Resubmissions

05-09-2023 09:36

230905-llcqbseg77 10

12-04-2023 15:55

230412-tc7s4sdc52 10

Analysis

  • max time kernel
    143s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    12-04-2023 15:55

General

  • Target

    suspect_file_2.exe

  • Size

    360KB

  • MD5

    9ce01dfbf25dfea778e57d8274675d6f

  • SHA1

    1bd767beb5bc36b396ca6405748042640ad57526

  • SHA256

    5343947829609f69e84fe7e8172c38ee018ede3c9898d4895275f596ac54320d

  • SHA512

    d6ba89c1f221a94e3061bc4da896760d99935a7c766b8e4e30146266cf3356acd883835e75dbb86574bc869c83d381c8f63f23392101f6062bba4343af49978b

  • SSDEEP

    6144:4qZbqZToxIizLBZ6R56VkGM4ceLJ5vs5JGJceO/QCErIiuNAvwu:4qZb8oR3D6R5QHXZJy/Q50imAvB

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECOVERY_+wguvh.txt

Family

teslacrypt

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with AES More information about the encryption keys using AES can be found here: http://en.wikipedia.org/wiki/AES How did this happen ? !!! Specially for your PC was generated personal AES KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/AD2BB114F4D6F036 2. http://tes543berda73i48fsdfsd.keratadze.at/AD2BB114F4D6F036 3. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/AD2BB114F4D6F036 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/AD2BB114F4D6F036 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/AD2BB114F4D6F036 http://tes543berda73i48fsdfsd.keratadze.at/AD2BB114F4D6F036 http://tt54rfdjhb34rfbnknaerg.milerteddy.com/AD2BB114F4D6F036 *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/AD2BB114F4D6F036
URLs

http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/AD2BB114F4D6F036

http://tes543berda73i48fsdfsd.keratadze.at/AD2BB114F4D6F036

http://tt54rfdjhb34rfbnknaerg.milerteddy.com/AD2BB114F4D6F036

http://xlowfznrg4wf7dli.ONION/AD2BB114F4D6F036

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\_RECOVERY_+wguvh.html

Ransom Note
NOT YOUR LANGUAGE? USE Google Translate What happened to your files? of your files were protected by a strong encryption with AES More information about the encryption AES can be found https://en.wikipedia.org/wiki/AES at does this mean? his means that the structure and data within your files have been irrevocably changed, you will not be able work with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them How did this happen? Especially for you, on our SERVER was generated the secret key All your files were encrypted with the public key, which has been transferred to your computer via the Internet. Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program which is on our Secret Server!!! at do I do? do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed If you really need your data, then we suggest you do not waste valuable time searching for other solutions becausen they do not exist. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1 - http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/AD2BB114F4D6F036 2 - http://tes543berda73i48fsdfsd.keratadze.at/AD2BB114F4D6F036 3 - http://tt54rfdjhb34rfbnknaerg.milerteddy.com/AD2BB114F4D6F036 If for some reasons the addresses are not available, follow these steps: 1 - Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2 - After a successful installation, run the browser and wait for initialization. 3 - Type in the tor-browser address bar: xlowfznrg4wf7dli.onion/AD2BB114F4D6F036 4 - Follow the instructions on the site. !!! IMPORTANT INFORMATION: Your Personal PAGES : http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/AD2BB114F4D6F036 http://tes543berda73i48fsdfsd.keratadze.at/AD2BB114F4D6F036 http://tt54rfdjhb34rfbnknaerg.milerteddy.com/AD2BB114F4D6F036 Your Personal TOR-Browser page : xlowfznrg4wf7dli.onion/AD2BB114F4D6F036 Your personal ID (if you open the site directly):
URLs

http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/AD2BB114F4D6F036

http://tes543berda73i48fsdfsd.keratadze.at/AD2BB114F4D6F036

http://tt54rfdjhb34rfbnknaerg.milerteddy.com/AD2BB114F4D6F036

http://xlowfznrg4wf7dli.onion/AD2BB114F4D6F036

Signatures

  • TeslaCrypt, AlphaCrypt

    Ransomware based on CryptoLocker. Shut down by the developers in 2016.

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Modifies extensions of user files 4 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Deletes itself 1 IoCs
  • Drops startup file 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 33 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs
  • System policy modification 1 TTPs 2 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\suspect_file_2.exe
    "C:\Users\Admin\AppData\Local\Temp\suspect_file_2.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1960
    • C:\Windows\tpmiolendfkm.exe
      C:\Windows\tpmiolendfkm.exe
      2⤵
      • Modifies extensions of user files
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1788
      • C:\Windows\System32\wbem\WMIC.exe
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:944
      • C:\Windows\SysWOW64\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
        3⤵
        • Opens file in notepad (likely ransom note)
        PID:1612
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1528
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1528 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2008
      • C:\Windows\System32\wbem\WMIC.exe
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1940
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\TPMIOL~1.EXE
        3⤵
          PID:1172
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\SUSPEC~1.EXE
        2⤵
        • Deletes itself
        PID:268
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1896
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
      1⤵
      • Suspicious use of FindShellTrayWindow
      PID:1628

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECOVERY_+wguvh.html

      Filesize

      11KB

      MD5

      c99dc8ad04ef9edd80f2713ac3f9fb45

      SHA1

      f0b1865875bf0a693d703fcc24649b1eb7db9a05

      SHA256

      5f9755650c89e36f4b38c7f7be9aa21f98486165748cd65e02b67239decc86af

      SHA512

      6d0ec4fdb27284821673caae847076e938fb0cfc1e739ba4afc65f780d88b040e17f7b23d563e8d6060308aebb13178445e1881d5d12459b7ad9d692703fa1eb

    • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECOVERY_+wguvh.png

      Filesize

      62KB

      MD5

      aff2d96072fcb6866363e3818dc1a1d5

      SHA1

      5dcc9bef30d7aba083c5e8e2f813be1995614502

      SHA256

      e220fdf9411f19034f93ebb9c651a03adab78f300cecaebc442eaefa024a4d21

      SHA512

      ffa19aeebcbdcfcb034bdba2dd333a3e1e9c3e36d4afb6b997430502851451a365a7e2eee942648bc5d79418ec16ad634ae5c3eacfffcf1255bbb27a51368a63

    • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECOVERY_+wguvh.txt

      Filesize

      1KB

      MD5

      709195397eec26917bc94562c786f490

      SHA1

      1634cba1059993d4154ef148997f4df47fcd884c

      SHA256

      2325b7c5eb757f7b232127b231942f03959162e169ef191844f905a31ac527dc

      SHA512

      824da485921c4ace5dc31f44e55f709cbcd351ddee3ec5628766f837a54d0b455055309ff660dfa549bbcab4a52ad81eb006c8fe2924c531f6b664bc7b4547cc

    • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

      Filesize

      11KB

      MD5

      762f93aabf8527033892a1bbdcd48c22

      SHA1

      9457214fdf01f769d7d5feecb86ad62c0856f9fb

      SHA256

      e0756adf6ccb3b9f437d698f39efc4b51316dbab211ef2b69ab297efba37b431

      SHA512

      8ebb479c4cabcbe48152283ceb2b40c056d8b6bfb74c9baff4c4d60705529ff0ee6e2fdadb2e3e0d9470631e0c3dbcea6784c3628e4fc99c34cb05548ad57e28

    • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

      Filesize

      109KB

      MD5

      f56aada69a8aa9c732edbf43e2413498

      SHA1

      6b25bd8c0e255a8b97252c423198843b5f194161

      SHA256

      511461aea9ff90d84353512d73d9f4d4cab56fe9022cd93348358d0f29853136

      SHA512

      66682480ac76684894806d07fa3d5dcdc2a1347adb0233c64b4239433b4c858406b6e0167251cee55e86bb1b5a7d877a661fc0c2a86d3abb910dd0c3ec31e5ab

    • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

      Filesize

      173KB

      MD5

      44e694c3e7d49c16e0211ee4081c307e

      SHA1

      96716009b89a01c62eed3bd05be18f8fadcb521a

      SHA256

      6d6091ccb78dba4706c418ab15c9fded1c2169447b945a1039a7ffc09ad68c1a

      SHA512

      df5eae9a2184e454b7724897ee8325a11df6b032a6ae71adf9951ca785a1f11d075211f4e5c236f4fc4f718745de34519f3ffaf95040a14de9649b9466fc48dc

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

      Filesize

      61KB

      MD5

      e71c8443ae0bc2e282c73faead0a6dd3

      SHA1

      0c110c1b01e68edfacaeae64781a37b1995fa94b

      SHA256

      95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

      SHA512

      b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      1ffbba087299ed7d91a0a8e7639bc928

      SHA1

      7753a9da5c991e23e223825601206ca45d8f9534

      SHA256

      a556cd7beef4e6f247d1d64908abf874487a89407863a4d5823c56037f96251f

      SHA512

      75631ab5a176290f7210223bab45aadfc32b9e219b1ea945c9f8ca041afe778234d471d5ac0c18ed4725097a4605ba68e06158ce89ecaf96134dc92cd9435459

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      83860f4b2eff6baf1d7786571156c2b5

      SHA1

      bca7b5de196e9ac0388502573354ca1b0c0b9149

      SHA256

      102f14d6becd2b02c502aecb00fb3e1b43fe64232d8419296cb5d96619bb8422

      SHA512

      d87fa720878f6110c76029de7da381f744f07cedc124f9a91f9e662ad6c46c3cf5decd20ef8525cfe30a54f81ee815f55cccefc18b5f891a7d0f286eaa272a65

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      dc52b3b761c41bfb83bb4d45c59f652a

      SHA1

      c38aafb8adff074eb4e76913033a177a564ef9fa

      SHA256

      a13647755ac7d2441ebb61bf84eb7ce275c9939f0f0ff83e6037ce8f0c5b0e85

      SHA512

      eae6bf969f6445af5b5af9c322546f1bc98f753bcdc39e01542c0f86271693981bdbb0b722f976fff9dc779a6a4fd8731e1af49ba458c303fe731a3df239170f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      d33fedecc6c97ff1df3a309b4cabc29c

      SHA1

      95bd0b45c189d06be3ba4fc96b1850b831761939

      SHA256

      1dc5a02c9422ecdb1fae96072f0f8e0a61a0e8f078ff3b725fb10761cf0969ca

      SHA512

      d1fa7fc3495aaf13e51294cef2d3b83e37901d97692af23c0467d038a7c209a4308984704f9b30a47add653f3d08437f78e96bd734f3001dfac2ad8d0f59022a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      46a2587e9c044ebe4b09e5e6a48d2a6d

      SHA1

      03870897f8e6cf82f826596c6003d191744c5b13

      SHA256

      a9b70db3ca3873a3419628e0e6eee9db2ce8afe241370e29ff511a379f86ec73

      SHA512

      c653aa7be9fe11c6dedcad42c2925eb68e2c158f380ed4b640426f888086b1220bf255a043bcc6041a6874b9deceb8aa2dbb76f1b68416810e621a8f8070746d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      58283b37886f5f0f01ef21ffabceab43

      SHA1

      ba4a01466227b9701c7648649e12c6abfe942680

      SHA256

      a7b3da35362997fc02144432a1b4979a48c513aa4846f8eb8a11a622784851c3

      SHA512

      a282abb89ede720ee12946cc17fd2fefa3b7397581cae1e0a204502f1b13c20f1946ad85057e866017164f5f26641f5fc8a7a43c6401ec4042ffca9ef0ba30da

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      619bebd6dca83b6897aa96140bd51005

      SHA1

      7c2c9ca23ad87d2c5ab9ad01c09c5d58c3a263cd

      SHA256

      19760b2509429fb517c6c4408450a03be1a5f8902b00498d8e452082c2f40dff

      SHA512

      bd222dbf90bdc58786ce679120dd067471d8c30d310b5feeaef99add5bb935abe0fd49f8c79fb16faa300ddef5c935dccc5d559eaf6a8d7268188149a6f22a27

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      71c8fb6c1fdf20cff4e27e429f7c2e50

      SHA1

      d5e9f931a852c3d217f0cdc817c7ae40ce1f6bb0

      SHA256

      b4a0de544d6d40b1eb792cbd3d090b585520cd420708db43120d7535ad3fa32d

      SHA512

      39d25840218a3ba55c98f4cc217ab5187c6068f1a56f0d550762391e03af9ec61cbd6d0539876849f25dfbbb373c4da797c04790232ad1639b0f550aea418b4d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      0a35ee395eab2404f0282ebe4e9abce0

      SHA1

      a95fcf09efa4b21a556bae9441ea28787c5efae7

      SHA256

      e3f8ab5b57c6fec0f26d8d9f5efcb0fa43de898ca2dc004f69db2dfea9736c54

      SHA512

      617250721ed1cbd59ed9279729ccb5bca8a36cbc186d0edf4454f00a8ab4602253726b9e6526ca8acda1d195331dc15fd340f8632929ef2252d4589b4cf1615d

    • C:\Users\Admin\AppData\Local\Temp\CabF77D.tmp

      Filesize

      61KB

      MD5

      fc4666cbca561e864e7fdf883a9e6661

      SHA1

      2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

      SHA256

      10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

      SHA512

      c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

    • C:\Users\Admin\AppData\Local\Temp\TarFB8B.tmp

      Filesize

      161KB

      MD5

      be2bec6e8c5653136d3e72fe53c98aa3

      SHA1

      a8182d6db17c14671c3d5766c72e58d87c0810de

      SHA256

      1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

      SHA512

      0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

    • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\_RECOVERY_+wguvh.html

      Filesize

      11KB

      MD5

      c99dc8ad04ef9edd80f2713ac3f9fb45

      SHA1

      f0b1865875bf0a693d703fcc24649b1eb7db9a05

      SHA256

      5f9755650c89e36f4b38c7f7be9aa21f98486165748cd65e02b67239decc86af

      SHA512

      6d0ec4fdb27284821673caae847076e938fb0cfc1e739ba4afc65f780d88b040e17f7b23d563e8d6060308aebb13178445e1881d5d12459b7ad9d692703fa1eb

    • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\_RECOVERY_+wguvh.png

      Filesize

      62KB

      MD5

      aff2d96072fcb6866363e3818dc1a1d5

      SHA1

      5dcc9bef30d7aba083c5e8e2f813be1995614502

      SHA256

      e220fdf9411f19034f93ebb9c651a03adab78f300cecaebc442eaefa024a4d21

      SHA512

      ffa19aeebcbdcfcb034bdba2dd333a3e1e9c3e36d4afb6b997430502851451a365a7e2eee942648bc5d79418ec16ad634ae5c3eacfffcf1255bbb27a51368a63

    • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\_RECOVERY_+wguvh.txt

      Filesize

      1KB

      MD5

      709195397eec26917bc94562c786f490

      SHA1

      1634cba1059993d4154ef148997f4df47fcd884c

      SHA256

      2325b7c5eb757f7b232127b231942f03959162e169ef191844f905a31ac527dc

      SHA512

      824da485921c4ace5dc31f44e55f709cbcd351ddee3ec5628766f837a54d0b455055309ff660dfa549bbcab4a52ad81eb006c8fe2924c531f6b664bc7b4547cc

    • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\_RECOVERY_+wguvh.html

      Filesize

      11KB

      MD5

      c99dc8ad04ef9edd80f2713ac3f9fb45

      SHA1

      f0b1865875bf0a693d703fcc24649b1eb7db9a05

      SHA256

      5f9755650c89e36f4b38c7f7be9aa21f98486165748cd65e02b67239decc86af

      SHA512

      6d0ec4fdb27284821673caae847076e938fb0cfc1e739ba4afc65f780d88b040e17f7b23d563e8d6060308aebb13178445e1881d5d12459b7ad9d692703fa1eb

    • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\_RECOVERY_+wguvh.png

      Filesize

      62KB

      MD5

      aff2d96072fcb6866363e3818dc1a1d5

      SHA1

      5dcc9bef30d7aba083c5e8e2f813be1995614502

      SHA256

      e220fdf9411f19034f93ebb9c651a03adab78f300cecaebc442eaefa024a4d21

      SHA512

      ffa19aeebcbdcfcb034bdba2dd333a3e1e9c3e36d4afb6b997430502851451a365a7e2eee942648bc5d79418ec16ad634ae5c3eacfffcf1255bbb27a51368a63

    • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\_RECOVERY_+wguvh.txt

      Filesize

      1KB

      MD5

      709195397eec26917bc94562c786f490

      SHA1

      1634cba1059993d4154ef148997f4df47fcd884c

      SHA256

      2325b7c5eb757f7b232127b231942f03959162e169ef191844f905a31ac527dc

      SHA512

      824da485921c4ace5dc31f44e55f709cbcd351ddee3ec5628766f837a54d0b455055309ff660dfa549bbcab4a52ad81eb006c8fe2924c531f6b664bc7b4547cc

    • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\_RECOVERY_+wguvh.html

      Filesize

      11KB

      MD5

      c99dc8ad04ef9edd80f2713ac3f9fb45

      SHA1

      f0b1865875bf0a693d703fcc24649b1eb7db9a05

      SHA256

      5f9755650c89e36f4b38c7f7be9aa21f98486165748cd65e02b67239decc86af

      SHA512

      6d0ec4fdb27284821673caae847076e938fb0cfc1e739ba4afc65f780d88b040e17f7b23d563e8d6060308aebb13178445e1881d5d12459b7ad9d692703fa1eb

    • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\_RECOVERY_+wguvh.png

      Filesize

      62KB

      MD5

      aff2d96072fcb6866363e3818dc1a1d5

      SHA1

      5dcc9bef30d7aba083c5e8e2f813be1995614502

      SHA256

      e220fdf9411f19034f93ebb9c651a03adab78f300cecaebc442eaefa024a4d21

      SHA512

      ffa19aeebcbdcfcb034bdba2dd333a3e1e9c3e36d4afb6b997430502851451a365a7e2eee942648bc5d79418ec16ad634ae5c3eacfffcf1255bbb27a51368a63

    • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\_RECOVERY_+wguvh.txt

      Filesize

      1KB

      MD5

      709195397eec26917bc94562c786f490

      SHA1

      1634cba1059993d4154ef148997f4df47fcd884c

      SHA256

      2325b7c5eb757f7b232127b231942f03959162e169ef191844f905a31ac527dc

      SHA512

      824da485921c4ace5dc31f44e55f709cbcd351ddee3ec5628766f837a54d0b455055309ff660dfa549bbcab4a52ad81eb006c8fe2924c531f6b664bc7b4547cc

    • C:\Users\Admin\Desktop\RECOVERY.HTM

      Filesize

      11KB

      MD5

      c99dc8ad04ef9edd80f2713ac3f9fb45

      SHA1

      f0b1865875bf0a693d703fcc24649b1eb7db9a05

      SHA256

      5f9755650c89e36f4b38c7f7be9aa21f98486165748cd65e02b67239decc86af

      SHA512

      6d0ec4fdb27284821673caae847076e938fb0cfc1e739ba4afc65f780d88b040e17f7b23d563e8d6060308aebb13178445e1881d5d12459b7ad9d692703fa1eb

    • C:\Users\Admin\Desktop\RECOVERY.TXT

      Filesize

      1KB

      MD5

      709195397eec26917bc94562c786f490

      SHA1

      1634cba1059993d4154ef148997f4df47fcd884c

      SHA256

      2325b7c5eb757f7b232127b231942f03959162e169ef191844f905a31ac527dc

      SHA512

      824da485921c4ace5dc31f44e55f709cbcd351ddee3ec5628766f837a54d0b455055309ff660dfa549bbcab4a52ad81eb006c8fe2924c531f6b664bc7b4547cc

    • C:\Users\Admin\Desktop\RECOVERY.png

      Filesize

      62KB

      MD5

      aff2d96072fcb6866363e3818dc1a1d5

      SHA1

      5dcc9bef30d7aba083c5e8e2f813be1995614502

      SHA256

      e220fdf9411f19034f93ebb9c651a03adab78f300cecaebc442eaefa024a4d21

      SHA512

      ffa19aeebcbdcfcb034bdba2dd333a3e1e9c3e36d4afb6b997430502851451a365a7e2eee942648bc5d79418ec16ad634ae5c3eacfffcf1255bbb27a51368a63

    • C:\Windows\tpmiolendfkm.exe

      Filesize

      360KB

      MD5

      9ce01dfbf25dfea778e57d8274675d6f

      SHA1

      1bd767beb5bc36b396ca6405748042640ad57526

      SHA256

      5343947829609f69e84fe7e8172c38ee018ede3c9898d4895275f596ac54320d

      SHA512

      d6ba89c1f221a94e3061bc4da896760d99935a7c766b8e4e30146266cf3356acd883835e75dbb86574bc869c83d381c8f63f23392101f6062bba4343af49978b

    • C:\Windows\tpmiolendfkm.exe

      Filesize

      360KB

      MD5

      9ce01dfbf25dfea778e57d8274675d6f

      SHA1

      1bd767beb5bc36b396ca6405748042640ad57526

      SHA256

      5343947829609f69e84fe7e8172c38ee018ede3c9898d4895275f596ac54320d

      SHA512

      d6ba89c1f221a94e3061bc4da896760d99935a7c766b8e4e30146266cf3356acd883835e75dbb86574bc869c83d381c8f63f23392101f6062bba4343af49978b

    • C:\Windows\tpmiolendfkm.exe

      Filesize

      360KB

      MD5

      9ce01dfbf25dfea778e57d8274675d6f

      SHA1

      1bd767beb5bc36b396ca6405748042640ad57526

      SHA256

      5343947829609f69e84fe7e8172c38ee018ede3c9898d4895275f596ac54320d

      SHA512

      d6ba89c1f221a94e3061bc4da896760d99935a7c766b8e4e30146266cf3356acd883835e75dbb86574bc869c83d381c8f63f23392101f6062bba4343af49978b

    • memory/1628-5798-0x00000000000C0000-0x00000000000C2000-memory.dmp

      Filesize

      8KB

    • memory/1628-6286-0x00000000001C0000-0x00000000001C1000-memory.dmp

      Filesize

      4KB

    • memory/1628-5799-0x00000000001C0000-0x00000000001C1000-memory.dmp

      Filesize

      4KB

    • memory/1788-1634-0x0000000000400000-0x000000000049E000-memory.dmp

      Filesize

      632KB

    • memory/1788-771-0x0000000000400000-0x000000000049E000-memory.dmp

      Filesize

      632KB

    • memory/1788-5625-0x0000000000400000-0x000000000049E000-memory.dmp

      Filesize

      632KB

    • memory/1788-4487-0x0000000000400000-0x000000000049E000-memory.dmp

      Filesize

      632KB

    • memory/1788-3728-0x0000000000400000-0x000000000049E000-memory.dmp

      Filesize

      632KB

    • memory/1788-2496-0x0000000000400000-0x000000000049E000-memory.dmp

      Filesize

      632KB

    • memory/1788-5801-0x0000000000400000-0x000000000049E000-memory.dmp

      Filesize

      632KB

    • memory/1788-5797-0x0000000002560000-0x0000000002562000-memory.dmp

      Filesize

      8KB

    • memory/1788-565-0x0000000000400000-0x000000000049E000-memory.dmp

      Filesize

      632KB

    • memory/1788-74-0x0000000000400000-0x000000000049E000-memory.dmp

      Filesize

      632KB

    • memory/1788-72-0x0000000000400000-0x000000000049E000-memory.dmp

      Filesize

      632KB

    • memory/1788-70-0x0000000000270000-0x00000000002F5000-memory.dmp

      Filesize

      532KB

    • memory/1960-66-0x0000000000400000-0x000000000049E000-memory.dmp

      Filesize

      632KB

    • memory/1960-58-0x0000000000400000-0x000000000049E000-memory.dmp

      Filesize

      632KB

    • memory/1960-57-0x0000000000300000-0x0000000000385000-memory.dmp

      Filesize

      532KB

    • memory/1960-54-0x0000000000400000-0x000000000049E000-memory.dmp

      Filesize

      632KB