ceb220b71dabfe1c875dd8a0620226c05dd45adef7e3812c11cd3759d7058070

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 11:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VirusShare_331767c8a95117a9e51cc47c95afd3a9.exe
Size 332KB
Sample240610-nd22cshc72
SHA256 ceb220b71dabfe1c875dd8a0620226c05dd45adef7e3812c11cd3759d7058070
MD5 331767c8a95117a9e51cc47c95afd3a9
SHA1 7426d13db7f5c0d5ec7c6eca79279c11fd47def9
SHA512 f40dd430b450e8bfe5be7a1d1468330b81ec972d3946c3161e3f22acb5302754889237c8611ab18790ba8e9bcd493aec7fac1a6f18bcadd77d1a64868a5344cf
SSDEEP 6144:iiNEzZL9+eE5WAH4nt5ssWK2NTZ5wV/sRVLtuO/Y5UCyf1KyN8z8+Tl:ZEzZh+eE5WASO7fOV/gN/SyNKyNmBJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\Recovery+mkbjb.txt

Ransom Note

__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#! NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-4096 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://ytrest84y5i456hghadefdsd.pontogrot.com/6C2362752E7630BB 2. http://prest54538hnksjn4kjfwdbhwere.hotchunman.com/6C2362752E7630BB 3. http://5rport45vcdef345adfkksawe.bematvocal.at/6C2362752E7630BB If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser and wait for initialization 3. Type in the address bar: fwgrhsao3aoml7ej.onion/6C2362752E7630BB 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://ytrest84y5i456hghadefdsd.pontogrot.com/6C2362752E7630BB http://prest54538hnksjn4kjfwdbhwere.hotchunman.com/6C2362752E7630BB http://5rport45vcdef345adfkksawe.bematvocal.at/6C2362752E7630BB *-*-* Your personal page Tor-Browser: fwgrhsao3aoml7ej.ONION/6C2362752E7630BB *-*-* Your personal identification ID: 6C2362752E7630BB

URLs

http://ytrest84y5i456hghadefdsd.pontogrot.com/6C2362752E7630BB
http://prest54538hnksjn4kjfwdbhwere.hotchunman.com/6C2362752E7630BB
http://5rport45vcdef345adfkksawe.bematvocal.at/6C2362752E7630BB
http://fwgrhsao3aoml7ej.onion/6C2362752E7630BB
http://fwgrhsao3aoml7ej.ONION/6C2362752E7630BB

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (885) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	VirusShare_331767c8a95117a9e51cc47c95afd3a9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	eaqsvmxpjcgj.exe

Drops startup file 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+mkbjb.png	eaqsvmxpjcgj.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+mkbjb.txt	eaqsvmxpjcgj.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+mkbjb.html	eaqsvmxpjcgj.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+mkbjb.png	eaqsvmxpjcgj.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+mkbjb.txt	eaqsvmxpjcgj.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+mkbjb.html	eaqsvmxpjcgj.exe

Executes dropped EXE 1 IoCs

pid	Process
2604	eaqsvmxpjcgj.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hcurslrloiti = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\eaqsvmxpjcgj.exe\""	eaqsvmxpjcgj.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl\Recovery+mkbjb.png	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-addtotable.png	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\166.png	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-48_altform-unplated_contrast-white.png	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsSplashScreen.scale-200.png	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_~_8wekyb3d8bbwe\Recovery+mkbjb.txt	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\MEIPreload\Recovery+mkbjb.html	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lo\LC_MESSAGES\Recovery+mkbjb.png	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\Recovery+mkbjb.png	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\Assets\Images\SkypeLargeTile.scale-100.png	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionLargeTile.scale-400.png	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\Recovery+mkbjb.html	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\es-ES\Recovery+mkbjb.html	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\Recovery+mkbjb.txt	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Recovery+mkbjb.html	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\microsoft.system.package.metadata\Recovery+mkbjb.png	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\hu-HU\Recovery+mkbjb.png	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-white_targetsize-256.png	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_2019.716.2316.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\Recovery+mkbjb.txt	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-black\Recovery+mkbjb.png	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Dial\Undo.png	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\PhotosApp\Assets\Recovery+mkbjb.html	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\Light\Recovery+mkbjb.html	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ha-Latn-NG\Recovery+mkbjb.html	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_EyeLashEye.png	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-60_altform-unplated_contrast-white.png	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.scale-200.png	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteAppList.targetsize-256.png	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookSmallTile.scale-400.png	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionGroupSmallTile.scale-400.png	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Recovery+mkbjb.txt	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\README.txt	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeLargeTile.scale-125_contrast-black.png	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-150_contrast-black.png	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\Recovery+mkbjb.html	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\Recovery+mkbjb.png	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeLargeTile.scale-400.png	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AXIS\THMBNAIL.PNG	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\en-US\Recovery+mkbjb.html	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageWideTile.scale-200_contrast-black.png	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\Recovery+mkbjb.html	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hr\Recovery+mkbjb.png	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Lumia.MagicEdit\UserControls\Recovery+mkbjb.html	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\Recovery+mkbjb.html	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_neutral_split.scale-100_8wekyb3d8bbwe\Recovery+mkbjb.png	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-256.png	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ca@valencia\Recovery+mkbjb.html	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.scale-100.png	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-96_altform-unplated.png	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Recovery+mkbjb.html	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-64.png	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\en-IN\en-IN_female_TTS\Recovery+mkbjb.txt	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\Recovery+mkbjb.txt	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\assembly\GAC_MSIL\Recovery+mkbjb.html	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookLargeTile.scale-150.png	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-256_altform-unplated.png	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Recovery+mkbjb.png	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\tinytile.targetsize-16_contrast-white.png	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreAppList.targetsize-16.png	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\Recovery+mkbjb.txt	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\Recovery+mkbjb.png	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-black\Recovery+mkbjb.png	eaqsvmxpjcgj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-white\Recovery+mkbjb.txt	eaqsvmxpjcgj.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\eaqsvmxpjcgj.exe	VirusShare_331767c8a95117a9e51cc47c95afd3a9.exe
File created	C:\Windows\eaqsvmxpjcgj.exe	VirusShare_331767c8a95117a9e51cc47c95afd3a9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	eaqsvmxpjcgj.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2764	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe
2604	eaqsvmxpjcgj.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	2176	VirusShare_331767c8a95117a9e51cc47c95afd3a9.exe
Token: SeDebugPrivilege	2604	eaqsvmxpjcgj.exe
Token: SeIncreaseQuotaPrivilege	4948	WMIC.exe
Token: SeSecurityPrivilege	4948	WMIC.exe
Token: SeTakeOwnershipPrivilege	4948	WMIC.exe
Token: SeLoadDriverPrivilege	4948	WMIC.exe
Token: SeSystemProfilePrivilege	4948	WMIC.exe
Token: SeSystemtimePrivilege	4948	WMIC.exe
Token: SeProfSingleProcessPrivilege	4948	WMIC.exe
Token: SeIncBasePriorityPrivilege	4948	WMIC.exe
Token: SeCreatePagefilePrivilege	4948	WMIC.exe
Token: SeBackupPrivilege	4948	WMIC.exe
Token: SeRestorePrivilege	4948	WMIC.exe
Token: SeShutdownPrivilege	4948	WMIC.exe
Token: SeDebugPrivilege	4948	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4948	WMIC.exe
Token: SeRemoteShutdownPrivilege	4948	WMIC.exe
Token: SeUndockPrivilege	4948	WMIC.exe
Token: SeManageVolumePrivilege	4948	WMIC.exe
Token: 33	4948	WMIC.exe
Token: 34	4948	WMIC.exe
Token: 35	4948	WMIC.exe
Token: 36	4948	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4948	WMIC.exe
Token: SeSecurityPrivilege	4948	WMIC.exe
Token: SeTakeOwnershipPrivilege	4948	WMIC.exe
Token: SeLoadDriverPrivilege	4948	WMIC.exe
Token: SeSystemProfilePrivilege	4948	WMIC.exe
Token: SeSystemtimePrivilege	4948	WMIC.exe
Token: SeProfSingleProcessPrivilege	4948	WMIC.exe
Token: SeIncBasePriorityPrivilege	4948	WMIC.exe
Token: SeCreatePagefilePrivilege	4948	WMIC.exe
Token: SeBackupPrivilege	4948	WMIC.exe
Token: SeRestorePrivilege	4948	WMIC.exe
Token: SeShutdownPrivilege	4948	WMIC.exe
Token: SeDebugPrivilege	4948	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4948	WMIC.exe
Token: SeRemoteShutdownPrivilege	4948	WMIC.exe
Token: SeUndockPrivilege	4948	WMIC.exe
Token: SeManageVolumePrivilege	4948	WMIC.exe
Token: 33	4948	WMIC.exe
Token: 34	4948	WMIC.exe
Token: 35	4948	WMIC.exe
Token: 36	4948	WMIC.exe
Token: SeBackupPrivilege	640	vssvc.exe
Token: SeRestorePrivilege	640	vssvc.exe
Token: SeAuditPrivilege	640	vssvc.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2604	2176	VirusShare_331767c8a95117a9e51cc47c95afd3a9.exe	84
PID 2176 wrote to memory of 2604	2176	VirusShare_331767c8a95117a9e51cc47c95afd3a9.exe	84
PID 2176 wrote to memory of 2604	2176	VirusShare_331767c8a95117a9e51cc47c95afd3a9.exe	84
PID 2176 wrote to memory of 1912	2176	VirusShare_331767c8a95117a9e51cc47c95afd3a9.exe	85
PID 2176 wrote to memory of 1912	2176	VirusShare_331767c8a95117a9e51cc47c95afd3a9.exe	85
PID 2176 wrote to memory of 1912	2176	VirusShare_331767c8a95117a9e51cc47c95afd3a9.exe	85
PID 2604 wrote to memory of 4948	2604	eaqsvmxpjcgj.exe	87
PID 2604 wrote to memory of 4948	2604	eaqsvmxpjcgj.exe	87
PID 2604 wrote to memory of 2764	2604	eaqsvmxpjcgj.exe	100
PID 2604 wrote to memory of 2764	2604	eaqsvmxpjcgj.exe	100
PID 2604 wrote to memory of 2764	2604	eaqsvmxpjcgj.exe	100
PID 2604 wrote to memory of 2968	2604	eaqsvmxpjcgj.exe	101
PID 2604 wrote to memory of 2968	2604	eaqsvmxpjcgj.exe	101
PID 2968 wrote to memory of 2176	2968	msedge.exe	102
PID 2968 wrote to memory of 2176	2968	msedge.exe	102
PID 2968 wrote to memory of 300	2968	msedge.exe	103
PID 2968 wrote to memory of 300	2968	msedge.exe	103
PID 2968 wrote to memory of 300	2968	msedge.exe	103
PID 2968 wrote to memory of 300	2968	msedge.exe	103
PID 2968 wrote to memory of 300	2968	msedge.exe	103
PID 2968 wrote to memory of 300	2968	msedge.exe	103
PID 2968 wrote to memory of 300	2968	msedge.exe	103
PID 2968 wrote to memory of 300	2968	msedge.exe	103
PID 2968 wrote to memory of 300	2968	msedge.exe	103
PID 2968 wrote to memory of 300	2968	msedge.exe	103
PID 2968 wrote to memory of 300	2968	msedge.exe	103
PID 2968 wrote to memory of 300	2968	msedge.exe	103
PID 2968 wrote to memory of 300	2968	msedge.exe	103
PID 2968 wrote to memory of 300	2968	msedge.exe	103
PID 2968 wrote to memory of 300	2968	msedge.exe	103
PID 2968 wrote to memory of 300	2968	msedge.exe	103
PID 2968 wrote to memory of 300	2968	msedge.exe	103
PID 2968 wrote to memory of 300	2968	msedge.exe	103
PID 2968 wrote to memory of 300	2968	msedge.exe	103
PID 2968 wrote to memory of 300	2968	msedge.exe	103
PID 2968 wrote to memory of 300	2968	msedge.exe	103
PID 2968 wrote to memory of 300	2968	msedge.exe	103
PID 2968 wrote to memory of 300	2968	msedge.exe	103
PID 2968 wrote to memory of 300	2968	msedge.exe	103
PID 2968 wrote to memory of 300	2968	msedge.exe	103
PID 2968 wrote to memory of 300	2968	msedge.exe	103
PID 2968 wrote to memory of 300	2968	msedge.exe	103
PID 2968 wrote to memory of 300	2968	msedge.exe	103
PID 2968 wrote to memory of 300	2968	msedge.exe	103
PID 2968 wrote to memory of 300	2968	msedge.exe	103
PID 2968 wrote to memory of 300	2968	msedge.exe	103
PID 2968 wrote to memory of 300	2968	msedge.exe	103
PID 2968 wrote to memory of 300	2968	msedge.exe	103
PID 2968 wrote to memory of 300	2968	msedge.exe	103
PID 2968 wrote to memory of 300	2968	msedge.exe	103
PID 2968 wrote to memory of 300	2968	msedge.exe	103
PID 2968 wrote to memory of 300	2968	msedge.exe	103
PID 2968 wrote to memory of 300	2968	msedge.exe	103
PID 2968 wrote to memory of 300	2968	msedge.exe	103
PID 2968 wrote to memory of 300	2968	msedge.exe	103
PID 2968 wrote to memory of 2044	2968	msedge.exe	104
PID 2968 wrote to memory of 2044	2968	msedge.exe	104
PID 2968 wrote to memory of 3256	2968	msedge.exe	105
PID 2968 wrote to memory of 3256	2968	msedge.exe	105
PID 2968 wrote to memory of 3256	2968	msedge.exe	105
PID 2968 wrote to memory of 3256	2968	msedge.exe	105
PID 2968 wrote to memory of 3256	2968	msedge.exe	105
PID 2968 wrote to memory of 3256	2968	msedge.exe	105
PID 2968 wrote to memory of 3256	2968	msedge.exe	105

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	eaqsvmxpjcgj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	eaqsvmxpjcgj.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\VirusShare_331767c8a95117a9e51cc47c95afd3a9.exe
"C:\Users\Admin\AppData\Local\Temp\VirusShare_331767c8a95117a9e51cc47c95afd3a9.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\eaqsvmxpjcgj.exe
  C:\Windows\eaqsvmxpjcgj.exe
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2604
- - C:\Windows\System32\wbem\WMIC.exe
    "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4948
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:2764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RECOVERY.HTM
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb166646f8,0x7ffb16664708,0x7ffb16664718
      4⤵
      PID:2176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,7526063028456190658,17516899565589424777,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
      4⤵
      PID:300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,7526063028456190658,17516899565589424777,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
      4⤵
      PID:2044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,7526063028456190658,17516899565589424777,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
      4⤵
      PID:3256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7526063028456190658,17516899565589424777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
      4⤵
      PID:3216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7526063028456190658,17516899565589424777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
      4⤵
      PID:3772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,7526063028456190658,17516899565589424777,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
      4⤵
      PID:2396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,7526063028456190658,17516899565589424777,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
      4⤵
      PID:4048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7526063028456190658,17516899565589424777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
      4⤵
      PID:3344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7526063028456190658,17516899565589424777,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
      4⤵
      PID:2208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7526063028456190658,17516899565589424777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1
      4⤵
      PID:4580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7526063028456190658,17516899565589424777,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
      4⤵
      PID:3016
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\EAQSVM~1.EXE
    3⤵
    PID:520
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE
  2⤵
  PID:1912

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

Recovery+mkbjb.html

Path C:\Program Files\7-Zip\Lang\Recovery+mkbjb.html
Size 9KB
SHA256 1f36d55c1acdaf7d44e1759a88ff6bd3872b855451d9a9e15d6cd74b423f1e48
MD5 45c4f7c22c986d04679907ba3bfd22dd
SHA1 78ad9340dc708649c18c96c3c5a2762cd7e51f47
SHA512 b0e2c0c9d6c9aa81e49498a0f9a0aee15fb594613917cad140a40f7e508a937d004b6226981892dc9525dfae3ce115a2ec6f35bd47b92c97e10e839ed8a8d515
SSDEEP 96:Jm1hpDl1ZiSi9/oVnrm9b5yM3IY5cc2lcS++/FP8mpsJFooQUMGhlYUXaHIOTPyL:UjCH/OrO5fVodKcAioQoh/KxPyL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Recovery+mkbjb.png

Path C:\Program Files\7-Zip\Lang\Recovery+mkbjb.png
Size 68KB
SHA256 1589fa102bfdcb28d125cb41fd8639671176871b818575d7ca7598a21037416e
MD5 ff005b7887bf022e4b77c873ba892c17
SHA1 15dcd2aa89bf21ae18bf8cc34e58eb7c937b211c
SHA512 d6f0e0e723c818f5f18f6b484197edae97270168fd409e2fd1e37b8205d7c392b5da6b768c327eb504e25a1b9f28c6647824dd5909d698101166554891d7d598
SSDEEP 1536:QTu8Q9Unj0ea4zR4tq7uYfC6Feo2wHKNHwIXF38W7o:Q2Unbxz37uq6qIXFsWE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Recovery+mkbjb.txt

Path C:\Program Files\7-Zip\Lang\Recovery+mkbjb.txt
Size 2KB
SHA256 e25233e6c6a086a07559f442adb3ccb428a7c84c170d64c73ddde6bd0e7db176
MD5 f300cbb8e1c7784a9749f56070c2fbe1
SHA1 f8f39a3b805d1ae3f1e0464d9bc1e7252e42ebff
SHA512 f9232f993db85140a58de1e31eca8917a2380edb19135952c83ef12f62c0215e446e705dbafa619c3dbfea7a851e16e404f2732757116c7ff65f4d2fc23e119c
MD5 SHA1 SHA512

Submit Download

THIRDPARTYLICENSEREADME-JAVAFX.txt

Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
Size 560B
SHA256 981309aa27e39587c1cc0451e89b9f7d4cb181af2aa5e8dd1b56565ca14b9219
MD5 7544325a2708075920b2ef925188dbbd
SHA1 f87b3f44710c9de68493118840e7004c0da9eab5
SHA512 18d1c24e5776cb0c33159acd30b46993312ee513119333a36fb74319fce6dc9dec24fb619e1b141a998f1991af330258aebe31d3977b4b927a63b9b7db40d516
MD5 SHA1 SHA512

Submit Download

THIRDPARTYLICENSEREADME.txt

Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
Size 560B
SHA256 e46ff003052d71cf49ba0f5d6a9efa8f1aa014b74b477b6f8a81e72b61c52b4d
MD5 6f5ea00980f5cceab8fa7870df3784a6
SHA1 f37a36e1d6683d2a64aa9b33d84eade92a23022e
SHA512 9400f92ea8ab5721e5535c3fc99939635884ef2df42ebe2fe9f7475354172b20a0a704001fee14e1d79a5014f718766b5aaf532fa56fc0f1a5bdcff20eef0f98
MD5 SHA1 SHA512

Submit Download

ClientSub2019_eula.txt

Path C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
Size 416B
SHA256 7426f06b943b05297fca62b047119dd5e29e00aeb8d4ab9490645f70916a0b7d
MD5 309f076a57fe53bad6adaf928954456c
SHA1 e8a4e0d88020b73b58e874431ae05f1b8b575e50
SHA512 c8017f41dce072bf131af86b62d3a23a883967fc84f35f0a9afeb36e1053bbb08f18252f38885d883e4a34fac724ae8ee7a5ab98839b8f8a8ba1d0f953b9d358
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
MD5 87f7abeb82600e1e640b843ad50fe0a1
SHA1 045bbada3f23fc59941bf7d0210fb160cb78ae87
SHA512 ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
MD5 f61fa5143fe872d1d8f1e9f8dc6544f9
SHA1 df44bab94d7388fb38c63085ec4db80cfc5eb009
SHA512 971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6
MD5 SHA1 SHA512

Submit Download

31a1d51d-fa83-4f18-8978-11b3783f0f6a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\31a1d51d-fa83-4f18-8978-11b3783f0f6a.tmp
Size 6KB
SHA256 78cf710c6d5f19e1bd0fe8c649150ac52abd1ef2b4994b9ac069e14383029875
MD5 0afdc1bad4e66dcad2247e6d987eac05
SHA1 5b01f1e39ce561df5d9bdef189f0a3f99b121273
SHA512 c619efc2390fcf63344ab31aa526b6d87615c90721b339fdf65312a7d685c8701bf81e2e38429831bacae97a77624e5715733af6e578bd90a2cc81e529c213bb
SSDEEP 96:nWksm1Q30wpvWMoiVmdeH/zOHUWQyV+VD7AiEwb:nWkrWkGWMXQrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 9557b822cc10023968791d4043b3c5af2c194f80a24746fa25f58a1c4da7d1ed
MD5 2268fbb82b0ccd0fb299444f9f6feb7d
SHA1 cc20aa8d1c400fcbaa0041452c7dc8d0e6cbeaf3
SHA512 805b9c8150383d69146f06985766937663eca59f59363fed371f18e7ae2e3e1c17c0bc341f8b828f3515a585bda1d3cc104e1b8d084dcafa290fee5c0b803f31
SSDEEP 96:nWkhm1Qv0wpvWMoiVmdeH/zOHUWQyV+VDCziEwb:nWkQW8GWMXQro
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 dfeade22a7abc985a40e3d99db204cdcc730a873a7dd4eb5a8753732730ebace
MD5 b50648dc0cd4f894f58d75ffdd354773
SHA1 a30d4c6977ccf5579512204bc5f2f56764cdc886
SHA512 b4666d87716fc51cf69b8be9f770dbfef2e350a8d3a2bcee67702d4ef28a200a52448922bad0a9c8a213448ca4557ed55ac9fa9f789d3b5515af9c8ba54e4755
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupQv3Qe2RUYd/my13z2OMDCL:A9iIxuERzA83h09RZxY++BV1aOMWRHqU
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133596380552933791.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596380552933791.txt
Size 47KB
SHA256 0c98ffbf6e1974eef63b09e9fefe9e2ba8d4dacf21cf0ca8ba08338ac1dd0fd1
MD5 9fe4ad86c2e0841233524ad9af878928
SHA1 9f54ce16b246254cc093734a939e652969fbda7d
SHA512 76777fbb5507a8bac9a64759391c31a79fa884ad36fae4d1d401175141e536059f30bbf6c45585ed3de52681e90cc3ec47855ab2ccb237ae68746bcefe2c2662
SSDEEP 768:mejeWBJikyzUFJWP0h9avPnYCFgPS7aBM3ogHayP4TuwVHVXxclMsnOb6oO4eocK:fBJikyYTWPEh6gPJBt0P46oHVxclLnO3
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133596395215789431.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596395215789431.txt
Size 75KB
SHA256 66f539d377da386ec2de7b0fb3984c2a695758161fc579aa68cafeda06b5723c
MD5 092e2f650d3b41852f6666556fdfe928
SHA1 143b5e07da348d35915b1ac14dc4af64b628423a
SHA512 fc552721dca444ff22cf01772f1daec255407a8f9d17e65b8e0d08e236562bcbc73cceab2772a9b391bf6fd2b2486fb697d3dd30a78aa913b4629e7f408bd2d5
SSDEEP 1536:MKM3Dz86pEmazI1cIX7aABaPdWKGFNSL/MdlbukxBzPvnAyNYsXqDbJsA:lM3H869GI2+mUaPdWxuczPvnAyNYs4br
MD5 SHA1 SHA512 SSDEEP

Submit Download

eaqsvmxpjcgj.exe

Path C:\Windows\eaqsvmxpjcgj.exe
Size 332KB
SHA256 ceb220b71dabfe1c875dd8a0620226c05dd45adef7e3812c11cd3759d7058070
MD5 331767c8a95117a9e51cc47c95afd3a9
SHA1 7426d13db7f5c0d5ec7c6eca79279c11fd47def9
SHA512 f40dd430b450e8bfe5be7a1d1468330b81ec972d3946c3161e3f22acb5302754889237c8611ab18790ba8e9bcd493aec7fac1a6f18bcadd77d1a64868a5344cf
SSDEEP 6144:iiNEzZL9+eE5WAH4nt5ssWK2NTZ5wV/sRVLtuO/Y5UCyf1KyN8z8+Tl:ZEzZh+eE5WASO7fOV/gN/SyNKyNmBJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2176-0-0x0000000000400000-0x0000000000496000-memory.dmp

Download

memory/2176-14-0x0000000002120000-0x00000000021A6000-memory.dmp

Download

memory/2176-13-0x0000000000400000-0x0000000000496000-memory.dmp

Download

memory/2176-3-0x0000000002120000-0x00000000021A6000-memory.dmp

Download

memory/2604-10381-0x0000000000400000-0x0000000000496000-memory.dmp

Download

memory/2604-8197-0x0000000000400000-0x0000000000496000-memory.dmp

Download

memory/2604-10427-0x0000000000400000-0x0000000000496000-memory.dmp

Download

memory/2604-4748-0x0000000000400000-0x0000000000496000-memory.dmp

Download

memory/2604-2381-0x0000000000400000-0x0000000000496000-memory.dmp

Download

memory/2604-12-0x0000000001FC0000-0x0000000002046000-memory.dmp

Download

memory/2604-10475-0x0000000000400000-0x0000000000496000-memory.dmp

Download