Overview

overview

10

Static

static

VirusShare...3a.exe

windows7_x64

10

VirusShare...3a.exe

windows10_x64

10

VirusShare...3a.exe

windows10-2004_x64

10

VirusShare...3a.exe

windows11_x64

VirusShare...3a.exe

macos_amd64

1

VirusShare...3a.exe

linux_armhf

VirusShare...3a.exe

linux_mips

VirusShare...3a.exe

linux_mipsel

VirusShare...3a.exe

linux_amd64

Analysis

  • max time kernel
    1628s
  • max time network
    1631s
  • platform
    windows7_x64
  • resource
    win7-20220331-en
  • submitted
    07-04-2022 19:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    VirusShare_0d8ff116ce8976fc820c996a6ee90c3a.exe

  • Size

    324KB

  • MD5

    0d8ff116ce8976fc820c996a6ee90c3a

  • SHA1

    f04aa63508e99c54095cba747f31fb28fbfd392e

  • SHA256

    25c1c67de6ead9c4efd8372caccfbba80cc77667dd9b172e5535b1c7a7b81a5e

  • SHA512

    2c2c7b2eac7ac70d0bba26821a52e72e443428c154368c0ca173ff9901bcfdab386d81a759478ca6e85211003eb5fe3bebef076533eed647ad4803054a38311a

Score
10/10
evasionpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-3422572840-2899912402-917774768-1000\how_recover+kmq.txt

Ransom Note
________________________1234____________________________________- What happened to your files ? All of your files were protected by a strong encryption with RSA-2048. More information about the encryption keys using RSA-2048 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) What does this mean ? This means that the structure and data within your files have been irrevocably changed, you will not be able to work with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them. How did this happen ? Especially for you, on our server was generated the secret key pair RSA-2048 - public and private. All your files were encrypted with the public key, which has been transferred to your computer via the Internet. Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server. What do I do ? ________________________1234____________________________________ Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed. If you really value your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist. ________________________1234____________________________________ For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://gfhshhf.home7dfg4.com/E6F170CA0D69ACB 2. http://td63hftt.buwve5ton2.com/E6F170CA0D69ACB 3. https://tw7kaqthui5ojcez.onion.to/E6F170CA0D69ACB If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser and wait for initialization. 3. Type in the address bar: tw7kaqthui5ojcez.onion/E6F170CA0D69ACB 4. Follow the instructions on the site. IMPORTANT INFORMATION: Your personal pages: http://gfhshhf.home7dfg4.com/E6F170CA0D69ACB http://td63hftt.buwve5ton2.com/E6F170CA0D69ACB https://tw7kaqthui5ojcez.onion.to/E6F170CA0D69ACB Your personal page (using TOR-Browser): tw7kaqthui5ojcez.onion/E6F170CA0D69ACB Your personal identification number (if you open the site (or TOR-Browser's) directly): E6F170CA0D69ACB
URLs

http://gfhshhf.home7dfg4.com/E6F170CA0D69ACB

http://td63hftt.buwve5ton2.com/E6F170CA0D69ACB

https://tw7kaqthui5ojcez.onion.to/E6F170CA0D69ACB

http://tw7kaqthui5ojcez.onion/E6F170CA0D69ACB

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-3422572840-2899912402-917774768-1000\how_recover+kmq.html

Ransom Note
<html> <!-- 1274zskjdhfsdal9021842__ --> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; } .ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <!--1274zskjdhfsdal9021842__-1274zskjdhfsdal9021842__ --> <center> <div style="text-align:left; font-family:Arial; <!------1274zskjdhfsdal9021842__ --> font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"> <b><font class="ttl">What happened <!------1274zskjdhfsdal9021842__ --> to your files?</b></font><br> <font style="font-size:13px;">All of your files were<!------1274zskjdhfsdal9021842__ --> protected by a strong<!------1274zskjdhfsdal9021842__ --> encryption with<!------1274zskjdhfsdal9021842__ --> RSA-2048 <br> More information about the <!------1274zskjdhfsdal9021842__ -->encryption RSA-2048 can be<!------1274zskjdhfsdal9021842__ --> found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font> <br><b><font class="ttl">What <!------1274zskjdhfsdal9021842__ --> does this mean?</b></font><br><font style="font-size:13px;"> This<!------1274zskjdhfsdal9021842__ --> means that the <!------1274zskjdhfsdal9021842__ --> structure and data within your files have been irrevocably <!------1274zskjdhfsdal9021842__ -->changed, you will not be able to work<br> with them, read<!------1274zskjdhfsdal9021842__ --> them or see them, it is the same thing <!------2333232 -->as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private. <br>All your <!------1274zskjdhfsdal9021842__ --> files were encrypted with the public key, <!------1274zskjdhfsdal9021842__ --> which has been <!------1274zskjdhfsdal9021842__ --> transferred to <!------1274zskjdhfsdal9021842__ -->your computer via <!------1274zskjdhfsdal9021842__ -->the Internet.<br> <!------1274zskjdhfsdal9021842__ --> Decrypting of <!------1274zskjdhfsdal9021842__ -->YOUR FILES is <!------1274zskjdhfsdal9021842__ -->only possible <!--- -1274zskjdhfsdal9021842__ -->with the help of the <!----1274zskjdhfsdal9021842__ -->private key and <!--1274zskjdhfsdal9021842__ -->decrypt program, <!------1274zskjdhfsdal9021842__ -->which is on our <!--- -1274zskjdhfsdal9021842__ -->Secret Server!!! *</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you <!------dsgdfgsdg --> do not take <!------1274zskjdhfsdal9021842__ --> the necessary measures <!------1274zskjdhfsdal9021842__ -->for the specified <!------1274zskjdhfsdal9021842__ --> time then the conditions for <!------1274zskjdhfsdal9021842__ --> obtaining the private key will be changed.<br> <!------1274zskjdhfsdal9021842__ --> If you really need <!------1274zskjdhfsdal9021842__ --> your data, then we suggest you <!------1274zskjdhfsdal9021842__ --> do not waste valuable <!------1274zskjdhfsdal9021842__ --> time searching for other <!------1274zskjdhfsdal9021842__ --> solutions becausen <!------1274zskjdhfsdal9021842__ --> they do not exist.</font><br><br> <!------1274zskjdhfsdal9021842__ --><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your <!------1274zskjdhfsdal9021842__ --> personal home page, there are a few <!------1274zskjdhfsdal9021842__ --> different addresses pointing to <!------1274zskjdhfsdal9021842__ --> your page below: <hr> <!------1274zskjdhfsdal9021842__ --><b>1.<a href="http://gfhshhf.home7dfg4.com/E6F170CA0D69ACB" target="_blank">http://gfhshhf.home7dfg4.com/E6F170CA0D69ACB</a></b><br> <!------1274zskjdhfsdal9021842__ --><b>2.<a href="http://td63hftt.buwve5ton2.com/E6F170CA0D69ACB" target="_blank">http://td63hftt.buwve5ton2.com/E6F170CA0D69ACB</a></b><br> <!------1274zskjdhfsdal9021842__ --><b>3.<a href="https://tw7kaqthui5ojcez.onion.to/E6F170CA0D69ACB" target="_blank">https://tw7kaqthui5ojcez.onion.to/E6F170CA0D69ACB</a></b><br> <!------1274zskjdhfsdal9021842__ --></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the <!------1274zskjdhfsdal9021842__ --> addresses are not available, <!------1274zskjdhfsdal9021842__ --> follow these steps: <hr> 1. <!------1274zskjdhfsdal9021842__ --> Download and <!------1274zskjdhfsdal9021842__ --> install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br> 2. <!--1274zskjdhfsdal9021842__ --> After a successful<!------1274zskjdhfsdal9021842__ --> installation, run the browser and wait for initialization.<br> 3. <!-- 1274zskjdhfsdal9021842__ --> Type<!-- 1274zskjdhfsdal9021842__ --> in<!-- 1274zskjdhfsdal9021842__ --> the tor-browser<!-- 1274zskjdhfsdal9021842__ --> address<!-- 1274zskjdhfsdal9021842__ --> bar: <font style="font-weight:bold; color:#009977;"><!-- 1274zskjdhfsdal9021842__ -->tw7kaqthui5ojcez.onion/E6F170CA0D69ACB<!-- 1274zskjdhfsdal9021842__ --></font><!-- 1274zskjdhfsdal9021842__ --><br> 4. <!-- 1274zskjdhfsdal9021842__ --> Follow the instructions <!-- 1274zskjdhfsdal9021842__ --> on the site.</div><br><br><b>IMPORTANT INFORMATION:</b><br> <div class="tb" style="width:790px;"> <!------1274zskjdhfsdal9021842__ --> Your Personal PAGES: <b><br> <a href="http://gfhshhf.home7dfg4.com/E6F170CA0D69ACB" target="_blank">http://gfhshhf.home7dfg4.com/E6F170CA0D69ACB</a> <br> <!------1274zskjdhfsdal9021842__ --><a href="http://td63hftt.buwve5ton2.com/E6F170CA0D69ACB" target="_blank">http://td63hftt.buwve5ton2.com/E6F170CA0D69ACB</a> <br> <!------1274zskjdhfsdal9021842__ --> <a href="https://tw7kaqthui5ojcez.onion.to/E6F170CA0D69ACB" target="_blank"> <!------1274zskjdhfsdal9021842__ --> https://tw7kaqthui5ojcez.onion.to/E6F170CA0D69ACB</a> </b> <br> <!------1274zskjdhfsdal9021842__ --> Your <!------1274zskjdhfsdal9021842__ --> Personal PAGES <!------1274zskjdhfsdal9021842__ --> (using TOR-Browser): <!------1274zskjdhfsdal9021842__ --><font style="font-weight:bold; color:#009977;"><!-- 1274zskjdhfsdal9021842__ -->tw7kaqthui5ojcez.onion/E6F170CA0D69ACB<!-- 1274zskjdhfsdal9021842__ --></font><br> <!------1274zskjdhfsdal9021842__ --> Your personal <!------1274zskjdhfsdal9021842__ --> code <!------1274zskjdhfsdal9021842__ --> (if you open the <!------1274zskjdhfsdal9021842__ --> site (or TOR-Browser's) directly): <!------1274zskjdhfsdal9021842__ --> <font style="font-weight:bold; color:#770000;">E6F170CA0D69ACB</font><br> </div></div></center></body></html>
URLs

https://tw7kaqthui5ojcez.onion.to/E6F170CA0D69ACB</a>

Extracted

Path

C:\Users\Admin\Desktop\Howto_RESTORE_FILES.html

Ransom Note
to your files? protected by a strong encryption with RSA-2048 More information about the encryption RSA-2048 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) does this mean? means that the structure and data within your files have been irrevocably changed, you will not be able to work with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them. All your files were encrypted with the public key, which has been transferred to your computer via the Internet. Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our Secret Server!!! * do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed. If you really need your data, then we suggest you do not waste valuable time searching for other solutions becausen they do not exist. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1.http://gfhshhf.home7dfg4.com/E6F170CA0D69ACB 2.http://td63hftt.buwve5ton2.com/E6F170CA0D69ACB 3.https://tw7kaqthui5ojcez.onion.to/E6F170CA0D69ACB If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser and wait for initialization. 3. Type in the tor-browser address bar: tw7kaqthui5ojcez.onion/E6F170CA0D69ACB 4. Follow the instructions on the site. IMPORTANT INFORMATION: Your Personal PAGES: http://gfhshhf.home7dfg4.com/E6F170CA0D69ACB http://td63hftt.buwve5ton2.com/E6F170CA0D69ACB https://tw7kaqthui5ojcez.onion.to/E6F170CA0D69ACB Your Personal PAGES (using TOR-Browser): tw7kaqthui5ojcez.onion/E6F170CA0D69ACB Your personal code (if you open the site (or TOR-Browser's) directly):
URLs

http://tw7kaqthui5ojcez.onion/E6F170CA0D69ACB

http://gfhshhf.home7dfg4.com/E6F170CA0D69ACB

http://td63hftt.buwve5ton2.com/E6F170CA0D69ACB

https://tw7kaqthui5ojcez.onion.to/E6F170CA0D69ACB

Signatures

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 5 IoCs
    ransomwareevasion
  • Executes dropped EXE 2 IoCs
  • Modifies extensions of user files 6 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Deletes itself 1 IoCs
  • Drops startup file 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
    adwarespyware
  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\VirusShare_0d8ff116ce8976fc820c996a6ee90c3a.exe
    "C:\Users\Admin\AppData\Local\Temp\VirusShare_0d8ff116ce8976fc820c996a6ee90c3a.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1600
    • C:\Users\Admin\AppData\Local\Temp\VirusShare_0d8ff116ce8976fc820c996a6ee90c3a.exe
      "C:\Users\Admin\AppData\Local\Temp\VirusShare_0d8ff116ce8976fc820c996a6ee90c3a.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1088
      • C:\Users\Admin\AppData\Roaming\fcwfj-a.exe
        C:\Users\Admin\AppData\Roaming\fcwfj-a.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2032
        • C:\Users\Admin\AppData\Roaming\fcwfj-a.exe
          C:\Users\Admin\AppData\Roaming\fcwfj-a.exe
          4⤵
          • Executes dropped EXE
          • Modifies extensions of user files
          • Drops startup file
          • Adds Run key to start application
          • Drops file in Program Files directory
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:1976
          • C:\Windows\system32\bcdedit.exe
            bcdedit.exe /set {current} bootems off
            5⤵
            • Modifies boot configuration data using bcdedit
            PID:1544
          • C:\Windows\system32\bcdedit.exe
            bcdedit.exe /set {current} advancedoptions off
            5⤵
            • Modifies boot configuration data using bcdedit
            PID:1516
          • C:\Windows\system32\bcdedit.exe
            bcdedit.exe /set {current} optionsedit off
            5⤵
            • Modifies boot configuration data using bcdedit
            PID:328
          • C:\Windows\system32\bcdedit.exe
            bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures
            5⤵
            • Modifies boot configuration data using bcdedit
            PID:660
          • C:\Windows\system32\bcdedit.exe
            bcdedit.exe /set {current} recoveryenabled off
            5⤵
            • Modifies boot configuration data using bcdedit
            PID:672
          • C:\Windows\System32\vssadmin.exe
            "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
            5⤵
            • Interacts with shadow copies
            PID:1656
          • C:\Windows\SysWOW64\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Howto_RESTORE_FILES.txt
            5⤵
            • Opens file in notepad (likely ransom note)
            PID:1784
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\Howto_RESTORE_FILES.html
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2012
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:2
              6⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:1716
          • C:\Windows\System32\vssadmin.exe
            "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
            5⤵
            • Interacts with shadow copies
            PID:1892
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Roaming\fcwfj-a.exe
            5⤵
              PID:1712
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE
          3⤵
          • Deletes itself
          PID:1992
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1108
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
      1⤵
      • Suspicious use of FindShellTrayWindow
      PID:216

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Privilege Escalation

    Defense Evasion

    File Deletion

    2
    T1107

    Modify Registry

    4
    T1112

    Install Root Certificate

    1
    T1130

    Credential Access

    Credentials in Files

    1
    T1081

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Exfiltration

    Command and Control

    Impact

    Inhibit System Recovery

    3
    T1490

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      c7c55fe01c92b773a7d5b2a36779afba

      SHA1

      943d6c2e4c663544118a778eb3cf025a5e402a4e

      SHA256

      7e861acf996163b43b3501012d38f3c2093e88cf4d100721c1a7f57d14745026

      SHA512

      b7de16142ef04a72d3636a2c020ffe64f2e686e795d5fcba7505c1016b29e034a20c78c453f926398c982a8a18ccd3efd18a236d0a8bf0592a02541fc67e9d3b

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\how_recover+kmq.html
      Filesize

      6KB

      MD5

      b5d6610ce5cb60e508501edf4f9ff1ee

      SHA1

      4888c31b0581f71a43084cf611201f6fca2a8941

      SHA256

      eaa20b5eac4b0a721a5ff600376f8971b8c4d0dfa9a99c52b928325850274744

      SHA512

      494fd11167cbecc15cc61084f5138c00c82b5ea65bb6d811acf17c443e82a7aecad1e8b680f77221d63e9a1c1b07f74dcd633a43e72a1f6873d9c364a6d79059

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\how_recover+kmq.txt
      Filesize

      2KB

      MD5

      4cda16bc635f5244e5db6ed9f78fb99b

      SHA1

      561e0de49b8d8cb9e0a82b84f7fab425955faddb

      SHA256

      72e1018f066bc249e06d142af30647dec548653170ec943a2929e0e4fb0b845d

      SHA512

      7ce06642e155653b3eca61c56acbdf743c994c357b8857def681486c45085b34f04d73279e923c8b3b6dc635cf13ec0164d0c9fd343fb8245ca6e843ad3e8c4b

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\how_recover+kmq.html
      Filesize

      6KB

      MD5

      b5d6610ce5cb60e508501edf4f9ff1ee

      SHA1

      4888c31b0581f71a43084cf611201f6fca2a8941

      SHA256

      eaa20b5eac4b0a721a5ff600376f8971b8c4d0dfa9a99c52b928325850274744

      SHA512

      494fd11167cbecc15cc61084f5138c00c82b5ea65bb6d811acf17c443e82a7aecad1e8b680f77221d63e9a1c1b07f74dcd633a43e72a1f6873d9c364a6d79059

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\how_recover+kmq.txt
      Filesize

      2KB

      MD5

      4cda16bc635f5244e5db6ed9f78fb99b

      SHA1

      561e0de49b8d8cb9e0a82b84f7fab425955faddb

      SHA256

      72e1018f066bc249e06d142af30647dec548653170ec943a2929e0e4fb0b845d

      SHA512

      7ce06642e155653b3eca61c56acbdf743c994c357b8857def681486c45085b34f04d73279e923c8b3b6dc635cf13ec0164d0c9fd343fb8245ca6e843ad3e8c4b

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\how_recover+kmq.html
      Filesize

      6KB

      MD5

      b5d6610ce5cb60e508501edf4f9ff1ee

      SHA1

      4888c31b0581f71a43084cf611201f6fca2a8941

      SHA256

      eaa20b5eac4b0a721a5ff600376f8971b8c4d0dfa9a99c52b928325850274744

      SHA512

      494fd11167cbecc15cc61084f5138c00c82b5ea65bb6d811acf17c443e82a7aecad1e8b680f77221d63e9a1c1b07f74dcd633a43e72a1f6873d9c364a6d79059

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\how_recover+kmq.txt
      Filesize

      2KB

      MD5

      4cda16bc635f5244e5db6ed9f78fb99b

      SHA1

      561e0de49b8d8cb9e0a82b84f7fab425955faddb

      SHA256

      72e1018f066bc249e06d142af30647dec548653170ec943a2929e0e4fb0b845d

      SHA512

      7ce06642e155653b3eca61c56acbdf743c994c357b8857def681486c45085b34f04d73279e923c8b3b6dc635cf13ec0164d0c9fd343fb8245ca6e843ad3e8c4b

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\SVHQY3J9.txt
      Filesize

      607B

      MD5

      d4d6802d05c620b3c3a1855d088514b6

      SHA1

      6e20b7226b426adc1e9476f5784f195d2874d6ce

      SHA256

      2ae176e1157fbdc4763266777a3b8aab4478c99fbe8064f9c2c0cabaaef2ed90

      SHA512

      dcaa20609f99c6551bc901a8fad836d43e0d419b20c961f362113a0b5e3b9855c7ec0c4c95e263fed02693f556810f6d14a90ba834a4e932efef56244b08e7fc

      Download Submit
    • C:\Users\Admin\AppData\Roaming\fcwfj-a.exe
      Filesize

      324KB

      MD5

      0d8ff116ce8976fc820c996a6ee90c3a

      SHA1

      f04aa63508e99c54095cba747f31fb28fbfd392e

      SHA256

      25c1c67de6ead9c4efd8372caccfbba80cc77667dd9b172e5535b1c7a7b81a5e

      SHA512

      2c2c7b2eac7ac70d0bba26821a52e72e443428c154368c0ca173ff9901bcfdab386d81a759478ca6e85211003eb5fe3bebef076533eed647ad4803054a38311a

      Download Submit
    • C:\Users\Admin\AppData\Roaming\fcwfj-a.exe
      Filesize

      324KB

      MD5

      0d8ff116ce8976fc820c996a6ee90c3a

      SHA1

      f04aa63508e99c54095cba747f31fb28fbfd392e

      SHA256

      25c1c67de6ead9c4efd8372caccfbba80cc77667dd9b172e5535b1c7a7b81a5e

      SHA512

      2c2c7b2eac7ac70d0bba26821a52e72e443428c154368c0ca173ff9901bcfdab386d81a759478ca6e85211003eb5fe3bebef076533eed647ad4803054a38311a

      Download Submit
    • C:\Users\Admin\AppData\Roaming\fcwfj-a.exe
      Filesize

      324KB

      MD5

      0d8ff116ce8976fc820c996a6ee90c3a

      SHA1

      f04aa63508e99c54095cba747f31fb28fbfd392e

      SHA256

      25c1c67de6ead9c4efd8372caccfbba80cc77667dd9b172e5535b1c7a7b81a5e

      SHA512

      2c2c7b2eac7ac70d0bba26821a52e72e443428c154368c0ca173ff9901bcfdab386d81a759478ca6e85211003eb5fe3bebef076533eed647ad4803054a38311a

      Download Submit
    • C:\Users\Admin\Desktop\Howto_RESTORE_FILES.bmp
      Filesize

      3.3MB

      MD5

      07a0aeae811ceab7dd189462804c5cdc

      SHA1

      970ed8d4d4ca57c9728a84e7d446aa1c331b1ef1

      SHA256

      8b94eaec76d723cd9c503897463e24797dbdbd53a08b1ab969e089f6b1a20c45

      SHA512

      1a397463dec2bf258bb8f562c3d88ec7c44c99684d4abf09224fe9f20fbf6d0b8dbb2bdfcb5a9c27941b15d6585422dd526699a3dc82cde7b9273221aed7c7af

      Download Submit
    • C:\Users\Admin\Desktop\Howto_RESTORE_FILES.html
      Filesize

      6KB

      MD5

      b5d6610ce5cb60e508501edf4f9ff1ee

      SHA1

      4888c31b0581f71a43084cf611201f6fca2a8941

      SHA256

      eaa20b5eac4b0a721a5ff600376f8971b8c4d0dfa9a99c52b928325850274744

      SHA512

      494fd11167cbecc15cc61084f5138c00c82b5ea65bb6d811acf17c443e82a7aecad1e8b680f77221d63e9a1c1b07f74dcd633a43e72a1f6873d9c364a6d79059

      Download Submit
    • C:\Users\Admin\Desktop\Howto_RESTORE_FILES.txt
      Filesize

      2KB

      MD5

      4cda16bc635f5244e5db6ed9f78fb99b

      SHA1

      561e0de49b8d8cb9e0a82b84f7fab425955faddb

      SHA256

      72e1018f066bc249e06d142af30647dec548653170ec943a2929e0e4fb0b845d

      SHA512

      7ce06642e155653b3eca61c56acbdf743c994c357b8857def681486c45085b34f04d73279e923c8b3b6dc635cf13ec0164d0c9fd343fb8245ca6e843ad3e8c4b

      Download Submit
    • \Users\Admin\AppData\Roaming\fcwfj-a.exe
      Filesize

      324KB

      MD5

      0d8ff116ce8976fc820c996a6ee90c3a

      SHA1

      f04aa63508e99c54095cba747f31fb28fbfd392e

      SHA256

      25c1c67de6ead9c4efd8372caccfbba80cc77667dd9b172e5535b1c7a7b81a5e

      SHA512

      2c2c7b2eac7ac70d0bba26821a52e72e443428c154368c0ca173ff9901bcfdab386d81a759478ca6e85211003eb5fe3bebef076533eed647ad4803054a38311a

      Download Submit
    • \Users\Admin\AppData\Roaming\fcwfj-a.exe
      Filesize

      324KB

      MD5

      0d8ff116ce8976fc820c996a6ee90c3a

      SHA1

      f04aa63508e99c54095cba747f31fb28fbfd392e

      SHA256

      25c1c67de6ead9c4efd8372caccfbba80cc77667dd9b172e5535b1c7a7b81a5e

      SHA512

      2c2c7b2eac7ac70d0bba26821a52e72e443428c154368c0ca173ff9901bcfdab386d81a759478ca6e85211003eb5fe3bebef076533eed647ad4803054a38311a

      Download Submit
    • memory/216-102-0x0000000000380000-0x0000000000382000-memory.dmp
      Filesize

      8KB

      Download
    • memory/328-94-0x0000000000000000-mapping.dmp
      Download
    • memory/660-95-0x0000000000000000-mapping.dmp
      Download
    • memory/672-96-0x0000000000000000-mapping.dmp
      Download
    • memory/1088-69-0x0000000000400000-0x0000000000486000-memory.dmp
      Filesize

      536KB

      Download
    • memory/1088-62-0x0000000000400000-0x0000000000486000-memory.dmp
      Filesize

      536KB

      Download
    • memory/1088-55-0x0000000000400000-0x0000000000486000-memory.dmp
      Filesize

      536KB

      Download
    • memory/1088-56-0x0000000000400000-0x0000000000486000-memory.dmp
      Filesize

      536KB

      Download
    • memory/1088-58-0x0000000000400000-0x0000000000486000-memory.dmp
      Filesize

      536KB

      Download
    • memory/1088-60-0x0000000000400000-0x0000000000486000-memory.dmp
      Filesize

      536KB

      Download
    • memory/1088-63-0x0000000000400000-0x0000000000486000-memory.dmp
      Filesize

      536KB

      Download
    • memory/1088-65-0x0000000000400000-0x0000000000486000-memory.dmp
      Filesize

      536KB

      Download
    • memory/1088-66-0x00000000004097F0-mapping.dmp
      Download
    • memory/1088-68-0x0000000075D11000-0x0000000075D13000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1516-93-0x0000000000000000-mapping.dmp
      Download
    • memory/1544-92-0x0000000000000000-mapping.dmp
      Download
    • memory/1600-54-0x0000000000220000-0x0000000000223000-memory.dmp
      Filesize

      12KB

      Download
    • memory/1656-97-0x0000000000000000-mapping.dmp
      Download
    • memory/1712-106-0x0000000000000000-mapping.dmp
      Download
    • memory/1784-98-0x0000000000000000-mapping.dmp
      Download
    • memory/1892-103-0x0000000000000000-mapping.dmp
      Download
    • memory/1976-87-0x00000000004097F0-mapping.dmp
      Download
    • memory/1976-91-0x0000000000400000-0x0000000000486000-memory.dmp
      Filesize

      536KB

      Download
    • memory/1992-74-0x0000000000000000-mapping.dmp
      Download
    • memory/2032-72-0x0000000000000000-mapping.dmp
      Download