648e8149105b8091860f47d8d81ab0e66ebc1f477b5cc2ad0c606962ac0bd4eb

Analysis

max time kernel
149s
max time network
128s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
31-10-2023 21:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.2023-09-05_fa12972b8fd4e302e1791c4d080498a9_ryuk_JC.exe
Size

21.4MB
MD5

fa12972b8fd4e302e1791c4d080498a9
SHA1

b0b7deea8d40217b6861f3bfd92cf6bb789a9824
SHA256

648e8149105b8091860f47d8d81ab0e66ebc1f477b5cc2ad0c606962ac0bd4eb
SHA512

4bcc74f33bc0853cb8e71a393460fdaa69e76a73c6bd28166eb56d12fba9c2cf3f914ef2f58628d1b9fcbd0dde0d13e6b61e5fc5a5bf3c273c5bb23219cccd74
SSDEEP

98304:9E2RpMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMVMMMYJMMzMk:9nwngnwnBRT

Score

10^/10

persistence ransomware

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	MZ

Renames multiple (91) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	MZ
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe

Executes dropped EXE 2 IoCs

pid	Process
3008	HelpMe.exe
2080	MZ

Loads dropped DLL 4 IoCs

pid	Process
2944	NEAS.2023-09-05_fa12972b8fd4e302e1791c4d080498a9_ryuk_JC.exe
2944	NEAS.2023-09-05_fa12972b8fd4e302e1791c4d080498a9_ryuk_JC.exe
2944	NEAS.2023-09-05_fa12972b8fd4e302e1791c4d080498a9_ryuk_JC.exe
2944	NEAS.2023-09-05_fa12972b8fd4e302e1791c4d080498a9_ryuk_JC.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\G:	MZ
File opened (read-only)	\??\N:	MZ
File opened (read-only)	\??\W:	MZ
File opened (read-only)	\??\X:	MZ
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\K:	MZ
File opened (read-only)	\??\U:	MZ
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\V:	MZ
File opened (read-only)	\??\E:	HelpMe.exe
File opened (read-only)	\??\B:	MZ
File opened (read-only)	\??\I:	MZ
File opened (read-only)	\??\M:	MZ
File opened (read-only)	\??\P:	MZ
File opened (read-only)	\??\R:	MZ
File opened (read-only)	\??\S:	MZ
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\T:	MZ
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\A:	MZ
File opened (read-only)	\??\H:	MZ
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\Y:	MZ
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\E:	MZ
File opened (read-only)	\??\J:	MZ
File opened (read-only)	\??\L:	MZ
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\O:	MZ
File opened (read-only)	\??\Q:	MZ
File opened (read-only)	\??\Z:	MZ
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\AUTORUN.INF	MZ
File opened for modification	F:\AUTORUN.INF	HelpMe.exe
File opened for modification	C:\AUTORUN.INF	MZ

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HelpMe.exe	NEAS.2023-09-05_fa12972b8fd4e302e1791c4d080498a9_ryuk_JC.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	MZ
File opened for modification	C:\Windows\SysWOW64\HelpMe.exe	NEAS.2023-09-05_fa12972b8fd4e302e1791c4d080498a9_ryuk_JC.exe
File created	C:\Windows\SysWOW64\notepad.exe.exe	NEAS.2023-09-05_fa12972b8fd4e302e1791c4d080498a9_ryuk_JC.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Internet Explorer\iexplore.exe.exe	NEAS.2023-09-05_fa12972b8fd4e302e1791c4d080498a9_ryuk_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2944	NEAS.2023-09-05_fa12972b8fd4e302e1791c4d080498a9_ryuk_JC.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 3008	2944	NEAS.2023-09-05_fa12972b8fd4e302e1791c4d080498a9_ryuk_JC.exe	28
PID 2944 wrote to memory of 3008	2944	NEAS.2023-09-05_fa12972b8fd4e302e1791c4d080498a9_ryuk_JC.exe	28
PID 2944 wrote to memory of 3008	2944	NEAS.2023-09-05_fa12972b8fd4e302e1791c4d080498a9_ryuk_JC.exe	28
PID 2944 wrote to memory of 3008	2944	NEAS.2023-09-05_fa12972b8fd4e302e1791c4d080498a9_ryuk_JC.exe	28
PID 2944 wrote to memory of 2080	2944	NEAS.2023-09-05_fa12972b8fd4e302e1791c4d080498a9_ryuk_JC.exe	29
PID 2944 wrote to memory of 2080	2944	NEAS.2023-09-05_fa12972b8fd4e302e1791c4d080498a9_ryuk_JC.exe	29
PID 2944 wrote to memory of 2080	2944	NEAS.2023-09-05_fa12972b8fd4e302e1791c4d080498a9_ryuk_JC.exe	29
PID 2944 wrote to memory of 2080	2944	NEAS.2023-09-05_fa12972b8fd4e302e1791c4d080498a9_ryuk_JC.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-05_fa12972b8fd4e302e1791c4d080498a9_ryuk_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-05_fa12972b8fd4e302e1791c4d080498a9_ryuk_JC.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\SysWOW64\HelpMe.exe
  C:\Windows\system32\HelpMe.exe
  2⤵
  - Modifies WinLogon for persistence
  - Drops startup file
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  PID:3008
- C:\Users\Admin\AppData\Local\Temp\MZ
  C:\Users\Admin\AppData\Local\Temp\\MZ
  2⤵
  - Modifies WinLogon for persistence
  - Drops startup file
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1861898231-3446828954-4278112889-1000\desktop.ini.exe

Filesize
21.4MB

MD5
8a9db2c469e03830f5c601534eabfab2

SHA1
1f59003c0a6242fe55b134948bcef26b51c0b9d2

SHA256
b8b6a09e06a7f39617bea184423e0d6f6431e4dd109f9ee98aa0b9a1e1ed54df

SHA512
0b5121640506f72b4adf6fff10e8a41fb269f185a07fda8950925f3156cdf730849b39c1548b82bdc6a165b13adb968a22dc4d6d302ce874310fec6a631d1e5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MZ

Filesize
21.4MB

MD5
fa12972b8fd4e302e1791c4d080498a9

SHA1
b0b7deea8d40217b6861f3bfd92cf6bb789a9824

SHA256
648e8149105b8091860f47d8d81ab0e66ebc1f477b5cc2ad0c606962ac0bd4eb

SHA512
4bcc74f33bc0853cb8e71a393460fdaa69e76a73c6bd28166eb56d12fba9c2cf3f914ef2f58628d1b9fcbd0dde0d13e6b61e5fc5a5bf3c273c5bb23219cccd74

Download Submit
C:\Users\Admin\AppData\Local\Temp\MZ

Filesize
21.4MB

MD5
fa12972b8fd4e302e1791c4d080498a9

SHA1
b0b7deea8d40217b6861f3bfd92cf6bb789a9824

SHA256
648e8149105b8091860f47d8d81ab0e66ebc1f477b5cc2ad0c606962ac0bd4eb

SHA512
4bcc74f33bc0853cb8e71a393460fdaa69e76a73c6bd28166eb56d12fba9c2cf3f914ef2f58628d1b9fcbd0dde0d13e6b61e5fc5a5bf3c273c5bb23219cccd74

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
954B

MD5
69275ba2a01b89f56209b7b5fc35775f

SHA1
1abb6b36d0fcb89addfbe8bee44ee28db7032e30

SHA256
ff835fb339c4cdb72dad2616ec8c4a48528ea90fcfa2d62d0e97aff83e048b64

SHA512
0fece32bc315d9eabd65173a01cf5568e10950d9ad15d6496c0321c3c5e789da7910450c85455a1191cf2079bb14d7843c8d411a8072731b80d8d74759cc1188

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
996B

MD5
8dc2e026503064c08e1e5c8e7bcfb3e8

SHA1
32d072680794c1115ec69a3dd0a7e18d24af1abb

SHA256
47ba3e70ee93b0704be9ed3c75b55b436484d26920ba1cdf0eebd473807eff64

SHA512
511aad74e1305eeed9fdfdbd094561eb033526bd907a10881b2ad2fdf92faf0b1115c0d037d4508ad1cddaee507d489734b9196439c4c2a141af2c1644cf17a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
996B

MD5
8dc2e026503064c08e1e5c8e7bcfb3e8

SHA1
32d072680794c1115ec69a3dd0a7e18d24af1abb

SHA256
47ba3e70ee93b0704be9ed3c75b55b436484d26920ba1cdf0eebd473807eff64

SHA512
511aad74e1305eeed9fdfdbd094561eb033526bd907a10881b2ad2fdf92faf0b1115c0d037d4508ad1cddaee507d489734b9196439c4c2a141af2c1644cf17a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
996B

MD5
8dc2e026503064c08e1e5c8e7bcfb3e8

SHA1
32d072680794c1115ec69a3dd0a7e18d24af1abb

SHA256
47ba3e70ee93b0704be9ed3c75b55b436484d26920ba1cdf0eebd473807eff64

SHA512
511aad74e1305eeed9fdfdbd094561eb033526bd907a10881b2ad2fdf92faf0b1115c0d037d4508ad1cddaee507d489734b9196439c4c2a141af2c1644cf17a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
996B

MD5
8dc2e026503064c08e1e5c8e7bcfb3e8

SHA1
32d072680794c1115ec69a3dd0a7e18d24af1abb

SHA256
47ba3e70ee93b0704be9ed3c75b55b436484d26920ba1cdf0eebd473807eff64

SHA512
511aad74e1305eeed9fdfdbd094561eb033526bd907a10881b2ad2fdf92faf0b1115c0d037d4508ad1cddaee507d489734b9196439c4c2a141af2c1644cf17a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
996B

MD5
8dc2e026503064c08e1e5c8e7bcfb3e8

SHA1
32d072680794c1115ec69a3dd0a7e18d24af1abb

SHA256
47ba3e70ee93b0704be9ed3c75b55b436484d26920ba1cdf0eebd473807eff64

SHA512
511aad74e1305eeed9fdfdbd094561eb033526bd907a10881b2ad2fdf92faf0b1115c0d037d4508ad1cddaee507d489734b9196439c4c2a141af2c1644cf17a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
996B

MD5
8dc2e026503064c08e1e5c8e7bcfb3e8

SHA1
32d072680794c1115ec69a3dd0a7e18d24af1abb

SHA256
47ba3e70ee93b0704be9ed3c75b55b436484d26920ba1cdf0eebd473807eff64

SHA512
511aad74e1305eeed9fdfdbd094561eb033526bd907a10881b2ad2fdf92faf0b1115c0d037d4508ad1cddaee507d489734b9196439c4c2a141af2c1644cf17a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
954B

MD5
69275ba2a01b89f56209b7b5fc35775f

SHA1
1abb6b36d0fcb89addfbe8bee44ee28db7032e30

SHA256
ff835fb339c4cdb72dad2616ec8c4a48528ea90fcfa2d62d0e97aff83e048b64

SHA512
0fece32bc315d9eabd65173a01cf5568e10950d9ad15d6496c0321c3c5e789da7910450c85455a1191cf2079bb14d7843c8d411a8072731b80d8d74759cc1188

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
954B

MD5
69275ba2a01b89f56209b7b5fc35775f

SHA1
1abb6b36d0fcb89addfbe8bee44ee28db7032e30

SHA256
ff835fb339c4cdb72dad2616ec8c4a48528ea90fcfa2d62d0e97aff83e048b64

SHA512
0fece32bc315d9eabd65173a01cf5568e10950d9ad15d6496c0321c3c5e789da7910450c85455a1191cf2079bb14d7843c8d411a8072731b80d8d74759cc1188

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
996B

MD5
8dc2e026503064c08e1e5c8e7bcfb3e8

SHA1
32d072680794c1115ec69a3dd0a7e18d24af1abb

SHA256
47ba3e70ee93b0704be9ed3c75b55b436484d26920ba1cdf0eebd473807eff64

SHA512
511aad74e1305eeed9fdfdbd094561eb033526bd907a10881b2ad2fdf92faf0b1115c0d037d4508ad1cddaee507d489734b9196439c4c2a141af2c1644cf17a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
996B

MD5
8dc2e026503064c08e1e5c8e7bcfb3e8

SHA1
32d072680794c1115ec69a3dd0a7e18d24af1abb

SHA256
47ba3e70ee93b0704be9ed3c75b55b436484d26920ba1cdf0eebd473807eff64

SHA512
511aad74e1305eeed9fdfdbd094561eb033526bd907a10881b2ad2fdf92faf0b1115c0d037d4508ad1cddaee507d489734b9196439c4c2a141af2c1644cf17a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
996B

MD5
8dc2e026503064c08e1e5c8e7bcfb3e8

SHA1
32d072680794c1115ec69a3dd0a7e18d24af1abb

SHA256
47ba3e70ee93b0704be9ed3c75b55b436484d26920ba1cdf0eebd473807eff64

SHA512
511aad74e1305eeed9fdfdbd094561eb033526bd907a10881b2ad2fdf92faf0b1115c0d037d4508ad1cddaee507d489734b9196439c4c2a141af2c1644cf17a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
996B

MD5
be77a55ce368f50ffbe7376111c6c523

SHA1
315302e9817260dee14ba9f365a6261427f17131

SHA256
276301607f25aaaba0f406c20a6a41703f67226ee932676760e574adf7dc8e2f

SHA512
679facfb6de667a13910f5193fb33d0844213b304ff9ba2ecf2c7072c3eec574d93b095d56e2201d23c056064326c3e3c22f690282aa9e5ea3e2b0592c1310d3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
996B

MD5
8dc2e026503064c08e1e5c8e7bcfb3e8

SHA1
32d072680794c1115ec69a3dd0a7e18d24af1abb

SHA256
47ba3e70ee93b0704be9ed3c75b55b436484d26920ba1cdf0eebd473807eff64

SHA512
511aad74e1305eeed9fdfdbd094561eb033526bd907a10881b2ad2fdf92faf0b1115c0d037d4508ad1cddaee507d489734b9196439c4c2a141af2c1644cf17a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
954B

MD5
69275ba2a01b89f56209b7b5fc35775f

SHA1
1abb6b36d0fcb89addfbe8bee44ee28db7032e30

SHA256
ff835fb339c4cdb72dad2616ec8c4a48528ea90fcfa2d62d0e97aff83e048b64

SHA512
0fece32bc315d9eabd65173a01cf5568e10950d9ad15d6496c0321c3c5e789da7910450c85455a1191cf2079bb14d7843c8d411a8072731b80d8d74759cc1188

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
954B

MD5
69275ba2a01b89f56209b7b5fc35775f

SHA1
1abb6b36d0fcb89addfbe8bee44ee28db7032e30

SHA256
ff835fb339c4cdb72dad2616ec8c4a48528ea90fcfa2d62d0e97aff83e048b64

SHA512
0fece32bc315d9eabd65173a01cf5568e10950d9ad15d6496c0321c3c5e789da7910450c85455a1191cf2079bb14d7843c8d411a8072731b80d8d74759cc1188

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
996B

MD5
8dc2e026503064c08e1e5c8e7bcfb3e8

SHA1
32d072680794c1115ec69a3dd0a7e18d24af1abb

SHA256
47ba3e70ee93b0704be9ed3c75b55b436484d26920ba1cdf0eebd473807eff64

SHA512
511aad74e1305eeed9fdfdbd094561eb033526bd907a10881b2ad2fdf92faf0b1115c0d037d4508ad1cddaee507d489734b9196439c4c2a141af2c1644cf17a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
996B

MD5
8dc2e026503064c08e1e5c8e7bcfb3e8

SHA1
32d072680794c1115ec69a3dd0a7e18d24af1abb

SHA256
47ba3e70ee93b0704be9ed3c75b55b436484d26920ba1cdf0eebd473807eff64

SHA512
511aad74e1305eeed9fdfdbd094561eb033526bd907a10881b2ad2fdf92faf0b1115c0d037d4508ad1cddaee507d489734b9196439c4c2a141af2c1644cf17a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
996B

MD5
8dc2e026503064c08e1e5c8e7bcfb3e8

SHA1
32d072680794c1115ec69a3dd0a7e18d24af1abb

SHA256
47ba3e70ee93b0704be9ed3c75b55b436484d26920ba1cdf0eebd473807eff64

SHA512
511aad74e1305eeed9fdfdbd094561eb033526bd907a10881b2ad2fdf92faf0b1115c0d037d4508ad1cddaee507d489734b9196439c4c2a141af2c1644cf17a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
954B

MD5
69275ba2a01b89f56209b7b5fc35775f

SHA1
1abb6b36d0fcb89addfbe8bee44ee28db7032e30

SHA256
ff835fb339c4cdb72dad2616ec8c4a48528ea90fcfa2d62d0e97aff83e048b64

SHA512
0fece32bc315d9eabd65173a01cf5568e10950d9ad15d6496c0321c3c5e789da7910450c85455a1191cf2079bb14d7843c8d411a8072731b80d8d74759cc1188

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
996B

MD5
8dc2e026503064c08e1e5c8e7bcfb3e8

SHA1
32d072680794c1115ec69a3dd0a7e18d24af1abb

SHA256
47ba3e70ee93b0704be9ed3c75b55b436484d26920ba1cdf0eebd473807eff64

SHA512
511aad74e1305eeed9fdfdbd094561eb033526bd907a10881b2ad2fdf92faf0b1115c0d037d4508ad1cddaee507d489734b9196439c4c2a141af2c1644cf17a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
954B

MD5
69275ba2a01b89f56209b7b5fc35775f

SHA1
1abb6b36d0fcb89addfbe8bee44ee28db7032e30

SHA256
ff835fb339c4cdb72dad2616ec8c4a48528ea90fcfa2d62d0e97aff83e048b64

SHA512
0fece32bc315d9eabd65173a01cf5568e10950d9ad15d6496c0321c3c5e789da7910450c85455a1191cf2079bb14d7843c8d411a8072731b80d8d74759cc1188

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
996B

MD5
8dc2e026503064c08e1e5c8e7bcfb3e8

SHA1
32d072680794c1115ec69a3dd0a7e18d24af1abb

SHA256
47ba3e70ee93b0704be9ed3c75b55b436484d26920ba1cdf0eebd473807eff64

SHA512
511aad74e1305eeed9fdfdbd094561eb033526bd907a10881b2ad2fdf92faf0b1115c0d037d4508ad1cddaee507d489734b9196439c4c2a141af2c1644cf17a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
996B

MD5
8dc2e026503064c08e1e5c8e7bcfb3e8

SHA1
32d072680794c1115ec69a3dd0a7e18d24af1abb

SHA256
47ba3e70ee93b0704be9ed3c75b55b436484d26920ba1cdf0eebd473807eff64

SHA512
511aad74e1305eeed9fdfdbd094561eb033526bd907a10881b2ad2fdf92faf0b1115c0d037d4508ad1cddaee507d489734b9196439c4c2a141af2c1644cf17a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
996B

MD5
8dc2e026503064c08e1e5c8e7bcfb3e8

SHA1
32d072680794c1115ec69a3dd0a7e18d24af1abb

SHA256
47ba3e70ee93b0704be9ed3c75b55b436484d26920ba1cdf0eebd473807eff64

SHA512
511aad74e1305eeed9fdfdbd094561eb033526bd907a10881b2ad2fdf92faf0b1115c0d037d4508ad1cddaee507d489734b9196439c4c2a141af2c1644cf17a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
996B

MD5
8dc2e026503064c08e1e5c8e7bcfb3e8

SHA1
32d072680794c1115ec69a3dd0a7e18d24af1abb

SHA256
47ba3e70ee93b0704be9ed3c75b55b436484d26920ba1cdf0eebd473807eff64

SHA512
511aad74e1305eeed9fdfdbd094561eb033526bd907a10881b2ad2fdf92faf0b1115c0d037d4508ad1cddaee507d489734b9196439c4c2a141af2c1644cf17a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
996B

MD5
8dc2e026503064c08e1e5c8e7bcfb3e8

SHA1
32d072680794c1115ec69a3dd0a7e18d24af1abb

SHA256
47ba3e70ee93b0704be9ed3c75b55b436484d26920ba1cdf0eebd473807eff64

SHA512
511aad74e1305eeed9fdfdbd094561eb033526bd907a10881b2ad2fdf92faf0b1115c0d037d4508ad1cddaee507d489734b9196439c4c2a141af2c1644cf17a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
954B

MD5
69275ba2a01b89f56209b7b5fc35775f

SHA1
1abb6b36d0fcb89addfbe8bee44ee28db7032e30

SHA256
ff835fb339c4cdb72dad2616ec8c4a48528ea90fcfa2d62d0e97aff83e048b64

SHA512
0fece32bc315d9eabd65173a01cf5568e10950d9ad15d6496c0321c3c5e789da7910450c85455a1191cf2079bb14d7843c8d411a8072731b80d8d74759cc1188

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
954B

MD5
69275ba2a01b89f56209b7b5fc35775f

SHA1
1abb6b36d0fcb89addfbe8bee44ee28db7032e30

SHA256
ff835fb339c4cdb72dad2616ec8c4a48528ea90fcfa2d62d0e97aff83e048b64

SHA512
0fece32bc315d9eabd65173a01cf5568e10950d9ad15d6496c0321c3c5e789da7910450c85455a1191cf2079bb14d7843c8d411a8072731b80d8d74759cc1188

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
996B

MD5
8dc2e026503064c08e1e5c8e7bcfb3e8

SHA1
32d072680794c1115ec69a3dd0a7e18d24af1abb

SHA256
47ba3e70ee93b0704be9ed3c75b55b436484d26920ba1cdf0eebd473807eff64

SHA512
511aad74e1305eeed9fdfdbd094561eb033526bd907a10881b2ad2fdf92faf0b1115c0d037d4508ad1cddaee507d489734b9196439c4c2a141af2c1644cf17a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
996B

MD5
8dc2e026503064c08e1e5c8e7bcfb3e8

SHA1
32d072680794c1115ec69a3dd0a7e18d24af1abb

SHA256
47ba3e70ee93b0704be9ed3c75b55b436484d26920ba1cdf0eebd473807eff64

SHA512
511aad74e1305eeed9fdfdbd094561eb033526bd907a10881b2ad2fdf92faf0b1115c0d037d4508ad1cddaee507d489734b9196439c4c2a141af2c1644cf17a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
954B

MD5
69275ba2a01b89f56209b7b5fc35775f

SHA1
1abb6b36d0fcb89addfbe8bee44ee28db7032e30

SHA256
ff835fb339c4cdb72dad2616ec8c4a48528ea90fcfa2d62d0e97aff83e048b64

SHA512
0fece32bc315d9eabd65173a01cf5568e10950d9ad15d6496c0321c3c5e789da7910450c85455a1191cf2079bb14d7843c8d411a8072731b80d8d74759cc1188

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
996B

MD5
8dc2e026503064c08e1e5c8e7bcfb3e8

SHA1
32d072680794c1115ec69a3dd0a7e18d24af1abb

SHA256
47ba3e70ee93b0704be9ed3c75b55b436484d26920ba1cdf0eebd473807eff64

SHA512
511aad74e1305eeed9fdfdbd094561eb033526bd907a10881b2ad2fdf92faf0b1115c0d037d4508ad1cddaee507d489734b9196439c4c2a141af2c1644cf17a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
954B

MD5
69275ba2a01b89f56209b7b5fc35775f

SHA1
1abb6b36d0fcb89addfbe8bee44ee28db7032e30

SHA256
ff835fb339c4cdb72dad2616ec8c4a48528ea90fcfa2d62d0e97aff83e048b64

SHA512
0fece32bc315d9eabd65173a01cf5568e10950d9ad15d6496c0321c3c5e789da7910450c85455a1191cf2079bb14d7843c8d411a8072731b80d8d74759cc1188

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
996B

MD5
8dc2e026503064c08e1e5c8e7bcfb3e8

SHA1
32d072680794c1115ec69a3dd0a7e18d24af1abb

SHA256
47ba3e70ee93b0704be9ed3c75b55b436484d26920ba1cdf0eebd473807eff64

SHA512
511aad74e1305eeed9fdfdbd094561eb033526bd907a10881b2ad2fdf92faf0b1115c0d037d4508ad1cddaee507d489734b9196439c4c2a141af2c1644cf17a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
996B

MD5
8dc2e026503064c08e1e5c8e7bcfb3e8

SHA1
32d072680794c1115ec69a3dd0a7e18d24af1abb

SHA256
47ba3e70ee93b0704be9ed3c75b55b436484d26920ba1cdf0eebd473807eff64

SHA512
511aad74e1305eeed9fdfdbd094561eb033526bd907a10881b2ad2fdf92faf0b1115c0d037d4508ad1cddaee507d489734b9196439c4c2a141af2c1644cf17a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
996B

MD5
8dc2e026503064c08e1e5c8e7bcfb3e8

SHA1
32d072680794c1115ec69a3dd0a7e18d24af1abb

SHA256
47ba3e70ee93b0704be9ed3c75b55b436484d26920ba1cdf0eebd473807eff64

SHA512
511aad74e1305eeed9fdfdbd094561eb033526bd907a10881b2ad2fdf92faf0b1115c0d037d4508ad1cddaee507d489734b9196439c4c2a141af2c1644cf17a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
996B

MD5
8dc2e026503064c08e1e5c8e7bcfb3e8

SHA1
32d072680794c1115ec69a3dd0a7e18d24af1abb

SHA256
47ba3e70ee93b0704be9ed3c75b55b436484d26920ba1cdf0eebd473807eff64

SHA512
511aad74e1305eeed9fdfdbd094561eb033526bd907a10881b2ad2fdf92faf0b1115c0d037d4508ad1cddaee507d489734b9196439c4c2a141af2c1644cf17a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
996B

MD5
8dc2e026503064c08e1e5c8e7bcfb3e8

SHA1
32d072680794c1115ec69a3dd0a7e18d24af1abb

SHA256
47ba3e70ee93b0704be9ed3c75b55b436484d26920ba1cdf0eebd473807eff64

SHA512
511aad74e1305eeed9fdfdbd094561eb033526bd907a10881b2ad2fdf92faf0b1115c0d037d4508ad1cddaee507d489734b9196439c4c2a141af2c1644cf17a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
996B

MD5
8dc2e026503064c08e1e5c8e7bcfb3e8

SHA1
32d072680794c1115ec69a3dd0a7e18d24af1abb

SHA256
47ba3e70ee93b0704be9ed3c75b55b436484d26920ba1cdf0eebd473807eff64

SHA512
511aad74e1305eeed9fdfdbd094561eb033526bd907a10881b2ad2fdf92faf0b1115c0d037d4508ad1cddaee507d489734b9196439c4c2a141af2c1644cf17a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
996B

MD5
8dc2e026503064c08e1e5c8e7bcfb3e8

SHA1
32d072680794c1115ec69a3dd0a7e18d24af1abb

SHA256
47ba3e70ee93b0704be9ed3c75b55b436484d26920ba1cdf0eebd473807eff64

SHA512
511aad74e1305eeed9fdfdbd094561eb033526bd907a10881b2ad2fdf92faf0b1115c0d037d4508ad1cddaee507d489734b9196439c4c2a141af2c1644cf17a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
996B

MD5
8dc2e026503064c08e1e5c8e7bcfb3e8

SHA1
32d072680794c1115ec69a3dd0a7e18d24af1abb

SHA256
47ba3e70ee93b0704be9ed3c75b55b436484d26920ba1cdf0eebd473807eff64

SHA512
511aad74e1305eeed9fdfdbd094561eb033526bd907a10881b2ad2fdf92faf0b1115c0d037d4508ad1cddaee507d489734b9196439c4c2a141af2c1644cf17a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
954B

MD5
69275ba2a01b89f56209b7b5fc35775f

SHA1
1abb6b36d0fcb89addfbe8bee44ee28db7032e30

SHA256
ff835fb339c4cdb72dad2616ec8c4a48528ea90fcfa2d62d0e97aff83e048b64

SHA512
0fece32bc315d9eabd65173a01cf5568e10950d9ad15d6496c0321c3c5e789da7910450c85455a1191cf2079bb14d7843c8d411a8072731b80d8d74759cc1188

Download Submit
C:\Windows\SysWOW64\HelpMe.exe

Filesize
20.9MB

MD5
6a69bd2554914d01f6deaf4ea0513375

SHA1
552dfc06280ddf086eec83b046213c357bdf5f5c

SHA256
d51ac7d3f8bee6ca855a7f448f74bec4f0b6af93226b2e60cfd764694408fb97

SHA512
461a7f128791f2cc908562e227b50498e415946dddfc57a56d63fc63c7ccfa6e4153907717319771128d8dc2b40eba7a8b986ef110a25f84618835de7d69842e

Download Submit
C:\Windows\SysWOW64\HelpMe.exe

Filesize
20.9MB

MD5
6a69bd2554914d01f6deaf4ea0513375

SHA1
552dfc06280ddf086eec83b046213c357bdf5f5c

SHA256
d51ac7d3f8bee6ca855a7f448f74bec4f0b6af93226b2e60cfd764694408fb97

SHA512
461a7f128791f2cc908562e227b50498e415946dddfc57a56d63fc63c7ccfa6e4153907717319771128d8dc2b40eba7a8b986ef110a25f84618835de7d69842e

Download Submit
C:\Windows\SysWOW64\HelpMe.exe

Filesize
20.9MB

MD5
6a69bd2554914d01f6deaf4ea0513375

SHA1
552dfc06280ddf086eec83b046213c357bdf5f5c

SHA256
d51ac7d3f8bee6ca855a7f448f74bec4f0b6af93226b2e60cfd764694408fb97

SHA512
461a7f128791f2cc908562e227b50498e415946dddfc57a56d63fc63c7ccfa6e4153907717319771128d8dc2b40eba7a8b986ef110a25f84618835de7d69842e

Download Submit
F:\AUTORUN.INF

Filesize
145B

MD5
ca13857b2fd3895a39f09d9dde3cca97

SHA1
8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

SHA256
cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

SHA512
55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

Download Submit
F:\AutoRun.exe

Filesize
21.4MB

MD5
fa12972b8fd4e302e1791c4d080498a9

SHA1
b0b7deea8d40217b6861f3bfd92cf6bb789a9824

SHA256
648e8149105b8091860f47d8d81ab0e66ebc1f477b5cc2ad0c606962ac0bd4eb

SHA512
4bcc74f33bc0853cb8e71a393460fdaa69e76a73c6bd28166eb56d12fba9c2cf3f914ef2f58628d1b9fcbd0dde0d13e6b61e5fc5a5bf3c273c5bb23219cccd74

Download Submit
\Users\Admin\AppData\Local\Temp\MZ

Filesize
21.4MB

MD5
fa12972b8fd4e302e1791c4d080498a9

SHA1
b0b7deea8d40217b6861f3bfd92cf6bb789a9824

SHA256
648e8149105b8091860f47d8d81ab0e66ebc1f477b5cc2ad0c606962ac0bd4eb

SHA512
4bcc74f33bc0853cb8e71a393460fdaa69e76a73c6bd28166eb56d12fba9c2cf3f914ef2f58628d1b9fcbd0dde0d13e6b61e5fc5a5bf3c273c5bb23219cccd74

Download Submit
\Users\Admin\AppData\Local\Temp\MZ

Filesize
21.4MB

MD5
fa12972b8fd4e302e1791c4d080498a9

SHA1
b0b7deea8d40217b6861f3bfd92cf6bb789a9824

SHA256
648e8149105b8091860f47d8d81ab0e66ebc1f477b5cc2ad0c606962ac0bd4eb

SHA512
4bcc74f33bc0853cb8e71a393460fdaa69e76a73c6bd28166eb56d12fba9c2cf3f914ef2f58628d1b9fcbd0dde0d13e6b61e5fc5a5bf3c273c5bb23219cccd74

Download Submit
\Windows\SysWOW64\HelpMe.exe

Filesize
20.9MB

MD5
6a69bd2554914d01f6deaf4ea0513375

SHA1
552dfc06280ddf086eec83b046213c357bdf5f5c

SHA256
d51ac7d3f8bee6ca855a7f448f74bec4f0b6af93226b2e60cfd764694408fb97

SHA512
461a7f128791f2cc908562e227b50498e415946dddfc57a56d63fc63c7ccfa6e4153907717319771128d8dc2b40eba7a8b986ef110a25f84618835de7d69842e

Download Submit
\Windows\SysWOW64\HelpMe.exe

Filesize
20.9MB

MD5
6a69bd2554914d01f6deaf4ea0513375

SHA1
552dfc06280ddf086eec83b046213c357bdf5f5c

SHA256
d51ac7d3f8bee6ca855a7f448f74bec4f0b6af93226b2e60cfd764694408fb97

SHA512
461a7f128791f2cc908562e227b50498e415946dddfc57a56d63fc63c7ccfa6e4153907717319771128d8dc2b40eba7a8b986ef110a25f84618835de7d69842e

Download Submit
memory/2080-79-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2080-23-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2080-25-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2944-9-0x0000000001E40000-0x0000000001EBB000-memory.dmp

Filesize
492KB

Download
memory/2944-22-0x0000000001E40000-0x0000000001EBB000-memory.dmp

Filesize
492KB

Download
memory/2944-0-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2944-30-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2944-1-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/3008-14-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/3008-11-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3008-31-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download