a38207f0e70d472afbbde057caa046c47c56d86d02b3c2a633a2e08f02e7274a

Analysis

max time kernel
118s
max time network
146s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10/06/2024, 10:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VirusShare_1eb412a5f6400eb490a8698dc08129da.exe
Size

344KB
MD5

1eb412a5f6400eb490a8698dc08129da
SHA1

065daf13ce7d8adfca48fb1405f76b122b5edd62
SHA256

a38207f0e70d472afbbde057caa046c47c56d86d02b3c2a633a2e08f02e7274a
SHA512

7155af1756cd1639b9d7baf96caad6f658d28cd64723755dae657adb156fbb9cc107cecc68c376dd2c0bcdc532aef6233c00418e91fa9f35728d4c759daa5c70
SSDEEP

6144:fclgBCoMvJpr3IZVXBRVRC3BMaXGRTuKYAyqeT6y52cZuvrvD1hNVWfO6:f5C9Jpr3I3XBRi3WaXGEKXnW6RjPkv

Score

10^/10

defense_evasion evasion execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\how_recover+twy.txt

Ransom Note

111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) What does this mean ? This means that the structure and data within your files have been irrevocably changed, you will not be able to work with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them. 111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 How did this happen ? ---Specially for your PC was generated personal RSA-4096 KEY, both public and private. ---ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. 111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server. What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BTC NOW, and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://vr6g2curb2kcidou.encpayment23.com/EC3565E91F6AB2D4 2. http://vr6g2curb2kcidou.expay34.com/EC3565E91F6AB2D4 3. http://psbc532jm8c.hsh73cu37n1.net/EC3565E91F6AB2D4 4. https://vr6g2curb2kcidou.onion.to/EC3565E91F6AB2D4 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser and wait for initialization. 3. Type in the address bar: vr6g2curb2kcidou.onion/EC3565E91F6AB2D4 4. Follow the instructions on the site. IMPORTANT INFORMATION: Your personal pages: http://vr6g2curb2kcidou.encpayment23.com/EC3565E91F6AB2D4 http://vr6g2curb2kcidou.expay34.com/EC3565E91F6AB2D4 http://psbc532jm8c.hsh73cu37n1.net/EC3565E91F6AB2D4 https://vr6g2curb2kcidou.onion.to/EC3565E91F6AB2D4 Your personal page (using TOR-Browser): vr6g2curb2kcidou.onion/EC3565E91F6AB2D4 Your personal identification number (if you open the site (or TOR-Browser's) directly): EC3565E91F6AB2D4 111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111

URLs

http://vr6g2curb2kcidou.encpayment23.com/EC3565E91F6AB2D4

http://vr6g2curb2kcidou.expay34.com/EC3565E91F6AB2D4

http://psbc532jm8c.hsh73cu37n1.net/EC3565E91F6AB2D4

https://vr6g2curb2kcidou.onion.to/EC3565E91F6AB2D4

http://vr6g2curb2kcidou.onion/EC3565E91F6AB2D4

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 5 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2516	bcdedit.exe
2164	bcdedit.exe
1864	bcdedit.exe
1996	bcdedit.exe
2272	bcdedit.exe

Renames multiple (417) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Deletes itself 1 IoCs

pid	Process
2596	cmd.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\how_recover+twy.txt	rttnsacroic.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\how_recover+twy.html	rttnsacroic.exe

Executes dropped EXE 2 IoCs

pid	Process
2660	rttnsacroic.exe
2784	rttnsacroic.exe

Loads dropped DLL 3 IoCs

pid	Process
2160	VirusShare_1eb412a5f6400eb490a8698dc08129da.exe
2160	VirusShare_1eb412a5f6400eb490a8698dc08129da.exe
2660	rttnsacroic.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Acrndtd = "C:\\Users\\Admin\\AppData\\Roaming\\rttnsacroic.exe"	rttnsacroic.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	myexternalip.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2740 set thread context of 2160	2740	VirusShare_1eb412a5f6400eb490a8698dc08129da.exe	29
PID 2660 set thread context of 2784	2660	rttnsacroic.exe	34

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\how_recover+twy.txt	rttnsacroic.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\how_recover+twy.html	rttnsacroic.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw120.jpg	rttnsacroic.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\css\how_recover+twy.txt	rttnsacroic.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_top.png	rttnsacroic.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\27.png	rttnsacroic.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\how_recover+twy.txt	rttnsacroic.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\how_recover+twy.txt	rttnsacroic.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ne\how_recover+twy.html	rttnsacroic.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	rttnsacroic.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\how_recover+twy.txt	rttnsacroic.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\settings.js	rttnsacroic.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\how_recover+twy.txt	rttnsacroic.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\te\how_recover+twy.html	rttnsacroic.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\how_recover+twy.html	rttnsacroic.exe
File opened for modification	C:\Program Files\DVD Maker\ja-JP\how_recover+twy.txt	rttnsacroic.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\icon.png	rttnsacroic.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower.png	rttnsacroic.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\base-docked.png	rttnsacroic.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\weather.js	rttnsacroic.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\de\how_recover+twy.txt	rttnsacroic.exe
File opened for modification	C:\Program Files\Microsoft Office\how_recover+twy.html	rttnsacroic.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\how_recover+twy.txt	rttnsacroic.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\how_recover+twy.txt	rttnsacroic.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\en-US\how_recover+twy.html	rttnsacroic.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\how_recover+twy.txt	rttnsacroic.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\how_recover+twy.txt	rttnsacroic.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\how_recover+twy.html	rttnsacroic.exe
File opened for modification	C:\Program Files\Common Files\System\en-US\how_recover+twy.html	rttnsacroic.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ur.pak	rttnsacroic.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\en-US\how_recover+twy.html	rttnsacroic.exe
File opened for modification	C:\Program Files\Microsoft Games\Minesweeper\de-DE\how_recover+twy.txt	rttnsacroic.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\en-US\how_recover+twy.txt	rttnsacroic.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\how_recover+twy.txt	rttnsacroic.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-image-mask.png	rttnsacroic.exe
File opened for modification	C:\Program Files\ImportResolve.dwg	rttnsacroic.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\how_recover+twy.html	rttnsacroic.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\spu\how_recover+twy.html	rttnsacroic.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\settings.css	rttnsacroic.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	rttnsacroic.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\15x15dot.png	rttnsacroic.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sl\how_recover+twy.txt	rttnsacroic.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\how_recover+twy.html	rttnsacroic.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_right.png	rttnsacroic.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	rttnsacroic.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\how_recover+twy.txt	rttnsacroic.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access_output\how_recover+twy.txt	rttnsacroic.exe
File opened for modification	C:\Program Files\Mozilla Firefox\fonts\how_recover+twy.txt	rttnsacroic.exe
File opened for modification	C:\Program Files\Microsoft Games\Minesweeper\ja-JP\how_recover+twy.txt	rttnsacroic.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_222222_256x240.png	rttnsacroic.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\how_recover+twy.txt	rttnsacroic.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_selectionsubpicture.png	rttnsacroic.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\how_recover+twy.html	rttnsacroic.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bg-today.png	rttnsacroic.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	rttnsacroic.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ja\how_recover+twy.txt	rttnsacroic.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\AUTHORS.txt	rttnsacroic.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\how_recover+twy.txt	rttnsacroic.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	rttnsacroic.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg	rttnsacroic.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\how_recover+twy.txt	rttnsacroic.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\how_recover+twy.html	rttnsacroic.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sw.pak	rttnsacroic.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\library.js	rttnsacroic.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
1868	vssadmin.exe
344	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6001216d23bbda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9898C801-2716-11EF-A7A3-7A58A1FDD547} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000f796a030cba6e8f4891c4114a58e502e9bb22b91d0f82d618ecb7327ffbb30bd000000000e80000000020000200000002cb8e9189acb572f440a057a8724d671adde172d7ac176b157ef681bf65de092200000000a37656fb0d63dc8fe3d6d7ebdfa14ed84f9db0de33f87cc9ee7a2510a631498400000001ab25f7ef41b628100dde3149ead0414efce098597f0b28c174468730ad2bac553ce13da6b2473b9a75e4492595e7f2e51c2f51a55f54150c51a74f561f626cd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424178214"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000d02678b63b06e35eecdf9bd39dc6e2a31bf1ccbafe8aa721b685ce7d39dd0c4a000000000e8000000002000020000000e2790f6b2a1a14c335f92a4da1b692159875e778a48cf648c380c210fa587f5f9000000090dd64e503bcc906f6c1e2a3d1883e726a11b76ca571504cdfbb0c2c76268b28e28dd6a30b77a130f60cf675b048723f17ba6c5a7433e4ef589e2f5e70e2b5084ab7df9ce1a9ae8550ae73a4e7b1f96eee890c3f9a741dae5b277edd8b9212ca17b082033de4ee0c21f6a6994797e97f95e61fdc55e08daa17b8f685a82e6836f63dac8818faea14bb9f5b164b6efe1c40000000c2e8da9676b21c40bf1af202b20e89b7e9ca47fe8dedcd85153483f28f860fcd40b4e7952b16b19d2691cfe47bc0f231166c2d5f1e71c43671b3b4c205e7c302	iexplore.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2912	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe
2784	rttnsacroic.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2160	VirusShare_1eb412a5f6400eb490a8698dc08129da.exe
Token: SeDebugPrivilege	2784	rttnsacroic.exe
Token: SeBackupPrivilege	1664	vssvc.exe
Token: SeRestorePrivilege	1664	vssvc.exe
Token: SeAuditPrivilege	1664	vssvc.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
872	iexplore.exe
584	DllHost.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
872	iexplore.exe
872	iexplore.exe
2224	IEXPLORE.EXE
2224	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2160	2740	VirusShare_1eb412a5f6400eb490a8698dc08129da.exe	29
PID 2740 wrote to memory of 2160	2740	VirusShare_1eb412a5f6400eb490a8698dc08129da.exe	29
PID 2740 wrote to memory of 2160	2740	VirusShare_1eb412a5f6400eb490a8698dc08129da.exe	29
PID 2740 wrote to memory of 2160	2740	VirusShare_1eb412a5f6400eb490a8698dc08129da.exe	29
PID 2740 wrote to memory of 2160	2740	VirusShare_1eb412a5f6400eb490a8698dc08129da.exe	29
PID 2740 wrote to memory of 2160	2740	VirusShare_1eb412a5f6400eb490a8698dc08129da.exe	29
PID 2740 wrote to memory of 2160	2740	VirusShare_1eb412a5f6400eb490a8698dc08129da.exe	29
PID 2740 wrote to memory of 2160	2740	VirusShare_1eb412a5f6400eb490a8698dc08129da.exe	29
PID 2740 wrote to memory of 2160	2740	VirusShare_1eb412a5f6400eb490a8698dc08129da.exe	29
PID 2740 wrote to memory of 2160	2740	VirusShare_1eb412a5f6400eb490a8698dc08129da.exe	29
PID 2740 wrote to memory of 2160	2740	VirusShare_1eb412a5f6400eb490a8698dc08129da.exe	29
PID 2160 wrote to memory of 2660	2160	VirusShare_1eb412a5f6400eb490a8698dc08129da.exe	30
PID 2160 wrote to memory of 2660	2160	VirusShare_1eb412a5f6400eb490a8698dc08129da.exe	30
PID 2160 wrote to memory of 2660	2160	VirusShare_1eb412a5f6400eb490a8698dc08129da.exe	30
PID 2160 wrote to memory of 2660	2160	VirusShare_1eb412a5f6400eb490a8698dc08129da.exe	30
PID 2160 wrote to memory of 2596	2160	VirusShare_1eb412a5f6400eb490a8698dc08129da.exe	32
PID 2160 wrote to memory of 2596	2160	VirusShare_1eb412a5f6400eb490a8698dc08129da.exe	32
PID 2160 wrote to memory of 2596	2160	VirusShare_1eb412a5f6400eb490a8698dc08129da.exe	32
PID 2160 wrote to memory of 2596	2160	VirusShare_1eb412a5f6400eb490a8698dc08129da.exe	32
PID 2660 wrote to memory of 2784	2660	rttnsacroic.exe	34
PID 2660 wrote to memory of 2784	2660	rttnsacroic.exe	34
PID 2660 wrote to memory of 2784	2660	rttnsacroic.exe	34
PID 2660 wrote to memory of 2784	2660	rttnsacroic.exe	34
PID 2660 wrote to memory of 2784	2660	rttnsacroic.exe	34
PID 2660 wrote to memory of 2784	2660	rttnsacroic.exe	34
PID 2660 wrote to memory of 2784	2660	rttnsacroic.exe	34
PID 2660 wrote to memory of 2784	2660	rttnsacroic.exe	34
PID 2660 wrote to memory of 2784	2660	rttnsacroic.exe	34
PID 2660 wrote to memory of 2784	2660	rttnsacroic.exe	34
PID 2660 wrote to memory of 2784	2660	rttnsacroic.exe	34
PID 2784 wrote to memory of 2516	2784	rttnsacroic.exe	35
PID 2784 wrote to memory of 2516	2784	rttnsacroic.exe	35
PID 2784 wrote to memory of 2516	2784	rttnsacroic.exe	35
PID 2784 wrote to memory of 2516	2784	rttnsacroic.exe	35
PID 2784 wrote to memory of 1868	2784	rttnsacroic.exe	37
PID 2784 wrote to memory of 1868	2784	rttnsacroic.exe	37
PID 2784 wrote to memory of 1868	2784	rttnsacroic.exe	37
PID 2784 wrote to memory of 1868	2784	rttnsacroic.exe	37
PID 2784 wrote to memory of 2164	2784	rttnsacroic.exe	41
PID 2784 wrote to memory of 2164	2784	rttnsacroic.exe	41
PID 2784 wrote to memory of 2164	2784	rttnsacroic.exe	41
PID 2784 wrote to memory of 2164	2784	rttnsacroic.exe	41
PID 2784 wrote to memory of 1864	2784	rttnsacroic.exe	43
PID 2784 wrote to memory of 1864	2784	rttnsacroic.exe	43
PID 2784 wrote to memory of 1864	2784	rttnsacroic.exe	43
PID 2784 wrote to memory of 1864	2784	rttnsacroic.exe	43
PID 2784 wrote to memory of 1996	2784	rttnsacroic.exe	45
PID 2784 wrote to memory of 1996	2784	rttnsacroic.exe	45
PID 2784 wrote to memory of 1996	2784	rttnsacroic.exe	45
PID 2784 wrote to memory of 1996	2784	rttnsacroic.exe	45
PID 2784 wrote to memory of 2272	2784	rttnsacroic.exe	47
PID 2784 wrote to memory of 2272	2784	rttnsacroic.exe	47
PID 2784 wrote to memory of 2272	2784	rttnsacroic.exe	47
PID 2784 wrote to memory of 2272	2784	rttnsacroic.exe	47
PID 2784 wrote to memory of 2912	2784	rttnsacroic.exe	52
PID 2784 wrote to memory of 2912	2784	rttnsacroic.exe	52
PID 2784 wrote to memory of 2912	2784	rttnsacroic.exe	52
PID 2784 wrote to memory of 2912	2784	rttnsacroic.exe	52
PID 2784 wrote to memory of 872	2784	rttnsacroic.exe	53
PID 2784 wrote to memory of 872	2784	rttnsacroic.exe	53
PID 2784 wrote to memory of 872	2784	rttnsacroic.exe	53
PID 2784 wrote to memory of 872	2784	rttnsacroic.exe	53
PID 872 wrote to memory of 2224	872	iexplore.exe	54
PID 872 wrote to memory of 2224	872	iexplore.exe	54

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	rttnsacroic.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	rttnsacroic.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\VirusShare_1eb412a5f6400eb490a8698dc08129da.exe
"C:\Users\Admin\AppData\Local\Temp\VirusShare_1eb412a5f6400eb490a8698dc08129da.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Users\Admin\AppData\Local\Temp\VirusShare_1eb412a5f6400eb490a8698dc08129da.exe
  "C:\Users\Admin\AppData\Local\Temp\VirusShare_1eb412a5f6400eb490a8698dc08129da.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Users\Admin\AppData\Roaming\rttnsacroic.exe
    C:\Users\Admin\AppData\Roaming\rttnsacroic.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2660
  - - C:\Users\Admin\AppData\Roaming\rttnsacroic.exe
      C:\Users\Admin\AppData\Roaming\rttnsacroic.exe
      4⤵
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2784
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit.exe /set {current} bootems off
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2516
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
        5⤵
        Interacts with shadow copies
        
        PID:1868
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit.exe /set {current} advancedoptions off
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2164
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit.exe /set {current} optionsedit off
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1864
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1996
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit.exe /set {current} recoveryenabled off
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2272
    - - C:\Windows\SysWOW64\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Howto_RESTORE_FILES.txt
        5⤵
        Opens file in notepad (likely ransom note)
        
        PID:2912
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\Howto_RESTORE_FILES.html
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:872
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:872 CREDAT:275457 /prefetch:2
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2224
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
        5⤵
        Interacts with shadow copies
        
        PID:344
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Roaming\RTTNSA~1.EXE
        5⤵
        
        PID:2204
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE
    3⤵
    - Deletes itself
    PID:2596

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1664

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\how_recover+twy.html

Filesize
9KB

MD5
cdcc2cff2b313d876b46ed02bc8e2645

SHA1
f5e5cfc89bb64e0c4e374d4e922edc7a675ff3cd

SHA256
41087dc14cd65ef4a70e9b93e5a7f6c21b51a1899df076586fff6e1b9625a99b

SHA512
dbe2514eabb7a5e0f1c7e50395dd116be7c345a70a3a0b2d572440e3ebb77bec2d6451fcaf682d0edc005b5b9c897cd79241f7a917689e45a4101fb67a510c7c

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\how_recover+twy.txt

Filesize
2KB

MD5
055f1cd551f4490c2cc21e66bb8cc2bd

SHA1
08dd6f0637be98c3dedde3404232fbf71b8b3b1b

SHA256
a2eaaf95d799749f7e5506dcdf76f953a937412be06801b5b868adfb20a8a6f5

SHA512
5c9fe955f63e8cf67026e19481f7a860030880ced0da609d627b2dff76f7ae1595caaf42b2a2ecc4244914ed79a17426f8fb39cfb76c21454f9339202d596a22

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
0d3d705772f6f40f832733d234b2b6af

SHA1
72ff8cf10e7769d5f48d1c9b57e4f9f71d7f1b8c

SHA256
f33f0257e01600ec0cb53453b7df452b8c4f457ea2564333c7a92e7bf43a0189

SHA512
6f13bfecc2566b80dfe167a282877b3556b2d468680a012dc6a986f0efff15b5df0bde6101ee1dc4af55f783e21d02300887dd4411c3c05ccb8c72bb6da943fc

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
1d6a8a2d568e030d005e8b068f084bd4

SHA1
3525630ac8ac1ecfc6e4821cadd1605455ddcebb

SHA256
c41c4ebab63b248fa97411bc39b97344071b00835039eab0a81ee3ce32224077

SHA512
5d269026c2924c8417b1c7d419b53fadddae88a929dbb03d1e1f5d2bb4c6a4c155321ecf2d8162c5f115ea3b0613068731f991587bcd5ce8085649ffdf84f68e

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
173KB

MD5
fdba1d38a7e60580a6c3542f5be4198c

SHA1
8f1e2511ddaf19f16d2645032b0ce0928b28e947

SHA256
0d567229048eabe244f733f408920d9a5dfc25696b7633d73466701958af856a

SHA512
785cc8e0bc2a14b0fd716e360c99ef39d5308385960e83ff1320ab573abab40919a58150787c730536e04c8df2a8c57a7b9b9f9b55f69ae0830c07c2fa1077dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73198b9202e0d4107670d2c10459c210

SHA1
8e2c7a6b2b56cdd7a42f0cb18450675db6291958

SHA256
db7c65c8f0bd1ba8f01faa54b12be9786a885b0fdbf3aca51eaeb0ac46d2ce8f

SHA512
6a1ba87136ebbc4e81e36db9ac19fb87ad70bb29d86f6162234d6cf853854c02d2991d4e234418cbd34cc9493c70be8c9648116bf92be11411e98dcb360e5b48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85f773f527617e0120cb6c88112d3cd0

SHA1
e8bca9b2d33330293ca86981ea9cc5b43a591d70

SHA256
6f79905ab3f62c53a155f7e9e476d31320b2dc9284319ffc2c79f4dd5a4235b7

SHA512
a2dd33ee70c1602fcfba4840e8c8d5a37eaa10c848142c67e57aaf14623d68b1cbbe0501b98deb087c15ced135f176773704012f3da579c5929bdda8bded735b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ad5d8e6dd6e51d13bbe14a135128949

SHA1
52b365af3548bc9f3e98269c67343cd389da26c2

SHA256
89c2cc9572468f3849a8eb80f6e9ce88fc03474eb644475174f173aa48963b6b

SHA512
67e958e8bd9dde043d0e525a647d4a11c6d74f4568e3e22b055a5913ffe1d8d55324c46335256a09ebea68eb18e5994c23959eed4bb649f32245a2915e5b4a33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ee5c73c0173186cfff644e41ef419c9

SHA1
d42a9cd8571808d2c8e3aebe8451381e0d1634c4

SHA256
94e39f521b2367a32c2fec58e2d3d7fcd2a65f84a4b5543a807f41dbf0ac773d

SHA512
1213fb72b30608220d12df9f2326731b1dac2d8e6289ac91ada1e6dec4d38ed3101ed0aee615641ef3d51c9b55e8d5ca25d26c01ab200383450a53bb762aff3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc8ccdf7b869090b5ca889a45cc4fdcd

SHA1
cf9a5170b31b291756413477165538c7041247c8

SHA256
ba6507c8e38240488894164c31878743acd2256ba2b28eec30fdf07b3ac46c87

SHA512
910da0891f68a89ea2b9edd840f101d4f9e6dbfcd7fbec8f62a6a19163279caa505876ffa4baf0de81921184759c00b4413b2037dc33a6d598a3abc7286aaac3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a0752f916da993e9241a932f90457d0

SHA1
537fb09d44a510eb2ea77ee86cf128e5ae66668e

SHA256
e3823ee8d31d6eab26fc9c5833afdd399e90c4ea4fd3a5dd91560c80d1f5a71b

SHA512
988098188e1ec5f8643808bbf89f6b20610c20edc41e8a8aecbf7599724b5caa51cb0067a0d7fb9b572810202db484ff374f6c6bbc75caf0de2925c9a60b05d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b436b3fe13190bbdc3961097a04968d

SHA1
5285c5ce66851af0d9bca10a23503df87874ae4c

SHA256
3d03020a3399cf0f32410d77fbca498e45a7e59754ec0f061cb6f3b2a3aa7770

SHA512
3c02f824d9971e99a9104301099fe2bca55f7db86b8e888e3304ef5512943a53343239fbb8684ba82ddf758d9278934703183466bbe8fdaa14585ff7c92a6cdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d01d67764a38b7d0e76df43377744c2e

SHA1
64915fc87d81ae15f595305f8f587f6326334750

SHA256
241010fefbb97cbf8970b70fb6232a974d5772a479afdba2e40601e8a758e005

SHA512
b363facba90dd8e1fb124e7e79bb8d5da10edd1417f0376d2dd54e65c45aeb7293e7487974b1335a2eccf129a78e8158df743feca5f28cfb9002307fc0d39b24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b9f5c462c02046557754a7f79415994

SHA1
49275d33e08548873ada9fb5203470757c994beb

SHA256
ad7c137020b0a7952823f620b211f3ba82359d5b78d5d7cc38fd9913a99d88d6

SHA512
b6b9c172ccaf8e4a38b7ec7677e60a3f59683595fa95a7e4f9188c1f2db66a8222f1e7e3c4017ac9e66f4a8164ddd482e1d2a4ac0c6a498a5c0f475a6103f4df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3fab27fbebb9a71ad5c2c78fea8a780

SHA1
e57beed3703027d69d39b97bd2bb4b3b75fd1811

SHA256
75c8dd1d365a8ef0a3d09f0cf7f42d0e715efc34702cef61aa84ebb0acd682f0

SHA512
f1f2d9ccc5ec7daf540b076fd67cc6de17d8bb83bfe9b6f1d87cc2e7fce105aaef158bc37ec5aefb1fc16c518e7f06d344ceff5ef9d414229f733968c51643d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12408c951993cff0f9ae66846bf3fa25

SHA1
f60e24f79387fbc706af0fdcf2ff653d4c168d9e

SHA256
b503088fa93a92dfb4e06a9e16f09c59ef1f3f8484c06e1d72627b0957d6b91b

SHA512
f9b465439b88c11a9c25722526baa045cf849e5e65607e91cd543c69afd228186d0de8056709747551ea590faae7eb3a0cd19c740bbc2732b7d2b46d2db7e6f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b53a3326aa0a0fb39d9ef06696d048aa

SHA1
a7cd9feb30232e92cf91e9ef1760021ce5a4392f

SHA256
9e077fa9a44cfb5814c668a28163b7e200bf09716ed8adcfb04f3dd3219ca75d

SHA512
8e35396c17cfb75244eb5b249122e13ae39c8d452ba4a01457aaf06d2c82c1d719276a3289b2ced0c19f31b64b11bb5610f5bb295cd7f5a26ee3612e9790e225

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4fc9d4205b3467eb1804c1f515961242

SHA1
b716b8d15111bd1144a4f42121d6baefed5f94ab

SHA256
0c8ffda9ffa81f7a6464e0a0746d0763f3f07a24b7e09fd4cb9e4683ef1fff4e

SHA512
c185a6d7556a98f5ebdff21fd452b111e993b04a53c80af3a23b8539ec898a952ca9e7c7b351b329e71bd98b7274454ff68a030d432ab981a44b936cfe8deb7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c32eae56d04dec8cc19046d0e39cec7

SHA1
27050c505ced6772d055881d06285aad8a260a1a

SHA256
3cf0cf1ae6f733812f10277fa39154c0ceffa7b4ed17d6b6e5ef08382a4cb054

SHA512
ba94184e1de4267825fdd8e039f138bf41149f722b1d561cd106301a253457e4f4c865350b3269ddbbb1b27c757f16ac60d0e39458f3a3469ddadacc5e741a86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a3db72a958a590c33e7655171f650b6

SHA1
a3683f58f879c1109bee2cb742aecf98c8f0a9f3

SHA256
d3c1a20c04279e956d70941fef3f778cff4334d9769416c91a02536c48c532f8

SHA512
013db17b370e21bec7aec060cd9fd74af53ec36ffc84799a7df23844d592476e7ad31be7d8d7e40f4e8169a9757c8ffdc753cc786a04a6fde340d1354e37ab2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e7e2b5b6b4d4027199f7c90f95f58dc

SHA1
5078a6392b5c7a6390460b4950ab7b513f2edf33

SHA256
085e1b54a2f9d4f822738b60ba3b7d3fdbde0282b7f0e2a49e49cb089658a13c

SHA512
27f8155795cb644de916f100797d5468309d65590a61e4c155b47c9cfc348fca91b29a4ff9d39388f30693ff5b08a86a7acab533a58466e79e95ab0d316c2863

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9d5971f9921ff55b434752d6d679bdf

SHA1
d1bc107d79eb5a6077b95dd503fb0977b6d63e22

SHA256
f9affb1909e43c243d775b97a4749aae9beb57394eed8034f7c5fba64f723bfa

SHA512
920e22681d95863db4a27701a41b42c16df068733abea99c6f529fea8819a408a2645330bdc58d7b04ad9698c05ca4086c1b581132655e89e57d077f03157502

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa45b1d18e37663d9433a38dec0859b1

SHA1
6f042749bd8d10d983006bab29855678bc67be0c

SHA256
7719d5cb98623cc081057ba8d88db70b42ece924bd4caca661cf6d13255bb4fa

SHA512
b70e12c3cefbfc6c724f7f9768229e259d93be8168a11fd6a67cce9f274963c3daa8bc3815b1b5a0199661622bec91a22b70e4bd1f06079df1a54946d25239ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
39bf5517511277dc251789e7ef60fd94

SHA1
dfc139304735f4ddb4e4db2edc13379359423692

SHA256
575c4f0acbc8086df8038227766d36db00b544e016c5fc2cce6a18ae1c9d0a46

SHA512
4624c537bc97cd83654a3ab5fb7bb30f029b816c335574520f6efed992f81916a86db6f6c5e91cf2d6d644f2126cf409d4a4bde9bbdd5fd1fb309b5edd994496

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0019b94efba46a3e68a59e46be7227d5

SHA1
c722faf8b201bba4ae8c351777a02f1012442edd

SHA256
3d5fdbde747578daadc7b7a219a098ff8cc4f1b72964e8924ea8979aadc422e7

SHA512
7328f1faef6471ed11a20c26cb06854bf4d76b6ebbecbec98cf8115ffab2ebff49c380f674a3c1ced64eafc2dd81385d2ffcfa42725631f1f542bbe3e8e9a8d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3C5C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\Desktop\Howto_RESTORE_FILES.bmp

Filesize
3.3MB

MD5
cd0843fa4c06259c71ec75256f497655

SHA1
fc8db6a64824dc53d14e384717abf90ea2704dc1

SHA256
27cdb257599b2b23a73be61a924583a8e1044dc80dbbf690e4c4312280a67874

SHA512
4712f5f590fca4af9681747a73523041ecdd61bd04b27dbf894f70a4fb99c2a09bde5a0d8b074016e1df347f96e501a87eb784e10adb57456f7955a98f27fcae

Download Submit
\Users\Admin\AppData\Roaming\rttnsacroic.exe

Filesize
344KB

MD5
1eb412a5f6400eb490a8698dc08129da

SHA1
065daf13ce7d8adfca48fb1405f76b122b5edd62

SHA256
a38207f0e70d472afbbde057caa046c47c56d86d02b3c2a633a2e08f02e7274a

SHA512
7155af1756cd1639b9d7baf96caad6f658d28cd64723755dae657adb156fbb9cc107cecc68c376dd2c0bcdc532aef6233c00418e91fa9f35728d4c759daa5c70

Download Submit
memory/584-4391-0x0000000000180000-0x0000000000182000-memory.dmp

Filesize
8KB

Download
memory/2160-30-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2160-15-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2160-18-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2160-19-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2160-11-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2160-9-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2160-7-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2160-5-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2160-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2160-3-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2160-1-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2660-31-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/2740-0-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/2740-16-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/2784-3106-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2784-4393-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2784-4390-0x0000000002A10000-0x0000000002A12000-memory.dmp

Filesize
8KB

Download
memory/2784-4383-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2784-4444-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2784-928-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2784-57-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2784-56-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2784-53-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2784-51-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2784-52-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2784-4394-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2784-4447-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download