1c144b77a916b914d55fc2dc31e834b50577e08cba1c25a7f7f1ec5cccbb51ac

Analysis

max time kernel
148s
max time network
57s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 21:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VirusShare_3b8c3c00dc30a34b4b9b205a6f93caab.exe
Size 344KB
Sample240610-1g9ltssbpp
SHA256 1c144b77a916b914d55fc2dc31e834b50577e08cba1c25a7f7f1ec5cccbb51ac
MD5 3b8c3c00dc30a34b4b9b205a6f93caab
SHA1 ae7299ff88a5569c824f6123feaa979c08428ee0
SHA512 bad2895355901b4c20c7cae804be63a3644678063ba2e9461645b8f37f63b57296eeb8423d1a486720b7229f05cc82c71d1d01170f34a249a80dadc63e7d9c11
SSDEEP 6144:sclgBCoMvJpr3IZVXBRVRC3BMaXGRTuKYAyqeT6y52cZuvrvD1hNVWfO6:s5C9Jpr3I3XBRi3WaXGEKXnW6RjPkv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion evasion execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\how_recover+fjg.txt

Ransom Note

111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) What does this mean ? This means that the structure and data within your files have been irrevocably changed, you will not be able to work with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them. 111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 How did this happen ? ---Specially for your PC was generated personal RSA-4096 KEY, both public and private. ---ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. 111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server. What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BTC NOW, and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://vr6g2curb2kcidou.encpayment23.com/CA1C81BA8C883569 2. http://vr6g2curb2kcidou.expay34.com/CA1C81BA8C883569 3. http://psbc532jm8c.hsh73cu37n1.net/CA1C81BA8C883569 4. https://vr6g2curb2kcidou.onion.to/CA1C81BA8C883569 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser and wait for initialization. 3. Type in the address bar: vr6g2curb2kcidou.onion/CA1C81BA8C883569 4. Follow the instructions on the site. IMPORTANT INFORMATION: Your personal pages: http://vr6g2curb2kcidou.encpayment23.com/CA1C81BA8C883569 http://vr6g2curb2kcidou.expay34.com/CA1C81BA8C883569 http://psbc532jm8c.hsh73cu37n1.net/CA1C81BA8C883569 https://vr6g2curb2kcidou.onion.to/CA1C81BA8C883569 Your personal page (using TOR-Browser): vr6g2curb2kcidou.onion/CA1C81BA8C883569 Your personal identification number (if you open the site (or TOR-Browser's) directly): CA1C81BA8C883569 111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111

URLs

http://vr6g2curb2kcidou.encpayment23.com/CA1C81BA8C883569
http://vr6g2curb2kcidou.expay34.com/CA1C81BA8C883569
http://psbc532jm8c.hsh73cu37n1.net/CA1C81BA8C883569
https://vr6g2curb2kcidou.onion.to/CA1C81BA8C883569
http://vr6g2curb2kcidou.onion/CA1C81BA8C883569

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 5 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
4060	bcdedit.exe
756	bcdedit.exe
3892	bcdedit.exe
60	bcdedit.exe
3264	bcdedit.exe

Renames multiple (878) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	VirusShare_3b8c3c00dc30a34b4b9b205a6f93caab.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	dlyokacroic.exe

Drops startup file 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\how_recover+fjg.txt	dlyokacroic.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\how_recover+fjg.html	dlyokacroic.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\how_recover+fjg.txt	dlyokacroic.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\how_recover+fjg.html	dlyokacroic.exe

Executes dropped EXE 2 IoCs

pid	Process
2748	dlyokacroic.exe
4388	dlyokacroic.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Acrndtd = "C:\\Users\\Admin\\AppData\\Roaming\\dlyokacroic.exe"	dlyokacroic.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	myexternalip.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1168 set thread context of 2124	1168	VirusShare_3b8c3c00dc30a34b4b9b205a6f93caab.exe	84
PID 2748 set thread context of 4388	2748	dlyokacroic.exe	89

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-96_altform-unplated.png	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Generic-Light.scale-250.png	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-black\WideTile.scale-200.png	dlyokacroic.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-180.png	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square310x310Logo.scale-150.png	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\AppxMetadata\how_recover+fjg.html	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_~_kzf8qxf38zg5c\microsoft.system.package.metadata\how_recover+fjg.txt	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookLargeTile.scale-125.png	dlyokacroic.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\how_recover+fjg.html	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubMedTile.scale-125_contrast-black.png	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.scale-200_contrast-black.png	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-64_contrast-white.png	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsLargeTile.scale-200.png	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreSmallTile.scale-200.png	dlyokacroic.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_large.png	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\66.png	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\WorldClockSmallTile.contrast-black_scale-200.png	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailMediumTile.scale-150.png	dlyokacroic.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.XLS	dlyokacroic.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\services_discovery\how_recover+fjg.txt	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-16.png	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\how_recover+fjg.html	dlyokacroic.exe
File opened for modification	C:\Program Files\Windows Media Player\uk-UA\how_recover+fjg.txt	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\StopwatchMedTile.contrast-white_scale-200.png	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Yahoo-Light.scale-300.png	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-black\how_recover+fjg.html	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\nl-NL\View3d\how_recover+fjg.txt	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.scale-125_contrast-white.png	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7da.png	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-black\SmallTile.scale-200.png	dlyokacroic.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\de\how_recover+fjg.html	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-72_altform-unplated.png	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\bn-BD\View3d\how_recover+fjg.txt	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\eu-ES\how_recover+fjg.txt	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-24.png	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\LargeTile.scale-100_contrast-white.png	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-60_altform-unplated_contrast-white.png	dlyokacroic.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ar-SA\how_recover+fjg.txt	dlyokacroic.exe
File opened for modification	C:\Program Files\Common Files\System\uk-UA\how_recover+fjg.txt	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeMedTile.scale-125.png	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\Assets\how_recover+fjg.txt	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\LibrarySquare150x150Logo.scale-125_contrast-black.png	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\Attribution\wdt.png	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\BadgeLogo.scale-100_contrast-white.png	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-36.png	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.scale-125.png	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-72_altform-lightunplated.png	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNotePageMedTile.scale-200.png	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\how_recover+fjg.html	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-30.png	dlyokacroic.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-180.png	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\hu-HU\how_recover+fjg.html	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\how_recover+fjg.txt	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-100_contrast-white.png	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreMedTile.scale-200.png	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Resources\RetailDemo\data\en-us\3.jpg	dlyokacroic.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\server\how_recover+fjg.html	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Images\Ratings\Yelp7.scale-125.png	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\LargeTile.scale-100_contrast-white.png	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\how_recover+fjg.txt	dlyokacroic.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\how_recover+fjg.html	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\how_recover+fjg.txt	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\how_recover+fjg.html	dlyokacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.scale-100_contrast-white.png	dlyokacroic.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Interacts with shadow copies 2 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
3860	vssadmin.exe
4988	vssadmin.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	dlyokacroic.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3164	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe
4388	dlyokacroic.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2124	VirusShare_3b8c3c00dc30a34b4b9b205a6f93caab.exe
Token: SeDebugPrivilege	4388	dlyokacroic.exe
Token: SeBackupPrivilege	3092	vssvc.exe
Token: SeRestorePrivilege	3092	vssvc.exe
Token: SeAuditPrivilege	3092	vssvc.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 2124	1168	VirusShare_3b8c3c00dc30a34b4b9b205a6f93caab.exe	84
PID 1168 wrote to memory of 2124	1168	VirusShare_3b8c3c00dc30a34b4b9b205a6f93caab.exe	84
PID 1168 wrote to memory of 2124	1168	VirusShare_3b8c3c00dc30a34b4b9b205a6f93caab.exe	84
PID 1168 wrote to memory of 2124	1168	VirusShare_3b8c3c00dc30a34b4b9b205a6f93caab.exe	84
PID 1168 wrote to memory of 2124	1168	VirusShare_3b8c3c00dc30a34b4b9b205a6f93caab.exe	84
PID 1168 wrote to memory of 2124	1168	VirusShare_3b8c3c00dc30a34b4b9b205a6f93caab.exe	84
PID 1168 wrote to memory of 2124	1168	VirusShare_3b8c3c00dc30a34b4b9b205a6f93caab.exe	84
PID 1168 wrote to memory of 2124	1168	VirusShare_3b8c3c00dc30a34b4b9b205a6f93caab.exe	84
PID 1168 wrote to memory of 2124	1168	VirusShare_3b8c3c00dc30a34b4b9b205a6f93caab.exe	84
PID 1168 wrote to memory of 2124	1168	VirusShare_3b8c3c00dc30a34b4b9b205a6f93caab.exe	84
PID 2124 wrote to memory of 2748	2124	VirusShare_3b8c3c00dc30a34b4b9b205a6f93caab.exe	85
PID 2124 wrote to memory of 2748	2124	VirusShare_3b8c3c00dc30a34b4b9b205a6f93caab.exe	85
PID 2124 wrote to memory of 2748	2124	VirusShare_3b8c3c00dc30a34b4b9b205a6f93caab.exe	85
PID 2124 wrote to memory of 3804	2124	VirusShare_3b8c3c00dc30a34b4b9b205a6f93caab.exe	87
PID 2124 wrote to memory of 3804	2124	VirusShare_3b8c3c00dc30a34b4b9b205a6f93caab.exe	87
PID 2124 wrote to memory of 3804	2124	VirusShare_3b8c3c00dc30a34b4b9b205a6f93caab.exe	87
PID 2748 wrote to memory of 4388	2748	dlyokacroic.exe	89
PID 2748 wrote to memory of 4388	2748	dlyokacroic.exe	89
PID 2748 wrote to memory of 4388	2748	dlyokacroic.exe	89
PID 2748 wrote to memory of 4388	2748	dlyokacroic.exe	89
PID 2748 wrote to memory of 4388	2748	dlyokacroic.exe	89
PID 2748 wrote to memory of 4388	2748	dlyokacroic.exe	89
PID 2748 wrote to memory of 4388	2748	dlyokacroic.exe	89
PID 2748 wrote to memory of 4388	2748	dlyokacroic.exe	89
PID 2748 wrote to memory of 4388	2748	dlyokacroic.exe	89
PID 2748 wrote to memory of 4388	2748	dlyokacroic.exe	89
PID 4388 wrote to memory of 4060	4388	dlyokacroic.exe	90
PID 4388 wrote to memory of 4060	4388	dlyokacroic.exe	90
PID 4388 wrote to memory of 3860	4388	dlyokacroic.exe	92
PID 4388 wrote to memory of 3860	4388	dlyokacroic.exe	92
PID 4388 wrote to memory of 756	4388	dlyokacroic.exe	96
PID 4388 wrote to memory of 756	4388	dlyokacroic.exe	96
PID 4388 wrote to memory of 3892	4388	dlyokacroic.exe	98
PID 4388 wrote to memory of 3892	4388	dlyokacroic.exe	98
PID 4388 wrote to memory of 60	4388	dlyokacroic.exe	100
PID 4388 wrote to memory of 60	4388	dlyokacroic.exe	100
PID 4388 wrote to memory of 3264	4388	dlyokacroic.exe	102
PID 4388 wrote to memory of 3264	4388	dlyokacroic.exe	102
PID 4388 wrote to memory of 3164	4388	dlyokacroic.exe	110
PID 4388 wrote to memory of 3164	4388	dlyokacroic.exe	110
PID 4388 wrote to memory of 3164	4388	dlyokacroic.exe	110
PID 4388 wrote to memory of 384	4388	dlyokacroic.exe	111
PID 4388 wrote to memory of 384	4388	dlyokacroic.exe	111
PID 384 wrote to memory of 2716	384	msedge.exe	112
PID 384 wrote to memory of 2716	384	msedge.exe	112
PID 4388 wrote to memory of 4988	4388	dlyokacroic.exe	113
PID 4388 wrote to memory of 4988	4388	dlyokacroic.exe	113
PID 4388 wrote to memory of 2396	4388	dlyokacroic.exe	115
PID 4388 wrote to memory of 2396	4388	dlyokacroic.exe	115
PID 4388 wrote to memory of 2396	4388	dlyokacroic.exe	115
PID 384 wrote to memory of 4184	384	msedge.exe	117
PID 384 wrote to memory of 4184	384	msedge.exe	117
PID 384 wrote to memory of 4184	384	msedge.exe	117
PID 384 wrote to memory of 4184	384	msedge.exe	117
PID 384 wrote to memory of 4184	384	msedge.exe	117
PID 384 wrote to memory of 4184	384	msedge.exe	117
PID 384 wrote to memory of 4184	384	msedge.exe	117
PID 384 wrote to memory of 4184	384	msedge.exe	117
PID 384 wrote to memory of 4184	384	msedge.exe	117
PID 384 wrote to memory of 4184	384	msedge.exe	117
PID 384 wrote to memory of 4184	384	msedge.exe	117
PID 384 wrote to memory of 4184	384	msedge.exe	117
PID 384 wrote to memory of 4184	384	msedge.exe	117
PID 384 wrote to memory of 4184	384	msedge.exe	117

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	dlyokacroic.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	dlyokacroic.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\VirusShare_3b8c3c00dc30a34b4b9b205a6f93caab.exe
"C:\Users\Admin\AppData\Local\Temp\VirusShare_3b8c3c00dc30a34b4b9b205a6f93caab.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Users\Admin\AppData\Local\Temp\VirusShare_3b8c3c00dc30a34b4b9b205a6f93caab.exe
  "C:\Users\Admin\AppData\Local\Temp\VirusShare_3b8c3c00dc30a34b4b9b205a6f93caab.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Users\Admin\AppData\Roaming\dlyokacroic.exe
    C:\Users\Admin\AppData\Roaming\dlyokacroic.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2748
  - - C:\Users\Admin\AppData\Roaming\dlyokacroic.exe
      C:\Users\Admin\AppData\Roaming\dlyokacroic.exe
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4388
    - - C:\Windows\SYSTEM32\bcdedit.exe
        
        bcdedit.exe /set {current} bootems off
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:4060
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
        5⤵
        Interacts with shadow copies
        
        PID:3860
    - - C:\Windows\SYSTEM32\bcdedit.exe
        
        bcdedit.exe /set {current} advancedoptions off
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:756
    - - C:\Windows\SYSTEM32\bcdedit.exe
        
        bcdedit.exe /set {current} optionsedit off
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:3892
    - - C:\Windows\SYSTEM32\bcdedit.exe
        
        bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:60
    - - C:\Windows\SYSTEM32\bcdedit.exe
        
        bcdedit.exe /set {current} recoveryenabled off
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:3264
    - - C:\Windows\SysWOW64\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Howto_RESTORE_FILES.txt
        5⤵
        Opens file in notepad (likely ransom note)
        
        PID:3164
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\Howto_RESTORE_FILES.html
        5⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:384
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x9c,0x108,0x7ffd5bf146f8,0x7ffd5bf14708,0x7ffd5bf14718
        6⤵
        
        PID:2716
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,2980475523357803672,9965858218641336851,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
        6⤵
        
        PID:4184
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,2980475523357803672,9965858218641336851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 /prefetch:3
        6⤵
        
        PID:3300
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,2980475523357803672,9965858218641336851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
        6⤵
        
        PID:3732
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,2980475523357803672,9965858218641336851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
        6⤵
        
        PID:3208
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,2980475523357803672,9965858218641336851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
        6⤵
        
        PID:3652
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,2980475523357803672,9965858218641336851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4692 /prefetch:8
        6⤵
        
        PID:3108
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,2980475523357803672,9965858218641336851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4692 /prefetch:8
        6⤵
        
        PID:4832
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,2980475523357803672,9965858218641336851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
        6⤵
        
        PID:1072
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,2980475523357803672,9965858218641336851,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
        6⤵
        
        PID:3648
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,2980475523357803672,9965858218641336851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
        6⤵
        
        PID:804
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,2980475523357803672,9965858218641336851,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
        6⤵
        
        PID:4560
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
        5⤵
        Interacts with shadow copies
        
        PID:4988
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Roaming\DLYOKA~1.EXE
        5⤵
        
        PID:2396
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE
    3⤵
    PID:3804

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

how_recover+fjg.html

Path C:\Program Files\7-Zip\Lang\how_recover+fjg.html
Size 9KB
SHA256 ac7cb80a19e67fa739b704cbdf456f46a66b605fb0d0ddbba5ba1742ec14fd84
MD5 d2fc17c5e1e5a80bd091943e2a2609fa
SHA1 6e3d88811a5e52991e09d01c3166888b867f5041
SHA512 fc6121e8530029f64892c824c3476370cae066951cb1ad34886757a28450963ffb78af75123c66661539b505e399768cf843b2de184c433e25b0a20d58512ec4
SSDEEP 96:Y5Km1f5C5kk55Dl1Zjb5RTn54Y5d5b5w5985ku5g5wdg5mq5pTHVk5sg35d55l54:wUDP2pgsjJC1n49eEZ/
MD5 SHA1 SHA512 SSDEEP

Submit Download

how_recover+fjg.txt

Path C:\Program Files\7-Zip\Lang\how_recover+fjg.txt
Size 2KB
SHA256 0e8cba8f5c787a807231f0fb3a856881c5c5d86a5cc6269cda56c1d1b16267f9
MD5 e1acfdada61f4139eed7390f8cff9759
SHA1 d53eae68a62ef5031fd852813b369d7a80a163bf
SHA512 fefc00bfd4d63f07e41e5a73c88e72c6baa3a00667d5480afe93a81538418b565a25114f3dd7584f29272f0104ec2600f64b03ff4ef2d7f6940d10418f1c27d1
MD5 SHA1 SHA512

Submit Download

THIRDPARTYLICENSEREADME-JAVAFX.txt

Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
Size 606B
SHA256 258957b1ffa36c154b39eaedfd0648da3cb7a68868ab67ca47e0ff7b9a64639b
MD5 7730d752dcf09db4badb19bc8fd6af89
SHA1 bdda2d5a390edc1b8feb25bf5f319b46a8f74aad
SHA512 41d8d2267fd35198db5a13a2660489fe67a7cad04c4c42c22a7b388a0c330f3eae796b19532c2bdffab7484767afd9526eaedb2380f4c361bb5a88497fcce6cd
MD5 SHA1 SHA512

Submit Download

THIRDPARTYLICENSEREADME.txt

Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
Size 606B
SHA256 2b98ea00763337ebcac53350ec90ed299cec38d3011b4786c110d10448406f7b
MD5 0374b687f9ddab2c7d03854de229f204
SHA1 45153bbfdad9a39a5e84825bee18a33b611e1e3b
SHA512 4f5b51b0d94b7ecda851d281e4a1518fc53596f70fd5c1dbd07803e2c581b736a9e881144ce9f091426c04787493f876c04e41aa3b7e72ea441decfb838ab170
MD5 SHA1 SHA512

Submit Download

ClientSub2019_eula.txt

Path C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
Size 462B
SHA256 c892a8993f87cdbee458939c59207a236c9740312e53d5fb599b5a3fc409473f
MD5 f8f3be8e3432f41ab9d169a241136017
SHA1 5f8fa75205953c8ac9fdeaddb6212ac7774368cf
SHA512 f46cd612aa843417ca5cecbb528954f12b40aa20f13421ed53158f6e300d7bd82223ebfaf30c5e1c145ac5ff18f1083f9e130a3a5fcbbbc7657fd1fbda6a0c11
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
MD5 612a6c4247ef652299b376221c984213
SHA1 d306f3b16bde39708aa862aee372345feb559750
SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
MD5 56641592f6e69f5f5fb06f2319384490
SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 9593f03bf64f79637ac8fec88055e24a23a7a69901d7dbed4e48213de4763b9e
MD5 b9a003a9b155892768e227cd3defbde2
SHA1 1f63987495cdf791006a0fe94718608935b5e354
SHA512 6350e746ec25f95ef68ab7358fd7b0b19cd17796d95ca44339a1e3206506db1c6c53417efe02295873fc7adba2cebe83d3c69fafde8068b14a89bc0a38368061
SSDEEP 96:nBkDq1ayn2wpvWMoiVmdeHk4vUWQyV+VDCziEwb:nBkmkyn2GWMXdro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f2d7855d4769f3fd4ee71edaf124c0c4c1f4a8fcbc7bfc25557de5a8d299b7e5
MD5 8680f754831335ee03341f7b96db3632
SHA1 c0238368113e5bc6229e40aa78d5e76d7f672a6e
SHA512 5b1ec086e54d854305c5490d4cfcc2b8e0334fc6ddd95c9b87fd17e1ac0ecaa818f0297ff4cd9377103fa6f1135870e2014470e4e384b2c251d58a2c68927c90
SSDEEP 96:nBkDq1ayX2wpvWMoiVmdeHk4vUWQyV+VD7AiEwb:nBkmkyX2GWMXdrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 880ec0dcc4980a27e7a6c22c035df13ddd204a92b6a1015f8b7a1fc7a49cdb67
MD5 fa2b74f585044cc03e88cb3782d67f4a
SHA1 c8db6e4eaaa1271d7da54f6e646a591112c8b0c7
SHA512 0f5b28edaddfc6fe28d4a112476f3d1c62ac2ae56611a4d4b12633c296d7c123be41d6cd1c5ba34a4e38a99503ab6c9c0879bd9a97e23ca2c3f3f40aea328e16
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup1ze2RUC/y4Vr:A9iIxuERzA83h09RZxYN35r
MD5 SHA1 SHA512 SSDEEP

Submit Download

0.1.filtertrie.intermediate.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{cd1d3cab-902c-4309-987d-3fdd3ee875be}\0.1.filtertrie.intermediate.txt
Size 430B
SHA256 b52593a84a4d7f6deaa45fcf1e229332943fb21f79562eed6a83f089bbc7fd24
MD5 0a8fc8ee29ac46b7325f59f79895e868
SHA1 e601395600a9421b0f91875d349dc6eee2402d0b
SHA512 9819ca14407868e5a8b9bbf86e0884b50c35c49555d91eb912b37f28e656b87e51ffa8801cf0e7e00daa56bbc1e55b07dff5f9e5b46728172c54a01eeb83d73a
MD5 SHA1 SHA512

Submit Download

0.2.filtertrie.intermediate.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{cd1d3cab-902c-4309-987d-3fdd3ee875be}\0.2.filtertrie.intermediate.txt
Size 430B
SHA256 681ceaae9a71dce8674500af27d3fe7eff91d140ad5ad52b0d92d46a802ab4cb
MD5 33510404612570f0a1000fedab432350
SHA1 5075c6015868d3ee55906af1598cd41a2d5e67f7
SHA512 bb9f29f62d4b8932125932de43d46e9939380d7553a101ce788bd82f5a6d2135a8d84a4455ff13521a5d9d8222486b49b22681074f7a59b5663ef12f983555b8
MD5 SHA1 SHA512

Submit Download

AppCache133596440369039129.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596440369039129.txt
Size 47KB
SHA256 6907926f31723da51653183f7a530f7b280e1e901e8d6fe0469808e93cadb23c
MD5 d17ea1c37084542519cc928968e5e4c3
SHA1 8e3701c30e66f00b9643faaf4ee9feb8ed2a46a0
SHA512 b2fabfa158ba02103fd9bdfb0cc94fe984d622f9a2550c4c005060ec9e6603e760255c693fd5d1d954ce32149b72504826af0b265716138d7cab32fdbc554273
SSDEEP 768:0v/w8rm28cMsLG1xh1Ori+s1MCh+lxymteBkzZxrrfg0rl1po2EBILfJEYRrgzMC:E/JqnCG1xh1ZtBosHkzZ9rfNlYWbl8ec
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133596449026566195.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596449026566195.txt
Size 75KB
SHA256 5910d60929344a4fe94f50b24b069ec97512766d2b89e35e5f9a58a9bb2f7bc9
MD5 946c858fe0c4f372b2e8bf4ac76c4a43
SHA1 2b4ae0e5671e8b58dee45f08636bdeffb6597321
SHA512 1b3218b39ca8df7f779d87c5ff4628521c7ce378050dc5fc08bc6a5a37cab2f42e8a5af48e9348532544eca9defb2f0ac1dab1e8ee00dc601cb14a0edf0022ba
SSDEEP 1536:GAWLEz70dMqhv19s4UWsjFkCDcCGIglcLKjIpu3YVFDXbPpbf:GVoz70ORLBRGIQyBk3YHnPNf
MD5 SHA1 SHA512 SSDEEP

Submit Download

dlyokacroic.exe

Path C:\Users\Admin\AppData\Roaming\dlyokacroic.exe
Size 344KB
SHA256 1c144b77a916b914d55fc2dc31e834b50577e08cba1c25a7f7f1ec5cccbb51ac
MD5 3b8c3c00dc30a34b4b9b205a6f93caab
SHA1 ae7299ff88a5569c824f6123feaa979c08428ee0
SHA512 bad2895355901b4c20c7cae804be63a3644678063ba2e9461645b8f37f63b57296eeb8423d1a486720b7229f05cc82c71d1d01170f34a249a80dadc63e7d9c11
SSDEEP 6144:sclgBCoMvJpr3IZVXBRVRC3BMaXGRTuKYAyqeT6y52cZuvrvD1hNVWfO6:s5C9Jpr3I3XBRi3WaXGEKXnW6RjPkv
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1168-0-0x0000000000D10000-0x0000000000D13000-memory.dmp

Download

memory/1168-3-0x0000000000D10000-0x0000000000D13000-memory.dmp

Download

memory/2124-4-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/2124-1-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/2124-5-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/2124-2-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/2124-10-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/2748-12-0x0000000000400000-0x000000000076B000-memory.dmp

Download

memory/4388-15-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/4388-7510-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/4388-7512-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/4388-7509-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/4388-7526-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/4388-7533-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/4388-1602-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/4388-22-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/4388-21-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/4388-18-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/4388-17-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/4388-16-0x0000000000400000-0x0000000000485000-memory.dmp

Download