffb634686e7ddf58e672a2980f6d

    SHA256

    011ae070a9cfaec09a893d768f8131606d107b7d82d7d4dd71a9f7bb25f79994

    SHA512

    bf51dcec04a3a0dcf2f11b22917cc63cf38c3b12c42b78bacbda9863570465f86ba69c131f9fb9eef0b05fce8071b3b7cb77af481d32403f111e0814e137184c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    4a4e569b5671f314f04dbd82bc79239c

    SHA1

    4c047851b3dc6e6f04777eabf2a05ab82b88ad18

    SHA256

    974eee662a22323a343b74504d063414739ab206c35ffdffcd77b6ac46c8ecaf

    SHA512

    3218ebcc8413190e8563cb2ce554a975720cd3c30a43c0aa21710ee4dd23a72f08508392ca20add79c5c1cbefb958f2250640f0d058ba2a2adf6149c14abb743

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    63cfdc5520d0df6cedc1900d8e9549b4

    SHA1

    c516658421b6c526a710f989619080d51b3d27d6

    SHA256

    3abf5758420f3a1d48b5ea36d73ab944a21071489fa8c1a8addbdcf3f95d216e

    SHA512

    9e352affb44532262dc770f2309c62564614286498e8dc6578851a7f025cad5b5741edb6f1126081a9360dffcf15255b7f5934b8deb5ab149826bb922561b95e

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    8581a11dbb21641cadac15f66c1bb332

    SHA1

    d348d4460201fe52a2712c135f3a80c78dc7d03e

    SHA256

    6c136eef489cf940b6e8b23fcb56ec7cbfc1568c17f0002956e4540a10bf0dc7

    SHA512

    c3e4a5761b6a089eee4085a479fb2ae3c9a2980a336370bbaadb7c191d971c84326c3f27e983fdba9ba3c109bd97a066aeccab8e7094c1832e2ce21ab8c23bb3

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    af3220a84a1235b882cd5d88e2b2730d

    SHA1

    dc54cf67c436c955aca38775d98b450762942fed

    SHA256

    2bdd1ad7def35f11c3f8f05e8c6a893fb7e5b01bca62fa0f07be66f23cdabd62

    SHA512

    79581306551d50042312a444fcbf15d3aa033ab424379a3132530d07e85393eb24b91fe3e37c8c2d30d67dbd69449a3c3900cc6cc574c6bc1dd5f9bd7f7ee387

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    3ad9b4009e08dc6284636495af173d0d

    SHA1

    2113520a1b324671814e246446b76ea663f3a485

    SHA256

    b6e5a175dbb4b8b7fe2db89f91a84be5036239139aba3c4c13e13593f194b049

    SHA512

    0706a1855220d4a24a499b9bfaeecaf7d859dcc30d66ca98e1ec539b5077acf544389f599c4beb8c7137e186f3835b72af9e013b52c8809dc15910e4aa5dace1

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    5a9e8ee5e6adf2c2151128399df2e512

    SHA1

    4336fc1f0b711ba56b99cf6cc12be5ef5da629db

    SHA256

    8d2267caf5398a9144b17e99f1765a74ca672933cbe269e2ee184dd3636dd1c8

    SHA512

    8f2eb81eb884fe9d0e6c48787b84c98d99cfe240f22832357b9dc6afaac8303eda2104da80bac498ed84a797cf5cbf5cd5727da3a43deefad8b8ec712505e4e1

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    ac04ff616d442c25a1e53c31c239e85a

    SHA1

    f71dd0c89c4058e71da5005baacbf9e3572648c0

    SHA256

    b2b10198a0303a424a225991ba46af0eb004e966a48dd15fa33df4dd1b1270fe

    SHA512

    87d2609dba0427461aa2d208c24eb3b985e78797696749e6d65625de1f7891f5230b2df662ea925edd161b26218c1ebc8e528e562bc8b1bc9bd5ecdd994232f2

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    a00a955d17d4ba781e0e1ff57ef30041

    SHA1

    fd272e3d3b04ef1f8e30264ab8509ff7a81099f1

    SHA256

    71f910a39e7d8b9770995ad4a8b7b0b643b1dd2a12f3f062366ca65c71928ae2

    SHA512

    9f1e03532390db55c5c54a873cd8035fdcc3e6d0afbc2fa55cbf16777e996cb4db9f22fb719f00fd957260af281acbe92b0bc5f9f8e9bb55c361b90b3cd50438

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    da4eee54c59a71514913273963c8983d

    SHA1

    4abe479403ecd0fe1ce695ecc6c6da5f7aa37572

    SHA256

    0c4bfa2b45f23e1ef82cf1e48adc570fe3494155eecb86aebf9353050a00fd7e

    SHA512

    597340a9c259f5f87b33a0da939bcfca44b14d0a43cc1bdd830a3abe93398f4b719c55938ad7dbde9da86233e746c28d815b1ebac6772e3e595ffe8456f487a4

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    80f17b617c87c53fad47bd9907011ae7

    SHA1

    404307920f47c76c7d5017157a807dade44453ea

    SHA256

    ab348b11df90f0420c98d823bde1aafe311458e0af68ddd1f5c8b232133a3f12

    SHA512

    b4d199ab06e64a36c872992e223a085ec6918376ab460f36ed7f7fafd4e393127082e4b80aad262e149c40270945c93fa9c60c0bf0ef3800e62876e29310234c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    5af160444f0f427fc2bafae81eb6fe06

    SHA1

    17d7b104c41dcf13aacb3314a7a6e7f41ee05e5e

    SHA256

    8f05c6adf682a9a21c1f46a66bfb2fb40b273cada0d3f0748196316f91739122

    SHA512

    94350d41e68b9d6f201ab3db2fb03c1f36ebe7b7dd4714267ebcc56250078621183d4657556a598b69158c2ff47e76ecefda7185abdc6854f6ec98c9b8189b3a

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    e45ff5067a5d1a4d9094be608a66d5b6

    SHA1

    e6f18a300dbf09bdb0ae06780ae31a28fc46ee02

    SHA256

    b2a1627e0303e19addb8af6b3590dd18db1ea893228d93732fd73ffa497a5f8c

    SHA512

    a5498c1d47c1670a30359bd64eede011b9b18dcbd8a0110782b4bc8256ad9df741d103701f290010ad98db0d81a3e51fd49dd6cd5d361befacfa8a357f986314

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    8dbe74b22a01c0fb9e1121532cacf35c

    SHA1

    d8e3d395713d54ff30277da4566af44c00ca57e9

    SHA256

    5e163c4ce39b074fe97e0550f9be26aae0489b30cc216ca7278d9960b3bf43da

    SHA512

    b013c6a4428cc6c7a5c89d1b8c5fdd811c54266e52f8abbe9baeed7690e48d683dea0ee6f09985b9a5b47d1ad4d4770e53dd25a89730f62628fd58b0db9b963e

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    553f588694cbc91dcf419d8a6d2aa1b2

    SHA1

    93c31b84ed60ceb1e1b3d17a8326b7175f981ef9

    SHA256

    bebc3904cb2e8491e39fa2a165c6af92e59dd5803fcfa92e66ab9895f40a336e

    SHA512

    43b457d3fe2cb0fa753d282e66660c74b0fa55a8cfb7b7223c80fa23feac5a215ecfdad76c9eb3afd236827f810246b3d8158571f189e2e90827b08eb1678b2f

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    1d9a43aad2d31a34e4ab3bce34d56e27

    SHA1

    43da4a6bf044b3784fd3bbe89d36acc3132509df

    SHA256

    ada4f1775cc98fc205e9df71042188f851d2c88013ab879097e9d27769b07da4

    SHA512

    f3730d386edcbbb069a570d6d73d001ccd6ea4a1364f3d7b00905dfb3f1ceb2592f8af1c35eeda8292fc84c036362ccc084996ac6d85dd9a874bb396ae18e722

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    0aad64fc0ebadd542de031b4e8a3261a

    SHA1

    b7fe5b91602638f7feb988433ba58f12f90895d5

    SHA256

    5b06dba24af0e49b10fe0eb35e8e122bdd1547b3b527556c088f244b3a3178b1

    SHA512

    957996eef31cbbc261f851028775d120cf1e41c9e6543aa081c7f79ebfa7c3bafa8b28374c4042002a638aaac775684e933c894914dc7bd5d183e43cdcf56788

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    eced613ed88d55d90c6bdf4691d73939

    SHA1

    bef76a4d4d2cedc1f69ba737220010081677de85

    SHA256

    d683e6662b51058e0c713364ebfa2561624f19a1b633833dc8ae1cfe3b688587

    SHA512

    b07ad5e0dd0a69f31a3da0696c59fc08dc4828c00304a8e87bb68df46629b3898934a78d38dcfeb03da16faf778818df2cd10ae16dd406e41246a1e2044ed68b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    4579df4681daf4d8c67fa2a0c10f8318

    SHA1

    d26096f3e96c47a0dec38c947188d959f4dbf07f

    SHA256

    1019d6d99015f6cb85431b0e21d1cd4a8d5fd604d5d519b6086f81069bfd601a

    SHA512

    9a38bae71d2cd4faa0241699407188bb653a9b1ae32c96a1483b3287e8e105a8915dfb7d234f27c9121133dc6af777485fe68898a2d9ed9edce9a42d46863c66

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    463860ea633377bfddc74b86fb4533f4

    SHA1

    fd8d1588e0fd662182593bfafcba0065930fb8b3

    SHA256

    ee0e557605e52a34f62a4378849aa47d41e5eaef38c9b7685635d85d0b824f4a

    SHA512

    55ed0726857eb0ef1438ec3fcf73c0cf0f076bbe6b3bf4e1f1ea94aaf364c8e7531c3868fceb2caf4b437fd912d168fd1e5f0103c8b598aae3d16da5d6a02a8f

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    7a525a861f61e662fbc494d42bacd6f0

    SHA1

    1aef76ab2804d8f26f40ddc54c72aa790db1081c

    SHA256

    8288fa2630aa86bc7bc04f67b78221e97da3cea20d3203c4088de28b830036d7

    SHA512

    1f5f9b015a887418bb42c3e97fcdc464f881f8bf286eab2c67604b78d3d4588bba2870c18a644e90431830645bbc6295fd57360e407faeba57401025573da40f

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    07dfd2e7beca1a8ed90325c476d4004c

    SHA1

    67a2e1cca9d2929f7cd6b4fb250e532d9134df58

    SHA256

    f458b7a314c1741dfbd4790855152fca58fed4dbe0c0ca219f5663d2624566ee

    SHA512

    cea9165b2eaf09e42c9459caf140ac9bf985ba2519de910808f4218fcc805366dcc9d19a1b917b1b50f8a03b5ba4767b44211e760bc4ab5d41eea3407c454675

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    eb45f25942c48f191a7d169dfa8b990f

    SHA1

    917259162fbeba185eb463fa51b8d54e73b52b28

    SHA256

    bda82a5265441063830fa1f45c4144882aa25cc72b4436a87317c7e00bf4ad1b

    SHA512

    068b030134742f156e24d1f27557c40a9e7079f76180d820117a3d5b24705cee9bd5ea7842e6e5bfaab0b195c5edf8c92890e81a44902fc79b05ace2b14e30c6

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    6ee09be5b1146ef5cfddeb5b2a176617

    SHA1

    fea1d4d4d53efb119a91b14ba5a52bc6ebac0850

    SHA256

    7ddb00fc67f0f39ba2890d5743383cd5b27de151b8f47bc5fdcee6bd9a1aa163

    SHA512

    812285f58b0a39b0ba56e8f10a7dc5b5b8f3f8226f6f44d81a5e2385b01b9b6feabc7b06110169c9f2b6fa4be7feff5a41bd638b9c3f4d95a9af5e0a0295527a

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1019B

    MD5

    b9d829dcdb92a86637c58f29683b488d

    SHA1

    08f28b5f29e7e8646ccbedf1308282f8ef4a0ad3

    SHA256

    911bedf3c8b9aa931ae70f0b2916d2b6deae19acc5f711caa7684dca95bec4a4

    SHA512

    069d53be185ae2a11d5e59007308be1090ac34be58a368e5c8f911f15c30b410355a69deda672bd9766be10d69168f19dd34eea13268b99c87f74b0b78247bed

  • C:\Windows\SysWOW64\HelpMe.exe

    Filesize

    2.4MB

    MD5

    0c4fddaef5a664a708f6a382a6f5bc65

    SHA1

    9c7b78e7ad4d574d635452e072a816566db77603

    SHA256

    464ef662288c249036e9d8fbe507e7905e629847fd30e5068fcb13086c32a3de

    SHA512

    e27f84a2d0364870fd93b8e48b9db23d022152a9515b95f89a7b6bc2a19f1aada1078d228361277e960deb6c403c514bab07060045fe20c5f59fc0611e1d32d2

  • C:\Windows\SysWOW64\HelpMe.exe

    Filesize

    2.4MB

    MD5

    0c4fddaef5a664a708f6a382a6f5bc65

    SHA1

    9c7b78e7ad4d574d635452e072a816566db77603

    SHA256

    464ef662288c249036e9d8fbe507e7905e629847fd30e5068fcb13086c32a3de

    SHA512

    e27f84a2d0364870fd93b8e48b9db23d022152a9515b95f89a7b6bc2a19f1aada1078d228361277e960deb6c403c514bab07060045fe20c5f59fc0611e1d32d2

  • memory/656-245-0x0000000000400000-0x000000000047B000-memory.dmp

    Filesize

    492KB

  • memory/656-139-0x0000000000400000-0x000000000047B000-memory.dmp

    Filesize

    492KB

  • memory/656-140-0x00000000020B0000-0x00000000020B1000-memory.dmp

    Filesize

    4KB

  • memory/2132-133-0x0000000000400000-0x000000000047B000-memory.dmp

    Filesize

    492KB

  • memory/2132-196-0x0000000000400000-0x000000000047B000-memory.dmp

    Filesize

    492KB

  • memory/2132-138-0x0000000000750000-0x0000000000751000-memory.dmp

    Filesize

    4KB