Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

ghj.exe

windows10-1703-x64

10

Analysis

  • max time kernel
    299s
  • max time network
    299s
  • platform
    windows10-1703_x64
  • resource
    win10-20220901-en
  • resource tags

    arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
  • submitted
    12/02/2023, 15:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ghj.exe

  • Size

    66KB

  • MD5

    e6a1a7e9749c2e730a115db0d2322e0f

  • SHA1

    8dcaa44b6cb950507f953ebd8046f1c01ada02bf

  • SHA256

    0ff1a35e3ee55f9eb7523aa75999adf1208ffda8e318b411d00f81ae7db6d2e8

  • SHA512

    b5a8f515feaf26145a4ded31285f936934b1748f431aae66b4f03d94f6e58547c717ba46029c6eec2cbd67f6f4fb188e1f74407a1f115ce46088c492aab3751d

  • SSDEEP

    1536:vASM0a6LpfCejYAZQEdZbGYBuP7oCFo16AfG3OBf/Cs/LY:vASM0a6NfC/AZDdZbGYtrJfG3OBf/Y

Score
10/10
asyncratpersistenceransomwarerat

Malware Config

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Modifies extensions of user files 6 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Windows directory 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 26 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 5 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 49 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ghj.exe
    "C:\Users\Admin\AppData\Local\Temp\ghj.exe"
    1⤵
    • Modifies extensions of user files
    • Checks computer location settings
    • Drops startup file
    • Loads dropped DLL
    • Adds Run key to start application
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3044
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ghj.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4740
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'ghj.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3636
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\ghj.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4636
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "ghj" /tr "C:\ProgramData\ghj.exe"
      2⤵
      • Creates scheduled task(s)
      PID:4012
    • C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM explorer.exe
      2⤵
      • Kills process with taskkill
      PID:5104
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:4884
  • C:\ProgramData\ghj.exe
    C:\ProgramData\ghj.exe
    1⤵
    • Executes dropped EXE
    PID:3780
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1800
  • C:\Windows\system32\browser_broker.exe
    C:\Windows\system32\browser_broker.exe -Embedding
    1⤵
    • Modifies Internet Explorer settings
    PID:1184
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2916
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    PID:2488
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    PID:2804
  • C:\ProgramData\ghj.exe
    C:\ProgramData\ghj.exe
    1⤵
    • Executes dropped EXE
    PID:4708
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x3dc
    1⤵
      PID:2892
    • C:\ProgramData\ghj.exe
      C:\ProgramData\ghj.exe
      1⤵
      • Executes dropped EXE
      PID:3348
    • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
      1⤵
      • Drops file in Windows directory
      • Enumerates system info in registry
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4056
    • C:\ProgramData\ghj.exe
      C:\ProgramData\ghj.exe
      1⤵
      • Executes dropped EXE
      PID:4648
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:5088
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      PID:4660
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3328
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      PID:4368
    • C:\ProgramData\ghj.exe
      C:\ProgramData\ghj.exe
      1⤵
      • Executes dropped EXE
      PID:2488

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\ghj.exe
      Filesize

      66KB

      MD5

      e6a1a7e9749c2e730a115db0d2322e0f

      SHA1

      8dcaa44b6cb950507f953ebd8046f1c01ada02bf

      SHA256

      0ff1a35e3ee55f9eb7523aa75999adf1208ffda8e318b411d00f81ae7db6d2e8

      SHA512

      b5a8f515feaf26145a4ded31285f936934b1748f431aae66b4f03d94f6e58547c717ba46029c6eec2cbd67f6f4fb188e1f74407a1f115ce46088c492aab3751d

      Download Submit

    • C:\ProgramData\ghj.exe
      Filesize

      66KB

      MD5

      e6a1a7e9749c2e730a115db0d2322e0f

      SHA1

      8dcaa44b6cb950507f953ebd8046f1c01ada02bf

      SHA256

      0ff1a35e3ee55f9eb7523aa75999adf1208ffda8e318b411d00f81ae7db6d2e8

      SHA512

      b5a8f515feaf26145a4ded31285f936934b1748f431aae66b4f03d94f6e58547c717ba46029c6eec2cbd67f6f4fb188e1f74407a1f115ce46088c492aab3751d

      Download Submit

    • C:\ProgramData\ghj.exe
      Filesize

      66KB

      MD5

      e6a1a7e9749c2e730a115db0d2322e0f

      SHA1

      8dcaa44b6cb950507f953ebd8046f1c01ada02bf

      SHA256

      0ff1a35e3ee55f9eb7523aa75999adf1208ffda8e318b411d00f81ae7db6d2e8

      SHA512

      b5a8f515feaf26145a4ded31285f936934b1748f431aae66b4f03d94f6e58547c717ba46029c6eec2cbd67f6f4fb188e1f74407a1f115ce46088c492aab3751d

      Download Submit

    • C:\ProgramData\ghj.exe
      Filesize

      66KB

      MD5

      e6a1a7e9749c2e730a115db0d2322e0f

      SHA1

      8dcaa44b6cb950507f953ebd8046f1c01ada02bf

      SHA256

      0ff1a35e3ee55f9eb7523aa75999adf1208ffda8e318b411d00f81ae7db6d2e8

      SHA512

      b5a8f515feaf26145a4ded31285f936934b1748f431aae66b4f03d94f6e58547c717ba46029c6eec2cbd67f6f4fb188e1f74407a1f115ce46088c492aab3751d

      Download Submit

    • C:\ProgramData\ghj.exe
      Filesize

      66KB

      MD5

      e6a1a7e9749c2e730a115db0d2322e0f

      SHA1

      8dcaa44b6cb950507f953ebd8046f1c01ada02bf

      SHA256

      0ff1a35e3ee55f9eb7523aa75999adf1208ffda8e318b411d00f81ae7db6d2e8

      SHA512

      b5a8f515feaf26145a4ded31285f936934b1748f431aae66b4f03d94f6e58547c717ba46029c6eec2cbd67f6f4fb188e1f74407a1f115ce46088c492aab3751d

      Download Submit

    • C:\ProgramData\ghj.exe
      Filesize

      66KB

      MD5

      e6a1a7e9749c2e730a115db0d2322e0f

      SHA1

      8dcaa44b6cb950507f953ebd8046f1c01ada02bf

      SHA256

      0ff1a35e3ee55f9eb7523aa75999adf1208ffda8e318b411d00f81ae7db6d2e8

      SHA512

      b5a8f515feaf26145a4ded31285f936934b1748f431aae66b4f03d94f6e58547c717ba46029c6eec2cbd67f6f4fb188e1f74407a1f115ce46088c492aab3751d

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ghj.exe.log
      Filesize

      654B

      MD5

      16c5fce5f7230eea11598ec11ed42862

      SHA1

      75392d4824706090f5e8907eee1059349c927600

      SHA256

      87ba77c13905298acbac72be90949c4fe0755b6eff9777615aa37f252515f151

      SHA512

      153edd6da59beea6cc411ed7383c32916425d6ebb65f04c65aab7c1d6b25443d143aa8449aa92149de0ad8a975f6ecaa60f9f7574536eec6b38fe5fd3a6c6adc

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
      Filesize

      3KB

      MD5

      8592ba100a78835a6b94d5949e13dfc1

      SHA1

      63e901200ab9a57c7dd4c078d7f75dcd3b357020

      SHA256

      fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

      SHA512

      87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      1KB

      MD5

      9fceaa8f38c649b2e22774fae18c3a57

      SHA1

      5fd53df1613ba5450c0b8efd46825db0d9b524e3

      SHA256

      fd1439be9ac2c7e9657901542c04521cea486ac10ba40144cfd20183b18e51c5

      SHA512

      45846475ef49c7fe0b7ccca1c18404f963f689c73ff4bd29add0fc49ce3872bceb230d5a45782731c4161888d853671253231c23e13b05b0739a4b835ff0c52a

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      1KB

      MD5

      f4a7ad860775bc17b23ccf6c7aab0acc

      SHA1

      41f4c2e19ebc93b119673cbc2779720ff9f3e800

      SHA256

      52d325252adb32e6d62f798535de41227b7d16ac4cbf91bfcb66c5fd162b94fb

      SHA512

      eea7fb7580a958379d9bbe59ec7ca80e53c7b0227009ffbb7efa3ab093eaa6d1a65aa123d863435da659e2f704dfb7f4bc60edf75d3fd693621ac71b81c37f70

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\LogFiles\edb.log
      Filesize

      512KB

      MD5

      84e6ffb04c555095d0930b410f6edd52

      SHA1

      4a980303042076e62196e0b7b93f125ca8193434

      SHA256

      c5f8b740b3026175542b541be2a451df76187c9082af268ee4deaae07c4b084b

      SHA512

      0ddc3ae53e89f374f5bb9fe66e212f665f4e21e819363ab71701032f737bc2e7e97d58985ccbcaba2338e7cde2482e8b247fb4d04193f218c314c401bae835f3

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\edb.chk
      Filesize

      8KB

      MD5

      2ffc860e991c482ed33902cd9df292e9

      SHA1

      9f6e9d2222a599ce4a1c7ce51f8a5e90887339fd

      SHA256

      c7298f85e1edd4fb6f7c3389f9f763c6cdfaea2bbed2547ec87afa8922eb962c

      SHA512

      716b98f7e0f38e6c89068d33b601674fc748c6defa853c004d98d782812d39d9198a19e1cee6a878ce809b728c7e85a2961849555fc537cbb3aa98432ef33398

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\spartan.edb
      Filesize

      2.0MB

      MD5

      74081765b6f01ff691217b77bcc8a95d

      SHA1

      b0e55b85aaca423e3343679be8a7c22afa090e49

      SHA256

      9e46a6d5a841d5d39a69d25a5607b3196037d0ef09ed229449a5f0ec50f512d0

      SHA512

      e2342405c69b0605b42f46a4f43567836fb0a6af12d193a846aa9f3bf65b20df53b2159e4d16c5d930620eddc0e8678870c6dc1cedb17bb517a8448380163d0c

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\spartan.jfm
      Filesize

      16KB

      MD5

      2bfa4ec28d39ee30a25a20542681fe66

      SHA1

      539e61bf2b5b1f0fe2745e3f013eefd0f1223678

      SHA256

      4433a563ced16c8f7e15d54b7f1d42a89b0208698d14471f20733d0f245fc1e6

      SHA512

      ad40e91c52d16cced9f87883b9968599511ea05af868d7656ff2af964e54efa3564805ed19dab91ceee61dbc86c6deb13576ee7f017274c5208baf4d702a5d11

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\ImageStore\z6nqo42\imagestore.dat
      Filesize

      1KB

      MD5

      d91d08c2bba7b1432933efd050382d01

      SHA1

      5cd9ec3cc3dc654b063c2c4eea958bc165e9fc91

      SHA256

      ec5fe5c545b846a9b9254e950cd3cf418ce40dee7103efe4adb25392fab66af0

      SHA512

      0906335f4eded7d8d68312382029aab0983e4817df96c6d33d717bd9d03fcc07aeef183ca4d843addd033c1a468e21cac296607a1f1c2210373abc20a83d1116

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\Recovery\Active\RecoveryStore.{4E8CE229-A57B-46FB-B633-26E2CFC6FE64}.dat
      Filesize

      4KB

      MD5

      b5a6f44140ed5776f8f39af849ab1207

      SHA1

      8d43cb68b163d26f4ff3e057a5d3498f4314055a

      SHA256

      57dcfc48a9da75c181abcc84a844c693877afd2ab2be131affa4d731033ca3ab

      SHA512

      f4629004b703c60d6e4fe56430e229d35cf718edff678d4d7d1e236e738135f938677e878afa7bde9e1d4f6424a938117941765c4b24f12e1d4ac98eb932dfaa

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\Recovery\Active\{A413E448-CEB9-4540-9871-C9D4736EBCD7}.dat
      Filesize

      40KB

      MD5

      05de975c96582443d55da5dc77ae21c5

      SHA1

      50653daf3b9548016a649ee33e69d65b48b1e554

      SHA256

      71646d3b27dc68387872b5508b5a5efb95009f16c42d7555df968ab05db8ef19

      SHA512

      e6789fd55ed4566a7d3ce1bf341362c9446d287e953039e06da2e2e00e5a57490c8ff7b263ddc9707b6b6f1dde7a76b1b4780d6d496645d0a6522ad1e3f0bc37

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\Microsoft\Windows\3720402701\2219095117.pri
      Filesize

      207KB

      MD5

      e2b88765ee31470114e866d939a8f2c6

      SHA1

      e0a53b8511186ff308a0507b6304fb16cabd4e1f

      SHA256

      523e419d2fa2e780239812d36caa37e92f8c3e6a5cd9f18f0d807c593effa45e

      SHA512

      462e8e6b4e63fc6781b6a9935b332a1dc77bfb88e1de49134f86fd46bd1598d2e842902dd9415a328e325bd7cdee766bd9473f2695acdfa769ffe7ba9ae1953d

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\XBackground.bmp
      Filesize

      2.5MB

      MD5

      d63f77374f84c4d7bb6107e86ee3c8c5

      SHA1

      1e70f0e5b530d0c1cc8c5aebc6e4e6e2c1b16a0e

      SHA256

      94dcb0e20d29d28f95bcba1d96c59a4ad83fc1ac0df98185c28685a66f08a1da

      SHA512

      ceadc5c63c03563e43ec9a421b9afbf6df9278c03d77aa8badd26fecdcacdebcd6a8ca41b82b860e8441db563a449166fb725dfb65e844c93947b369f1f2da2b

      Download Submit

    • C:\Users\Admin\Desktop\How To Decrypt My Files.html
      Filesize

      710B

      MD5

      1bf77fad285dfe924484528612d0dc13

      SHA1

      2d54cb983ff333a3f0b90a80327a7e0da0dab91b

      SHA256

      d16a34e7eca0d34e39ffb2ace22bddf093a641f91738869e5d3b306bcd0f4983

      SHA512

      99eb012ceeb92c8af4582d725ed6ddd3b300452086c16d3f63f9268279eefb2357d76f0e5c001131323ed7096607a2d77b1bfd543ab4a4f4e608098e89ec4ab7

      Download Submit

    • \Users\Admin\AppData\Local\Temp\tmpD12C.tmp
      Filesize

      100KB

      MD5

      1b942faa8e8b1008a8c3c1004ba57349

      SHA1

      cd99977f6c1819b12b33240b784ca816dfe2cb91

      SHA256

      555ccb7ecd9ae52a75135fdd81ab443a49d5785b0621ed6468d28c4234e46ccc

      SHA512

      5aee3d59478d41ddd5885c99b394c9c4983064e2b3528db1a3f7fc289662bced4f57d072517bbe7573c6d1789435e987ef1aa9cc91f372bcfd30bc016675fa43

      Download Submit

    • memory/1800-234-0x0000021A26320000-0x0000021A26330000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1800-235-0x0000021A26420000-0x0000021A26430000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3044-276-0x000000001BF10000-0x000000001BF4A000-memory.dmp

      Filesize

      232KB

      Download

    • memory/3044-239-0x000000001B730000-0x000000001B73A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/3044-117-0x0000000000540000-0x0000000000556000-memory.dmp

      Filesize

      88KB

      Download

    • memory/3044-231-0x000000001BB50000-0x000000001BB5A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/3044-241-0x0000000000C40000-0x0000000000C4A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/3044-240-0x0000000000BE0000-0x0000000000C16000-memory.dmp

      Filesize

      216KB

      Download

    • memory/3044-259-0x000000001BD80000-0x000000001BD8C000-memory.dmp

      Filesize

      48KB

      Download

    • memory/3044-257-0x0000000000C80000-0x0000000000C8C000-memory.dmp

      Filesize

      48KB

      Download

    • memory/4740-127-0x0000026E6EEC0000-0x0000026E6EF36000-memory.dmp

      Filesize

      472KB

      Download

    • memory/4740-124-0x0000026E6DF60000-0x0000026E6DF82000-memory.dmp

      Filesize

      136KB

      Download

    • memory/4884-256-0x0000000008E40000-0x0000000008E50000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4884-255-0x0000000008E40000-0x0000000008E50000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4884-254-0x0000000008E40000-0x0000000008E50000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4884-253-0x0000000008E40000-0x0000000008E50000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4884-252-0x0000000008E40000-0x0000000008E50000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4884-251-0x0000000008E40000-0x0000000008E50000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4884-250-0x0000000008E20000-0x0000000008E30000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4884-249-0x0000000008E10000-0x0000000008E20000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4884-248-0x00000000089C0000-0x00000000089D0000-memory.dmp

      Filesize

      64KB

      Download