teslacrypt | 5343947829609f69e84fe7e8172c38ee018ede3c9898d4895275f596ac54320d

Analysis

max time kernel
129s
max time network
134s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
06-09-2023 19:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JC_suspectfile2.exe
Size

360KB
MD5

9ce01dfbf25dfea778e57d8274675d6f
SHA1

1bd767beb5bc36b396ca6405748042640ad57526
SHA256

5343947829609f69e84fe7e8172c38ee018ede3c9898d4895275f596ac54320d
SHA512

d6ba89c1f221a94e3061bc4da896760d99935a7c766b8e4e30146266cf3356acd883835e75dbb86574bc869c83d381c8f63f23392101f6062bba4343af49978b
SSDEEP

6144:4qZbqZToxIizLBZ6R56VkGM4ceLJ5vs5JGJceO/QCErIiuNAvwu:4qZb8oR3D6R5QHXZJy/Q50imAvB

Score

10^/10

teslacrypt persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECOVERY_+rljit.txt

Family

teslacrypt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with AES More information about the encryption keys using AES can be found here: http://en.wikipedia.org/wiki/AES How did this happen ? !!! Specially for your PC was generated personal AES KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/DF56CBB42A36D36C 2. http://tes543berda73i48fsdfsd.keratadze.at/DF56CBB42A36D36C 3. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/DF56CBB42A36D36C If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/DF56CBB42A36D36C 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/DF56CBB42A36D36C http://tes543berda73i48fsdfsd.keratadze.at/DF56CBB42A36D36C http://tt54rfdjhb34rfbnknaerg.milerteddy.com/DF56CBB42A36D36C *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/DF56CBB42A36D36C

URLs

http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/DF56CBB42A36D36C

http://tes543berda73i48fsdfsd.keratadze.at/DF56CBB42A36D36C

http://tt54rfdjhb34rfbnknaerg.milerteddy.com/DF56CBB42A36D36C

http://xlowfznrg4wf7dli.ONION/DF56CBB42A36D36C

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\_RECOVERY_+rljit.html

Ransom Note

NOT YOUR LANGUAGE? USE Google Translate What happened to your files? of your files were protected by a strong encryption with AES More information about the encryption AES can be found https://en.wikipedia.org/wiki/AES at does this mean? his means that the structure and data within your files have been irrevocably changed, you will not be able work with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them How did this happen? Especially for you, on our SERVER was generated the secret key All your files were encrypted with the public key, which has been transferred to your computer via the Internet. Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program which is on our Secret Server!!! at do I do? do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed If you really need your data, then we suggest you do not waste valuable time searching for other solutions becausen they do not exist. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1 - http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/DF56CBB42A36D36C 2 - http://tes543berda73i48fsdfsd.keratadze.at/DF56CBB42A36D36C 3 - http://tt54rfdjhb34rfbnknaerg.milerteddy.com/DF56CBB42A36D36C If for some reasons the addresses are not available, follow these steps: 1 - Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2 - After a successful installation, run the browser and wait for initialization. 3 - Type in the tor-browser address bar: xlowfznrg4wf7dli.onion/DF56CBB42A36D36C 4 - Follow the instructions on the site. !!! IMPORTANT INFORMATION: Your Personal PAGES : http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/DF56CBB42A36D36C http://tes543berda73i48fsdfsd.keratadze.at/DF56CBB42A36D36C http://tt54rfdjhb34rfbnknaerg.milerteddy.com/DF56CBB42A36D36C Your Personal TOR-Browser page : xlowfznrg4wf7dli.onion/DF56CBB42A36D36C Your personal ID (if you open the site directly):

URLs

http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/DF56CBB42A36D36C

http://tes543berda73i48fsdfsd.keratadze.at/DF56CBB42A36D36C

http://tt54rfdjhb34rfbnknaerg.milerteddy.com/DF56CBB42A36D36C

http://xlowfznrg4wf7dli.onion/DF56CBB42A36D36C

Signatures

TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
ransomware teslacrypt
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Renames multiple (380) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2788 cmd.exe

pid	process
2788	cmd.exe

Drops startup file 3 IoCs

Processes:

yeydengfrovj.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_RECOVERY_+rljit.png	yeydengfrovj.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_RECOVERY_+rljit.txt	yeydengfrovj.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_RECOVERY_+rljit.html	yeydengfrovj.exe

Executes dropped EXE 1 IoCs

Processes:

yeydengfrovj.exe

pid process

2144 yeydengfrovj.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

yeydengfrovj.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Windows\CurrentVersion\Run\tihwccubbdms = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\yeydengfrovj.exe\""	yeydengfrovj.exe

Drops file in Program Files directory 64 IoCs

Processes:

yeydengfrovj.exe

description	ioc	process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\_RECOVERY_+rljit.txt	yeydengfrovj.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\_RECOVERY_+rljit.png	yeydengfrovj.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\add_over.png	yeydengfrovj.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\es-ES\_RECOVERY_+rljit.html	yeydengfrovj.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\fr-FR\_RECOVERY_+rljit.html	yeydengfrovj.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\_RECOVERY_+rljit.txt	yeydengfrovj.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\js\_RECOVERY_+rljit.png	yeydengfrovj.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\30.png	yeydengfrovj.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\_RECOVERY_+rljit.html	yeydengfrovj.exe
File opened for modification	C:\Program Files\Common Files\SpeechEngines\Microsoft\_RECOVERY_+rljit.png	yeydengfrovj.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_dot.png	yeydengfrovj.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPHandle.png	yeydengfrovj.exe
File opened for modification	C:\Program Files\Java\jre7\lib\jvm.hprof.txt	yeydengfrovj.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\settings.css	yeydengfrovj.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rss_headline_glow_floating.png	yeydengfrovj.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\_RECOVERY_+rljit.txt	yeydengfrovj.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\_RECOVERY_+rljit.png	yeydengfrovj.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_gtk.css	yeydengfrovj.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\_RECOVERY_+rljit.png	yeydengfrovj.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\_RECOVERY_+rljit.txt	yeydengfrovj.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\_RECOVERY_+rljit.txt	yeydengfrovj.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\css\_RECOVERY_+rljit.html	yeydengfrovj.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Memories_buttonClear.png	yeydengfrovj.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_ButtonGraphic.png	yeydengfrovj.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\_RECOVERY_+rljit.txt	yeydengfrovj.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\_RECOVERY_+rljit.txt	yeydengfrovj.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pt_BR\_RECOVERY_+rljit.txt	yeydengfrovj.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\vignettemask25.png	yeydengfrovj.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\_RECOVERY_+rljit.png	yeydengfrovj.exe
File opened for modification	C:\Program Files\Microsoft Games\More Games\en-US\_RECOVERY_+rljit.html	yeydengfrovj.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\_RECOVERY_+rljit.png	yeydengfrovj.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\_RECOVERY_+rljit.txt	yeydengfrovj.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\fr-FR\_RECOVERY_+rljit.txt	yeydengfrovj.exe
File opened for modification	C:\Program Files\Java\_RECOVERY_+rljit.html	yeydengfrovj.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\kk\_RECOVERY_+rljit.png	yeydengfrovj.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\library.js	yeydengfrovj.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\activity16v.png	yeydengfrovj.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_RECOVERY_+rljit.png	yeydengfrovj.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\_RECOVERY_+rljit.png	yeydengfrovj.exe
File opened for modification	C:\Program Files\Microsoft Games\_RECOVERY_+rljit.png	yeydengfrovj.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\_RECOVERY_+rljit.png	yeydengfrovj.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\_RECOVERY_+rljit.png	yeydengfrovj.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\en-US\_RECOVERY_+rljit.png	yeydengfrovj.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoCanary.png	yeydengfrovj.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\weather.js	yeydengfrovj.exe
File opened for modification	C:\Program Files\Windows Sidebar\_RECOVERY_+rljit.png	yeydengfrovj.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_videoinset.png	yeydengfrovj.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\whiteband.png	yeydengfrovj.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\_RECOVERY_+rljit.html	yeydengfrovj.exe
File opened for modification	C:\Program Files\Common Files\System\ja-JP\_RECOVERY_+rljit.png	yeydengfrovj.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\15x15dot.png	yeydengfrovj.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\_RECOVERY_+rljit.txt	yeydengfrovj.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\calendar.js	yeydengfrovj.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\_RECOVERY_+rljit.html	yeydengfrovj.exe
File opened for modification	C:\Program Files\Common Files\System\ado\en-US\_RECOVERY_+rljit.html	yeydengfrovj.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\_RECOVERY_+rljit.png	yeydengfrovj.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\fr-FR\_RECOVERY_+rljit.png	yeydengfrovj.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\ja-JP\_RECOVERY_+rljit.html	yeydengfrovj.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\_RECOVERY_+rljit.html	yeydengfrovj.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\_RECOVERY_+rljit.txt	yeydengfrovj.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\_RECOVERY_+rljit.txt	yeydengfrovj.exe
File opened for modification	C:\Program Files\Windows Media Player\Media Renderer\_RECOVERY_+rljit.png	yeydengfrovj.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\picturePuzzle.js	yeydengfrovj.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\_RECOVERY_+rljit.png	yeydengfrovj.exe

Drops file in Windows directory 2 IoCs

Processes:

JC_suspectfile2.exe

description	ioc	process
File opened for modification	C:\Windows\yeydengfrovj.exe	JC_suspectfile2.exe
File created	C:\Windows\yeydengfrovj.exe	JC_suspectfile2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000918258b1c6eaef44bc85c7515db804ef000000000200000000001066000000010000200000003256174672722e56fe5f2436cd4b77c26505fb319f2a951bd70fd839de72d235000000000e8000000002000020000000b6ac1ab000535d6e91da46497712ed5c1a783327eac9cec32dcaff5cc2a1a38d200000003f22c7cacac26c0d529fd007281ca9d99643c5c16f47626dbba5bb034a26ba6140000000d79f79ed14ca08ebda50f2e446871a4646e0532da89bda66ed34e19f08514ed8f51eb2123ea6a661f15b640a7b3ade03c65cbcd684db0722724ef3b6e07587e9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000918258b1c6eaef44bc85c7515db804ef000000000200000000001066000000010000200000008055ee3f7939f7fb5e2826362a2a5dcf8f36cfde33c1e24627e79bd6e1a52a77000000000e80000000020000200000007506bfb6463a52011f3870e82787d1610d46f0b19df2ee46c88267eb7ce348be900000009c82795d9ccfeaaf316c53f198f8d580c230fc5592b95099469a94133a7bcd7d967e14d165048873002e91cafe019c8cd8e8d46206b830b5d9271e9df79f6acb6b307f055053485438ad4594d425d346506b349e984aed6f14510c7e692c649eaf2cc5199d409214cd5146632da853efe30e55745e76c274534030bd0e739d2b35e73222b7785ec303cd40ec85a9bf0040000000a72329f57b3741cd8322621c180190b4554d87382cbef3832421d68a6b5cde275a74aaa77104e4783ba3c348b894264bb7aad21ed4f5fe4fad437900de7b9a29	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "400190065"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D44A85C1-4CEA-11EE-B88D-4E9D0FD57FD1} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0b2e5a8f7e0d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

1804 NOTEPAD.EXE

pid	process
1804	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

yeydengfrovj.exe

pid	process
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe
2144	yeydengfrovj.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

JC_suspectfile2.exeyeydengfrovj.exeWMIC.exevssvc.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	368	JC_suspectfile2.exe
Token: SeDebugPrivilege	2144	yeydengfrovj.exe
Token: SeIncreaseQuotaPrivilege	2540	WMIC.exe
Token: SeSecurityPrivilege	2540	WMIC.exe
Token: SeTakeOwnershipPrivilege	2540	WMIC.exe
Token: SeLoadDriverPrivilege	2540	WMIC.exe
Token: SeSystemProfilePrivilege	2540	WMIC.exe
Token: SeSystemtimePrivilege	2540	WMIC.exe
Token: SeProfSingleProcessPrivilege	2540	WMIC.exe
Token: SeIncBasePriorityPrivilege	2540	WMIC.exe
Token: SeCreatePagefilePrivilege	2540	WMIC.exe
Token: SeBackupPrivilege	2540	WMIC.exe
Token: SeRestorePrivilege	2540	WMIC.exe
Token: SeShutdownPrivilege	2540	WMIC.exe
Token: SeDebugPrivilege	2540	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2540	WMIC.exe
Token: SeRemoteShutdownPrivilege	2540	WMIC.exe
Token: SeUndockPrivilege	2540	WMIC.exe
Token: SeManageVolumePrivilege	2540	WMIC.exe
Token: 33	2540	WMIC.exe
Token: 34	2540	WMIC.exe
Token: 35	2540	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2540	WMIC.exe
Token: SeSecurityPrivilege	2540	WMIC.exe
Token: SeTakeOwnershipPrivilege	2540	WMIC.exe
Token: SeLoadDriverPrivilege	2540	WMIC.exe
Token: SeSystemProfilePrivilege	2540	WMIC.exe
Token: SeSystemtimePrivilege	2540	WMIC.exe
Token: SeProfSingleProcessPrivilege	2540	WMIC.exe
Token: SeIncBasePriorityPrivilege	2540	WMIC.exe
Token: SeCreatePagefilePrivilege	2540	WMIC.exe
Token: SeBackupPrivilege	2540	WMIC.exe
Token: SeRestorePrivilege	2540	WMIC.exe
Token: SeShutdownPrivilege	2540	WMIC.exe
Token: SeDebugPrivilege	2540	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2540	WMIC.exe
Token: SeRemoteShutdownPrivilege	2540	WMIC.exe
Token: SeUndockPrivilege	2540	WMIC.exe
Token: SeManageVolumePrivilege	2540	WMIC.exe
Token: 33	2540	WMIC.exe
Token: 34	2540	WMIC.exe
Token: 35	2540	WMIC.exe
Token: SeBackupPrivilege	2836	vssvc.exe
Token: SeRestorePrivilege	2836	vssvc.exe
Token: SeAuditPrivilege	2836	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1564	WMIC.exe
Token: SeSecurityPrivilege	1564	WMIC.exe
Token: SeTakeOwnershipPrivilege	1564	WMIC.exe
Token: SeLoadDriverPrivilege	1564	WMIC.exe
Token: SeSystemProfilePrivilege	1564	WMIC.exe
Token: SeSystemtimePrivilege	1564	WMIC.exe
Token: SeProfSingleProcessPrivilege	1564	WMIC.exe
Token: SeIncBasePriorityPrivilege	1564	WMIC.exe
Token: SeCreatePagefilePrivilege	1564	WMIC.exe
Token: SeBackupPrivilege	1564	WMIC.exe
Token: SeRestorePrivilege	1564	WMIC.exe
Token: SeShutdownPrivilege	1564	WMIC.exe
Token: SeDebugPrivilege	1564	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1564	WMIC.exe
Token: SeRemoteShutdownPrivilege	1564	WMIC.exe
Token: SeUndockPrivilege	1564	WMIC.exe
Token: SeManageVolumePrivilege	1564	WMIC.exe
Token: 33	1564	WMIC.exe
Token: 34	1564	WMIC.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exeDllHost.exe

pid process

1632 iexplore.exe
2184 DllHost.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1632 iexplore.exe
1632 iexplore.exe
2028 IEXPLORE.EXE
2028 IEXPLORE.EXE

pid	process
1632	iexplore.exe
2184	DllHost.exe

pid	process
1632	iexplore.exe
1632	iexplore.exe
2028	IEXPLORE.EXE
2028	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

JC_suspectfile2.exeyeydengfrovj.exeiexplore.exe

description	pid	process	target process
PID 368 wrote to memory of 2144	368	JC_suspectfile2.exe	yeydengfrovj.exe
PID 368 wrote to memory of 2144	368	JC_suspectfile2.exe	yeydengfrovj.exe
PID 368 wrote to memory of 2144	368	JC_suspectfile2.exe	yeydengfrovj.exe
PID 368 wrote to memory of 2144	368	JC_suspectfile2.exe	yeydengfrovj.exe
PID 368 wrote to memory of 2788	368	JC_suspectfile2.exe	cmd.exe
PID 368 wrote to memory of 2788	368	JC_suspectfile2.exe	cmd.exe
PID 368 wrote to memory of 2788	368	JC_suspectfile2.exe	cmd.exe
PID 368 wrote to memory of 2788	368	JC_suspectfile2.exe	cmd.exe
PID 2144 wrote to memory of 2540	2144	yeydengfrovj.exe	WMIC.exe
PID 2144 wrote to memory of 2540	2144	yeydengfrovj.exe	WMIC.exe
PID 2144 wrote to memory of 2540	2144	yeydengfrovj.exe	WMIC.exe
PID 2144 wrote to memory of 2540	2144	yeydengfrovj.exe	WMIC.exe
PID 2144 wrote to memory of 1804	2144	yeydengfrovj.exe	NOTEPAD.EXE
PID 2144 wrote to memory of 1804	2144	yeydengfrovj.exe	NOTEPAD.EXE
PID 2144 wrote to memory of 1804	2144	yeydengfrovj.exe	NOTEPAD.EXE
PID 2144 wrote to memory of 1804	2144	yeydengfrovj.exe	NOTEPAD.EXE
PID 2144 wrote to memory of 1632	2144	yeydengfrovj.exe	iexplore.exe
PID 2144 wrote to memory of 1632	2144	yeydengfrovj.exe	iexplore.exe
PID 2144 wrote to memory of 1632	2144	yeydengfrovj.exe	iexplore.exe
PID 2144 wrote to memory of 1632	2144	yeydengfrovj.exe	iexplore.exe
PID 1632 wrote to memory of 2028	1632	iexplore.exe	IEXPLORE.EXE
PID 1632 wrote to memory of 2028	1632	iexplore.exe	IEXPLORE.EXE
PID 1632 wrote to memory of 2028	1632	iexplore.exe	IEXPLORE.EXE
PID 1632 wrote to memory of 2028	1632	iexplore.exe	IEXPLORE.EXE
PID 2144 wrote to memory of 1564	2144	yeydengfrovj.exe	WMIC.exe
PID 2144 wrote to memory of 1564	2144	yeydengfrovj.exe	WMIC.exe
PID 2144 wrote to memory of 1564	2144	yeydengfrovj.exe	WMIC.exe
PID 2144 wrote to memory of 1564	2144	yeydengfrovj.exe	WMIC.exe
PID 2144 wrote to memory of 564	2144	yeydengfrovj.exe	cmd.exe
PID 2144 wrote to memory of 564	2144	yeydengfrovj.exe	cmd.exe
PID 2144 wrote to memory of 564	2144	yeydengfrovj.exe	cmd.exe
PID 2144 wrote to memory of 564	2144	yeydengfrovj.exe	cmd.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

yeydengfrovj.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	yeydengfrovj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	yeydengfrovj.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\JC_suspectfile2.exe
"C:\Users\Admin\AppData\Local\Temp\JC_suspectfile2.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:368
- C:\Windows\yeydengfrovj.exe
  C:\Windows\yeydengfrovj.exe
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2144
- - C:\Windows\System32\wbem\WMIC.exe
    "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2540
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:1804
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1632
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1632 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2028
- - C:\Windows\System32\wbem\WMIC.exe
    "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1564
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\YEYDEN~1.EXE
    3⤵
    PID:564
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\JC_SUS~1.EXE
  2⤵
  - Deletes itself
  PID:2788

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2836

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECOVERY_+rljit.html

Filesize
11KB

MD5
8c6710f8436b46b89165374c225c9a00

SHA1
39f8fcfd7a9d139a454e52d8e251324e77a27126

SHA256
05fd934d19e4f3d35451c82dc84fe3fc1da478d8252dd1c774ed1c0e599c74a0

SHA512
33adaa3eba94b77d10cd83f31f269e6ad51bce97ef1d31fa0d4e660fa2b3dadbe312154eaac074d6cb9e244313caf4b47dd847a9c99389428ddcee7932b4d98e

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECOVERY_+rljit.png

Filesize
62KB

MD5
a90d8f9d31b4a33f58b8555ab5995670

SHA1
3931d335c2d07df5657293c74f82ebdbb5b3efab

SHA256
9a2c7eddcc58d814b6532a7d5d5bbc31ac591c2de68a660b4015ae1c8078a741

SHA512
af58e1ae21e0b200a813d336733996fbcb3a33c458aec1b2c484128b4b1bf2a2000ae03a0f86bf90f55e927efe158c06fcd5f264a8bf7a095d99efc41dccb1fa

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECOVERY_+rljit.txt

Filesize
1KB

MD5
8a85a3a701b92149de212b22f1f2f4b9

SHA1
32bac9d82e9f346591467baf843a49a368937c36

SHA256
72bfbed56857f329429ef5749ba4dd462bbeb13262c5c02c13dcbb69f5f92c82

SHA512
5630812fd95eadf4fc33a305379b218d6e53cf81ae6f1f6c5e02665bbd13bbf87cb1ac023ed4a76ce165e4276bd141145ad029be9e9c019ff603cdc5930f3699

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
2d244a0c90217f5e5a5ebe81d09b097c

SHA1
6575469f7d330a8c3ec04d848c751c9c308b99a8

SHA256
ed83bc1129513c436e7b9841acbf2d45b584ad5f9b1660ddd7de158222bcf589

SHA512
c5f10a780b4df641ef683bdaf90ee96cf5b02edaf70f1d54ad6e1f20911f5c67739b801f9a35c0ee83aa451aa72e5738445be086fecd7a63d82655abca97523e

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
fcb7d158421ea2a3a8694b729e7fa3fa

SHA1
2ebe2618127e1aff06b1bb3d25aa7f67de9d69e0

SHA256
a0800fc7602d5664fe8a876c93c9d5a39e9a3221571a368e08ab6c7af313d5e2

SHA512
e39c7fef1a2f30aec32ede37bacf5830ec81193d59cffd79b8f8d2034fdb3a11a139511d7be92a8a760a5993b64dd774856137452c26255cf67e89a3fb5b564d

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
173KB

MD5
9b47e400ec80b2873526aec5dbfb8e62

SHA1
c85d3d7c5557425e695ac979cdc3976aad20a188

SHA256
cce52f5e99ffa7d0a88cf0413d77df7e14a171dd2621650e2fa5f761cf97e7bc

SHA512
610bc53382ff1977aa25a0e9d1e3e5b6836cc2aa45b527e0fab7d6f268819591288988a09de62c697b15983be30b32dcab5238ac12672594454fed7e0f92573c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7389582b4961dcac8e0c5afeca12ace

SHA1
db8ca599613bf96892ed550f3f9e658a4f0b0a12

SHA256
ca6a89ed53b6f41f745f97c4eb12d23562cd265ae7edcef4c03562df7e75f84a

SHA512
e282ec8e56832d20ae9070be0641325bd583e144c38efc136ec746e1bbf540f58bc33da3b61d9d89e455c48329af459b91ea2497128f04bcb4eebf754496f122

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06b4ee9323fbefd5bc2a692c00e40871

SHA1
2db6929f7892aa6efdcd7fbf4fc4e35b6c9b93c4

SHA256
9c6b9fdfc457093fa94d13280d363394f81f2b287975dac2109287dc905ac128

SHA512
23e2cd92c62f03bc9638342a38ccbbd7f54257a93324d7116e9c70bcf198a7ac7adcc0967eeb3f63ab549c2631d72682a3d7f0e3af9aa6940715f43988295524

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00c0c4bf527cdc46e7ed8c1c6af89aeb

SHA1
e30ad61dfc48e2a3993d2c0d9469042052460e34

SHA256
010961d2fc0d695098f4ae91de80716b4fc8b08257e347df6d642ef2a0394bca

SHA512
6c847000ac7ac4034883c0b8e37c3381647661e4c6d533c0176ae035afba3a5d061292ff3e92f29338c2cf2991c6b624776e518d12db766e54e04d1188050929

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea50d029ae421b84f44710b1d02ec526

SHA1
de6f9dfbf07590253b954d5fd682ec138aa0c61b

SHA256
7f0a573ebb2e3157b4a81b6e5adb0493504bfeaaba661d653735b44ecc5cef51

SHA512
0a45fabf11bd7b9e0720a6e3909d62dc3330b9d59d8ca3e4bc86c02110557e12d997cfc0e728e0f0fd6f1da77c2e4d1ccce3919967c8fc5498ccecfafd45f691

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83f53f2d65409f23c5c00d781a1e5a1d

SHA1
726ee7ac696a209791cd4c2813ba7320f0248110

SHA256
995cdc1f7089d8554b71fd6ac4bfb4db9d4486dc65339a55c5b52edcf306dd6f

SHA512
88a6d669d07c190771f15b5bf33cfddb7009864fc9f8e2623e9a8a5367b3374ff0c412128df6354e1e3a48f2976e310d235742efc7888788acf01a2065ee3d52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8cf79905361c709a48353613289aa9a

SHA1
c5d356ae00842a28220d6415c4eae9cc8f474e31

SHA256
9c72fbf36eff97577a717bc3d19e2ad714f4ab5063eb3c58ae13200f2f607425

SHA512
7420b1f03599601e74230e05408bc5d111ee9f62d80bb4ffe3c65cc40b908b252c301fa14a6379ad0e2a62378e7fa192518e5094d09c671993130b52dbdba218

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca5a73a4696390a3bc400a94539f64b7

SHA1
1473f4809d0ff14dcbc1c5f9531682c118dd29e2

SHA256
688002885111ec4f07afccf5a7baa19dd5ad11d2e482b2aa702035fa2bf50b0b

SHA512
51bdb60ca0de54d2437b107c25bc762fedad1533389a109c581ecf4f3f66ed092cd85988e9a804fc84c444e6213ff4fceaaac796b85af9f6c9e49563167ddfd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d125d525049c306d544946c7d56b689f

SHA1
e1b53666ef5c2f1c64f882cd5b4f48973352fc63

SHA256
534eea86b51f6bc9c9cc06bfed25b540b96fd0a3d39365b43b42b3d5c6f5577f

SHA512
27f64b5d85397bfc1b8d4c9da49e57b5459803badd9bdd21a8a5b32b918aa305468f4a1809d5d19ab8cc6c256ab36a440e868f98adf09f17ff06d6575c47abdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3060e35f2ecbcabf3f5072435d6a5b6

SHA1
07714a8a75a8f16bbd6b510ca524d5d9611e58b6

SHA256
e00710a9b58bd9922a69e6b944374e4f5e64f5b76d30f12ede6e79a560a95132

SHA512
13eead66e0171688a8ee916d5321383883cbb6f4c605709e893d5911bc0ef0a80ace33d5dbf23dbd0a3f9fa41193e4213f0572f088f5491f43489e42e53f1d58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6f5e8222878e8d121588ca0460f68ea

SHA1
3e55bf3fca7a29f8ec70221d618376949e4fdd34

SHA256
97470c1c38cca20424243f9ec96f8f7e5d66a8c106495205d8c96ff6d626ed23

SHA512
e50799f10bc9207a06ea1b04458c7afe3c0b7d07b8ae51658c95d29097420646f9a3c6d3a2106ef6e627929e472e275e67955778b18d9f650c344415ac0e40b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6580375d82f4afcd60fa60482ec5e8e4

SHA1
407f5459d8977dcbb73e0e7ced9f427bf5c868bb

SHA256
8f94763bb454079f2b608a5eb72f3fecfe25e0a42a66dae53b4112134aabe979

SHA512
0590a3285429b86e73feb43812331bf08c6facb508516502016ea208b677b7fb4d66a109f64bccb774d49c5e2faf2f0b53576a6c615d2627a2a18b5e259b2800

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a57b4be426eec0d51fe18bbaae14d7c6

SHA1
68944cad81745cb159c750f01dcd1b1fddcde150

SHA256
4022258565e68983da31824a15985060a9f26c10bb9d1649811d8d774fd7db77

SHA512
d3189c26124f575f55db43b44bba2e20d261d68c3e142b0183e6035c2430ee4cd3a2cc69e7399e14a2b38e714cefa73c77e9ce808971fc567e4cecddf6bbed08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
649325abb99ee76c65adfe722b5dc67d

SHA1
996c874fd430f45d9d04df217a184910c8e6efd4

SHA256
d2fe5c1b7c8cba85b00ef82c91f7fd6dcad11f49b8f15815b581f7b9daf93554

SHA512
c87a76344facb03b6323e829ccb640411543ce01a34de5e8da9c8efcaf5c98d33b8a1d3825dbdecaa449ca0650040883dfe46dd2b2a71b6c1b4d090e5f7b0d0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b1d610dc132867273729e0921070a40

SHA1
5da83c38c7d5d0fbceffb9bc151621005b4e793e

SHA256
41c4705e57927c6e72e96b7fd0916c03b1682393d2d08f04b3e04e1b1c520d51

SHA512
4437b8b0adae068f39d3bb6dc64b78c9b325b6434b1d02e657e58941a8cb7b3e169e24474596fad78eb8feb032bee86a356cb6b7e249967ee328c1781d452fd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83e6572e4379a8c74c31ce8f9b408609

SHA1
9ddc5be1e6dabaead5d430522c5c972f8ed0e09b

SHA256
e5b4d20ec47d2b36d33aac3b5971f4d1321fe531f3036b626bb03fbda94fc1c9

SHA512
cad35ef73caf17cd79d90471234bb306191c03af80a91b2b6f7cd54a39a88d0187f20c1046ef6ecad40e5ee3b56af94992a2bc1fdd67dc5df89a0d3e6ff6d06c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a4cc09ee77fa892b246ba8bacbceac6

SHA1
702b890d103d0ba6d11826ad1a77939bfbcb5f81

SHA256
6a03d1e9cfa9685c8e6f58d0b0a61e2d0f0d49e47c900f1089a4c4bfb30a5b8c

SHA512
d427f526a8d8952d8dd7b7ec391e802c5dcdafdc7c7631caaee9782ba99d230c16a1327cfc46185040ae4d5483a11b593192e0f3c19ffb4f8c97fc09c27894f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3A07.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3A79.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\_RECOVERY_+rljit.html

Filesize
11KB

MD5
8c6710f8436b46b89165374c225c9a00

SHA1
39f8fcfd7a9d139a454e52d8e251324e77a27126

SHA256
05fd934d19e4f3d35451c82dc84fe3fc1da478d8252dd1c774ed1c0e599c74a0

SHA512
33adaa3eba94b77d10cd83f31f269e6ad51bce97ef1d31fa0d4e660fa2b3dadbe312154eaac074d6cb9e244313caf4b47dd847a9c99389428ddcee7932b4d98e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\_RECOVERY_+rljit.png

Filesize
62KB

MD5
a90d8f9d31b4a33f58b8555ab5995670

SHA1
3931d335c2d07df5657293c74f82ebdbb5b3efab

SHA256
9a2c7eddcc58d814b6532a7d5d5bbc31ac591c2de68a660b4015ae1c8078a741

SHA512
af58e1ae21e0b200a813d336733996fbcb3a33c458aec1b2c484128b4b1bf2a2000ae03a0f86bf90f55e927efe158c06fcd5f264a8bf7a095d99efc41dccb1fa

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\_RECOVERY_+rljit.txt

Filesize
1KB

MD5
8a85a3a701b92149de212b22f1f2f4b9

SHA1
32bac9d82e9f346591467baf843a49a368937c36

SHA256
72bfbed56857f329429ef5749ba4dd462bbeb13262c5c02c13dcbb69f5f92c82

SHA512
5630812fd95eadf4fc33a305379b218d6e53cf81ae6f1f6c5e02665bbd13bbf87cb1ac023ed4a76ce165e4276bd141145ad029be9e9c019ff603cdc5930f3699

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\_RECOVERY_+rljit.html

Filesize
11KB

MD5
8c6710f8436b46b89165374c225c9a00

SHA1
39f8fcfd7a9d139a454e52d8e251324e77a27126

SHA256
05fd934d19e4f3d35451c82dc84fe3fc1da478d8252dd1c774ed1c0e599c74a0

SHA512
33adaa3eba94b77d10cd83f31f269e6ad51bce97ef1d31fa0d4e660fa2b3dadbe312154eaac074d6cb9e244313caf4b47dd847a9c99389428ddcee7932b4d98e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\_RECOVERY_+rljit.png

Filesize
62KB

MD5
a90d8f9d31b4a33f58b8555ab5995670

SHA1
3931d335c2d07df5657293c74f82ebdbb5b3efab

SHA256
9a2c7eddcc58d814b6532a7d5d5bbc31ac591c2de68a660b4015ae1c8078a741

SHA512
af58e1ae21e0b200a813d336733996fbcb3a33c458aec1b2c484128b4b1bf2a2000ae03a0f86bf90f55e927efe158c06fcd5f264a8bf7a095d99efc41dccb1fa

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\_RECOVERY_+rljit.txt

Filesize
1KB

MD5
8a85a3a701b92149de212b22f1f2f4b9

SHA1
32bac9d82e9f346591467baf843a49a368937c36

SHA256
72bfbed56857f329429ef5749ba4dd462bbeb13262c5c02c13dcbb69f5f92c82

SHA512
5630812fd95eadf4fc33a305379b218d6e53cf81ae6f1f6c5e02665bbd13bbf87cb1ac023ed4a76ce165e4276bd141145ad029be9e9c019ff603cdc5930f3699

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\_RECOVERY_+rljit.html

Filesize
11KB

MD5
8c6710f8436b46b89165374c225c9a00

SHA1
39f8fcfd7a9d139a454e52d8e251324e77a27126

SHA256
05fd934d19e4f3d35451c82dc84fe3fc1da478d8252dd1c774ed1c0e599c74a0

SHA512
33adaa3eba94b77d10cd83f31f269e6ad51bce97ef1d31fa0d4e660fa2b3dadbe312154eaac074d6cb9e244313caf4b47dd847a9c99389428ddcee7932b4d98e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\_RECOVERY_+rljit.png

Filesize
62KB

MD5
a90d8f9d31b4a33f58b8555ab5995670

SHA1
3931d335c2d07df5657293c74f82ebdbb5b3efab

SHA256
9a2c7eddcc58d814b6532a7d5d5bbc31ac591c2de68a660b4015ae1c8078a741

SHA512
af58e1ae21e0b200a813d336733996fbcb3a33c458aec1b2c484128b4b1bf2a2000ae03a0f86bf90f55e927efe158c06fcd5f264a8bf7a095d99efc41dccb1fa

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\_RECOVERY_+rljit.txt

Filesize
1KB

MD5
8a85a3a701b92149de212b22f1f2f4b9

SHA1
32bac9d82e9f346591467baf843a49a368937c36

SHA256
72bfbed56857f329429ef5749ba4dd462bbeb13262c5c02c13dcbb69f5f92c82

SHA512
5630812fd95eadf4fc33a305379b218d6e53cf81ae6f1f6c5e02665bbd13bbf87cb1ac023ed4a76ce165e4276bd141145ad029be9e9c019ff603cdc5930f3699

Download Submit
C:\Users\Admin\Desktop\RECOVERY.HTM

Filesize
11KB

MD5
8c6710f8436b46b89165374c225c9a00

SHA1
39f8fcfd7a9d139a454e52d8e251324e77a27126

SHA256
05fd934d19e4f3d35451c82dc84fe3fc1da478d8252dd1c774ed1c0e599c74a0

SHA512
33adaa3eba94b77d10cd83f31f269e6ad51bce97ef1d31fa0d4e660fa2b3dadbe312154eaac074d6cb9e244313caf4b47dd847a9c99389428ddcee7932b4d98e

Download Submit
C:\Users\Admin\Desktop\RECOVERY.TXT

Filesize
1KB

MD5
8a85a3a701b92149de212b22f1f2f4b9

SHA1
32bac9d82e9f346591467baf843a49a368937c36

SHA256
72bfbed56857f329429ef5749ba4dd462bbeb13262c5c02c13dcbb69f5f92c82

SHA512
5630812fd95eadf4fc33a305379b218d6e53cf81ae6f1f6c5e02665bbd13bbf87cb1ac023ed4a76ce165e4276bd141145ad029be9e9c019ff603cdc5930f3699

Download Submit
C:\Users\Admin\Desktop\RECOVERY.png

Filesize
62KB

MD5
a90d8f9d31b4a33f58b8555ab5995670

SHA1
3931d335c2d07df5657293c74f82ebdbb5b3efab

SHA256
9a2c7eddcc58d814b6532a7d5d5bbc31ac591c2de68a660b4015ae1c8078a741

SHA512
af58e1ae21e0b200a813d336733996fbcb3a33c458aec1b2c484128b4b1bf2a2000ae03a0f86bf90f55e927efe158c06fcd5f264a8bf7a095d99efc41dccb1fa

Download Submit
C:\Windows\yeydengfrovj.exe

Filesize
360KB

MD5
9ce01dfbf25dfea778e57d8274675d6f

SHA1
1bd767beb5bc36b396ca6405748042640ad57526

SHA256
5343947829609f69e84fe7e8172c38ee018ede3c9898d4895275f596ac54320d

SHA512
d6ba89c1f221a94e3061bc4da896760d99935a7c766b8e4e30146266cf3356acd883835e75dbb86574bc869c83d381c8f63f23392101f6062bba4343af49978b

Download Submit
C:\Windows\yeydengfrovj.exe

Filesize
360KB

MD5
9ce01dfbf25dfea778e57d8274675d6f

SHA1
1bd767beb5bc36b396ca6405748042640ad57526

SHA256
5343947829609f69e84fe7e8172c38ee018ede3c9898d4895275f596ac54320d

SHA512
d6ba89c1f221a94e3061bc4da896760d99935a7c766b8e4e30146266cf3356acd883835e75dbb86574bc869c83d381c8f63f23392101f6062bba4343af49978b

Download Submit
C:\Windows\yeydengfrovj.exe

Filesize
360KB

MD5
9ce01dfbf25dfea778e57d8274675d6f

SHA1
1bd767beb5bc36b396ca6405748042640ad57526

SHA256
5343947829609f69e84fe7e8172c38ee018ede3c9898d4895275f596ac54320d

SHA512
d6ba89c1f221a94e3061bc4da896760d99935a7c766b8e4e30146266cf3356acd883835e75dbb86574bc869c83d381c8f63f23392101f6062bba4343af49978b

Download Submit
memory/368-1-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/368-12-0x00000000002F0000-0x0000000000375000-memory.dmp

Filesize
532KB

Download
memory/368-11-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/368-0-0x00000000002F0000-0x0000000000375000-memory.dmp

Filesize
532KB

Download
memory/2144-3739-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/2144-5820-0x0000000003E20000-0x0000000003E22000-memory.dmp

Filesize
8KB

Download
memory/2144-529-0x0000000001CD0000-0x0000000001D55000-memory.dmp

Filesize
532KB

Download
memory/2144-523-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/2144-5825-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/2144-6272-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/2144-2443-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/2144-14-0x0000000001CD0000-0x0000000001D55000-memory.dmp

Filesize
532KB

Download
memory/2144-13-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/2144-5139-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/2144-1034-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/2184-5821-0x00000000001F0000-0x00000000001F2000-memory.dmp

Filesize
8KB

Download
memory/2184-5822-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2184-6264-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download