Overview

overview

10

Static

static

3

2016-08-26...e2.exe

windows7-x64

10

2016-08-30...e2.exe

windows7-x64

10

2016-09-14...re.exe

windows7-x64

10

2016-09-16...e2.exe

windows7-x64

10

2016-09-19...e2.exe

windows7-x64

10

2016-09-21...om.exe

windows7-x64

10

2016-09-27...er.exe

windows7-x64

7

2016-09-28...om.exe

windows7-x64

10

2016-09-28...om.exe

windows7-x64

10

2016-09-29...e2.exe

windows7-x64

10

2016-09-29...e2.exe

windows7-x64

10

2016-10-04...er.exe

windows7-x64

7

2016-10-05...e2.exe

windows7-x64

10

2016-10-06...e2.exe

windows7-x64

10

2016-10-12...er.exe

windows7-x64

7

2016-10-14...er.exe

windows7-x64

7

2016-10-18...e2.exe

windows7-x64

10

2016-10-23...er.exe

windows7-x64

7

2016-10-28...e2.exe

windows7-x64

10

2016-11-07...e2.exe

windows7-x64

10

2016-11-08...e2.exe

windows7-x64

10

2016-11-09...e2.exe

windows7-x64

10

2016-11-15...e2.exe

windows7-x64

10

2016-11-16...e2.exe

windows7-x64

10

2016-11-21...e2.exe

windows7-x64

10

2017-03-15...si.exe

windows7-x64

10

2017-04-07...re.exe

windows7-x64

10

2017-04-07...re.exe

windows7-x64

10

2017-04-07...re.exe

windows7-x64

10

2018-01-28...re.exe

windows7-x64

10

Analysis

  • max time kernel
    1559s
  • max time network
    1559s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    11-11-2024 07:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2016-11-09-1st-run-EITest-Rig-EK-payload-CryptFile2.exe

  • Size

    85KB

  • MD5

    dbfb3cab8256d5cf12ccec4a75ac7a32

  • SHA1

    58b9373549cc649ebfd7e7ff279065696bbd6bd5

  • SHA256

    9b7a93df69ec9521ca5e169e865bfb9905625cadf056f2d10d48014a22cb253c

  • SHA512

    06f76ea6fe93e612f5f8f60d71814aeb46040a6d39bb5c142d704801d8026ed51fcdfcf3ee7de454b45416df7f9799c2bb7047cad19bca0018a61beea777ae3f

  • SSDEEP

    1536:VOF/WBUPuy14N5waImZ+uI3bQkizzgA7PftyFq3p:wFCy1a5pb6bQWATtRZ

Score
10/10
defense_evasiondiscoveryexecutionimpactpersistenceransomware

Malware Config

Extracted

Path

C:\PerfLogs\HELP_DECRYPT_YOUR_FILES.TXT

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files protected by a strong encryption with RSA-2048. More information about the encryption keys using RSA-2048 can be found here: https://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-2048 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start send email now for more specific instructions! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions: Contact us by email only, send us an email along with your ID number and wait for further instructions. Our specialist will contact you within 24 hours. For you to be sure, that we can decrypt your files - you can send us a single encrypted file and we will send you back it in a decrypted form. This will be your guarantee. Please do not waste your time! You have 72 hours only! After that The Main Server will double your price! So right now You have a chance to buy your individual private SoftWare with a low price! E-MAIL1: [email protected] E-MAIL2: [email protected]

Extracted

Path

C:\PerfLogs\HELP_DECRYPT_YOUR_FILES.TXT

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files protected by a strong encryption with RSA-2048. More information about the encryption keys using RSA-2048 can be found here: https://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-2048 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start send email now for more specific instructions! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions: Contact us by email only, send us an email along with your ID number and wait for further instructions. Our specialist will contact you within 24 hours. For you to be sure, that we can decrypt your files - you can send us a single encrypted file and we will send you back it in a decrypted form. This will be your guarantee. Please do not waste your time! You have 72 hours only! After that The Main Server will double your price! So right now You have a chance to buy your individual private SoftWare with a low price! E-MAIL1: [email protected] E-MAIL2: [email protected] YOUR_ID: 1c9b74ea1b3a80c3

Signatures

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Interacts with shadow copies 3 TTPs 27 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Runs net.exe
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2016-11-09-1st-run-EITest-Rig-EK-payload-CryptFile2.exe
    "C:\Users\Admin\AppData\Local\Temp\2016-11-09-1st-run-EITest-Rig-EK-payload-CryptFile2.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2360
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin.exe Delete Shadows /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2424
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin.exe Delete Shadows /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:2584
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1480
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic shadowcopy delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1772
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=Z: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1040
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=Z: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:1560
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=Y: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:928
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=Y: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:1308
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=X: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:956
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=X: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:2176
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=W: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1556
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=W: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:2244
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=V: /All /Quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1112
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=V: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:2492
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=U: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2668
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=U: /All /Quiet
        3⤵
        • Interacts with shadow copies
        PID:1604
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=T: /All /Quiet
      2⤵
        PID:2168
        • C:\Windows\SysWOW64\vssadmin.exe
          vssadmin Delete Shadows /For=T: /All /Quiet
          3⤵
          • System Location Discovery: System Language Discovery
          • Interacts with shadow copies
          PID:2520
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=S: /All /Quiet
        2⤵
        • System Location Discovery: System Language Discovery
        PID:1008
        • C:\Windows\SysWOW64\vssadmin.exe
          vssadmin Delete Shadows /For=S: /All /Quiet
          3⤵
          • System Location Discovery: System Language Discovery
          • Interacts with shadow copies
          PID:2436
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=R: /All /Quiet
        2⤵
        • System Location Discovery: System Language Discovery
        PID:1100
        • C:\Windows\SysWOW64\vssadmin.exe
          vssadmin Delete Shadows /For=R: /All /Quiet
          3⤵
          • Interacts with shadow copies
          PID:1576
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=Q: /All /Quiet
        2⤵
        • System Location Discovery: System Language Discovery
        PID:1064
        • C:\Windows\SysWOW64\vssadmin.exe
          vssadmin Delete Shadows /For=Q: /All /Quiet
          3⤵
          • System Location Discovery: System Language Discovery
          • Interacts with shadow copies
          PID:2248
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=P: /All /Quiet
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2524
        • C:\Windows\SysWOW64\vssadmin.exe
          vssadmin Delete Shadows /For=P: /All /Quiet
          3⤵
          • System Location Discovery: System Language Discovery
          • Interacts with shadow copies
          PID:2940
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=O: /All /Quiet
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2628
        • C:\Windows\SysWOW64\vssadmin.exe
          vssadmin Delete Shadows /For=O: /All /Quiet
          3⤵
          • System Location Discovery: System Language Discovery
          • Interacts with shadow copies
          PID:2704
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=N: /All /Quiet
        2⤵
        • System Location Discovery: System Language Discovery
        PID:1784
        • C:\Windows\SysWOW64\vssadmin.exe
          vssadmin Delete Shadows /For=N: /All /Quiet
          3⤵
          • System Location Discovery: System Language Discovery
          • Interacts with shadow copies
          PID:2756
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=M: /All /Quiet
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2936
        • C:\Windows\SysWOW64\vssadmin.exe
          vssadmin Delete Shadows /For=M: /All /Quiet
          3⤵
          • System Location Discovery: System Language Discovery
          • Interacts with shadow copies
          PID:2816
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=L: /All /Quiet
        2⤵
        • System Location Discovery: System Language Discovery
        PID:1936
        • C:\Windows\SysWOW64\vssadmin.exe
          vssadmin Delete Shadows /For=L: /All /Quiet
          3⤵
          • System Location Discovery: System Language Discovery
          • Interacts with shadow copies
          PID:2020
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=K: /All /Quiet
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2724
        • C:\Windows\SysWOW64\vssadmin.exe
          vssadmin Delete Shadows /For=K: /All /Quiet
          3⤵
          • System Location Discovery: System Language Discovery
          • Interacts with shadow copies
          PID:1208
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=J: /All /Quiet
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2136
        • C:\Windows\SysWOW64\vssadmin.exe
          vssadmin Delete Shadows /For=J: /All /Quiet
          3⤵
          • System Location Discovery: System Language Discovery
          • Interacts with shadow copies
          PID:1432
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=I: /All /Quiet
        2⤵
        • System Location Discovery: System Language Discovery
        PID:3032
        • C:\Windows\SysWOW64\vssadmin.exe
          vssadmin Delete Shadows /For=I: /All /Quiet
          3⤵
          • System Location Discovery: System Language Discovery
          • Interacts with shadow copies
          PID:2228
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=H: /All /Quiet
        2⤵
        • System Location Discovery: System Language Discovery
        PID:1528
        • C:\Windows\SysWOW64\vssadmin.exe
          vssadmin Delete Shadows /For=H: /All /Quiet
          3⤵
          • System Location Discovery: System Language Discovery
          • Interacts with shadow copies
          PID:1244
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=G: /All /Quiet
        2⤵
        • System Location Discovery: System Language Discovery
        PID:3020
        • C:\Windows\SysWOW64\vssadmin.exe
          vssadmin Delete Shadows /For=G: /All /Quiet
          3⤵
          • System Location Discovery: System Language Discovery
          • Interacts with shadow copies
          PID:2468
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=F: /All /Quiet
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2280
        • C:\Windows\SysWOW64\vssadmin.exe
          vssadmin Delete Shadows /For=F: /All /Quiet
          3⤵
          • System Location Discovery: System Language Discovery
          • Interacts with shadow copies
          PID:1616
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=E: /All /Quiet
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2288
        • C:\Windows\SysWOW64\vssadmin.exe
          vssadmin Delete Shadows /For=E: /All /Quiet
          3⤵
          • System Location Discovery: System Language Discovery
          • Interacts with shadow copies
          PID:1640
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=D: /All /Quiet
        2⤵
        • System Location Discovery: System Language Discovery
        PID:1708
        • C:\Windows\SysWOW64\vssadmin.exe
          vssadmin Delete Shadows /For=D: /All /Quiet
          3⤵
          • System Location Discovery: System Language Discovery
          • Interacts with shadow copies
          PID:556
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=C: /All /Quiet
        2⤵
        • System Location Discovery: System Language Discovery
        PID:1716
        • C:\Windows\SysWOW64\vssadmin.exe
          vssadmin Delete Shadows /For=C: /All /Quiet
          3⤵
          • System Location Discovery: System Language Discovery
          • Interacts with shadow copies
          PID:1036
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=B: /All /Quiet
        2⤵
        • System Location Discovery: System Language Discovery
        PID:1160
        • C:\Windows\SysWOW64\vssadmin.exe
          vssadmin Delete Shadows /For=B: /All /Quiet
          3⤵
          • System Location Discovery: System Language Discovery
          • Interacts with shadow copies
          PID:544
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=A: /All /Quiet
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2560
        • C:\Windows\SysWOW64\vssadmin.exe
          vssadmin Delete Shadows /For=A: /All /Quiet
          3⤵
          • Interacts with shadow copies
          PID:2392
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C net stop vss
        2⤵
        • System Location Discovery: System Language Discovery
        PID:1684
        • C:\Windows\SysWOW64\net.exe
          net stop vss
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1576
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop vss
            4⤵
            • System Location Discovery: System Language Discovery
            PID:572
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} recoveryenabled No
        2⤵
        • System Location Discovery: System Language Discovery
        PID:3000
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2772
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" bcdedit /set {default} recoveryenabled No
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2268
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" bcdedit /set {default} bootstatuspolicy ignoreallfailures
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2704
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" bcdedit /set bootstatuspolicy ignoreallfailures
        2⤵
          PID:2576
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C bcdedit /set bootstatuspolicy ignoreallfailures
          2⤵
          • System Location Discovery: System Language Discovery
          PID:1588
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" bcdedit /set recoveryenabled NO
          2⤵
          • System Location Discovery: System Language Discovery
          PID:2152
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C bcdedit /set recoveryenabled NO
          2⤵
          • System Location Discovery: System Language Discovery
          PID:1604
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
          2⤵
          • System Location Discovery: System Language Discovery
          PID:2452
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" wbadmin delete catalog -quiet
          2⤵
          • System Location Discovery: System Language Discovery
          PID:1944
        • C:\Windows\SysWOW64\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Documents\HELP_DECRYPT_YOUR_FILES.TXT
          2⤵
          • System Location Discovery: System Language Discovery
          • Opens file in notepad (likely ransom note)
          PID:2784
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:884
      • C:\Windows\system32\conhost.exe
        \??\C:\Windows\system32\conhost.exe "-1287864765-1847814527811261816-424769226-969725041402319760-1698769035-268994148"
        1⤵
          PID:2168
        • C:\Windows\system32\conhost.exe
          \??\C:\Windows\system32\conhost.exe "21433611211303200977-15282800142123995271-2134995907-625771454545223635-618521408"
          1⤵
            PID:2584
          • C:\Windows\system32\conhost.exe
            \??\C:\Windows\system32\conhost.exe "21258115741009707011164076762-757444558-19030773311635651818877695439379041169"
            1⤵
              PID:2424

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\PerfLogs\HELP_DECRYPT_YOUR_FILES.TXT
              Filesize

              3KB

              MD5

              6f396bc007e6cb7ec722e3a27920ab8d

              SHA1

              b9c8f579ab0756494e905ac51dbbe65c140a72cb

              SHA256

              85571273dbf528bf87e495b6addd136ad6acfc410e64c2446ebe774f00eb7b01

              SHA512

              ff0a0557c8a3b22a5f6ff04574d414556e15957a094ac98eca971e99d106501c0ec99f34deb29832f07cf480859f515797e05f7573b6f91771758babff9b1e29

              Download Submit

            • C:\PerfLogs\HELP_DECRYPT_YOUR_FILES.TXT
              Filesize

              3KB

              MD5

              1cd23d85fc78d2b993fe67f8be7b5ea1

              SHA1

              531bcce2b00de81b87540f2ac2a43c761e850c3a

              SHA256

              2ff2ea22d403084756cab548e13aae1ceb44bd7bdde861ab462c5061c1cba99b

              SHA512

              db2ffd7743dd62ad7a85ac79aa88c00fe36a2bf496c3cdfb548a448e7ee68812686c1456cdcbdf387786215b8c096418370869ce4629d49c8b0c8b301b1167c2

              Download Submit

            • memory/2360-0-0x0000000000100000-0x000000000010C000-memory.dmp

              Filesize

              48KB

              Download