22ef374836ad7d281f73682692d80f9febe07f8b3910dfee9c06f63ac84e639d

Analysis

max time kernel
147s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
24/05/2023, 05:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2023-05-23_88d95f7a0e35ce04ea56c9e7f676f4b6_ryuk.exe
Size

2.4MB
MD5

88d95f7a0e35ce04ea56c9e7f676f4b6
SHA1

b4de893d1a4d9686653c97b47c8b50345b70312a
SHA256

22ef374836ad7d281f73682692d80f9febe07f8b3910dfee9c06f63ac84e639d
SHA512

d1de00af08e5380b2c5df27a03ff493e154dc386795b79fe3c3519be363c503320e37ea99da46342a00d7cd2a9d548a4df0ad95d63dfee749854da2c18cdad8b
SSDEEP

12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCu:eEtl9mRda12sX7hKB8NIyXbacAfF

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	2023-05-23_88d95f7a0e35ce04ea56c9e7f676f4b6_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	2023-05-23_88d95f7a0e35ce04ea56c9e7f676f4b6_ryuk.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	2023-05-23_88d95f7a0e35ce04ea56c9e7f676f4b6_ryuk.exe

Executes dropped EXE 1 IoCs

pid	Process
760	HelpMe.exe

Loads dropped DLL 2 IoCs

pid	Process
1744	2023-05-23_88d95f7a0e35ce04ea56c9e7f676f4b6_ryuk.exe
1744	2023-05-23_88d95f7a0e35ce04ea56c9e7f676f4b6_ryuk.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	2023-05-23_88d95f7a0e35ce04ea56c9e7f676f4b6_ryuk.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\F:	2023-05-23_88d95f7a0e35ce04ea56c9e7f676f4b6_ryuk.exe
File opened (read-only)	\??\R:	2023-05-23_88d95f7a0e35ce04ea56c9e7f676f4b6_ryuk.exe
File opened (read-only)	\??\T:	2023-05-23_88d95f7a0e35ce04ea56c9e7f676f4b6_ryuk.exe
File opened (read-only)	\??\U:	2023-05-23_88d95f7a0e35ce04ea56c9e7f676f4b6_ryuk.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\P:	2023-05-23_88d95f7a0e35ce04ea56c9e7f676f4b6_ryuk.exe
File opened (read-only)	\??\H:	2023-05-23_88d95f7a0e35ce04ea56c9e7f676f4b6_ryuk.exe
File opened (read-only)	\??\J:	2023-05-23_88d95f7a0e35ce04ea56c9e7f676f4b6_ryuk.exe
File opened (read-only)	\??\F:	HelpMe.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\E:	2023-05-23_88d95f7a0e35ce04ea56c9e7f676f4b6_ryuk.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\A:	2023-05-23_88d95f7a0e35ce04ea56c9e7f676f4b6_ryuk.exe
File opened (read-only)	\??\O:	2023-05-23_88d95f7a0e35ce04ea56c9e7f676f4b6_ryuk.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\B:	2023-05-23_88d95f7a0e35ce04ea56c9e7f676f4b6_ryuk.exe
File opened (read-only)	\??\M:	2023-05-23_88d95f7a0e35ce04ea56c9e7f676f4b6_ryuk.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\L:	2023-05-23_88d95f7a0e35ce04ea56c9e7f676f4b6_ryuk.exe
File opened (read-only)	\??\K:	2023-05-23_88d95f7a0e35ce04ea56c9e7f676f4b6_ryuk.exe
File opened (read-only)	\??\S:	2023-05-23_88d95f7a0e35ce04ea56c9e7f676f4b6_ryuk.exe
File opened (read-only)	\??\X:	2023-05-23_88d95f7a0e35ce04ea56c9e7f676f4b6_ryuk.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\I:	2023-05-23_88d95f7a0e35ce04ea56c9e7f676f4b6_ryuk.exe
File opened (read-only)	\??\N:	2023-05-23_88d95f7a0e35ce04ea56c9e7f676f4b6_ryuk.exe
File opened (read-only)	\??\Q:	2023-05-23_88d95f7a0e35ce04ea56c9e7f676f4b6_ryuk.exe
File opened (read-only)	\??\V:	2023-05-23_88d95f7a0e35ce04ea56c9e7f676f4b6_ryuk.exe
File opened (read-only)	\??\W:	2023-05-23_88d95f7a0e35ce04ea56c9e7f676f4b6_ryuk.exe
File opened (read-only)	\??\Z:	2023-05-23_88d95f7a0e35ce04ea56c9e7f676f4b6_ryuk.exe
File opened (read-only)	\??\E:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\G:	2023-05-23_88d95f7a0e35ce04ea56c9e7f676f4b6_ryuk.exe
File opened (read-only)	\??\R:	HelpMe.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\AUTORUN.INF	2023-05-23_88d95f7a0e35ce04ea56c9e7f676f4b6_ryuk.exe
File opened for modification	C:\AUTORUN.INF	HelpMe.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe
File opened for modification	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe
File created	C:\Windows\SysWOW64\notepad.exe.exe	HelpMe.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	2023-05-23_88d95f7a0e35ce04ea56c9e7f676f4b6_ryuk.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Internet Explorer\iexplore.exe.exe	HelpMe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
760	HelpMe.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 760	1744	2023-05-23_88d95f7a0e35ce04ea56c9e7f676f4b6_ryuk.exe	28
PID 1744 wrote to memory of 760	1744	2023-05-23_88d95f7a0e35ce04ea56c9e7f676f4b6_ryuk.exe	28
PID 1744 wrote to memory of 760	1744	2023-05-23_88d95f7a0e35ce04ea56c9e7f676f4b6_ryuk.exe	28
PID 1744 wrote to memory of 760	1744	2023-05-23_88d95f7a0e35ce04ea56c9e7f676f4b6_ryuk.exe	28

C:\Users\Admin\AppData\Local\Temp\2023-05-23_88d95f7a0e35ce04ea56c9e7f676f4b6_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2023-05-23_88d95f7a0e35ce04ea56c9e7f676f4b6_ryuk.exe"
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\SysWOW64\HelpMe.exe
  C:\Windows\system32\HelpMe.exe
  2⤵
  - Modifies WinLogon for persistence
  - Drops startup file
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  PID:760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2647223082-2067913677-935928954-1000\desktop.ini.exe

Filesize
2.4MB

MD5
69247d27543ad8c0fd18f8893de2ebd3

SHA1
0e138412f1233ba54138a8879f16063a09439c81

SHA256
a1aebf7a780ec803f857fe404a7e1ed6284b8958d0110d1f1e72c9f84fd1d749

SHA512
deabbfed0f3c981d0f46abeb12fcfc66228fc7ece65ea892e9a10bc31236cf093ec8520c3cb5c5b94bfecc89f71f72567994a59bbc3b32e30e5243fbe224871c

Download Submit
C:\AUTORUN.INF

Filesize
145B

MD5
ca13857b2fd3895a39f09d9dde3cca97

SHA1
8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

SHA256
cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

SHA512
55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

Download Submit
C:\AutoRun.exe

Filesize
2.4MB

MD5
88d95f7a0e35ce04ea56c9e7f676f4b6

SHA1
b4de893d1a4d9686653c97b47c8b50345b70312a

SHA256
22ef374836ad7d281f73682692d80f9febe07f8b3910dfee9c06f63ac84e639d

SHA512
d1de00af08e5380b2c5df27a03ff493e154dc386795b79fe3c3519be363c503320e37ea99da46342a00d7cd2a9d548a4df0ad95d63dfee749854da2c18cdad8b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
950B

MD5
c1743989eae364d1f36605310a7ee32f

SHA1
9baf19ed796baab5580378e08b22de0bb8002fea

SHA256
f5eb2927db97a53f23147ab76d207398018a63bde0c3180524c5848ca4944090

SHA512
e58f47cafe716a15545dffb1899317a2c33dbf13c4c27fc6ea821103e260186f0a6ba929d267d423b4a30cbc88057f8f033061d2281412b080f6d58249522f8d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
d4ce19da814ec5ac6a912c5caaa469e9

SHA1
c4488948f12cab894cc17e864cb537a3a88c20ae

SHA256
6eb0b3578e8b504286041c5a353fd79e946f7883d59d86633cb2306c0bf46046

SHA512
7354884255c1f156716b0afeb97873636161c5cd178b3d646d90494cb55768925d06b47015262305afbc66c604b2de985f087d4493fe725ba5510ada4a06ba03

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
950B

MD5
c1743989eae364d1f36605310a7ee32f

SHA1
9baf19ed796baab5580378e08b22de0bb8002fea

SHA256
f5eb2927db97a53f23147ab76d207398018a63bde0c3180524c5848ca4944090

SHA512
e58f47cafe716a15545dffb1899317a2c33dbf13c4c27fc6ea821103e260186f0a6ba929d267d423b4a30cbc88057f8f033061d2281412b080f6d58249522f8d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
d4ce19da814ec5ac6a912c5caaa469e9

SHA1
c4488948f12cab894cc17e864cb537a3a88c20ae

SHA256
6eb0b3578e8b504286041c5a353fd79e946f7883d59d86633cb2306c0bf46046

SHA512
7354884255c1f156716b0afeb97873636161c5cd178b3d646d90494cb55768925d06b47015262305afbc66c604b2de985f087d4493fe725ba5510ada4a06ba03

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
950B

MD5
c1743989eae364d1f36605310a7ee32f

SHA1
9baf19ed796baab5580378e08b22de0bb8002fea

SHA256
f5eb2927db97a53f23147ab76d207398018a63bde0c3180524c5848ca4944090

SHA512
e58f47cafe716a15545dffb1899317a2c33dbf13c4c27fc6ea821103e260186f0a6ba929d267d423b4a30cbc88057f8f033061d2281412b080f6d58249522f8d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
d4ce19da814ec5ac6a912c5caaa469e9

SHA1
c4488948f12cab894cc17e864cb537a3a88c20ae

SHA256
6eb0b3578e8b504286041c5a353fd79e946f7883d59d86633cb2306c0bf46046

SHA512
7354884255c1f156716b0afeb97873636161c5cd178b3d646d90494cb55768925d06b47015262305afbc66c604b2de985f087d4493fe725ba5510ada4a06ba03

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
950B

MD5
c1743989eae364d1f36605310a7ee32f

SHA1
9baf19ed796baab5580378e08b22de0bb8002fea

SHA256
f5eb2927db97a53f23147ab76d207398018a63bde0c3180524c5848ca4944090

SHA512
e58f47cafe716a15545dffb1899317a2c33dbf13c4c27fc6ea821103e260186f0a6ba929d267d423b4a30cbc88057f8f033061d2281412b080f6d58249522f8d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
d4ce19da814ec5ac6a912c5caaa469e9

SHA1
c4488948f12cab894cc17e864cb537a3a88c20ae

SHA256
6eb0b3578e8b504286041c5a353fd79e946f7883d59d86633cb2306c0bf46046

SHA512
7354884255c1f156716b0afeb97873636161c5cd178b3d646d90494cb55768925d06b47015262305afbc66c604b2de985f087d4493fe725ba5510ada4a06ba03

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
d4ce19da814ec5ac6a912c5caaa469e9

SHA1
c4488948f12cab894cc17e864cb537a3a88c20ae

SHA256
6eb0b3578e8b504286041c5a353fd79e946f7883d59d86633cb2306c0bf46046

SHA512
7354884255c1f156716b0afeb97873636161c5cd178b3d646d90494cb55768925d06b47015262305afbc66c604b2de985f087d4493fe725ba5510ada4a06ba03

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
950B

MD5
c1743989eae364d1f36605310a7ee32f

SHA1
9baf19ed796baab5580378e08b22de0bb8002fea

SHA256
f5eb2927db97a53f23147ab76d207398018a63bde0c3180524c5848ca4944090

SHA512
e58f47cafe716a15545dffb1899317a2c33dbf13c4c27fc6ea821103e260186f0a6ba929d267d423b4a30cbc88057f8f033061d2281412b080f6d58249522f8d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
950B

MD5
c1743989eae364d1f36605310a7ee32f

SHA1
9baf19ed796baab5580378e08b22de0bb8002fea

SHA256
f5eb2927db97a53f23147ab76d207398018a63bde0c3180524c5848ca4944090

SHA512
e58f47cafe716a15545dffb1899317a2c33dbf13c4c27fc6ea821103e260186f0a6ba929d267d423b4a30cbc88057f8f033061d2281412b080f6d58249522f8d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
950B

MD5
c1743989eae364d1f36605310a7ee32f

SHA1
9baf19ed796baab5580378e08b22de0bb8002fea

SHA256
f5eb2927db97a53f23147ab76d207398018a63bde0c3180524c5848ca4944090

SHA512
e58f47cafe716a15545dffb1899317a2c33dbf13c4c27fc6ea821103e260186f0a6ba929d267d423b4a30cbc88057f8f033061d2281412b080f6d58249522f8d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
950B

MD5
c1743989eae364d1f36605310a7ee32f

SHA1
9baf19ed796baab5580378e08b22de0bb8002fea

SHA256
f5eb2927db97a53f23147ab76d207398018a63bde0c3180524c5848ca4944090

SHA512
e58f47cafe716a15545dffb1899317a2c33dbf13c4c27fc6ea821103e260186f0a6ba929d267d423b4a30cbc88057f8f033061d2281412b080f6d58249522f8d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
950B

MD5
c1743989eae364d1f36605310a7ee32f

SHA1
9baf19ed796baab5580378e08b22de0bb8002fea

SHA256
f5eb2927db97a53f23147ab76d207398018a63bde0c3180524c5848ca4944090

SHA512
e58f47cafe716a15545dffb1899317a2c33dbf13c4c27fc6ea821103e260186f0a6ba929d267d423b4a30cbc88057f8f033061d2281412b080f6d58249522f8d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
950B

MD5
c1743989eae364d1f36605310a7ee32f

SHA1
9baf19ed796baab5580378e08b22de0bb8002fea

SHA256
f5eb2927db97a53f23147ab76d207398018a63bde0c3180524c5848ca4944090

SHA512
e58f47cafe716a15545dffb1899317a2c33dbf13c4c27fc6ea821103e260186f0a6ba929d267d423b4a30cbc88057f8f033061d2281412b080f6d58249522f8d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
d4ce19da814ec5ac6a912c5caaa469e9

SHA1
c4488948f12cab894cc17e864cb537a3a88c20ae

SHA256
6eb0b3578e8b504286041c5a353fd79e946f7883d59d86633cb2306c0bf46046

SHA512
7354884255c1f156716b0afeb97873636161c5cd178b3d646d90494cb55768925d06b47015262305afbc66c604b2de985f087d4493fe725ba5510ada4a06ba03

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
950B

MD5
c1743989eae364d1f36605310a7ee32f

SHA1
9baf19ed796baab5580378e08b22de0bb8002fea

SHA256
f5eb2927db97a53f23147ab76d207398018a63bde0c3180524c5848ca4944090

SHA512
e58f47cafe716a15545dffb1899317a2c33dbf13c4c27fc6ea821103e260186f0a6ba929d267d423b4a30cbc88057f8f033061d2281412b080f6d58249522f8d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
d4ce19da814ec5ac6a912c5caaa469e9

SHA1
c4488948f12cab894cc17e864cb537a3a88c20ae

SHA256
6eb0b3578e8b504286041c5a353fd79e946f7883d59d86633cb2306c0bf46046

SHA512
7354884255c1f156716b0afeb97873636161c5cd178b3d646d90494cb55768925d06b47015262305afbc66c604b2de985f087d4493fe725ba5510ada4a06ba03

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
950B

MD5
c1743989eae364d1f36605310a7ee32f

SHA1
9baf19ed796baab5580378e08b22de0bb8002fea

SHA256
f5eb2927db97a53f23147ab76d207398018a63bde0c3180524c5848ca4944090

SHA512
e58f47cafe716a15545dffb1899317a2c33dbf13c4c27fc6ea821103e260186f0a6ba929d267d423b4a30cbc88057f8f033061d2281412b080f6d58249522f8d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
950B

MD5
c1743989eae364d1f36605310a7ee32f

SHA1
9baf19ed796baab5580378e08b22de0bb8002fea

SHA256
f5eb2927db97a53f23147ab76d207398018a63bde0c3180524c5848ca4944090

SHA512
e58f47cafe716a15545dffb1899317a2c33dbf13c4c27fc6ea821103e260186f0a6ba929d267d423b4a30cbc88057f8f033061d2281412b080f6d58249522f8d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
d4ce19da814ec5ac6a912c5caaa469e9

SHA1
c4488948f12cab894cc17e864cb537a3a88c20ae

SHA256
6eb0b3578e8b504286041c5a353fd79e946f7883d59d86633cb2306c0bf46046

SHA512
7354884255c1f156716b0afeb97873636161c5cd178b3d646d90494cb55768925d06b47015262305afbc66c604b2de985f087d4493fe725ba5510ada4a06ba03

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
950B

MD5
c1743989eae364d1f36605310a7ee32f

SHA1
9baf19ed796baab5580378e08b22de0bb8002fea

SHA256
f5eb2927db97a53f23147ab76d207398018a63bde0c3180524c5848ca4944090

SHA512
e58f47cafe716a15545dffb1899317a2c33dbf13c4c27fc6ea821103e260186f0a6ba929d267d423b4a30cbc88057f8f033061d2281412b080f6d58249522f8d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
950B

MD5
c1743989eae364d1f36605310a7ee32f

SHA1
9baf19ed796baab5580378e08b22de0bb8002fea

SHA256
f5eb2927db97a53f23147ab76d207398018a63bde0c3180524c5848ca4944090

SHA512
e58f47cafe716a15545dffb1899317a2c33dbf13c4c27fc6ea821103e260186f0a6ba929d267d423b4a30cbc88057f8f033061d2281412b080f6d58249522f8d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
d4ce19da814ec5ac6a912c5caaa469e9

SHA1
c4488948f12cab894cc17e864cb537a3a88c20ae

SHA256
6eb0b3578e8b504286041c5a353fd79e946f7883d59d86633cb2306c0bf46046

SHA512
7354884255c1f156716b0afeb97873636161c5cd178b3d646d90494cb55768925d06b47015262305afbc66c604b2de985f087d4493fe725ba5510ada4a06ba03

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
950B

MD5
c1743989eae364d1f36605310a7ee32f

SHA1
9baf19ed796baab5580378e08b22de0bb8002fea

SHA256
f5eb2927db97a53f23147ab76d207398018a63bde0c3180524c5848ca4944090

SHA512
e58f47cafe716a15545dffb1899317a2c33dbf13c4c27fc6ea821103e260186f0a6ba929d267d423b4a30cbc88057f8f033061d2281412b080f6d58249522f8d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
d4ce19da814ec5ac6a912c5caaa469e9

SHA1
c4488948f12cab894cc17e864cb537a3a88c20ae

SHA256
6eb0b3578e8b504286041c5a353fd79e946f7883d59d86633cb2306c0bf46046

SHA512
7354884255c1f156716b0afeb97873636161c5cd178b3d646d90494cb55768925d06b47015262305afbc66c604b2de985f087d4493fe725ba5510ada4a06ba03

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
950B

MD5
c1743989eae364d1f36605310a7ee32f

SHA1
9baf19ed796baab5580378e08b22de0bb8002fea

SHA256
f5eb2927db97a53f23147ab76d207398018a63bde0c3180524c5848ca4944090

SHA512
e58f47cafe716a15545dffb1899317a2c33dbf13c4c27fc6ea821103e260186f0a6ba929d267d423b4a30cbc88057f8f033061d2281412b080f6d58249522f8d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
950B

MD5
c1743989eae364d1f36605310a7ee32f

SHA1
9baf19ed796baab5580378e08b22de0bb8002fea

SHA256
f5eb2927db97a53f23147ab76d207398018a63bde0c3180524c5848ca4944090

SHA512
e58f47cafe716a15545dffb1899317a2c33dbf13c4c27fc6ea821103e260186f0a6ba929d267d423b4a30cbc88057f8f033061d2281412b080f6d58249522f8d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
950B

MD5
c1743989eae364d1f36605310a7ee32f

SHA1
9baf19ed796baab5580378e08b22de0bb8002fea

SHA256
f5eb2927db97a53f23147ab76d207398018a63bde0c3180524c5848ca4944090

SHA512
e58f47cafe716a15545dffb1899317a2c33dbf13c4c27fc6ea821103e260186f0a6ba929d267d423b4a30cbc88057f8f033061d2281412b080f6d58249522f8d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
950B

MD5
c1743989eae364d1f36605310a7ee32f

SHA1
9baf19ed796baab5580378e08b22de0bb8002fea

SHA256
f5eb2927db97a53f23147ab76d207398018a63bde0c3180524c5848ca4944090

SHA512
e58f47cafe716a15545dffb1899317a2c33dbf13c4c27fc6ea821103e260186f0a6ba929d267d423b4a30cbc88057f8f033061d2281412b080f6d58249522f8d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
950B

MD5
c1743989eae364d1f36605310a7ee32f

SHA1
9baf19ed796baab5580378e08b22de0bb8002fea

SHA256
f5eb2927db97a53f23147ab76d207398018a63bde0c3180524c5848ca4944090

SHA512
e58f47cafe716a15545dffb1899317a2c33dbf13c4c27fc6ea821103e260186f0a6ba929d267d423b4a30cbc88057f8f033061d2281412b080f6d58249522f8d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
d4ce19da814ec5ac6a912c5caaa469e9

SHA1
c4488948f12cab894cc17e864cb537a3a88c20ae

SHA256
6eb0b3578e8b504286041c5a353fd79e946f7883d59d86633cb2306c0bf46046

SHA512
7354884255c1f156716b0afeb97873636161c5cd178b3d646d90494cb55768925d06b47015262305afbc66c604b2de985f087d4493fe725ba5510ada4a06ba03

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
950B

MD5
c1743989eae364d1f36605310a7ee32f

SHA1
9baf19ed796baab5580378e08b22de0bb8002fea

SHA256
f5eb2927db97a53f23147ab76d207398018a63bde0c3180524c5848ca4944090

SHA512
e58f47cafe716a15545dffb1899317a2c33dbf13c4c27fc6ea821103e260186f0a6ba929d267d423b4a30cbc88057f8f033061d2281412b080f6d58249522f8d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
950B

MD5
c1743989eae364d1f36605310a7ee32f

SHA1
9baf19ed796baab5580378e08b22de0bb8002fea

SHA256
f5eb2927db97a53f23147ab76d207398018a63bde0c3180524c5848ca4944090

SHA512
e58f47cafe716a15545dffb1899317a2c33dbf13c4c27fc6ea821103e260186f0a6ba929d267d423b4a30cbc88057f8f033061d2281412b080f6d58249522f8d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
d4ce19da814ec5ac6a912c5caaa469e9

SHA1
c4488948f12cab894cc17e864cb537a3a88c20ae

SHA256
6eb0b3578e8b504286041c5a353fd79e946f7883d59d86633cb2306c0bf46046

SHA512
7354884255c1f156716b0afeb97873636161c5cd178b3d646d90494cb55768925d06b47015262305afbc66c604b2de985f087d4493fe725ba5510ada4a06ba03

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
950B

MD5
c1743989eae364d1f36605310a7ee32f

SHA1
9baf19ed796baab5580378e08b22de0bb8002fea

SHA256
f5eb2927db97a53f23147ab76d207398018a63bde0c3180524c5848ca4944090

SHA512
e58f47cafe716a15545dffb1899317a2c33dbf13c4c27fc6ea821103e260186f0a6ba929d267d423b4a30cbc88057f8f033061d2281412b080f6d58249522f8d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
d4ce19da814ec5ac6a912c5caaa469e9

SHA1
c4488948f12cab894cc17e864cb537a3a88c20ae

SHA256
6eb0b3578e8b504286041c5a353fd79e946f7883d59d86633cb2306c0bf46046

SHA512
7354884255c1f156716b0afeb97873636161c5cd178b3d646d90494cb55768925d06b47015262305afbc66c604b2de985f087d4493fe725ba5510ada4a06ba03

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
950B

MD5
c1743989eae364d1f36605310a7ee32f

SHA1
9baf19ed796baab5580378e08b22de0bb8002fea

SHA256
f5eb2927db97a53f23147ab76d207398018a63bde0c3180524c5848ca4944090

SHA512
e58f47cafe716a15545dffb1899317a2c33dbf13c4c27fc6ea821103e260186f0a6ba929d267d423b4a30cbc88057f8f033061d2281412b080f6d58249522f8d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
950B

MD5
c1743989eae364d1f36605310a7ee32f

SHA1
9baf19ed796baab5580378e08b22de0bb8002fea

SHA256
f5eb2927db97a53f23147ab76d207398018a63bde0c3180524c5848ca4944090

SHA512
e58f47cafe716a15545dffb1899317a2c33dbf13c4c27fc6ea821103e260186f0a6ba929d267d423b4a30cbc88057f8f033061d2281412b080f6d58249522f8d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
d4ce19da814ec5ac6a912c5caaa469e9

SHA1
c4488948f12cab894cc17e864cb537a3a88c20ae

SHA256
6eb0b3578e8b504286041c5a353fd79e946f7883d59d86633cb2306c0bf46046

SHA512
7354884255c1f156716b0afeb97873636161c5cd178b3d646d90494cb55768925d06b47015262305afbc66c604b2de985f087d4493fe725ba5510ada4a06ba03

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
950B

MD5
c1743989eae364d1f36605310a7ee32f

SHA1
9baf19ed796baab5580378e08b22de0bb8002fea

SHA256
f5eb2927db97a53f23147ab76d207398018a63bde0c3180524c5848ca4944090

SHA512
e58f47cafe716a15545dffb1899317a2c33dbf13c4c27fc6ea821103e260186f0a6ba929d267d423b4a30cbc88057f8f033061d2281412b080f6d58249522f8d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
d4ce19da814ec5ac6a912c5caaa469e9

SHA1
c4488948f12cab894cc17e864cb537a3a88c20ae

SHA256
6eb0b3578e8b504286041c5a353fd79e946f7883d59d86633cb2306c0bf46046

SHA512
7354884255c1f156716b0afeb97873636161c5cd178b3d646d90494cb55768925d06b47015262305afbc66c604b2de985f087d4493fe725ba5510ada4a06ba03

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
950B

MD5
c1743989eae364d1f36605310a7ee32f

SHA1
9baf19ed796baab5580378e08b22de0bb8002fea

SHA256
f5eb2927db97a53f23147ab76d207398018a63bde0c3180524c5848ca4944090

SHA512
e58f47cafe716a15545dffb1899317a2c33dbf13c4c27fc6ea821103e260186f0a6ba929d267d423b4a30cbc88057f8f033061d2281412b080f6d58249522f8d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
950B

MD5
c1743989eae364d1f36605310a7ee32f

SHA1
9baf19ed796baab5580378e08b22de0bb8002fea

SHA256
f5eb2927db97a53f23147ab76d207398018a63bde0c3180524c5848ca4944090

SHA512
e58f47cafe716a15545dffb1899317a2c33dbf13c4c27fc6ea821103e260186f0a6ba929d267d423b4a30cbc88057f8f033061d2281412b080f6d58249522f8d

Download Submit
C:\Windows\SysWOW64\HelpMe.exe

Filesize
2.4MB

MD5
4fcabd6af524fb70e356d08e610521f2

SHA1
f104637706390fd5f304e0ae671487f50e9b1c04

SHA256
7d75df18d2b20161d728fc950d7adaa0ff0e1bb8e9447787b90942aad407b61a

SHA512
970d7df16ad5aa7517fc68bed5e394a4f08a3ce8de6c4a3c8f055626b38ab45eeda63149a9051bde26559946bb3cfbe7d0f7e373730ea53c59fd83e5c9944697

Download Submit
C:\Windows\SysWOW64\HelpMe.exe

Filesize
2.4MB

MD5
4fcabd6af524fb70e356d08e610521f2

SHA1
f104637706390fd5f304e0ae671487f50e9b1c04

SHA256
7d75df18d2b20161d728fc950d7adaa0ff0e1bb8e9447787b90942aad407b61a

SHA512
970d7df16ad5aa7517fc68bed5e394a4f08a3ce8de6c4a3c8f055626b38ab45eeda63149a9051bde26559946bb3cfbe7d0f7e373730ea53c59fd83e5c9944697

Download Submit
C:\Windows\SysWOW64\HelpMe.exe

Filesize
2.4MB

MD5
4fcabd6af524fb70e356d08e610521f2

SHA1
f104637706390fd5f304e0ae671487f50e9b1c04

SHA256
7d75df18d2b20161d728fc950d7adaa0ff0e1bb8e9447787b90942aad407b61a

SHA512
970d7df16ad5aa7517fc68bed5e394a4f08a3ce8de6c4a3c8f055626b38ab45eeda63149a9051bde26559946bb3cfbe7d0f7e373730ea53c59fd83e5c9944697

Download Submit
\Windows\SysWOW64\HelpMe.exe

Filesize
2.4MB

MD5
4fcabd6af524fb70e356d08e610521f2

SHA1
f104637706390fd5f304e0ae671487f50e9b1c04

SHA256
7d75df18d2b20161d728fc950d7adaa0ff0e1bb8e9447787b90942aad407b61a

SHA512
970d7df16ad5aa7517fc68bed5e394a4f08a3ce8de6c4a3c8f055626b38ab45eeda63149a9051bde26559946bb3cfbe7d0f7e373730ea53c59fd83e5c9944697

Download Submit
\Windows\SysWOW64\HelpMe.exe

Filesize
2.4MB

MD5
4fcabd6af524fb70e356d08e610521f2

SHA1
f104637706390fd5f304e0ae671487f50e9b1c04

SHA256
7d75df18d2b20161d728fc950d7adaa0ff0e1bb8e9447787b90942aad407b61a

SHA512
970d7df16ad5aa7517fc68bed5e394a4f08a3ce8de6c4a3c8f055626b38ab45eeda63149a9051bde26559946bb3cfbe7d0f7e373730ea53c59fd83e5c9944697

Download Submit
memory/760-267-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/760-71-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/760-70-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1744-266-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1744-69-0x0000000000480000-0x00000000004FB000-memory.dmp

Filesize
492KB

Download
memory/1744-68-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1744-67-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download