teslacrypt | 006cb9242e9c08db01fcfedf3c1ec11e0e5e8178e07b6836154ad62fd5b64786

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 12:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

006cb9242e9c08db01fcfedf3c1ec11e0e5e8178e07b6836154ad62fd5b64786_NeikiAnalytics.exe
Size

553KB
MD5

f7030b13576de49beebb29da2d5c8890
SHA1

26ccbc9c36c030258d5e38d59bf09423e5204750
SHA256

006cb9242e9c08db01fcfedf3c1ec11e0e5e8178e07b6836154ad62fd5b64786
SHA512

a29d7264c3040a04ca036641295670ca7c6678ad8b2092153c51acbf9cd91e05f273d0c7926f07f05d8569eb4e49d64bb3d2d31dd7741aea49aa5c2f5c9b38c6
SSDEEP

6144:oGyrwsYlcsaBx6ukx409hRpC75c7bx7+AeEgYXuRrPXCWvFza:bqwsYlc9jQ4cRA7W7bxqAeEgY+Zzvda

Score

10^/10

teslacrypt defense_evasion execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_ReCoVeRy_+dkvgx.txt

Family

teslacrypt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA4096 More information about the encryption keys using RSA4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA4096 Key , both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So , there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1 - http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/4A806A3B1ACF67B8 2 - http://gfkuwflbhsjdabnu4nfukerfqwlfwr4rw.ringbalor.com/4A806A3B1ACF67B8 3 - http://oehknf74ohqlfnpq9rhfgcq93g.hateflux.com/4A806A3B1ACF67B8 If for some reasons the addresses are not available, follow these steps: 1 - Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2 - After a successful installation, run the browser 3 - Type in the address bar: xlowfznrg4wf7dli.onion/4A806A3B1ACF67B8 4 - Follow the instructions on the site IMPORTANT INFORMATION Your personal pages http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/4A806A3B1ACF67B8 http://gfkuwflbhsjdabnu4nfukerfqwlfwr4rw.ringbalor.com/4A806A3B1ACF67B8 http://oehknf74ohqlfnpq9rhfgcq93g.hateflux.com/4A806A3B1ACF67B8 Your personal page Tor-Browser xlowfznrg4wf7dli.ONION/4A806A3B1ACF67B8

URLs

http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/4A806A3B1ACF67B8

http://gfkuwflbhsjdabnu4nfukerfqwlfwr4rw.ringbalor.com/4A806A3B1ACF67B8

http://oehknf74ohqlfnpq9rhfgcq93g.hateflux.com/4A806A3B1ACF67B8

http://xlowfznrg4wf7dli.ONION/4A806A3B1ACF67B8

Signatures

TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
ransomware teslacrypt
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (375) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2660 cmd.exe

pid	process
2660	cmd.exe

Drops startup file 3 IoCs

Processes:

aceqjoiveyet.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_ReCoVeRy_+dkvgx.png	aceqjoiveyet.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_ReCoVeRy_+dkvgx.txt	aceqjoiveyet.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_ReCoVeRy_+dkvgx.html	aceqjoiveyet.exe

Executes dropped EXE 1 IoCs

Processes:

aceqjoiveyet.exe

pid process

3040 aceqjoiveyet.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

aceqjoiveyet.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\wpkkgxh = "C:\\Windows\\system32\\CMD.EXE /c start C:\\Windows\\aceqjoiveyet.exe"	aceqjoiveyet.exe

Drops file in Program Files directory 64 IoCs

Processes:

aceqjoiveyet.exe

description	ioc	process
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha2.png	aceqjoiveyet.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\_ReCoVeRy_+dkvgx.txt	aceqjoiveyet.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\_ReCoVeRy_+dkvgx.html	aceqjoiveyet.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\_ReCoVeRy_+dkvgx.png	aceqjoiveyet.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_win7.css	aceqjoiveyet.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\_ReCoVeRy_+dkvgx.txt	aceqjoiveyet.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_scene.wmv	aceqjoiveyet.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\_ReCoVeRy_+dkvgx.png	aceqjoiveyet.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\css\settings.css	aceqjoiveyet.exe
File opened for modification	C:\Program Files\Common Files\System\ado\_ReCoVeRy_+dkvgx.html	aceqjoiveyet.exe
File opened for modification	C:\Program Files\Microsoft Games\More Games\_ReCoVeRy_+dkvgx.html	aceqjoiveyet.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\am_ET\LC_MESSAGES\_ReCoVeRy_+dkvgx.png	aceqjoiveyet.exe
File opened for modification	C:\Program Files\Windows Journal\en-US\_ReCoVeRy_+dkvgx.png	aceqjoiveyet.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\en-US\_ReCoVeRy_+dkvgx.html	aceqjoiveyet.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ps\_ReCoVeRy_+dkvgx.png	aceqjoiveyet.exe
File opened for modification	C:\Program Files\Windows Journal\Templates\_ReCoVeRy_+dkvgx.html	aceqjoiveyet.exe
File opened for modification	C:\Program Files\Windows Sidebar\fr-FR\_ReCoVeRy_+dkvgx.txt	aceqjoiveyet.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\26.png	aceqjoiveyet.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	aceqjoiveyet.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\fr-FR\_ReCoVeRy_+dkvgx.png	aceqjoiveyet.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\af\_ReCoVeRy_+dkvgx.html	aceqjoiveyet.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\_ReCoVeRy_+dkvgx.html	aceqjoiveyet.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VGX\_ReCoVeRy_+dkvgx.png	aceqjoiveyet.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_left_disabled.png	aceqjoiveyet.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\_ReCoVeRy_+dkvgx.txt	aceqjoiveyet.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\_ReCoVeRy_+dkvgx.txt	aceqjoiveyet.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\_ReCoVeRy_+dkvgx.png	aceqjoiveyet.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ff\_ReCoVeRy_+dkvgx.html	aceqjoiveyet.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_flat_10_000000_40x100.png	aceqjoiveyet.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\_ReCoVeRy_+dkvgx.png	aceqjoiveyet.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\_ReCoVeRy_+dkvgx.txt	aceqjoiveyet.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_down_BIDI.png	aceqjoiveyet.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\_ReCoVeRy_+dkvgx.png	aceqjoiveyet.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\_ReCoVeRy_+dkvgx.txt	aceqjoiveyet.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\_ReCoVeRy_+dkvgx.html	aceqjoiveyet.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\_ReCoVeRy_+dkvgx.html	aceqjoiveyet.exe
File opened for modification	C:\Program Files\7-Zip\Lang\_ReCoVeRy_+dkvgx.html	aceqjoiveyet.exe
File opened for modification	C:\Program Files\VideoLAN\_ReCoVeRy_+dkvgx.txt	aceqjoiveyet.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\_ReCoVeRy_+dkvgx.png	aceqjoiveyet.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_ButtonGraphic.png	aceqjoiveyet.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\39.png	aceqjoiveyet.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\_ReCoVeRy_+dkvgx.png	aceqjoiveyet.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\id\_ReCoVeRy_+dkvgx.txt	aceqjoiveyet.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\_ReCoVeRy_+dkvgx.txt	aceqjoiveyet.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\20.png	aceqjoiveyet.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Notes_PAL.wmv	aceqjoiveyet.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winClassicHandle.png	aceqjoiveyet.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ja\_ReCoVeRy_+dkvgx.png	aceqjoiveyet.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg	aceqjoiveyet.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\blafdoc.css	aceqjoiveyet.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\css\_ReCoVeRy_+dkvgx.txt	aceqjoiveyet.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_divider.png	aceqjoiveyet.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\gu\_ReCoVeRy_+dkvgx.png	aceqjoiveyet.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\_ReCoVeRy_+dkvgx.png	aceqjoiveyet.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\_ReCoVeRy_+dkvgx.html	aceqjoiveyet.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\_ReCoVeRy_+dkvgx.html	aceqjoiveyet.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bs\_ReCoVeRy_+dkvgx.png	aceqjoiveyet.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\_ReCoVeRy_+dkvgx.txt	aceqjoiveyet.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\reveal_hov.png	aceqjoiveyet.exe
File opened for modification	C:\Program Files\Common Files\System\ja-JP\_ReCoVeRy_+dkvgx.txt	aceqjoiveyet.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\reflect.png	aceqjoiveyet.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-US.pak	aceqjoiveyet.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\en-US\_ReCoVeRy_+dkvgx.png	aceqjoiveyet.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\_ReCoVeRy_+dkvgx.html	aceqjoiveyet.exe

Drops file in Windows directory 2 IoCs

Processes:

006cb9242e9c08db01fcfedf3c1ec11e0e5e8178e07b6836154ad62fd5b64786_NeikiAnalytics.exe

description	ioc	process
File opened for modification	C:\Windows\aceqjoiveyet.exe	006cb9242e9c08db01fcfedf3c1ec11e0e5e8178e07b6836154ad62fd5b64786_NeikiAnalytics.exe
File created	C:\Windows\aceqjoiveyet.exe	006cb9242e9c08db01fcfedf3c1ec11e0e5e8178e07b6836154ad62fd5b64786_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000080803118db5c3c961e6453c75fd8d1b739175f46096b68830ec690c5486161bb000000000e8000000002000020000000936a955c8ed276091e09264069d7b79470a763845bd48218549613e667910a1c20000000b6b1df8df02de56a905b3bf7f4c28eeff0ae1c3687982577d4d86afe3c6abcef4000000070845f695bac3404aa63315bbe99d3728d077ded65391ec03b96449876308f08dcac12deb105658f7dc8d599897eeb8f998ec4268a1a268bb49cb272bb80f80c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000052d0861c418c356123d95f9b0d80a2a94a924900722d463a5ce760d6ae9c2cde000000000e800000000200002000000009aba22062b4448758db8c7841f51d61ff5603441a499935af0431949b43ced5900000006e2db803fb1cb7aeb281ae536eb9e8edf3370383fa99ab4552cfb6171d14ba818d1ffe7504b32d835788f95597239bcd93f73fbf711223855ea024308c4f3876c5475e972407601a1a6f5fc99efba433f0bdaa877fd63bd0c9730f7068c2ceff598e9fdd8be965953ab2f63e4cb820428258e0d1e24de2d441864a6c211fb9329773ba96545be7b9de71e0173143b18340000000532d4eaa747f598f6bce23453f20683e0e112448d11454bafa44b338d15b11ef1fd43f793fd1114d9416e660beb8b4a2d23e02b4147ad5f260b3ca3c1164ec5c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425739262"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2FFF9351-3549-11EF-AF9B-7E1039193522} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40cbad0456c9da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

2792 NOTEPAD.EXE

pid	process
2792	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

aceqjoiveyet.exe

pid	process
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe
3040	aceqjoiveyet.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

006cb9242e9c08db01fcfedf3c1ec11e0e5e8178e07b6836154ad62fd5b64786_NeikiAnalytics.exeaceqjoiveyet.exeWMIC.exevssvc.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	2016	006cb9242e9c08db01fcfedf3c1ec11e0e5e8178e07b6836154ad62fd5b64786_NeikiAnalytics.exe
Token: SeDebugPrivilege	3040	aceqjoiveyet.exe
Token: SeIncreaseQuotaPrivilege	2736	WMIC.exe
Token: SeSecurityPrivilege	2736	WMIC.exe
Token: SeTakeOwnershipPrivilege	2736	WMIC.exe
Token: SeLoadDriverPrivilege	2736	WMIC.exe
Token: SeSystemProfilePrivilege	2736	WMIC.exe
Token: SeSystemtimePrivilege	2736	WMIC.exe
Token: SeProfSingleProcessPrivilege	2736	WMIC.exe
Token: SeIncBasePriorityPrivilege	2736	WMIC.exe
Token: SeCreatePagefilePrivilege	2736	WMIC.exe
Token: SeBackupPrivilege	2736	WMIC.exe
Token: SeRestorePrivilege	2736	WMIC.exe
Token: SeShutdownPrivilege	2736	WMIC.exe
Token: SeDebugPrivilege	2736	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2736	WMIC.exe
Token: SeRemoteShutdownPrivilege	2736	WMIC.exe
Token: SeUndockPrivilege	2736	WMIC.exe
Token: SeManageVolumePrivilege	2736	WMIC.exe
Token: 33	2736	WMIC.exe
Token: 34	2736	WMIC.exe
Token: 35	2736	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2736	WMIC.exe
Token: SeSecurityPrivilege	2736	WMIC.exe
Token: SeTakeOwnershipPrivilege	2736	WMIC.exe
Token: SeLoadDriverPrivilege	2736	WMIC.exe
Token: SeSystemProfilePrivilege	2736	WMIC.exe
Token: SeSystemtimePrivilege	2736	WMIC.exe
Token: SeProfSingleProcessPrivilege	2736	WMIC.exe
Token: SeIncBasePriorityPrivilege	2736	WMIC.exe
Token: SeCreatePagefilePrivilege	2736	WMIC.exe
Token: SeBackupPrivilege	2736	WMIC.exe
Token: SeRestorePrivilege	2736	WMIC.exe
Token: SeShutdownPrivilege	2736	WMIC.exe
Token: SeDebugPrivilege	2736	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2736	WMIC.exe
Token: SeRemoteShutdownPrivilege	2736	WMIC.exe
Token: SeUndockPrivilege	2736	WMIC.exe
Token: SeManageVolumePrivilege	2736	WMIC.exe
Token: 33	2736	WMIC.exe
Token: 34	2736	WMIC.exe
Token: 35	2736	WMIC.exe
Token: SeBackupPrivilege	2456	vssvc.exe
Token: SeRestorePrivilege	2456	vssvc.exe
Token: SeAuditPrivilege	2456	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1204	WMIC.exe
Token: SeSecurityPrivilege	1204	WMIC.exe
Token: SeTakeOwnershipPrivilege	1204	WMIC.exe
Token: SeLoadDriverPrivilege	1204	WMIC.exe
Token: SeSystemProfilePrivilege	1204	WMIC.exe
Token: SeSystemtimePrivilege	1204	WMIC.exe
Token: SeProfSingleProcessPrivilege	1204	WMIC.exe
Token: SeIncBasePriorityPrivilege	1204	WMIC.exe
Token: SeCreatePagefilePrivilege	1204	WMIC.exe
Token: SeBackupPrivilege	1204	WMIC.exe
Token: SeRestorePrivilege	1204	WMIC.exe
Token: SeShutdownPrivilege	1204	WMIC.exe
Token: SeDebugPrivilege	1204	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1204	WMIC.exe
Token: SeRemoteShutdownPrivilege	1204	WMIC.exe
Token: SeUndockPrivilege	1204	WMIC.exe
Token: SeManageVolumePrivilege	1204	WMIC.exe
Token: 33	1204	WMIC.exe
Token: 34	1204	WMIC.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exeDllHost.exe

pid process

2768 iexplore.exe
1904 DllHost.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2768 iexplore.exe
2768 iexplore.exe
1328 IEXPLORE.EXE
1328 IEXPLORE.EXE

pid	process
2768	iexplore.exe
1904	DllHost.exe

pid	process
2768	iexplore.exe
2768	iexplore.exe
1328	IEXPLORE.EXE
1328	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

006cb9242e9c08db01fcfedf3c1ec11e0e5e8178e07b6836154ad62fd5b64786_NeikiAnalytics.exeaceqjoiveyet.exeiexplore.exe

description	pid	process	target process
PID 2016 wrote to memory of 3040	2016	006cb9242e9c08db01fcfedf3c1ec11e0e5e8178e07b6836154ad62fd5b64786_NeikiAnalytics.exe	aceqjoiveyet.exe
PID 2016 wrote to memory of 3040	2016	006cb9242e9c08db01fcfedf3c1ec11e0e5e8178e07b6836154ad62fd5b64786_NeikiAnalytics.exe	aceqjoiveyet.exe
PID 2016 wrote to memory of 3040	2016	006cb9242e9c08db01fcfedf3c1ec11e0e5e8178e07b6836154ad62fd5b64786_NeikiAnalytics.exe	aceqjoiveyet.exe
PID 2016 wrote to memory of 3040	2016	006cb9242e9c08db01fcfedf3c1ec11e0e5e8178e07b6836154ad62fd5b64786_NeikiAnalytics.exe	aceqjoiveyet.exe
PID 2016 wrote to memory of 2660	2016	006cb9242e9c08db01fcfedf3c1ec11e0e5e8178e07b6836154ad62fd5b64786_NeikiAnalytics.exe	cmd.exe
PID 2016 wrote to memory of 2660	2016	006cb9242e9c08db01fcfedf3c1ec11e0e5e8178e07b6836154ad62fd5b64786_NeikiAnalytics.exe	cmd.exe
PID 2016 wrote to memory of 2660	2016	006cb9242e9c08db01fcfedf3c1ec11e0e5e8178e07b6836154ad62fd5b64786_NeikiAnalytics.exe	cmd.exe
PID 2016 wrote to memory of 2660	2016	006cb9242e9c08db01fcfedf3c1ec11e0e5e8178e07b6836154ad62fd5b64786_NeikiAnalytics.exe	cmd.exe
PID 3040 wrote to memory of 2736	3040	aceqjoiveyet.exe	WMIC.exe
PID 3040 wrote to memory of 2736	3040	aceqjoiveyet.exe	WMIC.exe
PID 3040 wrote to memory of 2736	3040	aceqjoiveyet.exe	WMIC.exe
PID 3040 wrote to memory of 2736	3040	aceqjoiveyet.exe	WMIC.exe
PID 3040 wrote to memory of 2792	3040	aceqjoiveyet.exe	NOTEPAD.EXE
PID 3040 wrote to memory of 2792	3040	aceqjoiveyet.exe	NOTEPAD.EXE
PID 3040 wrote to memory of 2792	3040	aceqjoiveyet.exe	NOTEPAD.EXE
PID 3040 wrote to memory of 2792	3040	aceqjoiveyet.exe	NOTEPAD.EXE
PID 3040 wrote to memory of 2768	3040	aceqjoiveyet.exe	iexplore.exe
PID 3040 wrote to memory of 2768	3040	aceqjoiveyet.exe	iexplore.exe
PID 3040 wrote to memory of 2768	3040	aceqjoiveyet.exe	iexplore.exe
PID 3040 wrote to memory of 2768	3040	aceqjoiveyet.exe	iexplore.exe
PID 2768 wrote to memory of 1328	2768	iexplore.exe	IEXPLORE.EXE
PID 2768 wrote to memory of 1328	2768	iexplore.exe	IEXPLORE.EXE
PID 2768 wrote to memory of 1328	2768	iexplore.exe	IEXPLORE.EXE
PID 2768 wrote to memory of 1328	2768	iexplore.exe	IEXPLORE.EXE
PID 3040 wrote to memory of 1204	3040	aceqjoiveyet.exe	WMIC.exe
PID 3040 wrote to memory of 1204	3040	aceqjoiveyet.exe	WMIC.exe
PID 3040 wrote to memory of 1204	3040	aceqjoiveyet.exe	WMIC.exe
PID 3040 wrote to memory of 1204	3040	aceqjoiveyet.exe	WMIC.exe
PID 3040 wrote to memory of 1920	3040	aceqjoiveyet.exe	cmd.exe
PID 3040 wrote to memory of 1920	3040	aceqjoiveyet.exe	cmd.exe
PID 3040 wrote to memory of 1920	3040	aceqjoiveyet.exe	cmd.exe
PID 3040 wrote to memory of 1920	3040	aceqjoiveyet.exe	cmd.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

aceqjoiveyet.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	aceqjoiveyet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	aceqjoiveyet.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\006cb9242e9c08db01fcfedf3c1ec11e0e5e8178e07b6836154ad62fd5b64786_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\006cb9242e9c08db01fcfedf3c1ec11e0e5e8178e07b6836154ad62fd5b64786_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\aceqjoiveyet.exe
  C:\Windows\aceqjoiveyet.exe
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3040
- - C:\Windows\System32\wbem\WMIC.exe
    "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2736
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_ReCoVeRy_.TXT
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:2792
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\_ReCoVeRy_.HTM
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2768
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2768 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1328
- - C:\Windows\System32\wbem\WMIC.exe
    "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1204
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\ACEQJO~1.EXE
    3⤵
    PID:1920
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\006CB9~1.EXE
  2⤵
  - Deletes itself
  PID:2660

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2456

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:1904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_ReCoVeRy_+dkvgx.html

Filesize
11KB

MD5
abbe395b3250eaeccde6a8f52995d6af

SHA1
94db66279ce326473b0803c1a31039cbbdfca66e

SHA256
23b4691ad98e684c3dc03d4a0e1d41b86dfaf4bcc254ae105342ba61d6304f4a

SHA512
32db66907e34d753a6042157bdb8ca55c3814d032c72d0ead01b16e563f249243e96cfeeb6ee3840f8418f53f7526ad303907f1d37994b1a562eb8e766f97e48

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_ReCoVeRy_+dkvgx.png

Filesize
65KB

MD5
df1e2156362e5227ea94339072e13565

SHA1
e32992e6cfdfd03b9603656356211b03741a8193

SHA256
3c398331021bfdc3ea24187f36608d637a965a51c00c18f85f03dd65ec6a27ed

SHA512
751c5a580502cb1dc86f4785641f5b43b1135cdbc8f6a63b372b1ebe8f8cad785cb58c0aafe8030decb200cec3f1cb5a7dc774b524b5bf47bd110100f213a1d1

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_ReCoVeRy_+dkvgx.txt

Filesize
1KB

MD5
4de2225f7ec1f2305fa9a0809fbf8866

SHA1
8be1650d96fae1d6d7f31216fd73528b6f53ca8b

SHA256
0771884f1c60b580149a8086abdbf1e7bfb13815d04452ecef34b88979b684d5

SHA512
77c197b58886975bdc990c153ec1385254370a6c53d38d6adf88608da6b6579af9fa1ee444017c78310ba12386103931cde5677d5580ee2377b3d264037cf8cb

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
c912d71c2efa893d44adfa4c5ecb633d

SHA1
21af5b77e28d1bb4a4109492d8420502cf4ed760

SHA256
f4fa35e4a2efba0d264033f7ddc758761b64f12af99716f5c6a134758b3c5006

SHA512
7c18a09bab89db1c972c30bbdbfcbdff3a0853c1e3997cf5eb77dacbe97c20077ea41e559c52f8dbe401053e7e7e3267fa61fb2a414345633da1cc59e3d697bd

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
a47b1f716e8c70c45423c057274a2ddf

SHA1
dba841a0bba192ecd3c1cad945e7bec869e3757c

SHA256
4d9fe99daac37ac991659aac5b9342e2d855fe48bdeff263415158ff4dea2934

SHA512
997b7893c197a7d505425e20d906ebecd4de9ae56ea84cdb681e8a6e98d55e28f9adb434ffb90fb88279dca722af8d9dd8b8044fb8cef988b43326bb442e9d12

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
173KB

MD5
6fbe26157f20f0734da99637fc219991

SHA1
93a7f03d500869987c9edd2a7edd6038c05437aa

SHA256
407d9a6d247fa0af4a908df656d2d8361baf05daceed7ca898ee8557d499c810

SHA512
3dd30c57d36d21a4608f2b338b8744f4e9d46a94b92c64f47f7d0dc4fc19dae5bb14f46302c93435df9becb95ccc6cb213a7ba10946ee345120bde82ad58dfd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
194e866e06b4387ca486c79e2f4d7e55

SHA1
65427ec611b3f134ad13882874d5f95c5a7faca3

SHA256
0dbe7a2e55e6f1eeec63606ebcf76bc570c88217f70a7ca77292ebf82785055e

SHA512
240d1f8bdee7e650a1e6484d8a1d6dee2edace52bf08d6cdecf82c589d82a54a88e7c70de31e98509982807ab78d7b4505c4170c6b8f03343f0aee311c48eb1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
840eec8b8ee6bca9169e2fbb5aa90ed5

SHA1
5c3c3d2bccce485af5df0774373e0f7c3657c6f2

SHA256
a37e43aa5bffb7b686ef1baa420d3eed90159cf6b817e924500580cfdec48ab5

SHA512
fa51747c79a300706d388efa6364ecedd307a44e972ca861bceb59dc88fb8a775636e642a97e1044837e1ebb57d2da1c8556344a5ec0840a9920a04ed9ec0064

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8d96772f00684890d4e06d892ede7f8

SHA1
e3055f23777e34bc83c4193d4b804a22b8813916

SHA256
8ccce3adf5811a34d6aea6cb5c7b86d4f6fb931ca9cf8c6712c68377145b8b36

SHA512
3c9ea9545cc41df15e70ea9f21e99718060f8d8fda2a18f82c37bdffbc49a3d12c3ddd4571377f686527ac0e8a07e4d0732ac8cf55682b5d6220caf193135fbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca2baf791a91eb12d3079d1f6458c840

SHA1
c9e15cf3ab5d861e501e54c4ef0ceb7acd93455c

SHA256
22023d792ab3a6a77e24624f4def2a0342ac76328e97d1cf2fe45ede17e77e80

SHA512
5587fe1ee04b7d5d797dcb079f3a5275633dac35c1a1c96116d93c8d7ae4dcecf43bc3131dbfe38be62327a87ee66549d5a89651cf3fd2e0a89b63170f000163

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94a33cf6dee11a925bc69ae769a86d7e

SHA1
88a3d4a39d98345b5c2328f8ef411d60f4335800

SHA256
035222af5935e72991dc0a4b94693fa45f5ffa2f45cc45ed1923a7a19582845f

SHA512
79a4b041d37abf9c21bf2166e8d6e09ba23c6019a06be1f60387f929d1dd8cce89b99d84f73512ba0f6efa61520b5c94a352f4549a4589d589002c3682103a97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9d94b0c68f55518729d1493e911a0ab

SHA1
e8ca77edbe5a7eb8e780625d8e9b29a217f98af9

SHA256
87ff4fa2ec7870b5e35ea027a47250e26a381ee1997bb45523fd241d359d7d8d

SHA512
f9548a1e26a8824acb7fa4d584ef62be479849a2f5c35571c6b16397b8dcea915b814f7c36e41b1462ebba2e2cff0bb5c73a29c707df792a6e858063bea4a7a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb37cb23fe66655ffe0cc2c4b2de49c8

SHA1
332758b7d158be8fccbda8bcf946200d4e94aefb

SHA256
349cbc6a1d3fb43bceaf343af81043d3847ec7a9f664d719459e4e95e23617b9

SHA512
2abed95efe06e402ba8a93da0e159aa6e38cb03f1d4d954274fc299e522561b034b53474fde035f4690209f28d3a5222e492d0c09b401c33814e6a5a87d543ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4596ce38a276c91048fe6c365c6b611c

SHA1
d43acd45554a60b5999388da9cacf4bb52f34af8

SHA256
5f6e9c6a93d461ba3fa4102f057bca8195233007826a73126486411cd2f19ea3

SHA512
137ef7b0ee66f46cca9e862d23364f3d8603f883a5f89db4c71ad1ab2f498b55869cc28dcf928965ddc794fd96a25380690d3dc2acab9762bf8c209416304a8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd77aabb11714da2e5d27dce3e570e6a

SHA1
a42c1dcf6cd565efabc14e2f613ff06993a65d28

SHA256
5eff8d686bb1616f03c5d2839bf01c17c0786b3ee50fc0e1901d7407e2d16fe1

SHA512
a69c961e07ffee999985555979624c34d2b54a2c91f317e6785d8b362a60aa75139c312ff941199cdbab3376d6be09c7cff231a5a39218e4238e5136f7a33583

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4aa97983c33636a7f8e2ac0b04db6203

SHA1
a6ef15631f6143b4b9f16379d41da32cec9d26f6

SHA256
48c65f32923cec57ce2d38ccfcfa24360b7f42057793be5447dfc38d841bc61a

SHA512
e89e4d7008b1eeb92aeed1af9c62bab29834eb5ef4ea1f5a848f6aed3d165ca9a2a88ac98103a1c192f7464468d2c7640fc1f6912ddc6ad7ade2f7431279e7f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bdfc3525a7cb686eee81e37f3599e2c1

SHA1
bd4c44f6c6856ef2969f5190676ae9f8f180d410

SHA256
0ddf55312a4c96df58a7a0a46425b01b142d79d807b0c1650ca079056e7556b6

SHA512
388e792a2668bb82bd40d306e70412c07842a9b93c676898fdde736345d59940e4943ce1baaca5279f2f90cc7f7d0890505de02593941ac70d459cfc2a4b6b64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a725b5610f76dc584e5b6b2d908e111

SHA1
e726db1a90dd41020771e459fa0619855020e864

SHA256
5a6995951978b756c719fc28349ad8eb6ba75189586708d57f5d630d99820c61

SHA512
f44f02b99a64803976bed6961de713f25ad262c8afe4e6155d85f6fc558388ebb4e53409bfafdfceb2a4469e02e85c98db65090189a737347f74df6782a4c719

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0fe3653cc59c81c3920ee764e5dc2450

SHA1
8a02cee0af45623b8765d4e04576e3c329a29e13

SHA256
ebbd01b764750141e6f5995a4782cb732877a8ad45d646f60a474bcb4608a62a

SHA512
0195ad65a40be96d8e05a0e24b5810ca53b7fdcf4ac1d47a3fe494e5cc171fcb8016d8ec6b1e5ce67ae757a5513d79e73c2561bea15fe7c026d61245e0b01dfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab82f0f4bea3a9cb0d9e4c6600237a1c

SHA1
64eaee9b46d0203a3401e0a0730764dc16f37481

SHA256
e81d9a6022d6c6a6842017ea1fd6f906af2e9964b297fc83e2b756d6d322b6ed

SHA512
de41111da78e8579c1fdc66e47594f3453cf5bf4dc8c379ad16d4f749647194600eaa01365b498d2e5d2912596666d6f492d524f487c1f73b0eb829a2af0df2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52f00041d5ffd6ffa613df0318886f95

SHA1
ba16806e23290340809b086689201edbe8afeaff

SHA256
042093d18b9cc4ff867a7311c667b15025bcf89f18790f73d77b4e86dd285c5c

SHA512
b0b89aa7fe76b937a226e266e2bb472513ab8634a4c0955623c5f3a62638e17dcf0eed533697fe5351069697b92f71ccd720d3a058f062ecec1a5a7d8aeb9ef8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
249e33ce2f5bab8a258bbeacfc807bd6

SHA1
dc143ca94c0955da67c0cae749476d17e5e717be

SHA256
28df0d659d98ffdc4d1c75ec7d7dc45ef97279bf3a51a9a35cd8c3fcc4a0d5ab

SHA512
249e3019b04d3e8a136a1ac86de3da23f9f5facaf3888f8adfa58ac74f4a4c198137298c959b6c72f52703abae566f758a2bcde1cb736592134b9952585f8904

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2442249c77c915881cc03a960806f32b

SHA1
7e56c696cff7d55fe640fd3b821deac6d6967d9c

SHA256
3b0cef743855e1d167d4129fb5228a5e27e0840c8f1c6a09997c981aa6244e4b

SHA512
ec6d561067549eb3f387ea62a3a5ad57b1f85d0656a8e71eb0064e0b08d43183edfcca639bf21ef900125819d5ae99bee543e5e989c692e517712e883825fcf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bfe584e06a025cb28e6579c5f4075fc2

SHA1
237d1979e894b3f27b5a91929c2a1212e85b63fa

SHA256
f1985c5f568af974f42528741c4c685d0a7bf669b85da5b19c6b09717e7d50c1

SHA512
7ebab92b797ccb1ee8c636b3a97b129f6cec0e70afb82786608318ae47d9702cc0c494b5e6ebbcac57eefedd061d034876a68634767e8db317bd16fbac2b2d17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9880a8bf1dd515a7ea65c58ead525e9

SHA1
2b63c21058febf7c15cb37c1c1edded39b3b8e8a

SHA256
02797b1bf9f035b0049d0e16a99a79688fbb827798024464487bf14c4b46fd6f

SHA512
ca8717b834c984441231b048320cbca3d3e5d3f4107919aea79f2643d42b4031dc6e7db726973e993d7c70da286f9907fc1ed817033528e8d11eb1db2d152c6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9dce444e15a5fe6125b4e1335071c572

SHA1
864e83088430825c2db15e6613c618980dfe0c63

SHA256
eb53e7ac7b9ac4722b657cdbb83200ddf8d5859799a542d7198f0eb731aced40

SHA512
90162d0ef9a89f5f65e789860df2c6a878a97f8a3eb20673f46d35cd706032c801727a86d1ce60ce58e34925591e456ce4e14e87fbe41df1a9d30f265a69aa7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10576aa8ca8268920a1cf0600c7526b9

SHA1
b2f4bd7038197c23f2f02bc6de7775df84269f76

SHA256
142180c77f91cdbc4c0722cecf1ed1e7dede9359c2f3bf9c0d2f1ce9f7a06766

SHA512
dca3a62f7c233e9e7a7c52d422a89ab83a2a3a9611e5c4f806db5c879108205d3458a51c6bc2f973dd9adcf06e86164fb169999c82b5c1afea5fabf5da56c10c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA19D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA24E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\aceqjoiveyet.exe

Filesize
553KB

MD5
f7030b13576de49beebb29da2d5c8890

SHA1
26ccbc9c36c030258d5e38d59bf09423e5204750

SHA256
006cb9242e9c08db01fcfedf3c1ec11e0e5e8178e07b6836154ad62fd5b64786

SHA512
a29d7264c3040a04ca036641295670ca7c6678ad8b2092153c51acbf9cd91e05f273d0c7926f07f05d8569eb4e49d64bb3d2d31dd7741aea49aa5c2f5c9b38c6

Download Submit
memory/1904-5852-0x00000000001A0000-0x00000000001A2000-memory.dmp

Filesize
8KB

Download
memory/2016-0-0x0000000000340000-0x00000000003C6000-memory.dmp

Filesize
536KB

Download
memory/2016-12-0x0000000000340000-0x00000000003C6000-memory.dmp

Filesize
536KB

Download
memory/2016-11-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/2016-2-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/3040-1092-0x0000000000290000-0x0000000000316000-memory.dmp

Filesize
536KB

Download
memory/3040-5856-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/3040-5855-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/3040-5851-0x0000000002870000-0x0000000002872000-memory.dmp

Filesize
8KB

Download
memory/3040-5550-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/3040-4626-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/3040-3571-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/3040-2595-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/3040-1722-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/3040-886-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/3040-512-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/3040-16-0x0000000000290000-0x0000000000316000-memory.dmp

Filesize
536KB

Download
memory/3040-13-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download