03f81462c6d158453036fedf3e5d3dcd0eef4a5aafd79b5b9379b3df89e4d6fc

Analysis

max time kernel
145s
max time network
146s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10/06/2024, 11:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VirusShare_39028e8653ba4e422599441e49da3d29.exe
Size

444KB
MD5

39028e8653ba4e422599441e49da3d29
SHA1

62071f1ee92eb4e11e39a29b937bd86b9591c1d3
SHA256

03f81462c6d158453036fedf3e5d3dcd0eef4a5aafd79b5b9379b3df89e4d6fc
SHA512

42b31196d6e243c8e71949d820a70324872c87a488826b029d5ed8f57cc45a72dd2e93581cf26a1af6eff4155f3c696f8298265f3c3d185d7570cce0a6e19cb0
SSDEEP

12288:g4irDtSclFJNVKqjhKD2AWU7irDtSclFJN:GrDt7t7lKD2AWUGrDt7

Score

10^/10

defense_evasion evasion execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\how_recover+hkm.txt

Ransom Note

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-4096 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server. What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BTC NOW, and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://k5fxm4dl35qk323d.justmakeapayment.com/CE50D119CBF6074 2. http://vr6g2curb2kcidou.expay34.com/CE50D119CBF6074 3. http://tsbfdsv.extr6mchf.com/CE50D119CBF6074 4. https://o7zeip6us33igmgw.onion.to/CE50D119CBF6074 5. https://o7zeip6us33igmgw.tor2web.org/CE50D119CBF6074 6. https://o7zeip6us33igmgw.onion.cab/CE50D119CBF6074 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser and wait for initialization. 3. Type in the address bar: o7zeip6us33igmgw.onion/CE50D119CBF6074 4. Follow the instructions on the site. IMPORTANT INFORMATION: Your personal pages: http://k5fxm4dl35qk323d.justmakeapayment.com/CE50D119CBF6074 http://vr6g2curb2kcidou.expay34.com/CE50D119CBF6074 http://tsbfdsv.extr6mchf.com/CE50D119CBF6074 https://o7zeip6us33igmgw.onion.to/CE50D119CBF6074 Your personal page (using TOR-Browser): o7zeip6us33igmgw.onion/CE50D119CBF6074 Your personal identification number (if you open the site (or TOR-Browser's) directly): CE50D119CBF6074 !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

URLs

http://k5fxm4dl35qk323d.justmakeapayment.com/CE50D119CBF6074

http://vr6g2curb2kcidou.expay34.com/CE50D119CBF6074

http://tsbfdsv.extr6mchf.com/CE50D119CBF6074

https://o7zeip6us33igmgw.onion.to/CE50D119CBF6074

https://o7zeip6us33igmgw.tor2web.org/CE50D119CBF6074

https://o7zeip6us33igmgw.onion.cab/CE50D119CBF6074

http://o7zeip6us33igmgw.onion/CE50D119CBF6074

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 5 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2176	bcdedit.exe
1988	bcdedit.exe
2704	bcdedit.exe
2452	bcdedit.exe
1952	bcdedit.exe

Renames multiple (436) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Deletes itself 1 IoCs

pid	Process
2716	cmd.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\how_recover+hkm.txt	fttokacroic.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\how_recover+hkm.html	fttokacroic.exe

Executes dropped EXE 2 IoCs

pid	Process
2640	fttokacroic.exe
2624	fttokacroic.exe

Loads dropped DLL 1 IoCs

pid	Process
2720	VirusShare_39028e8653ba4e422599441e49da3d29.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\Acrndtd = "C:\\Users\\Admin\\AppData\\Roaming\\fttokacroic.exe"	fttokacroic.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	myexternalip.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1744 set thread context of 2720	1744	VirusShare_39028e8653ba4e422599441e49da3d29.exe	28
PID 2640 set thread context of 2624	2640	fttokacroic.exe	34

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Sidebar\it-IT\how_recover+hkm.html	fttokacroic.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\how_recover+hkm.html	fttokacroic.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\how_recover+hkm.html	fttokacroic.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_ButtonGraphic.png	fttokacroic.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer_m.png	fttokacroic.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\720x480icongraphic.png	fttokacroic.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask.wmv	fttokacroic.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\es-ES\how_recover+hkm.html	fttokacroic.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer_dot.png	fttokacroic.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\how_recover+hkm.txt	fttokacroic.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\how_recover+hkm.html	fttokacroic.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\how_recover+hkm.txt	fttokacroic.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\how_recover+hkm.html	fttokacroic.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\how_recover+hkm.html	fttokacroic.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_ButtonGraphic.png	fttokacroic.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bPrev-disable.png	fttokacroic.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_left.png	fttokacroic.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\videowall.png	fttokacroic.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\how_recover+hkm.txt	fttokacroic.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\RSSFeeds.css	fttokacroic.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_SelectionSubpicture.png	fttokacroic.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\how_recover+hkm.html	fttokacroic.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\how_recover+hkm.html	fttokacroic.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\highDpiImageSwap.js	fttokacroic.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	fttokacroic.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\how_recover+hkm.html	fttokacroic.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\clock.js	fttokacroic.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\skins\how_recover+hkm.html	fttokacroic.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\flyout_background.png	fttokacroic.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\it-IT\how_recover+hkm.html	fttokacroic.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\vi\how_recover+hkm.txt	fttokacroic.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_m.png	fttokacroic.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\how_recover+hkm.txt	fttokacroic.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\skins\how_recover+hkm.txt	fttokacroic.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\how_recover+hkm.html	fttokacroic.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	fttokacroic.exe
File opened for modification	C:\Program Files\PopAdd.avi	fttokacroic.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lt\how_recover+hkm.html	fttokacroic.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\how_recover+hkm.txt	fttokacroic.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_20_666666_40x40.png	fttokacroic.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\css\calendar.css	fttokacroic.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_right_mouseout.png	fttokacroic.exe
File opened for modification	C:\Program Files\Common Files\System\ado\ja-JP\how_recover+hkm.txt	fttokacroic.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_SelectionSubpicture.png	fttokacroic.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoDev.png	fttokacroic.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\how_recover+hkm.html	fttokacroic.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bg-today.png	fttokacroic.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\how_recover+hkm.txt	fttokacroic.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_corner_top_left.png	fttokacroic.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\divider-vertical.png	fttokacroic.exe
File opened for modification	C:\Program Files\Google\Chrome\how_recover+hkm.txt	fttokacroic.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\how_recover+hkm.txt	fttokacroic.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\en-US\how_recover+hkm.txt	fttokacroic.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\how_recover+hkm.html	fttokacroic.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\how_recover+hkm.html	fttokacroic.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\how_recover+hkm.txt	fttokacroic.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\how_recover+hkm.txt	fttokacroic.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\library.js	fttokacroic.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\da.pak	fttokacroic.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\how_recover+hkm.txt	fttokacroic.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\it-IT\how_recover+hkm.txt	fttokacroic.exe
File opened for modification	C:\Program Files\MSBuild\how_recover+hkm.txt	fttokacroic.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\how_recover+hkm.txt	fttokacroic.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\how_recover+hkm.html	fttokacroic.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
1412	vssadmin.exe
1788	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000002eb6a06062c9262e106bdc9d8b72a38c03e56a0ba3b2ed336916d49de8bfbaec000000000e80000000020000200000001f4231b2f7e1b64d995d9b583e34021e8146890cf29f2713d4bc2739288b863320000000e94f84a34a07f4b668d37f55a428cd94dc733c67875031c871601a8b4fa9729a40000000c91e965c84e79328bfc48c42853be958779021f574a2566bba6d392145018154368185a62f27f92275f4487d855be8ff2b665e50bc14e5a2bcce6a577348d12d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{54131641-271B-11EF-8F47-7A4B76010719} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00cf982828bbda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000007973ba5b7512c841886efdec37181c4939bfccd28423b4640e9a3c83384de2f7000000000e8000000002000020000000fae44815ada783740c7faf52ae1a8771e5853d7c9d9bc104b9235f45c75dfbe990000000b55f7496004266b9a05bfa61d79ddda99ece4f556fe01f6fe21806026e724532808fa5859cded6def6d0c98615382d660d916bc6ca9cd41b8384a5701243f29770277cec522028d074b5432117617ad882add2c32e34804d2a8f0614a355cfd9a207e67dc75c7dd371ef18b4cf2cd7720e7b1042f8941b58d20ece7e282e2ec325774d1e9234e4e65e43e36b6ee7f0de40000000e95eedc7733bc8f4d3b2c87bef97f03b297b2bccb5e32b0fa28e2fa7168442b06f353555520a851df76bc5b0f89054edfd7de1faaff609747cef17c490f0673b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424180247"	iexplore.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1136	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe
2624	fttokacroic.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2720	VirusShare_39028e8653ba4e422599441e49da3d29.exe
Token: SeDebugPrivilege	2624	fttokacroic.exe
Token: SeBackupPrivilege	2236	vssvc.exe
Token: SeRestorePrivilege	2236	vssvc.exe
Token: SeAuditPrivilege	2236	vssvc.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
960	iexplore.exe
832	DllHost.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1744	VirusShare_39028e8653ba4e422599441e49da3d29.exe
2640	fttokacroic.exe
960	iexplore.exe
960	iexplore.exe
1352	IEXPLORE.EXE
1352	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 2720	1744	VirusShare_39028e8653ba4e422599441e49da3d29.exe	28
PID 1744 wrote to memory of 2720	1744	VirusShare_39028e8653ba4e422599441e49da3d29.exe	28
PID 1744 wrote to memory of 2720	1744	VirusShare_39028e8653ba4e422599441e49da3d29.exe	28
PID 1744 wrote to memory of 2720	1744	VirusShare_39028e8653ba4e422599441e49da3d29.exe	28
PID 1744 wrote to memory of 2720	1744	VirusShare_39028e8653ba4e422599441e49da3d29.exe	28
PID 1744 wrote to memory of 2720	1744	VirusShare_39028e8653ba4e422599441e49da3d29.exe	28
PID 1744 wrote to memory of 2720	1744	VirusShare_39028e8653ba4e422599441e49da3d29.exe	28
PID 1744 wrote to memory of 2720	1744	VirusShare_39028e8653ba4e422599441e49da3d29.exe	28
PID 1744 wrote to memory of 2720	1744	VirusShare_39028e8653ba4e422599441e49da3d29.exe	28
PID 1744 wrote to memory of 2720	1744	VirusShare_39028e8653ba4e422599441e49da3d29.exe	28
PID 1744 wrote to memory of 2720	1744	VirusShare_39028e8653ba4e422599441e49da3d29.exe	28
PID 2720 wrote to memory of 2640	2720	VirusShare_39028e8653ba4e422599441e49da3d29.exe	29
PID 2720 wrote to memory of 2640	2720	VirusShare_39028e8653ba4e422599441e49da3d29.exe	29
PID 2720 wrote to memory of 2640	2720	VirusShare_39028e8653ba4e422599441e49da3d29.exe	29
PID 2720 wrote to memory of 2640	2720	VirusShare_39028e8653ba4e422599441e49da3d29.exe	29
PID 2720 wrote to memory of 2716	2720	VirusShare_39028e8653ba4e422599441e49da3d29.exe	30
PID 2720 wrote to memory of 2716	2720	VirusShare_39028e8653ba4e422599441e49da3d29.exe	30
PID 2720 wrote to memory of 2716	2720	VirusShare_39028e8653ba4e422599441e49da3d29.exe	30
PID 2720 wrote to memory of 2716	2720	VirusShare_39028e8653ba4e422599441e49da3d29.exe	30
PID 2640 wrote to memory of 2624	2640	fttokacroic.exe	34
PID 2640 wrote to memory of 2624	2640	fttokacroic.exe	34
PID 2640 wrote to memory of 2624	2640	fttokacroic.exe	34
PID 2640 wrote to memory of 2624	2640	fttokacroic.exe	34
PID 2640 wrote to memory of 2624	2640	fttokacroic.exe	34
PID 2640 wrote to memory of 2624	2640	fttokacroic.exe	34
PID 2640 wrote to memory of 2624	2640	fttokacroic.exe	34
PID 2640 wrote to memory of 2624	2640	fttokacroic.exe	34
PID 2640 wrote to memory of 2624	2640	fttokacroic.exe	34
PID 2640 wrote to memory of 2624	2640	fttokacroic.exe	34
PID 2640 wrote to memory of 2624	2640	fttokacroic.exe	34
PID 2624 wrote to memory of 2176	2624	fttokacroic.exe	35
PID 2624 wrote to memory of 2176	2624	fttokacroic.exe	35
PID 2624 wrote to memory of 2176	2624	fttokacroic.exe	35
PID 2624 wrote to memory of 2176	2624	fttokacroic.exe	35
PID 2624 wrote to memory of 1412	2624	fttokacroic.exe	37
PID 2624 wrote to memory of 1412	2624	fttokacroic.exe	37
PID 2624 wrote to memory of 1412	2624	fttokacroic.exe	37
PID 2624 wrote to memory of 1412	2624	fttokacroic.exe	37
PID 2624 wrote to memory of 1988	2624	fttokacroic.exe	41
PID 2624 wrote to memory of 1988	2624	fttokacroic.exe	41
PID 2624 wrote to memory of 1988	2624	fttokacroic.exe	41
PID 2624 wrote to memory of 1988	2624	fttokacroic.exe	41
PID 2624 wrote to memory of 2704	2624	fttokacroic.exe	43
PID 2624 wrote to memory of 2704	2624	fttokacroic.exe	43
PID 2624 wrote to memory of 2704	2624	fttokacroic.exe	43
PID 2624 wrote to memory of 2704	2624	fttokacroic.exe	43
PID 2624 wrote to memory of 2452	2624	fttokacroic.exe	45
PID 2624 wrote to memory of 2452	2624	fttokacroic.exe	45
PID 2624 wrote to memory of 2452	2624	fttokacroic.exe	45
PID 2624 wrote to memory of 2452	2624	fttokacroic.exe	45
PID 2624 wrote to memory of 1952	2624	fttokacroic.exe	47
PID 2624 wrote to memory of 1952	2624	fttokacroic.exe	47
PID 2624 wrote to memory of 1952	2624	fttokacroic.exe	47
PID 2624 wrote to memory of 1952	2624	fttokacroic.exe	47
PID 2624 wrote to memory of 1136	2624	fttokacroic.exe	52
PID 2624 wrote to memory of 1136	2624	fttokacroic.exe	52
PID 2624 wrote to memory of 1136	2624	fttokacroic.exe	52
PID 2624 wrote to memory of 1136	2624	fttokacroic.exe	52
PID 2624 wrote to memory of 960	2624	fttokacroic.exe	53
PID 2624 wrote to memory of 960	2624	fttokacroic.exe	53
PID 2624 wrote to memory of 960	2624	fttokacroic.exe	53
PID 2624 wrote to memory of 960	2624	fttokacroic.exe	53
PID 960 wrote to memory of 1352	960	iexplore.exe	54
PID 960 wrote to memory of 1352	960	iexplore.exe	54

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	fttokacroic.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	fttokacroic.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\VirusShare_39028e8653ba4e422599441e49da3d29.exe
"C:\Users\Admin\AppData\Local\Temp\VirusShare_39028e8653ba4e422599441e49da3d29.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Users\Admin\AppData\Local\Temp\VirusShare_39028e8653ba4e422599441e49da3d29.exe
  "C:\Users\Admin\AppData\Local\Temp\VirusShare_39028e8653ba4e422599441e49da3d29.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Users\Admin\AppData\Roaming\fttokacroic.exe
    C:\Users\Admin\AppData\Roaming\fttokacroic.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2640
  - - C:\Users\Admin\AppData\Roaming\fttokacroic.exe
      C:\Users\Admin\AppData\Roaming\fttokacroic.exe
      4⤵
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2624
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit.exe /set {current} bootems off
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2176
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
        5⤵
        Interacts with shadow copies
        
        PID:1412
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit.exe /set {current} advancedoptions off
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1988
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit.exe /set {current} optionsedit off
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2704
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2452
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit.exe /set {current} recoveryenabled off
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1952
    - - C:\Windows\SysWOW64\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Howto_Restore_FILES.TXT
        5⤵
        Opens file in notepad (likely ransom note)
        
        PID:1136
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\Howto_Restore_FILES.HTM
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:960
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:960 CREDAT:275457 /prefetch:2
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1352
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
        5⤵
        Interacts with shadow copies
        
        PID:1788
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Roaming\FTTOKA~1.EXE
        5⤵
        
        PID:2308
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE
    3⤵
    - Deletes itself
    PID:2716

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2236

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\how_recover+hkm.html

Filesize
10KB

MD5
862ced7c2716c8984a4fc78890e23ef5

SHA1
3b0a7be04cc99f4e5b019a62195896694adfda88

SHA256
91a06e1e97fff8af70bc5f76e6f4787bc2689429d75674609005856ceec137d1

SHA512
ad689fcb43e298656e060d7d4519c280976f04cc57195ee4bfeadf14d30dd2a5dce9ead44e0571701d80ee955e932ec9d39dbb6d891edcafc93db4e5f6179fbe

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\how_recover+hkm.txt

Filesize
2KB

MD5
ecf418ea3e73b0657d65d32cb037787d

SHA1
7da98371e63d99e2bd4fb712ced36f85afea1c69

SHA256
19071e63ef0fac87b96740423637deec07e11f9c188f7e181b85c2486d0dffad

SHA512
0bd94c7ecab7ae901e6de98526936726b4d65341a831edee730099e6a1a2c168a9ea5a1479126889b62beda5e7120d38642923408e08d162055375be9048656b

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
13d3b39dd3e90454943fb9084f5ffa30

SHA1
6fedc8524ffe8f1f099b5cbdea3e1ff6da3d6cff

SHA256
1f6f048f93ef2d7f092a0b21718f69f7a8e5e0619ea3dc6eda9cab4f400b036c

SHA512
a3998cb26ad3ea62dd98b7e1eadc7414a6dca076bca1027fc6dd0f3deb9fda359f0053f09a449bf4bdfdb743b615f8038b81823388dcb2e977db23faf093dee0

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
ba851d415bdf760987396308f98074d0

SHA1
1433cbb1992582d621a87b6653aa4bf9f3718353

SHA256
8824087965e892b06f2c5f32dd0ccff4e87115b4622849e8203a7014e8d5a242

SHA512
4db621d8a7d7fc8f254798a719b433743724bd1f4230e3eb015f8b05a851c2fbfa4ac740730d4810211388e269f77ce27ba2ae566f373363a67030792fccfc68

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
173KB

MD5
9afd1b0f269594abf5261af2b3d23ae7

SHA1
f7a25da570662c44c28b788e354cec45a4449105

SHA256
20cc9cc005efc1be5d123018a7b04c5359887d70cdf5833cbb24aef3edfb3e4c

SHA512
2c3e21046779cc257f3798221a8b6e80d898ca6969223906598f5892207df6537c222a50adbef8f88363b8af0776f7dbad77d76f37f39da9629130faa4fb73dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
335fa65847826df0d5f11c5b43373077

SHA1
098bb08c23b6c88eff27abb3ec31f8f377628beb

SHA256
1d11fd8c085ac92c4393e42967c7c61c19c417ed873ec5e984ab47d83105a995

SHA512
27155d3c3fd74a1c668fb08879d3318d7878bae996582d8a80198f2952aff9b878c037c326fe1c3aed7d5076b575d6347f2b9cd5cc3fe592afe9dc1f95a18dee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6bbdd96f0ff09845cceeda45e5214132

SHA1
c647459f7ded5cec85787b23b638ef23fef1a03e

SHA256
3b1510266e8519a1b97cb1036d8a844e36f4956f0b1df64e4bb7dbf84fdb79bb

SHA512
d67b43b329d76e742a11649fe8bd5ae1cd40af24fbcbe21317a859b25591c6ac064ed53fbba4386fc822622df53268bb49a1e600c9c2f6ce05b3916679571fdf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33f104a6b620bb9c1ebf23445117fd88

SHA1
c86e2b1e09601967b9d9ccb88887860ae2cb50db

SHA256
d41e89e400aaae17d4d0e3b3f369a552c95a8d26dc9ab6a5e03d4ec118bdb0e8

SHA512
06adc32bee15fb123b1b821f17fb149c60cb7c0b599e5c978990080ed5738a48dd042fd631d49cbcc66e5dee414dd9f52b14cfe4b01d7f8251207664978dd0e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
14fcf2ea1cc31e3ebf88671a6fb2aea6

SHA1
4e7326060b8c962e623d6fa655a07090da1318b4

SHA256
55301af77abfec6bb98fe5c0ccda72f266b6d70913a34aab21b93a99c992a811

SHA512
87a08c5363e442ed4d5c8c3840b0a97419bb0d75c02d9dafd47b0e44b3530cc172184fc97452145514505550b426f2e553a1a5edaaf4698bb223abb3fcfe30fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f9e57662428f71e4d678a73240ba242

SHA1
ef036f375a32abced0c53ce8f93ed10ce54856e4

SHA256
031bcf52b6ea8aff50c57e3d42f89ec3b1818ae1aaf10e45c469486103bf87ab

SHA512
0c2385a64b85ab7b19a6cf116e7b5f9f25cc002e396f8b08b1e839c2183b6b317cdd80d91781a64db49915859b7fc320426396d5573ee1f63bbd6a0aeaf8e56d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
187492a1020db64b1e90e404b897b743

SHA1
7ecd55fc8298026b2f267847d3731327094eefd8

SHA256
922d52d24757ac365e950c977e7fef7b5d0be68bf400701c754be32c70ab0001

SHA512
c02a1e8b22e03e7139d11f88254ff47aa37bd95a0faedf6c2d098ba910de5101aa275a63c831d9eb026002141fb54a27280ec02025efb2c73bda0a863647a092

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2746fb5988a269fd2afb37aca82b60f3

SHA1
1a20b739b3162d940c112775dbe3fbf50d964fd4

SHA256
d453d52342c28dff0c70c7d9bbdd199f734a0838ce8d28fcaac7c5542a4ee5fa

SHA512
57215058461cb274be615eb4e509f0f12994de68627735361b950023e666b2ccadf70aa1ba3da72b698dbc66f48984c8a2b9370a20bb94141560a69f1c592b32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13ddea094bdaea3f8998049ad316e71e

SHA1
fe9a724052e646f72b53c3b8cdc6751fe3cea847

SHA256
2a1b6da212dafb12f770566daa9ff174b25a7cba4811c9541bc7771b06a5262a

SHA512
09cb39d6052b56adeddc256a641acde474f4c9a9acab5fd108554445a45a4f7979314f6663e09afd5821d11999ce0a22e9346eca15a2cc4fa3f8ef8f2491c197

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71a96b79b8033865b7a6d7d19963e565

SHA1
cd633b43861d1e380a77648f96576e13bbd8a8f8

SHA256
8110ccf0881e607a231791db6fb022d5985e92b3a9af487cda37b82642f25c14

SHA512
69dc9f844d8bb6421b9a91f9bf562334f9e12a21ae309b03be0c65553f3046cc677ef5a3341a1c64125ba0f379a6266aa3f2cb45427cceba1ca6f8e84e037dec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
456a01e68f894f62c405b1dbded02c0f

SHA1
798f3c3df1dc5ce06139247d0f076bb5c92e4e02

SHA256
3a5a833093f12c87868854815bb188f1afdec603d06aedf6056bcbcac33b8e12

SHA512
287adaf6b1308c6aca0ade2774a5b5ea3b91cd282276cfa17c7ecfd424afc175c8a961054b7faf12a33c799526051d07057c1ed914516f36fa3efa15ed192c77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3677354cc81fa9304e71c974ec6cd478

SHA1
2da2546692342863bdb663072d637eb471ebaf9f

SHA256
179d1a2525e59d1b4695f03ed23d7bfc099c4705f7fd9674930ed48f87539abe

SHA512
7bd86819876e4b8e5ff95234629acf6eb42a81b02ce66140dac3427c41a7ca6f1aa9755eb29233648ef3dfa26d823e923645d39acfb4cc1cff92b2f1f01c3e63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f268c6407056e1dc124174f096d4783

SHA1
96404d53b78f74c52d450cffa96a41aae2b1d4eb

SHA256
cb428bad186c5827f74dc42b5bf6adcea2e3a4db552f07c8d9d64de8fd6916c6

SHA512
e332256b730659ca91950f97e890d831085be08a45b46eba72cd0227cb563b04288094003596f5263bfc0b04d1ae8109633c43048c55c0c91dfdecdd59216a0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f480a2471bcd83ffc99d523f794bd6c

SHA1
a561180629e8b3583aa4bb40d0b7ce4e4558d485

SHA256
4c687d82cc7725ec96dc908eff94bf75d6eac8f60aa45421c64389c4e876dc10

SHA512
4b9a89eb62c147d7d288c713823b382c9d53b54c6e854f5bba2b62cff44584374972d05aa12417a8de8e9e881f649ac77289f9191a80db7cb592b9cb286abe2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3c23814180815ef1eee67f5172cbbf0

SHA1
e788b73610e7fe322601fbbb942f031616bab650

SHA256
e7b58643afd2b02cae95c56893f6656148b7d25d64a67186abfb8541115acbbb

SHA512
29c91018bba3c52439876cc9c8cf279d5fde3a3244900864f3f712a73da4260b39828fdef70b3c98ffb54b91d7f3dc5e832fc09a119464074c09cb5e5a166259

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7af2930757e594d8872dccf279f13d0e

SHA1
0a96cb9db46cd2f29cdc76b1c8d28b03bfd607d8

SHA256
1d1a7ae2cc383ee1a3350044babdea9200fa45fc89cd0ba40dc0a3dd9683daec

SHA512
6616a01538845246d30a17bb531b6e5ced3fed9576662d5d1be08d2c070ead95c1ae3d8b7b0efb17e276975cc31cb44d6fe50be70920c9abaf4308189eb1d6d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29b6de3b5f64b83e1a268f025d799c46

SHA1
605be8aaf90207b8c59fe1c7c7dbb998d94f1c80

SHA256
8a9f80929420dd68bcba7f8f98b8eb9fa2c5d8174cfcf5538a4d17b33931d43f

SHA512
652f334c2ba55a1feda3cb8ecf8d99c60854231518c7206265626675b07f00202ef2dffaa33c13d8aa78c60314dba4e8fb2919df43d722f11e37d986574b06fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
118838c7599fd006770d5642a89a371d

SHA1
0b3ff75d58b66e93d40a78b0af4cb2dda8325dd1

SHA256
a3083eadbfacaed49615d389430e047c9b534298e2f89421a8dd4da46ef2f3ce

SHA512
985c8d790ec69d1fb4ead30466945e6acd678df98b016b29c10c92ae9e74c98f7cbd48181d4fee6352cf23b5a2aa24951d78a71fb992e1647536e2df6162b17d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6399fcc61fde342eed54e92aa541b940

SHA1
e6ff1e5d71d223fb10b2afa274bd8c851f449096

SHA256
5b11b85d8b147f0f6da9fcfabd81d0088f42a37662538054ee263d60fb8fc732

SHA512
94c7d6c3dc16e88ddbb3e586abcc07c9604918d6fe60d372ea1c4e5b18deb4a7167c6e29aae74238fe1e7ac8cb9ce1f391099be5e60a65dbda0aa43d0e283afe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab655B.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar660D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\Desktop\Howto_Restore_FILES.BMP

Filesize
3.3MB

MD5
1174f1a99b2d3f5785f0b0ff6118318c

SHA1
c704d7200ed194d8ebb7e29aadce5a13cb463f26

SHA256
d07d874ef848e9d56bfff510a65b53ce085bb5595b4a68510379b0dcc88e990d

SHA512
4bbdc738be8d41e7caf1d4f1aab71f4b5583049e038a82f6e13e096445398f13a6b298cab425acb4b37e23d1231df85bb22bd6dc26c5d3442094cf55fcd3d6e2

Download Submit
\Users\Admin\AppData\Roaming\fttokacroic.exe

Filesize
444KB

MD5
39028e8653ba4e422599441e49da3d29

SHA1
62071f1ee92eb4e11e39a29b937bd86b9591c1d3

SHA256
03f81462c6d158453036fedf3e5d3dcd0eef4a5aafd79b5b9379b3df89e4d6fc

SHA512
42b31196d6e243c8e71949d820a70324872c87a488826b029d5ed8f57cc45a72dd2e93581cf26a1af6eff4155f3c696f8298265f3c3d185d7570cce0a6e19cb0

Download Submit
memory/832-4386-0x0000000000160000-0x0000000000162000-memory.dmp

Filesize
8KB

Download
memory/1744-16-0x0000000000270000-0x0000000000273000-memory.dmp

Filesize
12KB

Download
memory/1744-0-0x0000000000270000-0x0000000000273000-memory.dmp

Filesize
12KB

Download
memory/2624-4378-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/2624-4389-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/2624-4388-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/2624-4395-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/2624-4392-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/2624-4385-0x0000000003470000-0x0000000003472000-memory.dmp

Filesize
8KB

Download
memory/2624-3044-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/2624-967-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/2624-53-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/2624-54-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/2624-50-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/2624-47-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/2624-49-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/2640-48-0x0000000000400000-0x000000000056A000-memory.dmp

Filesize
1.4MB

Download
memory/2640-25-0x0000000000400000-0x000000000056A000-memory.dmp

Filesize
1.4MB

Download
memory/2720-28-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/2720-19-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/2720-1-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/2720-3-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/2720-9-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/2720-11-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/2720-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2720-18-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/2720-15-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/2720-7-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/2720-5-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download