39b5dd803071ebc4590a51c7d25e15eeddf2f4dcb27950ebfe80c4315432b3c1

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 10:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VirusShare_1ba9ad23fa2182f7408878545d52fd1e.exe
Size 608KB
Sample240610-mslr9agf99
SHA256 39b5dd803071ebc4590a51c7d25e15eeddf2f4dcb27950ebfe80c4315432b3c1
MD5 1ba9ad23fa2182f7408878545d52fd1e
SHA1 624a0d2cb004d3f1ab1ef0cc308f9453b20ac7ad
SHA512 434c1234aa63d875a402a757afffb3d4ec07beeed1db62321615ff56f3af4e79771e8b98d40a36f510bbc7ddb15a04d2a9bf961a3ec4b4e0e981cbd53eecf631
SSDEEP 12288:CV4sPzhK43pOuoaT/AewoPJ0i22qWmYhK43pOuoaT/AewoP7:Cms7hKuzJwmSi2ruhKuzJwm7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion evasion execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\_H_e_l_p_RECOVER_INSTRUCTIONS+kgj.txt

Ransom Note

__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#! NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-4096 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server. What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://jj4dhbg4d86sdgrsdfzcadc.ziraimshi.com/CDE3EE65E44010 2. http://uu5dbnmsedf4s3jdnfbh34fsdf.parsesun.at/CDE3EE65E44010 3. http://perc54hg47fhnkjnfvcdgvdc.clinkjuno.com/CDE3EE65E44010 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser and wait for initialization 3. Type in the address bar: fwgrhsao3aoml7ej.onion/CDE3EE65E44010 4. Follow the instructions on the site. !!! IMPORTANT INFORMATION: !!! Your personal pages: http://jj4dhbg4d86sdgrsdfzcadc.ziraimshi.com/CDE3EE65E44010 http://uu5dbnmsedf4s3jdnfbh34fsdf.parsesun.at/CDE3EE65E44010 http://perc54hg47fhnkjnfvcdgvdc.clinkjuno.com/CDE3EE65E44010 !!! Your personal page Tor-Browser: fwgrhsao3aoml7ej.onion/CDE3EE65E44010 !!! Your personal identification ID: CDE3EE65E44010

URLs

http://jj4dhbg4d86sdgrsdfzcadc.ziraimshi.com/CDE3EE65E44010
http://uu5dbnmsedf4s3jdnfbh34fsdf.parsesun.at/CDE3EE65E44010
http://perc54hg47fhnkjnfvcdgvdc.clinkjuno.com/CDE3EE65E44010
http://fwgrhsao3aoml7ej.onion/CDE3EE65E44010

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 5 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
1792	bcdedit.exe
2272	bcdedit.exe
4732	bcdedit.exe
692	bcdedit.exe
208	bcdedit.exe

Renames multiple (868) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	lkhsgho.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\addon_v57 = "C:\\Users\\Admin\\AppData\\Roaming\\lkhsgho.exe"	lkhsgho.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	VirusShare_1ba9ad23fa2182f7408878545d52fd1e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	lkhsgho.exe

Drops startup file 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_H_e_l_p_RECOVER_INSTRUCTIONS+kgj.txt	lkhsgho.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_H_e_l_p_RECOVER_INSTRUCTIONS+kgj.html	lkhsgho.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_H_e_l_p_RECOVER_INSTRUCTIONS+kgj.png	lkhsgho.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_H_e_l_p_RECOVER_INSTRUCTIONS+kgj.txt	lkhsgho.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_H_e_l_p_RECOVER_INSTRUCTIONS+kgj.html	lkhsgho.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_H_e_l_p_RECOVER_INSTRUCTIONS+kgj.png	lkhsgho.exe

Executes dropped EXE 2 IoCs

pid	Process
1308	lkhsgho.exe
3356	lkhsgho.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3032 set thread context of 4656	3032	VirusShare_1ba9ad23fa2182f7408878545d52fd1e.exe	94
PID 1308 set thread context of 3356	1308	lkhsgho.exe	98

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Validator\_H_e_l_p_RECOVER_INSTRUCTIONS+kgj.png	lkhsgho.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\zh-CN\_H_e_l_p_RECOVER_INSTRUCTIONS+kgj.png	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-72_altform-unplated_contrast-white.png	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeSmallTile.scale-125.png	lkhsgho.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\_H_e_l_p_RECOVER_INSTRUCTIONS+kgj.txt	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-96_altform-unplated_contrast-black.png	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraLargeTile.scale-125.png	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\_H_e_l_p_RECOVER_INSTRUCTIONS+kgj.html	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosMedTile.scale-200.png	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\GamesXboxHubAppList.scale-100.png	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailWideTile.scale-200.png	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.scale-200.png	lkhsgho.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\eo\_H_e_l_p_RECOVER_INSTRUCTIONS+kgj.png	lkhsgho.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\_H_e_l_p_RECOVER_INSTRUCTIONS+kgj.png	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-60_altform-fullcolor.png	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\Assets\_H_e_l_p_RECOVER_INSTRUCTIONS+kgj.txt	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-16_altform-lightunplated.png	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-256_altform-lightunplated.png	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-black\_H_e_l_p_RECOVER_INSTRUCTIONS+kgj.html	lkhsgho.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\_H_e_l_p_RECOVER_INSTRUCTIONS+kgj.txt	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SmallTile.scale-200_contrast-black.png	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\_H_e_l_p_RECOVER_INSTRUCTIONS+kgj.png	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\_H_e_l_p_RECOVER_INSTRUCTIONS+kgj.html	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeMediumTile.scale-150.png	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\ringless_calls\Ringlesscalling_25more_360x120_2x.png	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\_H_e_l_p_RECOVER_INSTRUCTIONS+kgj.html	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-80_altform-unplated.png	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxSmallTile.scale-150.png	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\models\_H_e_l_p_RECOVER_INSTRUCTIONS+kgj.html	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\uk-UA\View3d\_H_e_l_p_RECOVER_INSTRUCTIONS+kgj.html	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-black\SmallTile.scale-200.png	lkhsgho.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\_H_e_l_p_RECOVER_INSTRUCTIONS+kgj.txt	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-32_contrast-black.png	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-16_contrast-black.png	lkhsgho.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\_H_e_l_p_RECOVER_INSTRUCTIONS+kgj.png	lkhsgho.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\_H_e_l_p_RECOVER_INSTRUCTIONS+kgj.html	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-150_contrast-black.png	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailWideTile.scale-100.png	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalSplashScreen.scale-125_contrast-white.png	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-60_altform-unplated_contrast-white.png	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-white\SmallTile.scale-200.png	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-100_contrast-white.png	lkhsgho.exe
File opened for modification	C:\Program Files\Common Files\System\en-US\_H_e_l_p_RECOVER_INSTRUCTIONS+kgj.txt	lkhsgho.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\fi\_H_e_l_p_RECOVER_INSTRUCTIONS+kgj.html	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageSmallTile.scale-400.png	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\_H_e_l_p_RECOVER_INSTRUCTIONS+kgj.html	lkhsgho.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\_H_e_l_p_RECOVER_INSTRUCTIONS+kgj.html	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\FFFFFF-0.png	lkhsgho.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\163.png	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MedTile.scale-150_contrast-black.png	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\_H_e_l_p_RECOVER_INSTRUCTIONS+kgj.png	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\LockScreenLogo.scale-100.png	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\subscription_intro\_H_e_l_p_RECOVER_INSTRUCTIONS+kgj.png	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarSmallTile.scale-200.png	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-36.png	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\Shield.targetsize-44_contrast-black.png	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-64.png	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\_H_e_l_p_RECOVER_INSTRUCTIONS+kgj.txt	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\TimerWideTile.contrast-black_scale-125.png	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-30_contrast-black.png	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\_H_e_l_p_RECOVER_INSTRUCTIONS+kgj.txt	lkhsgho.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-72_altform-unplated_contrast-white.png	lkhsgho.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\sl-SI\_H_e_l_p_RECOVER_INSTRUCTIONS+kgj.png	lkhsgho.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Interacts with shadow copies 2 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
3992	vssadmin.exe
2964	vssadmin.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	lkhsgho.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4052	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe
3356	lkhsgho.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4656	VirusShare_1ba9ad23fa2182f7408878545d52fd1e.exe
Token: SeDebugPrivilege	3356	lkhsgho.exe
Token: SeBackupPrivilege	808	vssvc.exe
Token: SeRestorePrivilege	808	vssvc.exe
Token: SeAuditPrivilege	808	vssvc.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3032	VirusShare_1ba9ad23fa2182f7408878545d52fd1e.exe
1308	lkhsgho.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 4656	3032	VirusShare_1ba9ad23fa2182f7408878545d52fd1e.exe	94
PID 3032 wrote to memory of 4656	3032	VirusShare_1ba9ad23fa2182f7408878545d52fd1e.exe	94
PID 3032 wrote to memory of 4656	3032	VirusShare_1ba9ad23fa2182f7408878545d52fd1e.exe	94
PID 3032 wrote to memory of 4656	3032	VirusShare_1ba9ad23fa2182f7408878545d52fd1e.exe	94
PID 3032 wrote to memory of 4656	3032	VirusShare_1ba9ad23fa2182f7408878545d52fd1e.exe	94
PID 3032 wrote to memory of 4656	3032	VirusShare_1ba9ad23fa2182f7408878545d52fd1e.exe	94
PID 3032 wrote to memory of 4656	3032	VirusShare_1ba9ad23fa2182f7408878545d52fd1e.exe	94
PID 3032 wrote to memory of 4656	3032	VirusShare_1ba9ad23fa2182f7408878545d52fd1e.exe	94
PID 3032 wrote to memory of 4656	3032	VirusShare_1ba9ad23fa2182f7408878545d52fd1e.exe	94
PID 3032 wrote to memory of 4656	3032	VirusShare_1ba9ad23fa2182f7408878545d52fd1e.exe	94
PID 4656 wrote to memory of 1308	4656	VirusShare_1ba9ad23fa2182f7408878545d52fd1e.exe	95
PID 4656 wrote to memory of 1308	4656	VirusShare_1ba9ad23fa2182f7408878545d52fd1e.exe	95
PID 4656 wrote to memory of 1308	4656	VirusShare_1ba9ad23fa2182f7408878545d52fd1e.exe	95
PID 4656 wrote to memory of 1716	4656	VirusShare_1ba9ad23fa2182f7408878545d52fd1e.exe	96
PID 4656 wrote to memory of 1716	4656	VirusShare_1ba9ad23fa2182f7408878545d52fd1e.exe	96
PID 4656 wrote to memory of 1716	4656	VirusShare_1ba9ad23fa2182f7408878545d52fd1e.exe	96
PID 1308 wrote to memory of 3356	1308	lkhsgho.exe	98
PID 1308 wrote to memory of 3356	1308	lkhsgho.exe	98
PID 1308 wrote to memory of 3356	1308	lkhsgho.exe	98
PID 1308 wrote to memory of 3356	1308	lkhsgho.exe	98
PID 1308 wrote to memory of 3356	1308	lkhsgho.exe	98
PID 1308 wrote to memory of 3356	1308	lkhsgho.exe	98
PID 1308 wrote to memory of 3356	1308	lkhsgho.exe	98
PID 1308 wrote to memory of 3356	1308	lkhsgho.exe	98
PID 1308 wrote to memory of 3356	1308	lkhsgho.exe	98
PID 1308 wrote to memory of 3356	1308	lkhsgho.exe	98
PID 3356 wrote to memory of 1792	3356	lkhsgho.exe	99
PID 3356 wrote to memory of 1792	3356	lkhsgho.exe	99
PID 3356 wrote to memory of 3992	3356	lkhsgho.exe	101
PID 3356 wrote to memory of 3992	3356	lkhsgho.exe	101
PID 3356 wrote to memory of 2272	3356	lkhsgho.exe	105
PID 3356 wrote to memory of 2272	3356	lkhsgho.exe	105
PID 3356 wrote to memory of 4732	3356	lkhsgho.exe	107
PID 3356 wrote to memory of 4732	3356	lkhsgho.exe	107
PID 3356 wrote to memory of 692	3356	lkhsgho.exe	109
PID 3356 wrote to memory of 692	3356	lkhsgho.exe	109
PID 3356 wrote to memory of 208	3356	lkhsgho.exe	111
PID 3356 wrote to memory of 208	3356	lkhsgho.exe	111
PID 3356 wrote to memory of 4052	3356	lkhsgho.exe	114
PID 3356 wrote to memory of 4052	3356	lkhsgho.exe	114
PID 3356 wrote to memory of 4052	3356	lkhsgho.exe	114
PID 3356 wrote to memory of 1484	3356	lkhsgho.exe	115
PID 3356 wrote to memory of 1484	3356	lkhsgho.exe	115
PID 1484 wrote to memory of 1308	1484	msedge.exe	116
PID 1484 wrote to memory of 1308	1484	msedge.exe	116
PID 3356 wrote to memory of 2964	3356	lkhsgho.exe	117
PID 3356 wrote to memory of 2964	3356	lkhsgho.exe	117
PID 1484 wrote to memory of 4180	1484	msedge.exe	119
PID 1484 wrote to memory of 4180	1484	msedge.exe	119
PID 1484 wrote to memory of 4180	1484	msedge.exe	119
PID 1484 wrote to memory of 4180	1484	msedge.exe	119
PID 1484 wrote to memory of 4180	1484	msedge.exe	119
PID 1484 wrote to memory of 4180	1484	msedge.exe	119
PID 1484 wrote to memory of 4180	1484	msedge.exe	119
PID 1484 wrote to memory of 4180	1484	msedge.exe	119
PID 1484 wrote to memory of 4180	1484	msedge.exe	119
PID 1484 wrote to memory of 4180	1484	msedge.exe	119
PID 1484 wrote to memory of 4180	1484	msedge.exe	119
PID 1484 wrote to memory of 4180	1484	msedge.exe	119
PID 1484 wrote to memory of 4180	1484	msedge.exe	119
PID 1484 wrote to memory of 4180	1484	msedge.exe	119
PID 1484 wrote to memory of 4180	1484	msedge.exe	119
PID 1484 wrote to memory of 4180	1484	msedge.exe	119
PID 1484 wrote to memory of 4180	1484	msedge.exe	119

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\VirusShare_1ba9ad23fa2182f7408878545d52fd1e.exe
"C:\Users\Admin\AppData\Local\Temp\VirusShare_1ba9ad23fa2182f7408878545d52fd1e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Users\Admin\AppData\Local\Temp\VirusShare_1ba9ad23fa2182f7408878545d52fd1e.exe
  "C:\Users\Admin\AppData\Local\Temp\VirusShare_1ba9ad23fa2182f7408878545d52fd1e.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Users\Admin\AppData\Roaming\lkhsgho.exe
    C:\Users\Admin\AppData\Roaming\lkhsgho.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1308
  - - C:\Users\Admin\AppData\Roaming\lkhsgho.exe
      C:\Users\Admin\AppData\Roaming\lkhsgho.exe
      4⤵
      Adds policy Run key to start application
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3356
    - - C:\Windows\SYSTEM32\bcdedit.exe
        
        bcdedit.exe /set {current} bootems off
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1792
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
        5⤵
        Interacts with shadow copies
        
        PID:3992
    - - C:\Windows\SYSTEM32\bcdedit.exe
        
        bcdedit.exe /set {current} advancedoptions off
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2272
    - - C:\Windows\SYSTEM32\bcdedit.exe
        
        bcdedit.exe /set {current} optionsedit off
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:4732
    - - C:\Windows\SYSTEM32\bcdedit.exe
        
        bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:692
    - - C:\Windows\SYSTEM32\bcdedit.exe
        
        bcdedit.exe /set {current} recoveryenabled off
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:208
    - - C:\Windows\SysWOW64\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_H_e_l_p_RECOVER_INSTRUCTIONS.TXT
        5⤵
        Opens file in notepad (likely ransom note)
        
        PID:4052
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\_H_e_l_p_RECOVER_INSTRUCTIONS.HTM
        5⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1484
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff918c046f8,0x7ff918c04708,0x7ff918c04718
        6⤵
        
        PID:1308
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,8470791141243039873,94220990386091926,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
        6⤵
        
        PID:4180
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,8470791141243039873,94220990386091926,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
        6⤵
        
        PID:4908
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,8470791141243039873,94220990386091926,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
        6⤵
        
        PID:3836
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,8470791141243039873,94220990386091926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
        6⤵
        
        PID:2716
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,8470791141243039873,94220990386091926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
        6⤵
        
        PID:3240
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,8470791141243039873,94220990386091926,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
        6⤵
        
        PID:4844
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,8470791141243039873,94220990386091926,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
        6⤵
        
        PID:4688
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,8470791141243039873,94220990386091926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
        6⤵
        
        PID:1700
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,8470791141243039873,94220990386091926,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
        6⤵
        
        PID:4108
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,8470791141243039873,94220990386091926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
        6⤵
        
        PID:116
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,8470791141243039873,94220990386091926,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
        6⤵
        
        PID:3992
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
        5⤵
        Interacts with shadow copies
        
        PID:2964
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Roaming\lkhsgho.exe
        5⤵
        
        PID:776
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE
    3⤵
    PID:1716

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

_H_e_l_p_RECOVER_INSTRUCTIONS+kgj.html

Path C:\Program Files\7-Zip\Lang\_H_e_l_p_RECOVER_INSTRUCTIONS+kgj.html
Size 8KB
SHA256 64a6f0ce76f818f18da6d31610c69e49564f2399fc5b4608c7d32eac8170ddb4
MD5 deb0c775f8456d15ac36f6fda347fc6b
SHA1 c736af5d525eef9e737fcbcd220d24af7eed0924
SHA512 75a6a9718ba1a5fcbffd275b8197fbff29d99b0bcbe23b1cf9a5704ca4fadbf07a431956b8ba2cfe2b0fcbe40be02be23a7fda0ba1f24b496ec78d98bb32b148
SSDEEP 96:1m1lZDl1ZWWSxirBvKlj3N+sn0Y2FJrdDVL5pFWNFwAIKZRAwmiHvLwk7hs:Qv2niuN/iRhgNOgZntMR
MD5 SHA1 SHA512 SSDEEP

Submit Download

_H_e_l_p_RECOVER_INSTRUCTIONS+kgj.png

Path C:\Program Files\7-Zip\Lang\_H_e_l_p_RECOVER_INSTRUCTIONS+kgj.png
Size 66KB
SHA256 5c22581f76d422ff87b2ea5f19acc284bf597a873c81ffda8acaf3417e74564c
MD5 d803b391bc86a4783ec35c6653aeda4a
SHA1 abc1c489b5177b32c769d8e8070f2ab7540005fa
SHA512 610a5b2f996262d382ab34a1ef9623777916fe93f93f87d3858765ca1a5f604e17fc86439d2c4dd58bfb2d3ea32202633d3a8418219aaa7bdb369ee0072e354d
SSDEEP 1536:K5wue8w9Ehi+BJ9YgiODk4tCb6EyTR719fIrsXz/x:K5wh8KEhiGYgJbq6EyTRMrsTx
MD5 SHA1 SHA512 SSDEEP

Submit Download

_H_e_l_p_RECOVER_INSTRUCTIONS+kgj.txt

Path C:\Program Files\7-Zip\Lang\_H_e_l_p_RECOVER_INSTRUCTIONS+kgj.txt
Size 2KB
SHA256 bdc0629231cfb78998c2ac9e641960b2c8cdbaa72f7a25a81083ff381b81bc8d
MD5 77f3a46a0fa9b196f16ccaedc79ddc09
SHA1 bf4bcd7a72972f950bd25d1d66414715658e2261
SHA512 4e01b11e5bfb2ff4844c8dad8cc63a0226bf5552e737bce8429068159b45b1e6774f298c7751f7330d6145aac43d8b3a31301faf506a0aefc5623e430ec45863
MD5 SHA1 SHA512

Submit Download

THIRDPARTYLICENSEREADME-JAVAFX.txt

Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
Size 560B
SHA256 718fc26a2b650528831f02c8da76c5a237abc037cabddb3b203d2d29e4650fa7
MD5 09656bf03652fa7a504cd460c5075ac2
SHA1 797878ad40f816dc7808f85697a37c89c4bee5d9
SHA512 5336e48dbe26bb390954cf587bdb9a2168842d751912b47a5366093374af1689752fee0f06400403aa5d1a8316e7640c8fa6241777a84b71967bd771b01c3707
MD5 SHA1 SHA512

Submit Download

THIRDPARTYLICENSEREADME.txt

Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
Size 560B
SHA256 2d2b33ce410e4b26c2376e77d5348817642b383cc91b686c6d59bf7ad2d08b74
MD5 9e01ce9a97b3dc58c8656d9f0c483f54
SHA1 0e71ade1108c91b1d9d7b4734be3e1f4f80dde4e
SHA512 bdb4a4afd6fdb0fd81ae7db8570fac8694e140af4909fb2a57f23be974dc5a5394380ce52a3127e0cff613eb3bbb8ee21c90ad3c1ea5d51e26bf21c04e985c9f
MD5 SHA1 SHA512

Submit Download

ClientSub2019_eula.txt

Path C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
Size 416B
SHA256 dda0f755b9ca626673245d00313c01637931c97318b231775d75a9a35a3d298d
MD5 5dd13e6ac4893543c166c2c53aeede34
SHA1 cfb881ee651ff3f8d5d45abed471308a75bacb65
SHA512 d865416b44d0e9977c3372bb93313dbdfea6b7660c754c19ef76225afe492e0eb3683f98f8eff17c7447195fff61d642a8ad84da209613c185dbede3eb7df28a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
MD5 87f7abeb82600e1e640b843ad50fe0a1
SHA1 045bbada3f23fc59941bf7d0210fb160cb78ae87
SHA512 ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
MD5 f61fa5143fe872d1d8f1e9f8dc6544f9
SHA1 df44bab94d7388fb38c63085ec4db80cfc5eb009
SHA512 971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 71c646a919a38b9ff2762162e2ff99b06f5193a093daeebaf55836d70bb73262
MD5 584ab537e965d50358bd6d9222c36524
SHA1 0ff639de802d5c1c55960642ee59e5ade2c681da
SHA512 47cfc5b20c63b7186929e1abc87322378c9c4e9f1cd9fb15a3424f776daaba7cbf7f7f4108d3932bf1a2261bc9f308d867f85366f806527d0af3491844e7161b
SSDEEP 96:nCkDZ1IT0wpvWMoiVmdeH/zG+UWQyV+VDCziEwb:nCkdWgGWMX9ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e8bee7bde575ff54e845f9adbb67f1e38d8662fb5322b6af179553bd8d041763
MD5 686b62b9314df1887de74bbd33d932b8
SHA1 34c637533012edec5f3f3445c63a9eaa8e38de1b
SHA512 dabb22bbf6ba58ba35e9be71ab3dd828eadca4bc8826498319c902fa50b0f7af81e239b237e08010ca87e51e44d273e62a497c8ed92346a32a236ae44e60cc46
SSDEEP 96:nCk6Z1ID0wpvWMoiVmdeH/zG+UWQyV+VD7AiEwb:nCkyWwGWMX9rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 8e60760dd1930968cb114ce055e5ea4328eeeabf863434eaeeedf5d8f00f3ad8
MD5 7cab1dfceecf7ed02c5fd90012a1f5b1
SHA1 95a433f507611491813b90736d24ff6fa33f371e
SHA512 bb49c245dab70d2a5ee9290dcc1a062a6d2b2359abe5f7144a871724fa888c41ac05b344447d61249d07f120fdf0c831ce1f24cbcbada36dd07a5b1e10e5e818
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupLvvCe2RUUmyu3z2OMDCRHI:A9iIxuERzA83h09RZxYL89uaOMWRHqlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133596380552933791.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596380552933791.txt
Size 47KB
SHA256 0f6afd6bec9e9f74bfd08a00922151c565fdc3c6042efd50507ae6e95a407e3e
MD5 f83982de49506cca5277bd84cf43395a
SHA1 424c16bf5b976303a3993fc4611a8061ddb8acfb
SHA512 a56a22ee6e0cf6bfaf9c963b5c808d994d53960acdcd3aee91ebebb10a000e1bded9983fe5774370b0db8def71371f753a952ac291cfcd70e5c731f4fd7d3fce
SSDEEP 768:JPeqi/dXC1ABsYC/KHeP8DVXuBpW8+C5PY3cKJqWlz/Nujsiu6wsNxW:RO/1C1+s5K+P8DV+CtYPUtonxNNI
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133596419062033091.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596419062033091.txt
Size 75KB
SHA256 b68fe897daf465aa0e8c1e003b14c6249c52aceb66e6a1206bd43982ef4323f7
MD5 65ee54a6577b6cfb06ae80b2dddd8220
SHA1 ade15e4390c647f0cd80ee3cf912a91a04abc1f8
SHA512 7a23092227c147c138406280c81e80382e4137295ecdd3be1197b9e0b316fa2f19aba094303a18212dcc9a5736a128484ed0e464a31a69b94057cb9b2a787562
SSDEEP 1536:BjPlMfXE4F/F4MzRMC2HExn1ZVfhu5GFhgvyGVtIft/5aVHX:Ij94MzRMC2kxn1ZVg0wvgt5aV3
MD5 SHA1 SHA512 SSDEEP

Submit Download

lkhsgho.exe

Path C:\Users\Admin\AppData\Roaming\lkhsgho.exe
Size 608KB
SHA256 39b5dd803071ebc4590a51c7d25e15eeddf2f4dcb27950ebfe80c4315432b3c1
MD5 1ba9ad23fa2182f7408878545d52fd1e
SHA1 624a0d2cb004d3f1ab1ef0cc308f9453b20ac7ad
SHA512 434c1234aa63d875a402a757afffb3d4ec07beeed1db62321615ff56f3af4e79771e8b98d40a36f510bbc7ddb15a04d2a9bf961a3ec4b4e0e981cbd53eecf631
SSDEEP 12288:CV4sPzhK43pOuoaT/AewoPJ0i22qWmYhK43pOuoaT/AewoP7:Cms7hKuzJwmSi2ruhKuzJwm7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1308-18-0x0000000000400000-0x0000000000842000-memory.dmp

Download

memory/1308-11-0x0000000000400000-0x0000000000842000-memory.dmp

Download

memory/3032-4-0x0000000002640000-0x0000000002643000-memory.dmp

Download

memory/3032-1-0x0000000002640000-0x0000000002643000-memory.dmp

Download

memory/3032-0-0x0000000002640000-0x0000000002643000-memory.dmp

Download

memory/3356-608-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/3356-10354-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/3356-24-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/3356-22-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/3356-3814-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/3356-7116-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/3356-20-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/3356-19-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/3356-10352-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/3356-871-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/3356-10362-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/3356-10364-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/3356-17-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/3356-16-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/3356-10404-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/4656-6-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/4656-12-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/4656-5-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/4656-2-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/4656-3-0x0000000000400000-0x0000000000486000-memory.dmp

Download