Overview

overview

10

Static

static

3

2016-08-26...e2.exe

windows7-x64

10

2016-08-30...e2.exe

windows7-x64

10

2016-09-14...re.exe

windows7-x64

10

2016-09-16...e2.exe

windows7-x64

10

2016-09-19...e2.exe

windows7-x64

10

2016-09-21...om.exe

windows7-x64

10

2016-09-27...er.exe

windows7-x64

7

2016-09-28...om.exe

windows7-x64

10

2016-09-28...om.exe

windows7-x64

10

2016-09-29...e2.exe

windows7-x64

10

2016-09-29...e2.exe

windows7-x64

10

2016-10-04...er.exe

windows7-x64

7

2016-10-05...e2.exe

windows7-x64

10

2016-10-06...e2.exe

windows7-x64

10

2016-10-12...er.exe

windows7-x64

7

2016-10-14...er.exe

windows7-x64

7

2016-10-18...e2.exe

windows7-x64

10

2016-10-23...er.exe

windows7-x64

7

2016-10-28...e2.exe

windows7-x64

10

2016-11-07...e2.exe

windows7-x64

10

2016-11-08...e2.exe

windows7-x64

10

2016-11-09...e2.exe

windows7-x64

10

2016-11-15...e2.exe

windows7-x64

10

2016-11-16...e2.exe

windows7-x64

10

2016-11-21...e2.exe

windows7-x64

10

2017-03-15...si.exe

windows7-x64

10

2017-04-07...re.exe

windows7-x64

10

2017-04-07...re.exe

windows7-x64

10

2017-04-07...re.exe

windows7-x64

10

2018-01-28...re.exe

windows7-x64

10

Analysis

  • max time kernel
    1566s
  • max time network
    1568s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    11-11-2024 07:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2016-09-28-EITest-Rig-EK-payload-CryptFile2-after-orfab.com.exe

  • Size

    89KB

  • MD5

    a4e832a6634151516ef43c1374544c9d

  • SHA1

    b9956d73f1ac987dd7b84c6e55f5aa1bf4816b5c

  • SHA256

    eab7d92ea08e1028b010c8c4287fa5b6cbdcb598270853944dde3bfcd5beeb8b

  • SHA512

    d263bd0ee9491f331e8d8e8e0cf639299101f8a5b46e1e60123e53fa1f98e6bd53bd642741402d5fae2a9846aed73f0c5204dcf5a439eccb28dd5e11f5f160ba

  • SSDEEP

    1536:Tp4G6gKt7m4yZsC8PK9S0583LHz2H0qquMTwx/EZVj2X1KFuOCrr:VDTh9S0583LHz20qBZxA/Y

Score
10/10
defense_evasiondiscoveryexecutionimpactpersistenceransomware

Malware Config

Extracted

Path

C:\PerfLogs\HELP_DECRYPT_YOUR_FILES.TXT

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-2048. More information about the encryption keys using RSA-2048 can be found here:-> http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-2048 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start send email now for more specific instructions! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions: Contact us by email only, send us an email along with your ID number and wait for further instructions. Our specialist will contact you within 24 hours. For you to be sure, that we can decrypt your files - you can send us a single encrypted file and we will send you back it in a decrypted form. This will be your guarantee. Please do not waste your time! You have 72 hours only! After that The Main Server will double your price! So right now You have a chance to buy your individual private softWare with a low price! E-MAIL1: [email protected] E-MAIL2: [email protected] Spare email: E-MAIL1: [email protected] E-MAIL2: [email protected]

Extracted

Path

C:\PerfLogs\HELP_DECRYPT_YOUR_FILES.TXT

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-2048. More information about the encryption keys using RSA-2048 can be found here:-> http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-2048 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start send email now for more specific instructions! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions: Contact us by email only, send us an email along with your ID number and wait for further instructions. Our specialist will contact you within 24 hours. For you to be sure, that we can decrypt your files - you can send us a single encrypted file and we will send you back it in a decrypted form. This will be your guarantee. Please do not waste your time! You have 72 hours only! After that The Main Server will double your price! So right now You have a chance to buy your individual private softWare with a low price! E-MAIL1: [email protected] E-MAIL2: [email protected] Spare email: E-MAIL1: [email protected] E-MAIL2: [email protected] YOUR_ID: 84ac884f1c9b74ea

Signatures

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Interacts with shadow copies 3 TTPs 27 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Runs net.exe
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2016-09-28-EITest-Rig-EK-payload-CryptFile2-after-orfab.com.exe
    "C:\Users\Admin\AppData\Local\Temp\2016-09-28-EITest-Rig-EK-payload-CryptFile2-after-orfab.com.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2236
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin.exe Delete Shadows /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2980
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin.exe Delete Shadows /All /Quiet
        3⤵
        • Interacts with shadow copies
        PID:948
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1776
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic shadowcopy delete
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:976
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=Z: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2508
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=Z: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:780
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=Y: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2804
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=Y: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:2472
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=X: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1392
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=X: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:2996
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=W: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2476
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=W: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:2448
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=V: /All /Quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2344
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=V: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:1724
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=U: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:688
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=U: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:1564
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=T: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2280
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=T: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:2056
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=S: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2076
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=S: /All /Quiet
        3⤵
        • Interacts with shadow copies
        PID:2204
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=R: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2100
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=R: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:1916
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=Q: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1592
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=Q: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:2364
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=P: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2152
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=P: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:2824
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=O: /All /Quiet
      2⤵
        PID:2528
        • C:\Windows\SysWOW64\vssadmin.exe
          vssadmin Delete Shadows /For=O: /All /Quiet
          3⤵
          • System Location Discovery: System Language Discovery
          • Interacts with shadow copies
          PID:2740
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=N: /All /Quiet
        2⤵
          PID:1152
          • C:\Windows\SysWOW64\vssadmin.exe
            vssadmin Delete Shadows /For=N: /All /Quiet
            3⤵
            • System Location Discovery: System Language Discovery
            • Interacts with shadow copies
            PID:2332
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=M: /All /Quiet
          2⤵
          • System Location Discovery: System Language Discovery
          PID:2720
          • C:\Windows\SysWOW64\vssadmin.exe
            vssadmin Delete Shadows /For=M: /All /Quiet
            3⤵
            • System Location Discovery: System Language Discovery
            • Interacts with shadow copies
            PID:1600
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=L: /All /Quiet
          2⤵
          • System Location Discovery: System Language Discovery
          PID:2864
          • C:\Windows\SysWOW64\vssadmin.exe
            vssadmin Delete Shadows /For=L: /All /Quiet
            3⤵
            • System Location Discovery: System Language Discovery
            • Interacts with shadow copies
            PID:3028
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=K: /All /Quiet
          2⤵
          • System Location Discovery: System Language Discovery
          PID:2748
          • C:\Windows\SysWOW64\vssadmin.exe
            vssadmin Delete Shadows /For=K: /All /Quiet
            3⤵
            • System Location Discovery: System Language Discovery
            • Interacts with shadow copies
            PID:2884
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=J: /All /Quiet
          2⤵
            PID:2644
            • C:\Windows\SysWOW64\vssadmin.exe
              vssadmin Delete Shadows /For=J: /All /Quiet
              3⤵
              • System Location Discovery: System Language Discovery
              • Interacts with shadow copies
              PID:1608
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=I: /All /Quiet
            2⤵
            • System Location Discovery: System Language Discovery
            PID:2628
            • C:\Windows\SysWOW64\vssadmin.exe
              vssadmin Delete Shadows /For=I: /All /Quiet
              3⤵
              • System Location Discovery: System Language Discovery
              • Interacts with shadow copies
              PID:1948
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=H: /All /Quiet
            2⤵
            • System Location Discovery: System Language Discovery
            PID:3044
            • C:\Windows\SysWOW64\vssadmin.exe
              vssadmin Delete Shadows /For=H: /All /Quiet
              3⤵
              • System Location Discovery: System Language Discovery
              • Interacts with shadow copies
              PID:2420
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=G: /All /Quiet
            2⤵
            • System Location Discovery: System Language Discovery
            PID:1512
            • C:\Windows\SysWOW64\vssadmin.exe
              vssadmin Delete Shadows /For=G: /All /Quiet
              3⤵
              • System Location Discovery: System Language Discovery
              • Interacts with shadow copies
              PID:1976
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=F: /All /Quiet
            2⤵
            • System Location Discovery: System Language Discovery
            PID:2428
            • C:\Windows\SysWOW64\vssadmin.exe
              vssadmin Delete Shadows /For=F: /All /Quiet
              3⤵
              • System Location Discovery: System Language Discovery
              • Interacts with shadow copies
              PID:3068
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=E: /All /Quiet
            2⤵
            • System Location Discovery: System Language Discovery
            PID:1740
            • C:\Windows\SysWOW64\vssadmin.exe
              vssadmin Delete Shadows /For=E: /All /Quiet
              3⤵
              • System Location Discovery: System Language Discovery
              • Interacts with shadow copies
              PID:2840
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=D: /All /Quiet
            2⤵
            • System Location Discovery: System Language Discovery
            PID:1980
            • C:\Windows\SysWOW64\vssadmin.exe
              vssadmin Delete Shadows /For=D: /All /Quiet
              3⤵
              • System Location Discovery: System Language Discovery
              • Interacts with shadow copies
              PID:2328
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=C: /All /Quiet
            2⤵
            • System Location Discovery: System Language Discovery
            PID:1368
            • C:\Windows\SysWOW64\vssadmin.exe
              vssadmin Delete Shadows /For=C: /All /Quiet
              3⤵
              • System Location Discovery: System Language Discovery
              • Interacts with shadow copies
              PID:1640
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=B: /All /Quiet
            2⤵
            • System Location Discovery: System Language Discovery
            PID:1956
            • C:\Windows\SysWOW64\vssadmin.exe
              vssadmin Delete Shadows /For=B: /All /Quiet
              3⤵
              • System Location Discovery: System Language Discovery
              • Interacts with shadow copies
              PID:2660
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=A: /All /Quiet
            2⤵
            • System Location Discovery: System Language Discovery
            PID:672
            • C:\Windows\SysWOW64\vssadmin.exe
              vssadmin Delete Shadows /For=A: /All /Quiet
              3⤵
              • System Location Discovery: System Language Discovery
              • Interacts with shadow copies
              PID:2604
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C net stop vss
            2⤵
            • System Location Discovery: System Language Discovery
            PID:352
            • C:\Windows\SysWOW64\net.exe
              net stop vss
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2204
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop vss
                4⤵
                • System Location Discovery: System Language Discovery
                PID:236
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} recoveryenabled No
            2⤵
            • System Location Discovery: System Language Discovery
            PID:2824
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
            2⤵
            • System Location Discovery: System Language Discovery
            PID:3032
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" bcdedit /set {default} recoveryenabled No
            2⤵
              PID:2156
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" bcdedit /set {default} bootstatuspolicy ignoreallfailures
              2⤵
              • System Location Discovery: System Language Discovery
              PID:2632
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" bcdedit /set bootstatuspolicy ignoreallfailures
              2⤵
              • System Location Discovery: System Language Discovery
              PID:1456
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C bcdedit /set bootstatuspolicy ignoreallfailures
              2⤵
              • System Location Discovery: System Language Discovery
              PID:2120
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" bcdedit /set recoveryenabled NO
              2⤵
              • System Location Discovery: System Language Discovery
              PID:1228
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C bcdedit /set recoveryenabled NO
              2⤵
              • System Location Discovery: System Language Discovery
              PID:2460
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
              2⤵
              • System Location Discovery: System Language Discovery
              PID:1132
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" wbadmin delete catalog -quiet
              2⤵
              • System Location Discovery: System Language Discovery
              PID:2132
            • C:\Windows\SysWOW64\NOTEPAD.EXE
              "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Documents\HELP_DECRYPT_YOUR_FILES.TXT
              2⤵
              • System Location Discovery: System Language Discovery
              • Opens file in notepad (likely ransom note)
              PID:2348
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1924
          • C:\Windows\system32\conhost.exe
            \??\C:\Windows\system32\conhost.exe "91085333901890196-1753099355-8969561741941433555-84248546-858861578-81699321"
            1⤵
              PID:1724
            • C:\Windows\system32\conhost.exe
              \??\C:\Windows\system32\conhost.exe "217984449-101233139720986669341669016468-1477020934196276252941692237-1796693014"
              1⤵
                PID:1152

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\PerfLogs\HELP_DECRYPT_YOUR_FILES.TXT
                Filesize

                3KB

                MD5

                a2055997c8035d5ddedcc5e320a71aa9

                SHA1

                3749338fe70104e808c368ff4375e8a763d91034

                SHA256

                b4513c07ca8c741c7128f273654afae79ead9420a17a624c9c0f375bea133618

                SHA512

                d3624f8ca4080ed87252a5260514e27d399cf3338cfdb6e6b9b7cd86e781bd47afe9df8e96263a74ae98de6562d863c00dce6367634787050f21af4e103b7334

                Download Submit

              • C:\PerfLogs\HELP_DECRYPT_YOUR_FILES.TXT
                Filesize

                3KB

                MD5

                8c79c6def5f6885c246c67a6eae62e5b

                SHA1

                0503d52c041f4f17a15b7a3de4cd597b5568b549

                SHA256

                ee077ed2278db68f4e7d6b54a5debf4a849914813deccb2a758fec8ae8c7adef

                SHA512

                75ef932c437053cf98b6707d4bb92281032e72130a7a1498e5515f25cfb03a7c007c2bc3f7e9ef03e3cb82c8a0fb5c0c2047ea1fca44b11ea089c5aed0feab23

                Download Submit

              • memory/2236-0-0x0000000000130000-0x000000000013B000-memory.dmp

                Filesize

                44KB

                Download