81aa4fa2f5b0c027e5939a1615929cf4d58db3ccf38744ad06d6e7f85a2a85f9

Analysis

max time kernel
145s
max time network
50s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26-04-2024 16:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

012c0953d1803e4e3f6a0c2183d22dd2_JaffaCakes118.exe
Size

3.8MB
MD5

012c0953d1803e4e3f6a0c2183d22dd2
SHA1

f37b8d2be55a81475cb90288d8f3b0b7e7f322c3
SHA256

81aa4fa2f5b0c027e5939a1615929cf4d58db3ccf38744ad06d6e7f85a2a85f9
SHA512

121d6d049e5c0d25e7d49c83d2b04c7ee6809371c40e9f26d0bec9167b95af6268c597d76e421f98e08ee3217422b5f6df911ac885a16dacd08f096b129f4b4d
SSDEEP

49152:hEs1UfPOgo7kMcbnKc/7PW9kwUidyZNSLx4qtamNzM1nEAadHi04:hE2UfzMc0MNSL14

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

012c0953d1803e4e3f6a0c2183d22dd2_JaffaCakes118.exeHelpMe.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	012c0953d1803e4e3f6a0c2183d22dd2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe

Drops startup file 3 IoCs

Processes:

HelpMe.exe012c0953d1803e4e3f6a0c2183d22dd2_JaffaCakes118.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	012c0953d1803e4e3f6a0c2183d22dd2_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe

Executes dropped EXE 1 IoCs

Processes:

HelpMe.exe

pid process

4836 HelpMe.exe

pid	process
4836	HelpMe.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

HelpMe.exe012c0953d1803e4e3f6a0c2183d22dd2_JaffaCakes118.exe

description	ioc	process
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\V:	012c0953d1803e4e3f6a0c2183d22dd2_JaffaCakes118.exe
File opened (read-only)	\??\W:	012c0953d1803e4e3f6a0c2183d22dd2_JaffaCakes118.exe
File opened (read-only)	\??\Y:	012c0953d1803e4e3f6a0c2183d22dd2_JaffaCakes118.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\Z:	012c0953d1803e4e3f6a0c2183d22dd2_JaffaCakes118.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\H:	012c0953d1803e4e3f6a0c2183d22dd2_JaffaCakes118.exe
File opened (read-only)	\??\J:	012c0953d1803e4e3f6a0c2183d22dd2_JaffaCakes118.exe
File opened (read-only)	\??\K:	012c0953d1803e4e3f6a0c2183d22dd2_JaffaCakes118.exe
File opened (read-only)	\??\N:	012c0953d1803e4e3f6a0c2183d22dd2_JaffaCakes118.exe
File opened (read-only)	\??\T:	012c0953d1803e4e3f6a0c2183d22dd2_JaffaCakes118.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\E:	012c0953d1803e4e3f6a0c2183d22dd2_JaffaCakes118.exe
File opened (read-only)	\??\L:	012c0953d1803e4e3f6a0c2183d22dd2_JaffaCakes118.exe
File opened (read-only)	\??\S:	012c0953d1803e4e3f6a0c2183d22dd2_JaffaCakes118.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\E:	HelpMe.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\O:	012c0953d1803e4e3f6a0c2183d22dd2_JaffaCakes118.exe
File opened (read-only)	\??\U:	012c0953d1803e4e3f6a0c2183d22dd2_JaffaCakes118.exe
File opened (read-only)	\??\X:	012c0953d1803e4e3f6a0c2183d22dd2_JaffaCakes118.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\I:	012c0953d1803e4e3f6a0c2183d22dd2_JaffaCakes118.exe
File opened (read-only)	\??\Q:	012c0953d1803e4e3f6a0c2183d22dd2_JaffaCakes118.exe
File opened (read-only)	\??\R:	012c0953d1803e4e3f6a0c2183d22dd2_JaffaCakes118.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\G:	012c0953d1803e4e3f6a0c2183d22dd2_JaffaCakes118.exe
File opened (read-only)	\??\M:	012c0953d1803e4e3f6a0c2183d22dd2_JaffaCakes118.exe
File opened (read-only)	\??\A:	012c0953d1803e4e3f6a0c2183d22dd2_JaffaCakes118.exe
File opened (read-only)	\??\B:	012c0953d1803e4e3f6a0c2183d22dd2_JaffaCakes118.exe
File opened (read-only)	\??\P:	012c0953d1803e4e3f6a0c2183d22dd2_JaffaCakes118.exe
File opened (read-only)	\??\H:	HelpMe.exe

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

012c0953d1803e4e3f6a0c2183d22dd2_JaffaCakes118.exeHelpMe.exe

description	ioc	process
File opened for modification	F:\AUTORUN.INF	012c0953d1803e4e3f6a0c2183d22dd2_JaffaCakes118.exe
File opened for modification	C:\AUTORUN.INF	012c0953d1803e4e3f6a0c2183d22dd2_JaffaCakes118.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe

Drops file in System32 directory 2 IoCs

Processes:

012c0953d1803e4e3f6a0c2183d22dd2_JaffaCakes118.exeHelpMe.exe

description	ioc	process
File created	C:\Windows\SysWOW64\HelpMe.exe	012c0953d1803e4e3f6a0c2183d22dd2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

012c0953d1803e4e3f6a0c2183d22dd2_JaffaCakes118.exe

description	pid	process	target process
PID 2036 wrote to memory of 4836	2036	012c0953d1803e4e3f6a0c2183d22dd2_JaffaCakes118.exe	HelpMe.exe
PID 2036 wrote to memory of 4836	2036	012c0953d1803e4e3f6a0c2183d22dd2_JaffaCakes118.exe	HelpMe.exe
PID 2036 wrote to memory of 4836	2036	012c0953d1803e4e3f6a0c2183d22dd2_JaffaCakes118.exe	HelpMe.exe

C:\Users\Admin\AppData\Local\Temp\012c0953d1803e4e3f6a0c2183d22dd2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\012c0953d1803e4e3f6a0c2183d22dd2_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\SysWOW64\HelpMe.exe
C:\Windows\system32\HelpMe.exe
2⤵
- Modifies WinLogon for persistence
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
PID:4836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-877519540-908060166-1852957295-1000\desktop.ini.exe

Filesize
3.8MB

MD5
d5bb1252ac655bb93e337b9b1c9e16d5

SHA1
c741f874e2781c749bd0f2cba6818bd619afcb9d

SHA256
c98fd02332ac25c8130117c7ea4e3e852d230f87c83aac20b9da51d4082d584f

SHA512
a7e03abdd20c67c2c16c1cedb439ceed42d249378d6fd6b809980b469fa144de3f469ab294f869770cef46f24a947466fc4439c85929bcc33389fa2f3e00c115

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
d6f858b58b7b6ac7bdb7f15602c5bd2e

SHA1
dad44e591c11dc73118cea6621681e729a017bee

SHA256
4e4098a6a70c361d36aecaae60d9d5451e217a068cdd09b0146a322ab1f2d9f0

SHA512
8f73d1b0493b7317f8689e6fbbb9bfdcad5541c68364935015901e82533f780d23516047a8eac9a8e4091bae4ed845ae8e49c951d3e677ffdbf84ee979cffaf5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
a80ca158829ee5d17455d4881e3c6db6

SHA1
8ac551780cdf04bb9a8ceb54cb44af50926d4226

SHA256
1227b640a68e95a2076e47472f46b0391b2ebfeb735b6ff0653e6dcabf07f98f

SHA512
c05cb19c2dd9b86f5ee59d6e8df54873ee864dd114addf0f2c791deb46b211133f4f3c07b6174c36cee7326120224c3acb80ecdf0e07de59976110142632cf7d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
623e93d8a6f906d23eaef5b74ba66a97

SHA1
204d5a74f01500aa1caab18403526c5494a711ac

SHA256
17057f1cbaf47f053d9214c234e6cb0f1b228f6c73f5f064f9909dfce11ecbed

SHA512
d822a3c405f6cd98c4c2df7c077fd168677684308845fb85bfc4a38051e60294dbba55bbf3830c4b50daa8276d5717231f7ebcf949c56cce6d0d5a732113ea9f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
86308874883e90f6e3f721879ed18f80

SHA1
eb945c20a26d36a1a49c0a115c0cb9d21e8b13b5

SHA256
5421ed98d1f0447b6405392a1b248931f5bc45f90e48c50f34d024a26cbd14e4

SHA512
0a8edd68f78baa78cbc0a1a8248900eb5f6974882fbd86a11713fd04dd9a07cf529a7b738a7024b92b7684cffc8a92729ae02ee6b6c461cf246591126729b201

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
00c2579c3b3d6667197dabbcd48d6c20

SHA1
504175adbfb0b639ce5d8de0fe03b3d5241c6d19

SHA256
53a88b1933445b5be5c9da216adc29015f28220f6d0cf42ca0bcb80f8fba906f

SHA512
168e2c4ab415edfec477f0e3fbdf04577cf8ba064fd2139664f291e265ec22dfc931e019ddb5d5ec00bf68fadb863e03a7182c496d317b8b616c1c8bdb754d2d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
29a86b0f9b14eb9c29cfe76e6642bcf5

SHA1
24e3dd66f73af745562a8c17f8156c38cf98b3e3

SHA256
27424f69a7325892c0523abf198fbe97043e3948984a2247a8fe74e7d7c50761

SHA512
bb2186a32484e6ac0113fda5db60a69d898d52031abbf911ec09cf8aa6d198bfd007126f525c47cc3525bc4a19a0cac243338bd806cb9baf295c586cf08a2670

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
6ae6040b33ded964f612909168a11eb9

SHA1
e4c4ec87b0561409b02ec4f1bfef41c91e269de6

SHA256
852985a64e8c7a93f1e4b82ca5f74e5abebe34ed7f97736c366c5bc7c0477e15

SHA512
469084e737145919cccf1648ee05bfbd367d47a8f80eee5eaf85a2f909fe6ae4f9fc0874fbe72402966a64f3922b3fcc540df4440bf9bae0dc7088d0542a3d24

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
6a47f574ee95fe8cd865404454968611

SHA1
b0c0eddbba1e1653e871b19ae99be0d250f2acea

SHA256
dd8e9921dbd1f29c8e35db417ef856b39c7030ace667080e44171f0ab460603a

SHA512
8b3f982c2ab2b7f5e22d7b1e66323e7d239589bbb573d0c2ed3a8ea1e0d45e73b219eb4fa0276bfa6d3bf6e0bb006675eb70fb8cfc0192001f5cc84a76e1e776

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
392d31329726cf6e0cd975bc87a647c4

SHA1
efb63c3862d5b4d9619830482f12cb26cd01162b

SHA256
6e3c2aa670a92c5dc205b3ea9290f9625dda0c4c94803f1b1719f8d688666d28

SHA512
8d4e92e7255bea4383ad1996efe86875974e9cda9d1a02a5d89d5fe5cb36e84b2db132d382871477e5fd385ad651a1f6c16890e0b9df2c9bbde6081a24beb974

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
b5a4a244f5343601ee7d0d60b2ebb2c9

SHA1
72249009112a8ad288cb804faabf16a23e46bd21

SHA256
1159473019b9387d295e223b56a303fd19d5765247edc7b5442f2ee815ca241a

SHA512
7ba4e39bcff385dea9454c9f513cf728452ad035d3ee94d2d2b225a66c63c5d7c5129d17e2ccc1959ed97043ace965565605e8fea12178aa06385d5d8a8273b7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
200a160fcd1db26ad5f90b06d5e71929

SHA1
bcc5eae485d92cc24b69470fb6e16e53dd133807

SHA256
d590feae1b5d98398c6f53279e68a7076b7048a7f764c85daef6597eea2d3d51

SHA512
9bb20ab3871ec918cecb3335bd55d2fb7ee30b293fd6a3e7ec8ba0af97909d92982781d5a083a5f6ebfd67c68ee7ae4ffe59d6d197ad8d5d0d33056d10d30432

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
5e67da5f74eca854b212172686a95f7a

SHA1
9d7eaacca451d0981e380efd63a7ce8511526311

SHA256
99334078ce44275bbf61f1db1e29dbd327bf1093ee2272c1d87e84d468e80537

SHA512
db09032cb02a41b29832df3cb1dde19ee65ecefcbba12aed6f286f18f91db61db43c0249cc375d1c8602e86e27b55347c0d41d82d902a3408f33ddbe5db952ff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
cbfaf846182e25e14d49991925e57bf1

SHA1
f17bf59e1941361b20a8cfa9f64358eb0f6cd3e3

SHA256
0ee18c8155c2ecbf1becdc0c94d61ba23ed9248a6b0f7e92534d81ceec06beee

SHA512
fc3b7180978c165fe3122d1783cca911a6322455c37e0b192a23b7b3f060e1c0b43b03cb024a054d6ac7b6805659377de8b33c4d6f99ec47509f76b7ed3d95cb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
cb54f88c4db81a33e804a8066e48fdd1

SHA1
86fab9d416da4d424bd52969a056592150dccf61

SHA256
261745a7f35d9607e443508a68919547336b51cb3ef873a06c94fdd501e3819c

SHA512
4a239f8ee68622031fd96a7065135a4685b31c88c3fe46a80d0f473ed252f1940741e46ff6d83beb754577ab34633ad7350d3f5f633686a483608ca262c2f44f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
498fb5a6e0d46c75384e95661ba7125e

SHA1
ff86b1df0802bfaeeca072dac65a86d7c1b8a432

SHA256
50a2b2a739f8c26f8d1075d2a1aa023c7c4516899ebd3f43008bd2d807c9b96e

SHA512
c8cc271a39c15c4856cb1943b15ec348d38cdf77855d40130123a7976dcfd554c4765b89e7c4cc0f98d5979593be13e3a13269e06c0fd251abb4d2ee401ff981

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
65fee1a55ffe3fd89abf087e3f66a50a

SHA1
2559c01b12d2b34579461e45452cfb0af42a6a45

SHA256
d1b249abbc2943abb554ca8b9aa334f196e12c8a9e323b56db9d4befaa45c676

SHA512
496227fb215b16eb319e81d8beac6069e31f7045c2307605e0683cb49a071dd0f2832dc099882996b2be6d536fc683edb8c2b8ccee9a6edeeb6e8ac52cd641f8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
9f69f2df0b17f923fe338fc7f5eb1591

SHA1
092a9f9f96a9423e660ed169f53c00517324e41f

SHA256
031667fb7a82ee3d31a551506e5d0e73344c318811459f3812bada165d6e368c

SHA512
8923789c0c6fbb305bfceaf51b4a91a192a3682bfa914870a996ff012b195385c7ddd5ea6f4fbea21e774e81a4f59ce4027468578d10c67d3b30d9174052a30e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
b8224c48422220401431e9becdeba7c7

SHA1
17d12983419d0d7dc83c264b8751137e778fca20

SHA256
59693e6abb35e0d3a321fe1a59b46f85b2ea6c386a9fabecb323fb13b2c04ef9

SHA512
098bdc74821dfcc778743e5a49cf24154c488ece6a6eb6d377e2430bd35e124fd5269f055d900c1578ce70809de8591a3e9cea81cf31127e77362d7a902c4d20

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
b5918295ba07ae4eaf8c054592a0765f

SHA1
1a9400db8ba855fa082f9d7000cf2d4fe5f93c41

SHA256
db76eedeb1a2ab9fef42622510d7d4643a74c15d299644eef19e1d02679864e3

SHA512
d13ea3b99f31278eb7ed0a3f178db0b61e2952c8fda26b266f22bc5d9707f7aaadbf09eada14468f6dd0001d88936d1aeb205d698e963beee1b66b2b429eb7d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
8c842a837d6a486ebfbb9588a6be03cf

SHA1
fa50970341b76f7a10350288076c55fe8bb3f21f

SHA256
f4b766f8e91b1b36ccb01aa34cfa90bf683a8f7bdc905600cda0543338973ec1

SHA512
53c0f1e0fd8e47079dc1d9757913d7165bc2188fd2f0cc4a10b3cc286e508f7d77655afb9cba657c1b3efb20967698aabc3a94227279a4b1530e0ae9f2884071

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
141457ed36c521eb1fb301580b7cbf0e

SHA1
978287ffd9833a0f833e68f58e93faccd8fa1c8e

SHA256
f6a864bf9ccbb48773937babec9539ea98af7be3be850e450c3447d5a3184903

SHA512
8f24d029734cb443d0847370d4c983547a734b23ee58dd6296d1492aaea9568bf05dfa85feeab915bda7d94c997bdbc68198de9663de481b0b9ffdc0c4e957a2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
d0e6cb96ce5bd82984a5eba38403b954

SHA1
37884b961359e6305afd2b857b16fcb504f39eae

SHA256
41a33a4793625cf7549a1ec7e8945777b61cfcbb2b0a11792a8050b109aeba38

SHA512
ee2182dcaa57fea39e6d9f9132bc2ea4a83a1814831bfcb25a90c93827ba8386dbdcf59ace1697867f4bb0f1331aa4cd73cc69cc6a7cbbf5622a459635f410bb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
68395d25469e874f13c708793e0882fe

SHA1
84501039e169a350917d66593f53e55dc85d6f8c

SHA256
475fd905a54ebedf638ae06978102468b4a49183657f485a2ad4940d766b34e6

SHA512
4823ec62f558149ddedd8c970259e9dcd30167e600a9298ca0464ee088ace43fbc7b49a875e0e03b4488bfa1f305d625effd2dab459ff8373f8f8d8b86a6ed49

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
212cd152416b48928e2a488b5074793a

SHA1
fa61faa3e5659d346a8c9ba01621f29fd3caefcc

SHA256
3534870b74887e9e6ea1ab3688dfb1b6c5b595e00e671b95e9910caf2705b9cd

SHA512
0beeff69d71a2d0295ca7f15ebe9b333f6adab0281848f886d6624e06efc7a1d3e399473555f05c30369b97e221f7cf720ec0da0bd40f5c3d6a2d3a02dbd6f00

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
609b2f11091e1585f9bb64a9f19932e5

SHA1
f0529347e2aecbc179744f7399ed852ca6095fef

SHA256
183afdf9be8f47ec73aa575a4648b2c7f72aa200ecb910973194702bea6a2229

SHA512
538f56644b91e4781b8352f6740ac8e29c8df0197b0aa3a4cbd967586b00d8498e8b4372b63e2110f3f392e00c72a399787a1d3baa7af030998e363fbfeea553

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
d60873250b16e5a737be88b9742d709c

SHA1
bfb0e01e2a601b9a73b192f6675de814234839dc

SHA256
78b3c3514df7409e76e9c85f78111947646747df4847545bdf6ac26922a73af7

SHA512
f4200f045c275b6f4b5e5c1e010ddfa45861c1b446a2cd94ccc24fafc1787ecd27207e927e0c79dc3259bb8ff81f1fa24e589e803f7fd0a13fa51417807532ec

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
d96ecfbea3671178468e88bdd61f8d6e

SHA1
617cb0287f47b29a44523ac3ba312da85075566f

SHA256
136389b0fcbdc8fa72937c6bbd27dd424bc24b1283d3a8f033527e9295837f05

SHA512
3176501ae47f6c016fc70a37457d01636bd607690d257559ea0b8da373329f05a208543a02d567265db46b1b0a96ef89d2d8443339b9f7d972c328de15334c1c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
f606b2e95ee9eabf2572610d133d647b

SHA1
f403111acb667af5af62f51dc2052039bcb8d94e

SHA256
f7dca6fcb75c3e9a150056f0e951994ddb1aa1e7ccd66c1adcb4b60a521a49a0

SHA512
fbd758f0315e92dc985945fec095b256204a4101449b36200a6555d7b9674f75e64263b545b659a788e7f84cf4970eb672e54d5b6054ec829a5be0c9552989a5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
a7482c4f6edfaa302ed16af485f29bda

SHA1
f457d2e215fbc547ef14f4edd5dea9d13e1b3876

SHA256
858d3830bcf09d54bc289c8309f7011542c44f920837061820e71be49368ed61

SHA512
d20ec041dd99b3380f880856e088a559645a46fc16384c7fd97aa9f4159f596ac8c94d27cee64d144be69ac8b407e9cc645ec7edfc1b4c6b3dbdf0a0ac8f4ae6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
54467da76c1f8bdc7e2ebe3adcba8999

SHA1
639cf40ebb3e72db0205193f53e442ed797626f5

SHA256
a78703fe74d5b389d08ecadcf04083a105c2e960b2bfd35b588d02eed19ca0bb

SHA512
d2361dd6ed2435000c517d4e6f052b98b44cb284b40c9517a1a39e6966e7aba57273357d863d0823cc4bbf27c9c7c28152ca4448884598bd03f5c39079c0b56a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
855fec98d9d3ddfe11c3f7f24d6824e3

SHA1
e4c9440c61d4ab208c98b73e385e666df98bd636

SHA256
ed1aad63eee87cbf6eb6623e511570b0a94c8f6dfe6cee7fa67fc661fc884ab6

SHA512
016bf508ed733419f8fdd943783ce9d37af2941d15a08b156b8a6e726c809d2667e07c1e09f9bb34b74a813a280f17ffef8759a46ea23596674cb2cf2cf8e21e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
2942fd0debe5b7c6ef6485f55604af7a

SHA1
cdc8d2f56f42ff7d15ca632174b32981066c5f1a

SHA256
a2a2a18861e844c7325f193490be3e7c0b0f866d47f804f4ddb29f3e441227bb

SHA512
74777dc4eb2ac2ab128854b6f09cca541491da88b62ab1e991bb4a9f10a3c6e21103fbac35c14a23962cc67f017e5b636ecf9f61b17dc3905e7abff7223ff10b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
119b6d74ae81d51125279641c85c7a32

SHA1
6a5339495b7c1562f1b54a81027bf84aa9155327

SHA256
ca5808c41b9eba3218544d9d7ab3c8471d3d87981fc3edb5142a9ed3d5db2297

SHA512
442de0ae7ff091af920641c04a6ec10c30ab5acc238ef25ee402026958618e12780990ed3ce103f1819e97529320df2e78ba771dc3ee2ca0d3cdc69329c8b548

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
f6e6a34473e0113759eb0ed026a4adfb

SHA1
b13f423880d36c18bfc9ebf32a427a97b32435a7

SHA256
453d9c8c9c03ae4b6f179dad8fb7ff07211058b30cc357f1e1ec56b115319479

SHA512
6707a707402b0b68c016db4e9a9279569544ae6edf33b9e6aea93ba134e69802c84101223d1f7716dc9db8f5d092d00657a1f57fc11aa7464ebc0a8854245d19

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
474c4f41cb63afdb1823f26665c786d4

SHA1
02ec18893378c76005840e9cdedebaf205926aaf

SHA256
dcd7d8685f58b26daa1760aaa68646d2c3454fb98283c9ae348a410098396a1c

SHA512
e296aae7e17c32cf197032b52f652980696f466610dab3c62a0745b02891d5fd20a9ff93be26600f3be8e03cb631715d2b7f7dd40239b1f89761dd237dc45e62

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
ac42cb83eb371c82cf74201e30246739

SHA1
85a8e31eef168da0044aeffe022e34bf6f0a631d

SHA256
6ea2b399769bc96cd45c32396b37be07fa797eeeb19b8ad420530ad6c8d3f6cd

SHA512
6298af8575eef264e0d348a7db574c46a8db3fca4862df631d85fa8a6aa31ea84120277a40fd332eb38850dec76e3997ea515f3c503f1b16ace466b0938b487f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
3a346b23a67f9b0f20cdcf92f15bab9d

SHA1
559d46ee991f21d892a3fa9bcdf12010173a6f61

SHA256
a277c1495dde7b10eb2720ebe3af09bf4f0bb1f3e03cce844cd0347ec9248ad6

SHA512
5556e10225b65f19472034be2dc5b04899bcf0057348ac0ff8257a10f08f17c86194d25529618e3f5f0c7849eb1a689f8f10fc541a2b0a95f23450aa31f94f08

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
920026e0663ce8c5b1aed52805527354

SHA1
174cc1425f239a5dba05b156f92c88be25a82ff6

SHA256
7c72c65d486493c734dc42145d0a8cad48da94884d22db2f258213a07cf064f9

SHA512
d8819fbe5a9f8d72c02f88ffe865286295c7c8fd1a7e71ad334331502230caa93caf5308fd22dfca5cf6b709e2d165199bf779ed759f8962f370ead8fd64175c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
5afb22cb4fb639eb3c42ed4502cba0f9

SHA1
3f3a6f46fe2d64f27c606530f1fd477ddc59f4a5

SHA256
9e8995f0cc1bb64c424be9be4851f4bfbed2593d70b34d030c087660812f980d

SHA512
e1bbbc71655160ef3ae8204343d7e454fe9c4e2edf3e081ff90f92d361352e558be7b16df6b962cecc80d52952122b05ffe84a6b2b1c439b0d18ccf37c958289

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
6aa1144425fa34506caf20f003a6aaaf

SHA1
876852b692b583d9aff659117a0c44d709d6ccbe

SHA256
170b44b0cebac113dc8c06584448f34689968f3de9160c41325f6b5dcc54b218

SHA512
0ddb5a378c8c109b8408ddeb4e861442f1844fceaf4785a14cb076771ed2225ecff1bbc7628a94c199d668057eeadbcf279c5b038273da4ab9ae307068ebd7ce

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
4ea555a59f606d27e87e0009d552c70b

SHA1
1ca67dfb4907b18a6039b3dacbae2b5c124867ee

SHA256
fa9cb1e87b75d2bb89d496564ef9cdc1e826b01abc65628edb23a177c0bd865a

SHA512
ab5c2a044ae4eefc41aadcdb05ea038c932b50e766bb70e770e2cbcfbc234f00526f29fde75a919ed5f7770df8b3fcc4b5168fb89b9c311049f6f824e0764036

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
c9c09360a9b56621d0247e3c4493c846

SHA1
ebfafe4a00b4b253e15110ccac58a8ba4ca7c768

SHA256
53a5cd5a7fed2861b6fd65a9a806433a1a5161bb0ca788aabd245cb7348d619a

SHA512
36100844cab721f8605e0fd4f1e3712dce211c9861e7214b8279a9643ad16adeb3b59c7188d8e15e162075f8d1648a58ba81edd46733e269847d4fa24e47c191

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
a7a950eef6fb50e5c85e4250bdbe648c

SHA1
f41395ca589773f4207c30573a8d4b578c793589

SHA256
ab0d72ff84bae281ebab2bf895acbf04095af04dd49295c561261e0e390c38a0

SHA512
fed67c00069d097899b51a707e7d329ac0f41f414877fd9636a1e4204094c1438b67eec8a22ba378a67fc251a39e733c428c938ed568f7880424cd384459f62d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
dad38d6a216c783e5348c7b0023ff8dc

SHA1
2e1e4c49dac8432e6cb5d90f6ad9f11fa79684f2

SHA256
bad4b8f6e8b29d67b92394a5e615b3343ea5ff5f36844be9457496db7d165d59

SHA512
676c4530ea8760f85c4fd5d3d8589927b9afb3f6c3ba703928d6377ccf217c1a984308d54305f03c86fac34be01911658c283ac5b667c2c78f08b26f3b85a47f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
581beadcd8924f21a5c290294583ff05

SHA1
5006a06f30af90aaad2b0aa0bcbe3f656abf02a2

SHA256
b62248aea5119103b72cd5f78c6e1bb9d37069002b220166837aa20dc8d67788

SHA512
eb8e127354809c42aa79e3bd4a75bd28f2acc04e199d94be9a72d386afa822889c7904a4f0b19eb3330b5bac68e3102234547c1e4d1f9a0ab57796f7ab76aef3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
05cfde6803e5843264f9bf6a6b99d6c2

SHA1
14b714a14df1dea53290153a46d092beba4e4aa6

SHA256
65db42c2342f02dbfb93d6ced4759560ff5f2d62dafd3578b3c92681c0d977cf

SHA512
878cbc9ccc8c15c8483333c7d5f96190cdffa5ae888077563e9b8cb2d0f36388a78a0d1d6c5f73708a7c82a0e03edf7fd9124dc44ab9aa9024f4ebfa301e077b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
ef6e30e92679cb5a3d59dc5317630e91

SHA1
39db04f173c666ff32aad23fd067ee4341895b98

SHA256
a03e0a7c05cf5974c46758535328f1176d00b2fa46c9e90d0567fb4881e0fb5b

SHA512
1241be551cc8b79622325253730a42308bd2542c5df95d1e8ccf5aacbe18075e5eb437aa5577968798f24755b443cb76b7e3679f9693ea1137f3f1823abd675c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
09033c8f2213fb554584b6d99c9c5c06

SHA1
6f132793201f0cc7432fdc70dab98304bdd58c94

SHA256
30b8f0bf708094c95785063483a7f94be4deeb7e2cfb4a1b714f48199a6166a2

SHA512
826c7247c63a17f99593ec6f973f5d3fc3133d46029e55d9e23724969a411e1a8c26a9c7d17e5f35456ed5aeb62e602a3752170f885abdfac13d2749d23cca73

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
d283b266c2a9633175ec806af563273b

SHA1
ad1137f10c056ed5138e03e43a7933800e9f2e5f

SHA256
be562cd94088196e4b8160f5bc7385bbc58c1299958ce48f9f7ad3e62dc9730d

SHA512
ddc8a9511b77c8290b08a1858c854347334fa7d99c13c155fcf9f694836ca2cc493805c0a5686f2618f087c3cb7fdeff7530723fb17a7f222ff8457eb12b064f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
6eba278ae4d1143974712141613064f3

SHA1
80590ebee949ca81bad4adc10be9390b49bc0b18

SHA256
931fbcfc18ecdce39127b1be7d0a2d847cbfaeec4aadaf1fa1f677debf186a55

SHA512
d1ebbb673404b533838622f4c3997708603e67ba557396d79ba516adab55c47d062fee4221c12696d69ffc8117fe01a6805df194091f65749c22f60278f4f90c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
33360f7cd4746f21e2b900bb0d5cf1d7

SHA1
9e44b1ef54401eba6826bcc6916bc38bcec720d0

SHA256
732ef2b7ce0fb10d6ac186bd488e9d8a1fe56f0e109f20d7681f0e2095908bae

SHA512
4ec7fa665f311f73d4d049c12ae7b6d25dfb1eaa104b53b68424ddce801976e23a546a82f0b034b7c2af65095772243d1bcf235d082bd74f63fb746c2c0f6b60

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
de98fa41f2b823b753a67724a669b0f0

SHA1
86a53d5b0b84aa40125b0b149572da5188f3359b

SHA256
bb06e86a8c8f07199ef223d54dbc4bd489f32a507a7267f16d9d16d33e6941ee

SHA512
a5cec806ae9b1191174ade67381b046ec0548b064600eb7f08120ad40d9a56ee702a2d43197442327163f4b9dc9f899fae278fc7ea47143969bb82006362610b

Download Submit
C:\Windows\SysWOW64\HelpMe.exe

Filesize
824KB

MD5
a062adf2c5653be6edd524c00fa609a1

SHA1
0ecdaf9e4af5694bcbe80e8dfb00ff1572b5b6a5

SHA256
63cc92096330f357c82dd835a123f76cecdccc1182b7fa1e7cc6f5678f0802bf

SHA512
3c1d68d1518e587a96fe1bc9088d83aaaa8e0c63c1e2b2b55c742ca75f5629dbb5d58449e4c13329f04bbb0ab0a581d5f189131e8b91bf5e2333de0987ac92f3

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-877519540-908060166-1852957295-1000\desktop.ini.exe

Filesize
3.8MB

MD5
300ec0e9cd831fda107d1977473c76a5

SHA1
fb2c94a0e634b74352ab7447dcabaf3be260d582

SHA256
858fff80d65e6b40df4a29c4ea6b10bc02e4b248e421153e5608be1e1c04dcf3

SHA512
1a43e5824332d8ea9581cc935d1f6bc2cf112d6beccdbccc8d875fcd3cd2d3a2d7337bd9f2b1379c271add9caed12aa701d93a3613b110472edae35c7021c35c

Download Submit
F:\AUTORUN.INF

Filesize
145B

MD5
ca13857b2fd3895a39f09d9dde3cca97

SHA1
8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

SHA256
cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

SHA512
55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

Download Submit
F:\AutoRun.exe

Filesize
3.8MB

MD5
012c0953d1803e4e3f6a0c2183d22dd2

SHA1
f37b8d2be55a81475cb90288d8f3b0b7e7f322c3

SHA256
81aa4fa2f5b0c027e5939a1615929cf4d58db3ccf38744ad06d6e7f85a2a85f9

SHA512
121d6d049e5c0d25e7d49c83d2b04c7ee6809371c40e9f26d0bec9167b95af6268c597d76e421f98e08ee3217422b5f6df911ac885a16dacd08f096b129f4b4d

Download Submit
memory/2036-54-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2036-55-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/2036-0-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2036-1-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/4836-7-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download
memory/4836-6-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4836-60-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download