akira | ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-11-2024 16:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
Size

1.0MB
MD5

56f673b1d3d65dce3ef3c8754098df04
SHA1

41323075a7dc590f20a154f503e089d2dac2fd12
SHA256

ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5
SHA512

8496c865cd0ec11b82d2d34d831c94bdd621f7a677f245bf098bc1adc57b6a6fbc249c452ccff24a3199348531643b82da3ee7583790044d6ed42f25d42724d1
SSDEEP

12288:Vpp+QIEmDzuImC01vbUE98pik+2i1NkshdMMK+AX99etq2dTdjf:Vpp+Q+u5bUI8pij1NkshdMf99etb5R

Score

10^/10

akira execution persistence ransomware ransowmware spyware stealer

Malware Config

Extracted

Path

C:\PerfLogs\Admin\akira_readme.txt

Family

akira

Ransom Note

Hi friends, Whatever who you are and what your title is if you're reading this it means the internal infrastructure of your company is fully or partially dead, all your backups - virtual, physical - everything that we managed to reach - are completely removed. Moreover, we have taken a great amount of your corporate data prior to encryption. Well, for now let's keep all the tears and resentment to ourselves and try to build a constructive dialogue. We're fully aware of what damage we caused by locking your internal sources. At the moment, you have to know: 1. Dealing with us you will save A LOT due to we are not interested in ruining your financially. We will study in depth your finance, bank & income statements, your savings, investments etc. and present our reasonable demand to you. If you have an active cyber insurance, let us know and we will guide you how to properly use it. Also, dragging out the negotiation process will lead to failing of a deal. 2. Paying us you save your TIME, MONEY, EFFORTS and be back on track within 24 hours approximately. Our decryptor works properly on any files or systems, so you will be able to check it by requesting a test decryption service from the beginning of our conversation. If you decide to recover on your own, keep in mind that you can permanently lose access to some files or accidently corrupt them - in this case we won't be able to help. 3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data. 4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion. 5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us. If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions: 1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/. 2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion. 3. Use this code - 1342-ZC-SLJQ-YDCX - to log into our chat. Keep in mind that the faster you will get in touch, the less damage we cause.

URLs

https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion

https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion

Signatures

Akira
Akira is a ransomware first seen in March 2023 and targets several industries, including education, finance, real estate, manufacturing, and consulting.
ransomware akira
Akira family
akira

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

powershell.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2040	3052	powershell.exe

Renames multiple (8640) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell command to delete shadowcopy.
execution ransowmware

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2040 powershell.exe

pid	process
2040	powershell.exe

Drops startup file 1 IoCs

Processes:

ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\akira_readme.txt	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 47 IoCs

Processes:

ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\QJELLEL3\desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Users\Public\desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\HE9LBEC2\desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\YLJ4V77F\desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files\desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\RM4QEUM4\desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Drops file in Program Files directory 64 IoCs

Processes:

ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe

description	ioc	process
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lo\LC_MESSAGES\vlc.mo	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\es-ES\sbdrop.dll.mui	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\ado\en-US\msader15.dll.mui	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui_5.5.0.165303.jar	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\SUBMIT.JS	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_VelvetRose.gif	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sw\LC_MESSAGES\akira_readme.txt	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\2.png	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-queries.jar	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\AUDIOSEARCHMAIN.DLL	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Puerto_Rico	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Computers\akira_readme.txt	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\2c1e44b6cc009b0c7fbf2dc1601a4a41.arika	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkObj.dll.mui	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\MLA.XSL	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\64ef4a2a6bea026c231b5c939e884865.arika	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR47B.GIF	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\SystemV\MST7	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files\Windows Journal\en-US\JNTFiltr.dll.mui	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGCHKBRD.DPV	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0185778.WMF	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0282932.WMF	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02439_.WMF	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0299611.WMF	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cgg\akira_readme.txt	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\settings.html	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\METCONV.DLL	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Paper.xml	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR9B.GIF	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\chkrzm.exe.mui	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_thunderstorm.png	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\Office64MUI.XML	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL078.XML	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGBOXES.DPV	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21520_.GIF	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Tasks.accdt	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGWEBBTN.DPV	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\settings.js	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\clock.css	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\settings.html	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\rtscom.dll.mui	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\akira_readme.txt	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01243_.GIF	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Africa\Bissau	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue.css	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\FORMCTL.POC	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\css\calendar.css	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\akira_readme.txt	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.attach_5.5.0.165303.jar	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File created	C:\Program Files\Microsoft Games\Chess\en-US\akira_readme.txt	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File created	C:\Program Files\Microsoft Games\Purble Place\en-US\akira_readme.txt	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Riga	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0314068.JPG	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface_3.10.1.v20140813-1009.jar	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-templates.xml	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\akira_readme.txt	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\ENVELOPE.XML	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\akira_readme.txt	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe

Drops file in Windows directory 2 IoCs

Processes:

explorer.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe	explorer.exe
File opened for modification	\??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\sc_reader.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 5 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exepowershell.exe

pid	process
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2040	powershell.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
2072	ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

2208 explorer.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes:

powershell.exevssvc.exeexplorer.exe

description	pid	process
Token: SeDebugPrivilege	2040	powershell.exe
Token: SeBackupPrivilege	2768	vssvc.exe
Token: SeRestorePrivilege	2768	vssvc.exe
Token: SeAuditPrivilege	2768	vssvc.exe
Token: SeShutdownPrivilege	2208	explorer.exe
Token: SeShutdownPrivilege	2208	explorer.exe
Token: SeShutdownPrivilege	2208	explorer.exe
Token: SeShutdownPrivilege	2208	explorer.exe
Token: SeShutdownPrivilege	2208	explorer.exe
Token: SeShutdownPrivilege	2208	explorer.exe
Token: SeShutdownPrivilege	2208	explorer.exe
Token: SeShutdownPrivilege	2208	explorer.exe
Token: SeShutdownPrivilege	2208	explorer.exe
Token: SeShutdownPrivilege	2208	explorer.exe
Token: SeShutdownPrivilege	2208	explorer.exe
Token: SeShutdownPrivilege	2208	explorer.exe

Suspicious use of FindShellTrayWindow 28 IoCs

Processes:

explorer.exe

pid	process
2208	explorer.exe
2208	explorer.exe
2208	explorer.exe
2208	explorer.exe
2208	explorer.exe
2208	explorer.exe
2208	explorer.exe
2208	explorer.exe
2208	explorer.exe
2208	explorer.exe
2208	explorer.exe
2208	explorer.exe
2208	explorer.exe
2208	explorer.exe
2208	explorer.exe
2208	explorer.exe
2208	explorer.exe
2208	explorer.exe
2208	explorer.exe
2208	explorer.exe
2208	explorer.exe
2208	explorer.exe
2208	explorer.exe
2208	explorer.exe
2208	explorer.exe
2208	explorer.exe
2208	explorer.exe
2208	explorer.exe

Suspicious use of SendNotifyMessage 16 IoCs

Processes:

explorer.exe

pid	process
2208	explorer.exe
2208	explorer.exe
2208	explorer.exe
2208	explorer.exe
2208	explorer.exe
2208	explorer.exe
2208	explorer.exe
2208	explorer.exe
2208	explorer.exe
2208	explorer.exe
2208	explorer.exe
2208	explorer.exe
2208	explorer.exe
2208	explorer.exe
2208	explorer.exe
2208	explorer.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe
"C:\Users\Admin\AppData\Local\Temp\ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5.bin.exe"
1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:2072

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -Command "Get-WmiObject Win32_Shadowcopy | Remove-WmiObject"
1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2040

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2768

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL

Filesize
6.4MB

MD5
5c1bf2729492f0ed4f7ccf8ab2600fd6

SHA1
10dfdd7b34d7ca7bf3a1ec4069899e10215f3b8b

SHA256
eb5e7093b72ab6ffa13d33fb6b511bf5fbbf890f78132f93fa115d2bcb1e55db

SHA512
bf954a0dd6c14f606e39cecd027c09359ab548f892e1690e913f392c84357f8b4f2b59a472d834b515e6f99e83d0e899fd9c8ecdfdd700a65e61bc217a2eb0f4

Download Submit
C:\PerfLogs\Admin\akira_readme.txt

Filesize
2KB

MD5
8911b4610953c2433136df6a6404bd4c

SHA1
b198ba0fed1bc3888e85cfb64b694736e42b011c

SHA256
986645b3e96ce4ffdb76723233a26fc12b6b4074888477ade0cbdf92b59ac002

SHA512
0a72bf31f7f7acb6ed2c1502ebffb6f35824c254fecdde865de2c6976fed2410ec5b80354364b323e16f966c07a10561f779e3f23c2774bcb1bbac57439b7824

Download Submit
C:\Users\Admin\Desktop\ConfirmRestart.docx.akira

Filesize
22KB

MD5
31d53ddc46c033b3db8f3a74f1a2bc33

SHA1
d13e92bf2eca20839780cc38610245cfc8007ec8

SHA256
3a0510719b9e8b32d4898bdf8c6438ed9db6eee8bf44b4eb4e617a652389863f

SHA512
0da9c3f0eaf3393381b9431d6bb25777a3f8334962d7d282256439927dd660dc965b5ebafe3b1eec6e3c9e20f336331de2754b3062ab8928f3a46adc5df30e1e

Download Submit
C:\Users\Admin\Desktop\DenyCompress.midi.akira

Filesize
242KB

MD5
58a506df7680a25b5577fe3663067567

SHA1
ffd11f18239ca193a69ea75dc22f44822330a769

SHA256
0000af7fc4efef2614585f3b621c6e4fae54e59828f30f063020b38900ab38d8

SHA512
a39788ed97e1659049245b255343f4dd1ec24a9b7d3da1e8f3bf2aa3dec3b893c65f93e83eca82b2b74a97f49779d96d814e9627d3d177a67ff5566cd02ae1a3

Download Submit
C:\Users\Admin\Desktop\DismountHide.ico.akira

Filesize
341KB

MD5
6571cffb8e56b34ec7e815e344024d36

SHA1
f3949e7650cab5e5409fe1a8765f626978e7d5c0

SHA256
98917566d1a8cece1f2b3dbe82fc10d5d37301a9e18d2e9294510444fa2366e5

SHA512
f9a1ecea2c46fbd32b266463d86629b392e9a2e99fbd47b570d7d688debd2a097a1f8fe88a584f48bf15bb4c88e3159f676510650a1764337ad0e234d7151ccc

Download Submit
C:\Users\Admin\Desktop\ExpandExit.rm.akira

Filesize
484KB

MD5
00035388f502f251f3f61913d58e438e

SHA1
9e1ff861e14f136ff061a62c4cf8d919feddb6f0

SHA256
0c8e4c90fa39609e849de8b27d526ffb0ea7e61029f7ecfe489617c5d0a061c8

SHA512
2a73ebb5e17d850210fc7e87b4282e1cc041a908729441b5da591a157ad56aacf654946107d35a2cfb74cf28c20b4bebb7296ca252339bbadcc1e971c9556c94

Download Submit
C:\Users\Admin\Desktop\ExportUnprotect.xsl.akira

Filesize
299KB

MD5
9041e84c5f0247ae96172bebcc56205e

SHA1
9ca59e8898b65252d21da25ae8115fb17edbf0ce

SHA256
645d6f4362f366b6bf9788cea6d305dd21900bc4be3111daf9f20aeb9b7154a9

SHA512
4ebd2c11f2c5cc550470081d53da1f160522c6d1fed900518d2594d432a783cc52c8a0404aaaa56ea34fdfd8c548814d5732ab1867ec7c85c871b4ec5ff5add9

Download Submit
C:\Users\Admin\Desktop\GetApprove.xlsx.akira

Filesize
11KB

MD5
08f758bc511a735a0afc9d9e97be372a

SHA1
b4654c2617300478e9cbd2d61620c94a05a674a0

SHA256
d1356f28bcc77b0cd735c331cbcbfe180ce52e5328a3a449752b3803965e8c77

SHA512
bee828375afe68ccdedce629b86e7249285515e9c02519271e05c0ae30b444079459068c8775d6d60650f4a687dae16a16653c10f217160acd3f0b6875c822e2

Download Submit
C:\Users\Admin\Desktop\GroupSkip.docx.akira

Filesize
19KB

MD5
81131d522498428525bf0c56de2accf6

SHA1
7f9760aaea8dbb33ad2533bc8f1a414a76a0b22f

SHA256
ca07cb4cb38ff311dfc9bff860238f33a7ac52320692f96b28805941b7134a97

SHA512
893d1027fc3a19cceae870e3b332cf89d4e0c32ebb94ee9c671a97049f9a73efd69fd86c27f1cfb6cb57b3da664975aafc21116404c485d3c3130b676139d4d0

Download Submit
C:\Users\Admin\Desktop\InitializeInvoke.sql.akira

Filesize
185KB

MD5
b89c224053b33e30209adf1bcab1d84a

SHA1
efbb30cf451c8f30dce664226227f36f17ea7503

SHA256
6ef55b1efea7082a87e3863390e853cf90415b22cea0f48e1f5e17f50a3bafdd

SHA512
2aa3e3a05a611d0e8c8715d75276518bfc35cb5105129cef9e2752715d008e6def7c389cb6571c8ec4d6e66e9cf702dc66ff93de700789dffd821cadf6286273

Download Submit
C:\Users\Admin\Desktop\InitializeSelect.docx.akira

Filesize
18KB

MD5
45804d03e89442d8b539698644e77a33

SHA1
fb97cf24def3d6c9e344d52e7aa404859fb1fd49

SHA256
4b2a699f795e39ca9c4abcc083c354d25ad3d1074566dfe5e76a418ea96cd355

SHA512
566a166a16cf899d7db816936dabda6e80eefb6c93a41093bf610d87b308b717542fc76bfed1901d3ab1e1200e953d9973f4cddf0b5877554777ea52a28d82e5

Download Submit
C:\Users\Admin\Desktop\MergeCompress.TTS.akira

Filesize
455KB

MD5
6c157184fe6e5ec8d2b3215fd30226b4

SHA1
a91549a9852afa17ae2403beb5ee1832b05afb79

SHA256
9dcac1436acc0ae53c7d65e0e211b7a65ce3e476019af7c4ca774b560749da0b

SHA512
fa43ccf4e78347f7ef718a274be76af90f2382c584c193214ddf2cc59c4650316e9ad2b0443838e98d3b7968d355e6523bc32d6df471a56d6936c226f99856e5

Download Submit
C:\Users\Admin\Desktop\ProtectRegister.ttf.akira

Filesize
441KB

MD5
67fcd942dcadd7578b4a3c5e8253c88a

SHA1
1f80f662a13cb0741a8cdda3bd355a7af3df91ad

SHA256
d5e3afdb10e17840cc8c24f266bdc4885a5f24a0b91b8eb0cf5ae403fd46cace

SHA512
4df9eb22b5a0312477b896616efa6f4514f7aa912da3862075d6f86da3fe606bde6bde540481fdd7325c065d29f6253ecb3a58698ec2717f9fdf349c4cffcffe

Download Submit
C:\Users\Admin\Desktop\PushReset.ram.akira

Filesize
327KB

MD5
a1c2dfe1c36080a98309348238c69cd7

SHA1
6a3fbd41309f1a2af725dcbb5b565a829fd0f294

SHA256
f163c2996c551c002c9f74e0c9b3435fcb299be7bbf7d13667ac0d3c1824297d

SHA512
1d8364203c49c789ba7f569be7b0b17bea809e979531bd1b1bb120b020445edb3203735d49ac032ceb053ebe289a91b223d5f9f17af411d8d82ec3a7bb23fb14

Download Submit
C:\Users\Admin\Desktop\ReadComplete.ps1.akira

Filesize
284KB

MD5
0bb1dadbf8df30d09e551622fde3d3b2

SHA1
89b0902ab50fc222e5991d94ee212dd1e4c3cdc1

SHA256
f801c89066fe024dd7257312453ad0d46b2a707c1baa9fe92995712b51c27a40

SHA512
bbad60cc575da96e974b7f985d79a0c312fa0ffa415352429597f74f24be833687f31c6f9fbd1121ad9c79113f81b63c6354ee766c3db89b4ea47b661d98d241

Download Submit
C:\Users\Admin\Desktop\ReadOut.pot.akira

Filesize
412KB

MD5
bec74722a863049499af0ce4ebe3acd1

SHA1
0dd67f7370cc49478b9ce0f803ee9086f5e1fa6e

SHA256
d9f22d4cfa718ea50e2ddac5b2a793b2d2c621ce4be0ad094e9f94eebf17efde

SHA512
5ac9b24383361f65130515b2346b971cd89fa21bd881ef0bb6c9674034c296de4a5079de76898c06bdf9732858666311105f6b3c5ad6ac62f5378cb2f0383759

Download Submit
C:\Users\Admin\Desktop\ReadRepair.scf.akira

Filesize
427KB

MD5
54bece2cfc0ec84595a0de659e43d82b

SHA1
dd47d8f8fdd90ac91b00ec7bebd92956e87d84ac

SHA256
9072943666ebd17c30eb04615cdae01497fb13ebb02aa25905db9d58a0b7eac1

SHA512
7fc082e6de4a9286f70dc1be94edaf2b95555f63092f3f093fce021245f702ce4a51962d15f7b45beaebf59b39302f40e8345f0d7e1d1f13e1bb99d259ff92df

Download Submit
C:\Users\Admin\Desktop\RenameResolve.csv.akira

Filesize
228KB

MD5
aeb367c80b761e6ec120e2bc0e99eeed

SHA1
f23f690885db239aa8d00c136af51af3e8b0a6b1

SHA256
2523545a62b089d569d635b0befb1b68489539fb38aff217e92309ca7c1de556

SHA512
719f47502e26c9ff85a8b6c09a4b1dd694109135ff96278889454ac1e9780bd388cd1e523bae40948508ab90fe0f661f58b2f7a62a5cecc3c6e800d5822f26cd

Download Submit
C:\Users\Admin\Desktop\RestoreUnregister.m3u.akira

Filesize
668KB

MD5
4226a9c1ece8712a2b684e162af10c88

SHA1
55613d2d1808273876c66749936164398dde820c

SHA256
6b92866cb6b4950028774725cb3a8f6dc0cba0b6ddd1466997ec55e3afa70325

SHA512
cc7935ea920740b14d7136d5b7999d35e635843e2a566026c253f94988700b38eba5010e08c45a359a9b3b403acc6c7faaa3409f2d67de6ad1cead7f4f5ef462

Download Submit
C:\Users\Admin\Desktop\ResumeComplete.tif.akira

Filesize
256KB

MD5
90a71c6722854fb2e3223d7cee361e86

SHA1
0cfd146129b6a02d82be7c2386d12114beb1f8a9

SHA256
80848216d40c92267aef45a73ed5039f119ee6515167e64245d83e918d943f93

SHA512
a19536323061adee70bd12cc6d9f7e521678183cee4fffc8ff4d4b398eefab55b09137a12bc340513823440a2366569e7fa97dc2a3ee5697b76500e2ab643215

Download Submit
C:\Users\Admin\Desktop\ShowSwitch.doc.akira

Filesize
384KB

MD5
6608fad91c45c9073e7c165f9e76bd78

SHA1
3deecd737c38f721b5bd286dd49d3920e1616bf1

SHA256
b75b3ef542b333d6f1f1cd0e80d8946cc3acb8eeaa878f57d32498e33ec4d679

SHA512
5a07fae36a0650a8bb908ead01f73731cb5cff50b908db88197b91c82b44497641983b709963067b39bc612d56e21b447d1b3bc8ba8289599f10edffab380bcf

Download Submit
C:\Users\Admin\Desktop\SkipDisconnect.wmv.akira

Filesize
469KB

MD5
14fae003443477ba166bc2f6b497b055

SHA1
532ab1f6cc4c96c5e43afb7940e76ab6f6f95348

SHA256
85e37ba840c79e499d0da8b5024a1e498a40b1782670bb82f2798613e4e3f839

SHA512
b6320d49d5bafac97221bb191234af495a1f8be0ed671b1fcc85df1e9615a428e0fb64721e798e71875a23c627a87b4662ddc663776d19099db469ba60e775b6

Download Submit
C:\Users\Admin\Desktop\StopInitialize.inf.akira

Filesize
356KB

MD5
111879c2e841ac3603271faadf2bee36

SHA1
6f353a890c42700bfd0a805d87cf5007b6ea5f6e

SHA256
ff70d8debe47170e800d48d2da535c65e581f5046f1741d942494f5864e250da

SHA512
be6f8c0425ab013b948cc174ad4a5309ee1eab005d944b62934d05f75fe5858f4463e8d8883e404b9027796f2ad0dd7457cae2939dffe16904e2df7024a96a0e

Download Submit
C:\Users\Admin\Desktop\StopMeasure.mov.akira

Filesize
171KB

MD5
0fda6b22659fba744551f87488d09c4e

SHA1
80b3cad28e21d1e47e2471afadddf63f7b09c0d2

SHA256
ace051cc143a3c070d3943a2cb0e6b9bbaa68b847a1a272e9e6a3d8d20450e38

SHA512
6fecd9ab4969f52930ae1e9bf659dacd34d8a8b7dedb79068bfafaa96bb746cdb08a2228b0df0c673a6f836bcfe567ccc617e5ea3680c040395a9e18f8669e57

Download Submit
C:\Users\Admin\Desktop\SubmitConvertTo.xlsx.akira

Filesize
11KB

MD5
08719a622bb86956be38d0f3197b51a1

SHA1
5f74f38e34347a159ae3dc92bd70db81902b7dbd

SHA256
aea0776f2a3bd73b014659bc38f8022cbd41d31f05803582a9d724fc67b00b90

SHA512
3d9aaf500ec61fa753d11f714e6a4758368532d76564f16d159111cbb6f52b8270857684b8d1271631ed9eb92bcf038a869107b5e708dd5adb21007afd979dff

Download Submit
C:\Users\Admin\Desktop\SuspendAdd.xml.akira

Filesize
199KB

MD5
6abad443305c645e91f756125d94d815

SHA1
607d09f04c0c64940be852329d31cba77cf596f3

SHA256
e6a10eb3c546f235e1bbc510cd852f8fb36168118b1e94f1d83a52b095add294

SHA512
8ab5d0a3710ec7afee3446ca6e17fa41456edfcc6948e9872f96257c34850de6582a3a7e40d76b8f0bfd3341caa66842d69a8beec997fca28127eb463c4e0ec2

Download Submit
C:\Users\Admin\Desktop\SyncUnregister.tif.akira

Filesize
370KB

MD5
7f67694b8b58128e7b5e75c593bd4c72

SHA1
2ffa636f6490b1a9d47d89ac71093e5c06d6b1fe

SHA256
a7293cc529540c0b5c0fce9007781c93b148bdfe0a71f52e9a9f42488caf527a

SHA512
39e5fb167873e2ddb20102b73f802700956e5191e7a423b0f91545f15660ae84bf13a8c50eefbd314e58727826503374778a9914d51d4d54f4dec1217e8354cd

Download Submit
C:\Users\Admin\Desktop\UndoGet.emz.akira

Filesize
313KB

MD5
e3b1e3d72314f52e093061a4a7174745

SHA1
37481a385090c256f817f43c5cd740b472ec8f4a

SHA256
5b58d6ed558662e05b05b25271e5a7de539be0ba4de7833ebf4ff06149380b16

SHA512
d02c64895a9509b5fe315cc99d50f76d83469807ae0e8674fb87f565b6ba0a6e0438e66061d374efb86d362c590c353a8cf61f31047da983e5424b2bfdabb815

Download Submit
C:\Users\Admin\Desktop\UninstallAdd.rar.akira

Filesize
398KB

MD5
71be5b4ea7b60b93641e6a84378c2a98

SHA1
e8d740f1c1faf2b0dabfbdfb4a1d1a16f74eab44

SHA256
7d69df60975aca028a054352edacb9f45b5037b765c21fe14e46a0ac53253bba

SHA512
0893964dcb021e8600850c9baefa11ee72d3564580a31e6ff3756327df1fc12f44744aadede6f1c78cea81a12d7116369f36056c9850e85a21e25052ab3d6847

Download Submit
C:\Users\Admin\Desktop\UpdateGet.TS.akira

Filesize
213KB

MD5
60d8206ff666397d99aeedcf29b451b5

SHA1
e0cd26c0bee586631a474c589a61ed7fb95824ae

SHA256
cda58e8fec1ab7388e8521991e0329a5ded00150bea08babbe405c0acfb08f19

SHA512
5a5b10430a0fe0f5636ebffe00d6f024cd352c307a1c35746ead471c13003721bbec26615a1bec6e350084eb0e7b1b32e2bc2e2ace2c60fbd1d683d5822197e7

Download Submit
C:\Users\Admin\Desktop\WaitSelect.ocx.akira

Filesize
270KB

MD5
ec86c1afc9e9edc7ac3dd39d8e99b7e0

SHA1
90b8a36fd6f9828886f756cd66aa44767c459b05

SHA256
d42be90f3bb484ae9eacda462a43029aae5913c77c23862ce2e35310a9658248

SHA512
d42418373ecac903989d8e0d4edaf04dbde163a0a3a003d57b857d239abf146b39a50c47b70149bced2c5d1532f90286ac355b53427eaf7922c3d6ac67231ba7

Download Submit
memory/2040-5-0x000000001B710000-0x000000001B9F2000-memory.dmp

Filesize
2.9MB

Download
memory/2040-6-0x0000000001E00000-0x0000000001E08000-memory.dmp

Filesize
32KB

Download
memory/2040-7-0x000007FEF5520000-0x000007FEF5EBD000-memory.dmp

Filesize
9.6MB

Download
memory/2040-8-0x000007FEF5520000-0x000007FEF5EBD000-memory.dmp

Filesize
9.6MB

Download
memory/2040-9-0x000007FEF5520000-0x000007FEF5EBD000-memory.dmp

Filesize
9.6MB

Download
memory/2040-4-0x000007FEF57DE000-0x000007FEF57DF000-memory.dmp

Filesize
4KB

Download