26a121886fcb43556e43eb9d68fb5dbaa69ce4fa00192a124dd1952f14982bab

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 10:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VirusShare_0da9a6a0095c28eced75fb1e59412747.exe
Size 348KB
Sample240610-mremjsgf72
SHA256 26a121886fcb43556e43eb9d68fb5dbaa69ce4fa00192a124dd1952f14982bab
MD5 0da9a6a0095c28eced75fb1e59412747
SHA1 ffa67efbb955e868a6315ed6414045e8cee4b8fe
SHA512 3f2ca9255bef45c2bad9239f6c890b05020d536c4e289c87e9027b22afe769764c7936cd60c6073a2e537234f1cb4d9e61b62082fa5a1931eab4f334a1f2010e
SSDEEP 6144:RuTS7jkGKlY1DI/D4ANTLfWHenmxadef3msPbnSLavUg0T1SmhGMvX/J+:RuTS7BKxDfTLuHenmx5msPbnSLavUwSx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion evasion execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\how_recover+gtl.txt

Ransom Note

111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) What does this mean ? This means that the structure and data within your files have been irrevocably changed, you will not be able to work with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them. 111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 How did this happen ? ---Specially for your PC was generated personal RSA-4096 KEY, both public and private. ---ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. 111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server. What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BTC NOW, and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://vr6g2curb2kcidou.encpayment23.com/EB5BE6EF6B3F17B 2. http://vr6g2curb2kcidou.expay34.com/EB5BE6EF6B3F17B 3. http://psbc532jm8c.hsh73cu37n1.net/EB5BE6EF6B3F17B 4. https://vr6g2curb2kcidou.onion.to/EB5BE6EF6B3F17B If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser and wait for initialization. 3. Type in the address bar: vr6g2curb2kcidou.onion/EB5BE6EF6B3F17B 4. Follow the instructions on the site. IMPORTANT INFORMATION: Your personal pages: http://vr6g2curb2kcidou.encpayment23.com/EB5BE6EF6B3F17B http://vr6g2curb2kcidou.expay34.com/EB5BE6EF6B3F17B http://psbc532jm8c.hsh73cu37n1.net/EB5BE6EF6B3F17B https://vr6g2curb2kcidou.onion.to/EB5BE6EF6B3F17B Your personal page (using TOR-Browser): vr6g2curb2kcidou.onion/EB5BE6EF6B3F17B Your personal identification number (if you open the site (or TOR-Browser's) directly): EB5BE6EF6B3F17B 111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111

URLs

http://vr6g2curb2kcidou.encpayment23.com/EB5BE6EF6B3F17B
http://vr6g2curb2kcidou.expay34.com/EB5BE6EF6B3F17B
http://psbc532jm8c.hsh73cu37n1.net/EB5BE6EF6B3F17B
https://vr6g2curb2kcidou.onion.to/EB5BE6EF6B3F17B
http://vr6g2curb2kcidou.onion/EB5BE6EF6B3F17B

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 5 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
4880	bcdedit.exe
1756	bcdedit.exe
2740	bcdedit.exe
1340	bcdedit.exe
3720	bcdedit.exe

Renames multiple (882) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	VirusShare_0da9a6a0095c28eced75fb1e59412747.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	qgmecacroic.exe

Drops startup file 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\how_recover+gtl.txt	qgmecacroic.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\how_recover+gtl.html	qgmecacroic.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\how_recover+gtl.txt	qgmecacroic.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\how_recover+gtl.html	qgmecacroic.exe

Executes dropped EXE 2 IoCs

pid	Process
1808	qgmecacroic.exe
3308	qgmecacroic.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Acrndtd = "C:\\Users\\Admin\\AppData\\Roaming\\qgmecacroic.exe"	qgmecacroic.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
13	myexternalip.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3196 set thread context of 4212	3196	VirusShare_0da9a6a0095c28eced75fb1e59412747.exe	86
PID 1808 set thread context of 3308	1808	qgmecacroic.exe	96

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-100.png	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square310x310Logo.scale-400.png	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SmallTile.scale-100.png	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-30.png	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\FileAttachmentPlaceholder.png	qgmecacroic.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\how_recover+gtl.txt	qgmecacroic.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\C4DB1FF2-9CF3-498E-B7AA-765DC7D448F8\how_recover+gtl.html	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-black\how_recover+gtl.html	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\LargeTile.scale-200.png	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-80_altform-lightunplated.png	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\Assets\ValueProp_Shadow.png	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\Movie-TVStoreLogo.scale-100_contrast-black.png	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\LockScreenLogo.scale-100.png	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-20_altform-lightunplated.png	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-256_altform-lightunplated.png	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\ringless_calls\how_recover+gtl.html	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailMediumTile.scale-100.png	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\IC_WelcomeBanner.scale-150.png	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreMedTile.scale-200.png	qgmecacroic.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sm\LC_MESSAGES\how_recover+gtl.txt	qgmecacroic.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\meta\how_recover+gtl.html	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_01.jpg	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x86__8wekyb3d8bbwe\how_recover+gtl.txt	qgmecacroic.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\how_recover+gtl.html	qgmecacroic.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\how_recover+gtl.html	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\how_recover+gtl.txt	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-256_altform-unplated.png	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-256_altform-unplated.png	qgmecacroic.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\how_recover+gtl.txt	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-black\how_recover+gtl.html	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-24_altform-unplated.png	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\Assets\Images\SkypeAppList.scale-100.png	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\SplashScreen.scale-125_contrast-white.png	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_neutral_~_8wekyb3d8bbwe\how_recover+gtl.txt	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-16_altform-lightunplated.png	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-200_contrast-white.png	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\how_recover+gtl.html	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\how_recover+gtl.html	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.scale-100_contrast-white.png	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteWideTile.scale-200.png	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNotePageSmallTile.scale-400.png	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\PeopleSmallTile.scale-100.png	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorWideTile.contrast-black_scale-200.png	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-24_contrast-black.png	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PSReadline\how_recover+gtl.txt	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\AppxMetadata\how_recover+gtl.txt	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-30_contrast-black.png	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-64_altform-fullcolor.png	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-72_altform-lightunplated.png	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\en-US\how_recover+gtl.txt	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\es\how_recover+gtl.html	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\kn-IN\how_recover+gtl.html	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-32_contrast-black.png	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-black\how_recover+gtl.txt	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-256_altform-lightunplated.png	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\how_recover+gtl.html	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-32_altform-unplated.png	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-24_altform-unplated.png	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-72_contrast-white.png	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-400_contrast-black.png	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Resources\RetailDemo\strings\en-us\how_recover+gtl.txt	qgmecacroic.exe
File opened for modification	C:\Program Files\Internet Explorer\how_recover+gtl.html	qgmecacroic.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-80.png	qgmecacroic.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\how_recover+gtl.txt	qgmecacroic.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Interacts with shadow copies 2 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
3488	vssadmin.exe
2524	vssadmin.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	qgmecacroic.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2860	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe
3308	qgmecacroic.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4212	VirusShare_0da9a6a0095c28eced75fb1e59412747.exe
Token: SeDebugPrivilege	3308	qgmecacroic.exe
Token: SeBackupPrivilege	2372	vssvc.exe
Token: SeRestorePrivilege	2372	vssvc.exe
Token: SeAuditPrivilege	2372	vssvc.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3196 wrote to memory of 4212	3196	VirusShare_0da9a6a0095c28eced75fb1e59412747.exe	86
PID 3196 wrote to memory of 4212	3196	VirusShare_0da9a6a0095c28eced75fb1e59412747.exe	86
PID 3196 wrote to memory of 4212	3196	VirusShare_0da9a6a0095c28eced75fb1e59412747.exe	86
PID 3196 wrote to memory of 4212	3196	VirusShare_0da9a6a0095c28eced75fb1e59412747.exe	86
PID 3196 wrote to memory of 4212	3196	VirusShare_0da9a6a0095c28eced75fb1e59412747.exe	86
PID 3196 wrote to memory of 4212	3196	VirusShare_0da9a6a0095c28eced75fb1e59412747.exe	86
PID 3196 wrote to memory of 4212	3196	VirusShare_0da9a6a0095c28eced75fb1e59412747.exe	86
PID 3196 wrote to memory of 4212	3196	VirusShare_0da9a6a0095c28eced75fb1e59412747.exe	86
PID 3196 wrote to memory of 4212	3196	VirusShare_0da9a6a0095c28eced75fb1e59412747.exe	86
PID 3196 wrote to memory of 4212	3196	VirusShare_0da9a6a0095c28eced75fb1e59412747.exe	86
PID 4212 wrote to memory of 1808	4212	VirusShare_0da9a6a0095c28eced75fb1e59412747.exe	90
PID 4212 wrote to memory of 1808	4212	VirusShare_0da9a6a0095c28eced75fb1e59412747.exe	90
PID 4212 wrote to memory of 1808	4212	VirusShare_0da9a6a0095c28eced75fb1e59412747.exe	90
PID 4212 wrote to memory of 1420	4212	VirusShare_0da9a6a0095c28eced75fb1e59412747.exe	92
PID 4212 wrote to memory of 1420	4212	VirusShare_0da9a6a0095c28eced75fb1e59412747.exe	92
PID 4212 wrote to memory of 1420	4212	VirusShare_0da9a6a0095c28eced75fb1e59412747.exe	92
PID 1808 wrote to memory of 3308	1808	qgmecacroic.exe	96
PID 1808 wrote to memory of 3308	1808	qgmecacroic.exe	96
PID 1808 wrote to memory of 3308	1808	qgmecacroic.exe	96
PID 1808 wrote to memory of 3308	1808	qgmecacroic.exe	96
PID 1808 wrote to memory of 3308	1808	qgmecacroic.exe	96
PID 1808 wrote to memory of 3308	1808	qgmecacroic.exe	96
PID 1808 wrote to memory of 3308	1808	qgmecacroic.exe	96
PID 1808 wrote to memory of 3308	1808	qgmecacroic.exe	96
PID 1808 wrote to memory of 3308	1808	qgmecacroic.exe	96
PID 1808 wrote to memory of 3308	1808	qgmecacroic.exe	96
PID 3308 wrote to memory of 4880	3308	qgmecacroic.exe	97
PID 3308 wrote to memory of 4880	3308	qgmecacroic.exe	97
PID 3308 wrote to memory of 3488	3308	qgmecacroic.exe	99
PID 3308 wrote to memory of 3488	3308	qgmecacroic.exe	99
PID 3308 wrote to memory of 1756	3308	qgmecacroic.exe	103
PID 3308 wrote to memory of 1756	3308	qgmecacroic.exe	103
PID 3308 wrote to memory of 2740	3308	qgmecacroic.exe	105
PID 3308 wrote to memory of 2740	3308	qgmecacroic.exe	105
PID 3308 wrote to memory of 1340	3308	qgmecacroic.exe	108
PID 3308 wrote to memory of 1340	3308	qgmecacroic.exe	108
PID 3308 wrote to memory of 3720	3308	qgmecacroic.exe	110
PID 3308 wrote to memory of 3720	3308	qgmecacroic.exe	110
PID 3308 wrote to memory of 2860	3308	qgmecacroic.exe	116
PID 3308 wrote to memory of 2860	3308	qgmecacroic.exe	116
PID 3308 wrote to memory of 2860	3308	qgmecacroic.exe	116
PID 3308 wrote to memory of 4908	3308	qgmecacroic.exe	117
PID 3308 wrote to memory of 4908	3308	qgmecacroic.exe	117
PID 4908 wrote to memory of 3820	4908	msedge.exe	118
PID 4908 wrote to memory of 3820	4908	msedge.exe	118
PID 3308 wrote to memory of 2524	3308	qgmecacroic.exe	119
PID 3308 wrote to memory of 2524	3308	qgmecacroic.exe	119
PID 4908 wrote to memory of 2696	4908	msedge.exe	121
PID 4908 wrote to memory of 2696	4908	msedge.exe	121
PID 4908 wrote to memory of 2696	4908	msedge.exe	121
PID 4908 wrote to memory of 2696	4908	msedge.exe	121
PID 4908 wrote to memory of 2696	4908	msedge.exe	121
PID 4908 wrote to memory of 2696	4908	msedge.exe	121
PID 4908 wrote to memory of 2696	4908	msedge.exe	121
PID 4908 wrote to memory of 2696	4908	msedge.exe	121
PID 4908 wrote to memory of 2696	4908	msedge.exe	121
PID 4908 wrote to memory of 2696	4908	msedge.exe	121
PID 4908 wrote to memory of 2696	4908	msedge.exe	121
PID 4908 wrote to memory of 2696	4908	msedge.exe	121
PID 4908 wrote to memory of 2696	4908	msedge.exe	121
PID 4908 wrote to memory of 2696	4908	msedge.exe	121
PID 4908 wrote to memory of 2696	4908	msedge.exe	121
PID 4908 wrote to memory of 2696	4908	msedge.exe	121
PID 4908 wrote to memory of 2696	4908	msedge.exe	121

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	qgmecacroic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	qgmecacroic.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\VirusShare_0da9a6a0095c28eced75fb1e59412747.exe
"C:\Users\Admin\AppData\Local\Temp\VirusShare_0da9a6a0095c28eced75fb1e59412747.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Users\Admin\AppData\Local\Temp\VirusShare_0da9a6a0095c28eced75fb1e59412747.exe
  "C:\Users\Admin\AppData\Local\Temp\VirusShare_0da9a6a0095c28eced75fb1e59412747.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4212
- - C:\Users\Admin\AppData\Roaming\qgmecacroic.exe
    C:\Users\Admin\AppData\Roaming\qgmecacroic.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1808
  - - C:\Users\Admin\AppData\Roaming\qgmecacroic.exe
      C:\Users\Admin\AppData\Roaming\qgmecacroic.exe
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:3308
    - - C:\Windows\SYSTEM32\bcdedit.exe
        
        bcdedit.exe /set {current} bootems off
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:4880
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
        5⤵
        Interacts with shadow copies
        
        PID:3488
    - - C:\Windows\SYSTEM32\bcdedit.exe
        
        bcdedit.exe /set {current} advancedoptions off
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1756
    - - C:\Windows\SYSTEM32\bcdedit.exe
        
        bcdedit.exe /set {current} optionsedit off
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2740
    - - C:\Windows\SYSTEM32\bcdedit.exe
        
        bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1340
    - - C:\Windows\SYSTEM32\bcdedit.exe
        
        bcdedit.exe /set {current} recoveryenabled off
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:3720
    - - C:\Windows\SysWOW64\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Howto_RESTORE_FILES.txt
        5⤵
        Opens file in notepad (likely ransom note)
        
        PID:2860
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\Howto_RESTORE_FILES.html
        5⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4908
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcbef146f8,0x7ffcbef14708,0x7ffcbef14718
        6⤵
        
        PID:3820
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,15306779093149202139,3038529706885298679,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
        6⤵
        
        PID:2696
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,15306779093149202139,3038529706885298679,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
        6⤵
        
        PID:3512
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,15306779093149202139,3038529706885298679,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
        6⤵
        
        PID:4532
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15306779093149202139,3038529706885298679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3084 /prefetch:1
        6⤵
        
        PID:1788
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15306779093149202139,3038529706885298679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3100 /prefetch:1
        6⤵
        
        PID:1272
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,15306779093149202139,3038529706885298679,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
        6⤵
        
        PID:1956
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,15306779093149202139,3038529706885298679,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
        6⤵
        
        PID:5096
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15306779093149202139,3038529706885298679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
        6⤵
        
        PID:2528
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15306779093149202139,3038529706885298679,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
        6⤵
        
        PID:4860
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15306779093149202139,3038529706885298679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
        6⤵
        
        PID:3152
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15306779093149202139,3038529706885298679,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
        6⤵
        
        PID:1924
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
        5⤵
        Interacts with shadow copies
        
        PID:2524
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Roaming\QGMECA~1.EXE
        5⤵
        
        PID:3368
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE
    3⤵
    PID:1420

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

how_recover+gtl.html

Path C:\Program Files\7-Zip\Lang\how_recover+gtl.html
Size 9KB
SHA256 58fe18081331310f933360f85d95a0d5538fd8f4d676f6d7c22d4c1d6bfbba3c
MD5 851bad8d641434cb323e39268e15cd56
SHA1 b2f85aebf54029aaa534842004226ae48ea5db41
SHA512 64f210c6d6f390d79ed22ea8281997150ef6a5b41910dcb6f483387476be3d1de68bfc10f283a4b5607f76c7c891a1296556d3df30d104db3679f899f330390a
SSDEEP 96:Y5Km1f5C5kk55Dl1Zjb5RTn54Y5d5b5w5985ku5g5wdg5mq5pTHVk5sg35d55l5t:wUDP2pgsjJC10oqL3Ud
MD5 SHA1 SHA512 SSDEEP

Submit Download

how_recover+gtl.txt

Path C:\Program Files\7-Zip\Lang\how_recover+gtl.txt
Size 2KB
SHA256 f5fac85f85f31e460bcc4526d5818e9c827a39353bb441924a73d668113e47e4
MD5 1b140058d106f1f30e84194a07581789
SHA1 30cf0d8072a358478b1ad484ff50dc3d3624cbf1
SHA512 328854c6e354dfb996a5e72537f5a465081bc5d13c0f15f8a594f4d951c0a9d6ae355b261d27288e9b3acb966d26b68c9215b84ed79f2c2f9172528723d25b90
MD5 SHA1 SHA512

Submit Download

THIRDPARTYLICENSEREADME-JAVAFX.txt

Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
Size 606B
SHA256 7cca000dedc8a99dd3839011fa24ea0b6119cfbca5b52daf4c89a76ea2357561
MD5 103386eb0c24317f6a1acedca8dbc392
SHA1 c18380de26dacbb10abce58bae3735fa36f785e0
SHA512 b1635a08912430e9a17e1c8406b46b179e6b7b6259ab4975b4230be0dc92b124268dbf48943bc0525fbc70869087dfa6eec2396caa9fe27e55180066acee8d7f
MD5 SHA1 SHA512

Submit Download

THIRDPARTYLICENSEREADME.txt

Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
Size 606B
SHA256 34bed6ddf8bfbec07d54cfe545b248a581cc1d698709b2063e88c6d438ad19c9
MD5 6f8502a001fbde1b172fd20efbfe972d
SHA1 ae98a08251ff58e6336c8a1b74426eef853cf895
SHA512 02b25d81ce20908e867409c69202735cb3eec8ab0d52234ece0f8f069b6bd51bcc68f885805dd9880b539907a4744a8230318c9cea10467505ed2f8cf2ffacd0
MD5 SHA1 SHA512

Submit Download

ClientSub2019_eula.txt

Path C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
Size 462B
SHA256 049ba7e74d6bf8e27029ee4d3e3c7ae30db95ddb5a4f63f1fa050931937e0339
MD5 b042e1f370a583077d1ff3aa30840874
SHA1 dcaf57b9bc184bcf7fdc16894186920197785abc
SHA512 7de569cb8c94512a3de5105e51ec5edb69de5eb7637d815f86b565f886d1e687b9991fc7ab51903dfd7028f662d3666f503e5df3be836acc33dbe2f4af1f6dbf
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
MD5 eaa3db555ab5bc0cb364826204aad3f0
SHA1 a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA512 e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
MD5 4b4f91fa1b362ba5341ecb2836438dea
SHA1 9561f5aabed742404d455da735259a2c6781fa07
SHA512 fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 663606157e73f6e7a82b309ac396c5874b572e3686d4c431c5aba5c4369a676e
MD5 c82372e30e6379650b5fcd457a9dbcb9
SHA1 08535106c6c0f5113706665f067b50061a3bd6f7
SHA512 ed79b5a74108d711a0f958dcfc99a4467b9b78cf214ba2c6d7de16a2ecc489157ee2b310acecb736c0a589b2d998fd75d3bb468f7d54b71c5b9ca591c83434b9
SSDEEP 96:nfkhdx1bEj0wpvWMoiVmdeHmQIgUWQyV+VDCziEwb:nfkxBEj0GWMXXro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f26042803c93602be5cc97da4cbcd4a2c3c05ca0f34215e47d683d11030e5c90
MD5 d6dc435feab808fdc2dd4ef2ee922c1c
SHA1 ceda90c3d0e517cb7a5f7c0863a29946731a1834
SHA512 b0683320cad0eee29ffa46e05f5cd6700c586dfdff998f10165bba259cf1bce4483ba764f6c14ba4087d1d31d4bd237272d96e30c1fe803571ac7b31f70aa448
SSDEEP 96:nfksdx1bcj0wpvWMoiVmdeHmQIgUWQyV+VD7AiEwb:nfkqBcj0GWMXXrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 d5ea5f79361e5d3240d0553991fb5ac83f1c2ba68c7ee39b68dcce4d88791ac0
MD5 714d9c7f326cca50bd9918446a956717
SHA1 77043a5bcb6a435f8cd081311e7b20dc10134312
SHA512 af10b590ff6e89ce62b622b7c27855397fa3a23401326a8eba7c9cbc68310012a9e4318ea2b2221d9f10f983753f09fa3f0caddb5a69aeb3795315519b371742
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupEme2RUZIKbpfYOxhZHnqT+:A9iIxuERzA83h09RZxYEoONxTHqTMTR
MD5 SHA1 SHA512 SSDEEP

Submit Download

0.1.filtertrie.intermediate.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{fe0cefc9-a550-4b5d-84e9-15afaabbec82}\0.1.filtertrie.intermediate.txt
Size 430B
SHA256 8334fd8d4c8e7a66dc72680ace3e010a4d3f25e12a509b7a2e0cc71cd2ca17aa
MD5 b4843ff6fd922bc9c3e7b32548c57130
SHA1 b6c29e1ca3b2c3310b8d9c482d685601ead5f9da
SHA512 e6d4ed83bebcc481cd17dc40fa5321206f7c63e2312afba3af1979de81515b3d9e72f50ce6b7e2285e3ffc6f597d42bc7e02516d3000349619456f88b0d6152c
MD5 SHA1 SHA512

Submit Download

0.2.filtertrie.intermediate.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{fe0cefc9-a550-4b5d-84e9-15afaabbec82}\0.2.filtertrie.intermediate.txt
Size 430B
SHA256 b7808399e26f3094ec5d25ea0a70416c325ebd52c640509db2a66224fbe6f29d
MD5 2a5f98288445be498f9746fdfb187a2e
SHA1 8d4fe657dc8dc40998a0087d48f1b240ac5e74e3
SHA512 301b2033cd285df9d9fa682923e0fc90714f64b1b4507438f811fa1098b3f48e0d1b70d31a1a32725ab1c9f1e15b243152d5ac097f65a2efc85bc9ab9331e4aa
MD5 SHA1 SHA512

Submit Download

AppCache133596380890952339.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596380890952339.txt
Size 47KB
SHA256 ebaceaa1dcbc4cc9b21b8a4642c736ca6ae2a86c51d7ac89d7658fc65b0d6eef
MD5 349a904591424814f7103c956a3da1c0
SHA1 0df3b3a4b306edf24a9e1cbf2f5f99ce2fe4d44a
SHA512 77f60c32c48332cc6e2d69253e01597e530812230b74c7004895c9ca90424520fe5b823477edc45aacfcd5b72ceae5d60770d684223e01f93b05fa653db1b41c
SSDEEP 768:nW8Bw1w3c2MDm1z1uFF/SZUOE1ne1CUPjsXdUp/rXPhwFfUt2kjgWRHFRNmcdhHj:nrw1w3nxzwFp/P6CULsXdUpjhww3xHPx
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133596400491251343.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596400491251343.txt
Size 75KB
SHA256 00a3501995ac732f98e7132167f346686fd7d77d06d4264b4d4369f43c1ef1f4
MD5 57495861b2b4cb13f24c856b102bbb8d
SHA1 fcd49e24cbce1a639b426d825722465c133d6ad2
SHA512 b36e6a0c28808abc2b51e9dc83b0ae5d5eff3aa546bca1080a1f99c2aa709277e08fd71289e3b8f5095bea616496a9849a03aecce51eb47a07473ca6d9d53f42
SSDEEP 1536:n5KxOhqhvjx8D+5Bq+AY7IU92N3s5cmfDqPzQy/9BMIyW//eGSWiF/:Mxpvjx8ilAdN5mrUzQy1B0Wu4iF/
MD5 SHA1 SHA512 SSDEEP

Submit Download

qgmecacroic.exe

Path C:\Users\Admin\AppData\Roaming\qgmecacroic.exe
Size 348KB
SHA256 26a121886fcb43556e43eb9d68fb5dbaa69ce4fa00192a124dd1952f14982bab
MD5 0da9a6a0095c28eced75fb1e59412747
SHA1 ffa67efbb955e868a6315ed6414045e8cee4b8fe
SHA512 3f2ca9255bef45c2bad9239f6c890b05020d536c4e289c87e9027b22afe769764c7936cd60c6073a2e537234f1cb4d9e61b62082fa5a1931eab4f334a1f2010e
SSDEEP 6144:RuTS7jkGKlY1DI/D4ANTLfWHenmxadef3msPbnSLavUg0T1SmhGMvX/J+:RuTS7BKxDfTLuHenmx5msPbnSLavUwSx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1808-12-0x0000000000400000-0x000000000075C000-memory.dmp

Download

memory/3196-4-0x00000000008B0000-0x00000000008B3000-memory.dmp

Download

memory/3196-0-0x00000000008B0000-0x00000000008B3000-memory.dmp

Download

memory/3308-15-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/3308-7608-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/3308-772-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/3308-21-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/3308-22-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/3308-18-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/3308-7592-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/3308-7594-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/3308-17-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/3308-1589-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/3308-7609-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/3308-16-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/3308-7657-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/4212-5-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/4212-3-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/4212-9-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/4212-2-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/4212-1-0x0000000000400000-0x0000000000485000-memory.dmp

Download