d24df945a8c781573c1a1172241ae9fc8fd8a8cca1e599754bac66b9a590ee0a

Analysis

max time kernel
148s
max time network
152s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 15:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1abb16b7c5ee027bdbe4146ea7afe3a0_NeikiAnalytics.exe
Size

336KB
MD5

1abb16b7c5ee027bdbe4146ea7afe3a0
SHA1

4d1cdf16ff56ebea28faf8c5b5adf9da03c98d48
SHA256

d24df945a8c781573c1a1172241ae9fc8fd8a8cca1e599754bac66b9a590ee0a
SHA512

558ac04dcfb2f69a4ed7d61b6ea180f33c9b976569f2e51a79f866099376bcac41c9f6a7c7fccaa1607a5d5b7370e8f29f73aa3f5f7f7070614992b75237a4d0
SSDEEP

6144:+FN336YMFYfVcT7/9ju3iuUtZhckmEAhzNKGQXHJxb780y2LFkN:q5n9W7/1tZhcIAhZKGQXHJxf8wLSN

Score

10^/10

defense_evasion execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+wwcmj.txt

Ransom Note

__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#! NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-4096 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://prest54538hnksjn4kjfwdbhwere.hotchunman.com/B1EFB6A41BC05B9A 2. http://b4youfred5485jgsa3453f.italazudda.com/B1EFB6A41BC05B9A 3. http://5rport45vcdef345adfkksawe.bematvocal.at/B1EFB6A41BC05B9A If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser and wait for initialization 3. Type in the address bar: fwgrhsao3aoml7ej.onion/B1EFB6A41BC05B9A 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://prest54538hnksjn4kjfwdbhwere.hotchunman.com/B1EFB6A41BC05B9A http://b4youfred5485jgsa3453f.italazudda.com/B1EFB6A41BC05B9A http://5rport45vcdef345adfkksawe.bematvocal.at/B1EFB6A41BC05B9A *-*-* Your personal page Tor-Browser: fwgrhsao3aoml7ej.ONION/B1EFB6A41BC05B9A *-*-* Your personal identification ID: B1EFB6A41BC05B9A

URLs

http://prest54538hnksjn4kjfwdbhwere.hotchunman.com/B1EFB6A41BC05B9A

http://b4youfred5485jgsa3453f.italazudda.com/B1EFB6A41BC05B9A

http://5rport45vcdef345adfkksawe.bematvocal.at/B1EFB6A41BC05B9A

http://fwgrhsao3aoml7ej.onion/B1EFB6A41BC05B9A

http://fwgrhsao3aoml7ej.ONION/B1EFB6A41BC05B9A

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (373) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2920 cmd.exe

pid	process
2920	cmd.exe

Drops startup file 3 IoCs

Processes:

qwrydmhfrbsr.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+wwcmj.png	qwrydmhfrbsr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+wwcmj.txt	qwrydmhfrbsr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+wwcmj.html	qwrydmhfrbsr.exe

Executes dropped EXE 1 IoCs

Processes:

qwrydmhfrbsr.exe

pid process

2312 qwrydmhfrbsr.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

qwrydmhfrbsr.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\bkjdmwmgoxfc = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\qwrydmhfrbsr.exe\""	qwrydmhfrbsr.exe

Drops file in Program Files directory 64 IoCs

Processes:

qwrydmhfrbsr.exe

description	ioc	process
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Recovery+wwcmj.txt	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\Recovery+wwcmj.txt	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\Recovery+wwcmj.txt	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\Java\jre7\lib\images\cursors\Recovery+wwcmj.html	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\Microsoft Games\Minesweeper\es-ES\Recovery+wwcmj.html	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\Recovery+wwcmj.html	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Small_News.jpg	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\Recovery+wwcmj.txt	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\modules\Recovery+wwcmj.png	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\Recovery+wwcmj.png	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\js\Recovery+wwcmj.html	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\ja-JP\Recovery+wwcmj.png	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fi\Recovery+wwcmj.txt	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\tr\Recovery+wwcmj.html	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\Recovery+wwcmj.png	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\Recovery+wwcmj.png	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_ButtonGraphic.png	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_ButtonGraphic.png	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\Windows Mail\fr-FR\Recovery+wwcmj.txt	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\en-US\Recovery+wwcmj.html	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\slideShow.css	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\gu\Recovery+wwcmj.html	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\Windows Journal\fr-FR\Recovery+wwcmj.txt	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\it-IT\Recovery+wwcmj.txt	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\Recovery+wwcmj.png	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\Recovery+wwcmj.txt	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\Recovery+wwcmj.txt	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\Recovery+wwcmj.png	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\rings-dock.png	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\Recovery+wwcmj.png	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\misc\Recovery+wwcmj.html	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fa\Recovery+wwcmj.txt	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_divider_right.png	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\Recovery+wwcmj.png	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\Recovery+wwcmj.txt	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\js\Recovery+wwcmj.txt	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\Recovery+wwcmj.txt	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\DVD Maker\es-ES\Recovery+wwcmj.txt	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\clock.js	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pl\Recovery+wwcmj.html	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\he\Recovery+wwcmj.html	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\Recovery+wwcmj.txt	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\Windows Journal\en-US\Recovery+wwcmj.html	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\Recovery+wwcmj.html	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\js\slideShow.js	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\Recovery+wwcmj.png	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\Recovery+wwcmj.txt	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\Recovery+wwcmj.png	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\Recovery+wwcmj.png	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ml\Recovery+wwcmj.html	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\or\Recovery+wwcmj.txt	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\RSSFeeds.js	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha2.png	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\Recovery+wwcmj.html	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\logo.png	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\Recovery+wwcmj.png	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Main_Background_QuickLaunch.png	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\Recovery+wwcmj.txt	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\vi.pak	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\Java\jre7\Recovery+wwcmj.png	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\Recovery+wwcmj.png	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\Recovery+wwcmj.html	qwrydmhfrbsr.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fur\Recovery+wwcmj.html	qwrydmhfrbsr.exe

Drops file in Windows directory 2 IoCs

Processes:

1abb16b7c5ee027bdbe4146ea7afe3a0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Windows\qwrydmhfrbsr.exe	1abb16b7c5ee027bdbe4146ea7afe3a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\qwrydmhfrbsr.exe	1abb16b7c5ee027bdbe4146ea7afe3a0_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422725953"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001a81ac49a1ca5241b3ec9134ed9ec203000000000200000000001066000000010000200000002a9da3de15402f5a739201ad139f824cda90e0e4ef86bf87a5effc7de2bc3887000000000e8000000002000020000000aabac78cadfc86ad920ed0f397e8ecebd3041a5d9875d25fa928f5737485cec1900000009660d36746add577f6a831dc88f0949890c16266eaf1ae533e2bb19efda69045239cd08d254c3995e6e70294c5a51cb1bce56ded815fc5413212237aa9e147c3fc5ce1e2306af1ceecc0857cde52fad2d5332dce9d31a097cfd29b24149025ae835020760af6b5ada80e86cc9d5668f9e1bf10231bd35222bfbb668562ff1ce24dc6a6ba7c9abfa79b6d89a00f589af740000000658a8acf4b41ad94e1409311296f7d75f9255184b788bed283398b88315509f4e936601f6d90e63e7ef7eadca717f0a72f0bfc93ef3a9e625c3721c944d1a0ec	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{47F24351-19E1-11EF-8C47-FA8378BF1C4A} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001a81ac49a1ca5241b3ec9134ed9ec20300000000020000000000106600000001000020000000b0fec4103bc388ea1f0b36976b4e6b2840456e9925a7c301cbdd38a5f7f46ea2000000000e80000000020000200000009b215ab51e3e500644d1f631314ac47a97401992beb255ce105c4e7f8b7359f7200000004fea47f1ca5ef10c892d57b815c356019ed8b2a9ed236317a608aede634c58a3400000008996889210caaf305ef737d6230a880c7900a8bdd7c5bb7729aad6ef756130d8211606d63cfab572edb8d58276ee6894968a9a264a39aaf79a829ebf61ca57e0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d066de1ceeadda01	iexplore.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

1472 NOTEPAD.EXE

pid	process
1472	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

qwrydmhfrbsr.exe

pid	process
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe
2312	qwrydmhfrbsr.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

Processes:

1abb16b7c5ee027bdbe4146ea7afe3a0_NeikiAnalytics.exeqwrydmhfrbsr.exeWMIC.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	1300	1abb16b7c5ee027bdbe4146ea7afe3a0_NeikiAnalytics.exe
Token: SeDebugPrivilege	2312	qwrydmhfrbsr.exe
Token: SeIncreaseQuotaPrivilege	2568	WMIC.exe
Token: SeSecurityPrivilege	2568	WMIC.exe
Token: SeTakeOwnershipPrivilege	2568	WMIC.exe
Token: SeLoadDriverPrivilege	2568	WMIC.exe
Token: SeSystemProfilePrivilege	2568	WMIC.exe
Token: SeSystemtimePrivilege	2568	WMIC.exe
Token: SeProfSingleProcessPrivilege	2568	WMIC.exe
Token: SeIncBasePriorityPrivilege	2568	WMIC.exe
Token: SeCreatePagefilePrivilege	2568	WMIC.exe
Token: SeBackupPrivilege	2568	WMIC.exe
Token: SeRestorePrivilege	2568	WMIC.exe
Token: SeShutdownPrivilege	2568	WMIC.exe
Token: SeDebugPrivilege	2568	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2568	WMIC.exe
Token: SeRemoteShutdownPrivilege	2568	WMIC.exe
Token: SeUndockPrivilege	2568	WMIC.exe
Token: SeManageVolumePrivilege	2568	WMIC.exe
Token: 33	2568	WMIC.exe
Token: 34	2568	WMIC.exe
Token: 35	2568	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2568	WMIC.exe
Token: SeSecurityPrivilege	2568	WMIC.exe
Token: SeTakeOwnershipPrivilege	2568	WMIC.exe
Token: SeLoadDriverPrivilege	2568	WMIC.exe
Token: SeSystemProfilePrivilege	2568	WMIC.exe
Token: SeSystemtimePrivilege	2568	WMIC.exe
Token: SeProfSingleProcessPrivilege	2568	WMIC.exe
Token: SeIncBasePriorityPrivilege	2568	WMIC.exe
Token: SeCreatePagefilePrivilege	2568	WMIC.exe
Token: SeBackupPrivilege	2568	WMIC.exe
Token: SeRestorePrivilege	2568	WMIC.exe
Token: SeShutdownPrivilege	2568	WMIC.exe
Token: SeDebugPrivilege	2568	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2568	WMIC.exe
Token: SeRemoteShutdownPrivilege	2568	WMIC.exe
Token: SeUndockPrivilege	2568	WMIC.exe
Token: SeManageVolumePrivilege	2568	WMIC.exe
Token: 33	2568	WMIC.exe
Token: 34	2568	WMIC.exe
Token: 35	2568	WMIC.exe
Token: SeBackupPrivilege	2500	vssvc.exe
Token: SeRestorePrivilege	2500	vssvc.exe
Token: SeAuditPrivilege	2500	vssvc.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exeDllHost.exe

pid process

2692 iexplore.exe
968 DllHost.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2692 iexplore.exe
2692 iexplore.exe
776 IEXPLORE.EXE
776 IEXPLORE.EXE

pid	process
2692	iexplore.exe
968	DllHost.exe

pid	process
2692	iexplore.exe
2692	iexplore.exe
776	IEXPLORE.EXE
776	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

1abb16b7c5ee027bdbe4146ea7afe3a0_NeikiAnalytics.exeqwrydmhfrbsr.exeiexplore.exe

description	pid	process	target process
PID 1300 wrote to memory of 2312	1300	1abb16b7c5ee027bdbe4146ea7afe3a0_NeikiAnalytics.exe	qwrydmhfrbsr.exe
PID 1300 wrote to memory of 2312	1300	1abb16b7c5ee027bdbe4146ea7afe3a0_NeikiAnalytics.exe	qwrydmhfrbsr.exe
PID 1300 wrote to memory of 2312	1300	1abb16b7c5ee027bdbe4146ea7afe3a0_NeikiAnalytics.exe	qwrydmhfrbsr.exe
PID 1300 wrote to memory of 2312	1300	1abb16b7c5ee027bdbe4146ea7afe3a0_NeikiAnalytics.exe	qwrydmhfrbsr.exe
PID 1300 wrote to memory of 2920	1300	1abb16b7c5ee027bdbe4146ea7afe3a0_NeikiAnalytics.exe	cmd.exe
PID 1300 wrote to memory of 2920	1300	1abb16b7c5ee027bdbe4146ea7afe3a0_NeikiAnalytics.exe	cmd.exe
PID 1300 wrote to memory of 2920	1300	1abb16b7c5ee027bdbe4146ea7afe3a0_NeikiAnalytics.exe	cmd.exe
PID 1300 wrote to memory of 2920	1300	1abb16b7c5ee027bdbe4146ea7afe3a0_NeikiAnalytics.exe	cmd.exe
PID 2312 wrote to memory of 2568	2312	qwrydmhfrbsr.exe	WMIC.exe
PID 2312 wrote to memory of 2568	2312	qwrydmhfrbsr.exe	WMIC.exe
PID 2312 wrote to memory of 2568	2312	qwrydmhfrbsr.exe	WMIC.exe
PID 2312 wrote to memory of 2568	2312	qwrydmhfrbsr.exe	WMIC.exe
PID 2312 wrote to memory of 1472	2312	qwrydmhfrbsr.exe	NOTEPAD.EXE
PID 2312 wrote to memory of 1472	2312	qwrydmhfrbsr.exe	NOTEPAD.EXE
PID 2312 wrote to memory of 1472	2312	qwrydmhfrbsr.exe	NOTEPAD.EXE
PID 2312 wrote to memory of 1472	2312	qwrydmhfrbsr.exe	NOTEPAD.EXE
PID 2312 wrote to memory of 2692	2312	qwrydmhfrbsr.exe	iexplore.exe
PID 2312 wrote to memory of 2692	2312	qwrydmhfrbsr.exe	iexplore.exe
PID 2312 wrote to memory of 2692	2312	qwrydmhfrbsr.exe	iexplore.exe
PID 2312 wrote to memory of 2692	2312	qwrydmhfrbsr.exe	iexplore.exe
PID 2692 wrote to memory of 776	2692	iexplore.exe	IEXPLORE.EXE
PID 2692 wrote to memory of 776	2692	iexplore.exe	IEXPLORE.EXE
PID 2692 wrote to memory of 776	2692	iexplore.exe	IEXPLORE.EXE
PID 2692 wrote to memory of 776	2692	iexplore.exe	IEXPLORE.EXE
PID 2312 wrote to memory of 884	2312	qwrydmhfrbsr.exe	cmd.exe
PID 2312 wrote to memory of 884	2312	qwrydmhfrbsr.exe	cmd.exe
PID 2312 wrote to memory of 884	2312	qwrydmhfrbsr.exe	cmd.exe
PID 2312 wrote to memory of 884	2312	qwrydmhfrbsr.exe	cmd.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

qwrydmhfrbsr.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	qwrydmhfrbsr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	qwrydmhfrbsr.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\1abb16b7c5ee027bdbe4146ea7afe3a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1abb16b7c5ee027bdbe4146ea7afe3a0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1300

C:\Windows\qwrydmhfrbsr.exe
C:\Windows\qwrydmhfrbsr.exe
2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2312

C:\Windows\System32\wbem\WMIC.exe
"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2568

C:\Windows\SysWOW64\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
3⤵
- Opens file in notepad (likely ransom note)
PID:1472

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2692

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2692 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:776

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c DEL C:\Windows\QWRYDM~1.EXE
3⤵
PID:884

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\1ABB16~1.EXE
2⤵
- Deletes itself
PID:2920

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2500

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+wwcmj.html
Filesize
8KB

MD5
dca1828910af5d6e08ebc82d678a62b4

SHA1
00cd5bb78fe9ecac8d96f7cb56928ce5f3024508

SHA256
005b365b60b768a847462e0eeaba928f934dc3a284f844b47cf026738890e15a

SHA512
f6c4cdcf63c21d419a119005b61e494e728888d0fc0d05540322568689cfcf4b9f6b1f118ba7cb5cb4d7b9c93c64f35bd1b202ad258ad0285d7f3a34012ff9c5

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+wwcmj.png
Filesize
68KB

MD5
c91cf53582a8f31338043c68d191d1de

SHA1
901b19119f1c61fa62065dbf4746fb8ab546535d

SHA256
85f2a0624e795ac1d11a19dc9381c9494d92b7804b0f6e193af47ee83e74a642

SHA512
b2d5e7c1431c9e155552d073b9d00d53968db24c2229fac0b5d5299e89322f462321749d3e06e5a6f8c4dc6104c2010d91b05a3b2ae8b1b33363032e12c1b6bf

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+wwcmj.txt
Filesize
2KB

MD5
4b736449b1f49a833254a11254d31f44

SHA1
03ceaed6f9e68c484e2d4e1dd408a8a1acc33b2c

SHA256
6870302cb5c2dcfb443749f854f61e65708405c3b4b1a01531ccb0331e20be1c

SHA512
3b2ec4249a2e3ccf1d11968b7891b0948aebac81a39c93ed4a5c18d804796e6498c63cd87d9be6e25a96e00aecc3d5d6fbc6ae19930f8f252f043d049472e143

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt
Filesize
11KB

MD5
bdf2113c95fa6dea1529e8f01af78f3e

SHA1
1b4dbdf9891660df0324c8c828eafb86a8e94367

SHA256
e099415dacdfcaa8cbd1340190ddaf22b35ec708d7c3a565630df6248087addb

SHA512
8988d8e715fcc877fadef1162b1dadc88f9e8195d79a2858b90d84a128dbe01c5f043f7a528f088f1de9326506d7a3499e611ba7bd9de3e4635d9f51f6fc2dfd

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt
Filesize
109KB

MD5
d80c29ba14d17da9c0d282ebb97c71f1

SHA1
141c214be59cb993226afa952410f6bd140e9850

SHA256
559f6a66a35048fb8d62e95c589fdf042072adfcc4e8569b45fd0bf6fa27c21e

SHA512
f9a31e900cdfd0e9457c4c0a90cc45a99e5bc720b7db0315c7c1c75b35b0331d01353113ba7c3c6d33fcf2b25d842ab277f97408a7880ebf3e459665092a6b88

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt
Filesize
173KB

MD5
38aa0c7e353da2bf1ad561cc61dc0200

SHA1
bbc0afcc4b4d0bdbf971d84663ff4568f436cd50

SHA256
91a6ff2fc5919039ad9499abc56ad27d69676c9dc53a4dd75a7883a51b1b01b7

SHA512
0f0eac2d4ef410efaca13521ab431bf7b38c2c7ae5a52b436d5da259615f30a5f6a7d9ec9acad71c280cc505a373c7a30bd5670d7caae6857b04c6e3d53f679e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
be77f34741cf217544764e3a6a2e5350

SHA1
e239502a53619b229e897a698b849ad689019b29

SHA256
9d0b71f561effe3b8793cdf270dab3fa6d2f8e53aa4fc649e8b98578a7670bea

SHA512
2882e399cb67924dea9aca80fc0a3511226606af20f035fc797899a902cbf1405040a3c8514cb88e531a5b0698242f517baae839ea1018ed7b8479e61634b52c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
6324a445134f43334e9082f428f579ef

SHA1
4b29d51f3afa805f3ee66215dd88869d10959c6d

SHA256
a90147f72a75b1ef0efd1afba05695aeaf3d8ad84ff54fd3e7b00592e49b301d

SHA512
0e0df3db363769cc3f90f7357b4fed420cb93a9070c813cb24679cb2bb06ab1e45e1a404c2592160f5b56e5df2d4ca87db9db8f99a5ef3394a4fbca5272a74ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
54f2a678b7d5ebc7665487005e11d257

SHA1
5e81eb1ecadd88b75ca554afb0c280c6fb92afa4

SHA256
cff56041a337a34ba02b9cc05df5aebc025140deb7652d9ee3604422a5cf0b28

SHA512
80ccbb8704f0a94701b57be20ede371a91ecdfd7ae80533ebfdf5d78c167206701ffba22a635d7ce03b51f4b326d6ea32895b1831d2ad96f65774c50ab794442

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
5152cdd78898ae6652fdf25698e90492

SHA1
45e5c8fa0b3b90993b95848b0ea95df491179df3

SHA256
b253467eb540ecfdb5efecdc26ebacc4bbe0deb44d31cec57688a69e091bf6d3

SHA512
4d25991ae220d7a75b2339b03e98dd47090a1dc0a6caf47380b88f60e27c3c84f01c8bb3f55e3f0a186d9c359ee6fb87e984e917133d6a645e20d80c4145f892

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
d0fb9f20729d9fceadffcb4b5766551f

SHA1
8eae2c88fbb583659c0014492f03e082002fde2c

SHA256
71456f6dee6e763cb47aa877f8022df9394e3aa693d57ab442861c5542e04d68

SHA512
b049e9a3249ac6e768629daeb2e4bae8fb3e38bcdb482081768c3acc35820b509399e61352a219f5966a378f83d5ef79275129d1a3a4a076b56bcce281971e10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
5b748e564425ea76f6a2c2bb53e8c032

SHA1
50e70edf77c475cefeaaf1e085c116c53b447e30

SHA256
dadbc008d6e27dd8d64c9372e8b2d6ec9e5bae0eb147d16898f813253933dc8d

SHA512
2392fd8c5be5edde21f4fc3cf724384d3fb0dd9fb6aa86de8b73aeb8989128067b66dca81ef83247d738e90ffb0b96e5e136392d2db956d58f37a10a4a53fc23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
46de08d4cc21d1aa19a46bdbdbcd94f2

SHA1
0db5caa41f07f86da0b1b685a5b44c68d95956f2

SHA256
4525449cc3b792ac1cc62290c7b70ea09f86cd5ff5b9172d3ed581df9c5f76ae

SHA512
275b72fc0972e623f1bf2dbbd6bdd7181e3199bd00232d17deabef0a61fa48e61b7098fda7b67e4ab627bfecbb11945f7a186b436dedd9e94b51622676f54f93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
41041ff710f5ccfd68dc4b6e36060727

SHA1
4a030a5e5d8b5d2bb856443bb832806eecb200ac

SHA256
30162d3305e731f7b011260afc3826dc87ca82b415088f2ef25ebd8b6e9293cb

SHA512
100206ad61a9943e431d8fe73e4ca04ab74a39e660a05d0a68e6d7d9ad819577b5c82e4e920144fbe1a8602ae81cea17219a442750ad3ab353d89ef632840f41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
41e468c192b3042cd664949301af2dfb

SHA1
c70d3686c38a7e50725a4e71ff16a5fa2048aae9

SHA256
18d2c17dd754bde62b99dd7d737912d506ca2789b594763cfb8fa68c5309d918

SHA512
46837863d27840a2ceffc64c43d9fdecce29fa54ba6a3a3ba693bae8e2b718a193294321ba22dad6dc82d2bc7f76de73049309884cad39a80d9867af0aaf95f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
fc00e2399393fdd969c978f086ed3009

SHA1
7cc0ef797f89f1f4537d89a678b542acc556b5e8

SHA256
009678df314d5bf7edca3532f07d2e265bd388ec780402bcf27781d0ea6bcc47

SHA512
0e32bfbd2d71253cfcaa47a4aa146f5ae5448a72ef5c4ca7ada2f023fe158fa31fb32b46ca4d0ef2ba109c6cfde389001aae4afab0054d8a9de3f1530a31633a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
2086bf2f9aeff1744aa8aaed986dac1d

SHA1
feadae2d4d3eae4795fee5eb18779a423d53444b

SHA256
512b38a9579c354b79019e4903028651d75f7085ba3d40304995eea01a5a7674

SHA512
a898b772b5dda52d321140d6c2121adcdd52677be2a7c0f2fac9156cbc120e8122ee71dab31e126ddb747cd95cbfbaa2db2c6731ecd03d3091e4061fbc6b322a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
8e6b08fba59cfddaab2d8e56633c4b9c

SHA1
a1265ce29a7d23468fe9987de4ee3b64669d610a

SHA256
bd6373804bd86ee2c64cc29beb234ebd39d1e5239bdf5872649c36479ccb83f0

SHA512
0d149a742146bd3419def04f7a49bbe7d30852703791d8f91dfd1231c4dd2cf18856d578b92345e0da35e8e033b1fad2c1fcdd0dedf2aaecd194478940085a31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
e73fd64fa7980a3db3e00b0a30debd21

SHA1
db2c2771e4325a58549fae354734cf1a248070c3

SHA256
db847c7b6a635d2c4e83410d2d8e09c92764650c758c5fb6d183cd516fc9e6df

SHA512
348762636ccd57caa5509e4f0b17a21ab02d3ba11113892b277aee88feac41271f0c75ea6c8134a9a97b604de56a2ceb721bf5fdfb373e2548c374a3339b403a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
157747f0bb420ba46984b405b2bb6acd

SHA1
71e66a125678ee13a514d40f7277857e903b1424

SHA256
6e11d34f779ae04321dc4ccbe827f920ed3514119d0767eda4da5c4caedd9886

SHA512
79375d881cd98bdf9748b5dcdb0ca3cd85533a46d14f56a95bad76724b1bdfa9cf7906cdaaa1adab6c4042e758210e0282d22967e26d45b871549abf1c682711

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
24ebe40d174ca51f86b2363b44b95762

SHA1
ce3ba5cd5a39b2bdaea1bbfcb35c7dfb314c76e4

SHA256
8a471012f5d55b7761408c4b8f1131455d134c4a85c0453ce83b427207d66379

SHA512
acb15b3b3afdf092c1f0212a8de7a818ee619168dbbd37f8a2faad88b047dc56018faaa43847dd8796f7461243ab8da709387431fb430aa2df4daa68a806a303

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
664011677864791b915b4ecb5bbe6365

SHA1
e658caf5ad65b1ed990d22edf591edd4a9163ea7

SHA256
7e5326759ed4d32ea039367e1bc841dc44ce6249e306259440d3c44ec5cda931

SHA512
469a36fc827480406828dfc0c88ef288bcbc55ab94b0eeff35ffeb1656d1109608509d82123c12f0000dcbe660200d752f8a02b2c855c0785d54578170b4353a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f3d1431875a9b229470d2cba1a3bc606

SHA1
30ed5fb797edb4a380d0a58417fc2aea1172ff3d

SHA256
ad183b35c7b6caeea5d9f8af097dc6da206ff96002dc061a14e70058e04fd54c

SHA512
359c09993b83e82629844fc618169c64d7614d776cc3ee651f5f93c433e3d58621cc6a54cefd1a6d62e84f4db57d01e238362c9d9b02d0b03e1741152b725cab

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD922.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDA2E.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDA81.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Windows\qwrydmhfrbsr.exe
Filesize
336KB

MD5
1abb16b7c5ee027bdbe4146ea7afe3a0

SHA1
4d1cdf16ff56ebea28faf8c5b5adf9da03c98d48

SHA256
d24df945a8c781573c1a1172241ae9fc8fd8a8cca1e599754bac66b9a590ee0a

SHA512
558ac04dcfb2f69a4ed7d61b6ea180f33c9b976569f2e51a79f866099376bcac41c9f6a7c7fccaa1607a5d5b7370e8f29f73aa3f5f7f7070614992b75237a4d0

Download Submit
memory/968-5793-0x00000000001A0000-0x00000000001A2000-memory.dmp

Filesize
8KB

Download
memory/1300-0-0x0000000000290000-0x0000000000315000-memory.dmp

Filesize
532KB

Download
memory/1300-16-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1300-17-0x0000000000290000-0x0000000000315000-memory.dmp

Filesize
532KB

Download
memory/1300-1-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2312-860-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2312-6040-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2312-5796-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2312-5792-0x00000000024D0000-0x00000000024D2000-memory.dmp

Filesize
8KB

Download
memory/2312-5555-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2312-4580-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2312-3754-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2312-2581-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2312-1677-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2312-632-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2312-14-0x0000000000300000-0x0000000000385000-memory.dmp

Filesize
532KB

Download