Overview

overview

10

Static

static

6

AES-NI.exe

windows7-x64

7

AES-NI.exe

windows10-2004-x64

7

Abrechnung.exe

windows7-x64

8

Abrechnung.exe

windows10-2004-x64

8

Box (2).exe

windows7-x64

3

Box (2).exe

windows10-2004-x64

3

Box.exe

windows7-x64

3

Box.exe

windows10-2004-x64

3

a66dde2298...43.exe

windows7-x64

9

a66dde2298...43.exe

windows10-2004-x64

9

a7768f4973...e0.exe

windows7-x64

10

a7768f4973...e0.exe

windows10-2004-x64

10

aa7ff3bc28...1e.exe

windows7-x64

7

aa7ff3bc28...1e.exe

windows10-2004-x64

7

aace43af8d...99.exe

windows7-x64

8

aace43af8d...99.exe

windows10-2004-x64

8

ad3cc219a8...ws.dll

windows7-x64

10

ad3cc219a8...ws.dll

windows10-2004-x64

10

aee03626b8...b1.exe

windows7-x64

6

aee03626b8...b1.exe

windows10-2004-x64

6

afd3b729cf...2e.exe

windows7-x64

10

afd3b729cf...2e.exe

windows10-2004-x64

10

b56c4569d6...ss.exe

windows7-x64

3

b56c4569d6...ss.exe

windows10-2004-x64

3

0.84762379...67.exe

windows7-x64

7

0.84762379...67.exe

windows10-2004-x64

3

zsgblrbrum...ke.exe

windows7-x64

7

zsgblrbrum...ke.exe

windows10-2004-x64

3

b7d9f11c16...b0.exe

windows7-x64

5

b7d9f11c16...b0.exe

windows10-2004-x64

5

b8f60c64c7...af.exe

windows7-x64

10

b8f60c64c7...af.exe

windows10-2004-x64

10

Resubmissions

22-11-2024 22:54

241122-2vh7gaxmfl 10

22-11-2024 03:27

241122-dzqkcatmht 10

22-11-2024 03:16

241122-dsgc4atlgs 10

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-11-2024 03:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe

  • Size

    164KB

  • MD5

    08b304d01220f9de63244b4666621bba

  • SHA1

    b7f9dd8ee3434b35fbb3395f69ff43fd5112a0c6

  • SHA256

    afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e

  • SHA512

    162cc0fb48615c67ce6e104ca462c41aba79bad0d5409e837b300cffc34a1c9bed63f603eee7091b93edfcd772d8ab1e180fcb3aae6b07fe24413b8505815ae9

  • SSDEEP

    3072:fHynAdzu0t5GtE13lkAB9z3KJZ3fCI1AjZ7yXgpiqQp:fHKautY3TzaJZarjZeXgpn

Score
10/10
hydracryptdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Signatures

  • HydraCrypt

    Relatively unsophisticated ransomware family based on leaked CrypBoss source code.

    ransomwarehydracrypt
  • Hydracrypt family
    hydracrypt
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (877) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 64 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe
    "C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4464
    • C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe
      C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4920
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C net stop vss
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3560
        • C:\Windows\SysWOW64\net.exe
          net stop vss
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2088
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop vss
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4384
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4692
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4348
        • C:\Windows\SysWOW64\Wbem\WMIC.exe
          wmic shadowcopy delete
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1284
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=Z: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4756
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=Y: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1264
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=X: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4984
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=W: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1084
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=V: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1156
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=U: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2580
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=T: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:636
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=S: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3184
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=R: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3164
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=Q: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4872
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=P: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1584
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=O: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2816
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=N: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1424
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=M: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3468
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=L: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4024
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=K: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5092
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=J: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:968
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=I: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4672
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=H: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:388
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=G: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5044
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=F: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3304
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=E: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1936
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=D: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2216
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=C: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1792
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=B: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1536
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=A: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5104
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 992
        3⤵
        • Program crash
        PID:5000
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2516
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
    1⤵
      PID:4984
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4920 -ip 4920
      1⤵
        PID:3016

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Windows Management Instrumentation

      1
      T1047

      Persistence

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Privilege Escalation

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Defense Evasion

      Indicator Removal

      1
      T1070

      File Deletion

      1
      T1070.004

      Modify Registry

      1
      T1112

      Credential Access

      Credentials from Password Stores

      1
      T1555

      Credentials from Web Browsers

      1
      T1555.003

      Unsecured Credentials

      1
      T1552

      Credentials In Files

      1
      T1552.001

      Discovery

      Peripheral Device Discovery

      1
      T1120

      Query Registry

      2
      T1012

      System Information Discovery

      3
      T1082

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      Lateral Movement

      Collection

      Data from Local System

      1
      T1005

      Command and Control

      Exfiltration

      Impact

      Inhibit System Recovery

      1
      T1490

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.hydracrypttmp_ID_21570a38
        Filesize

        126KB

        MD5

        5b17e79ecb3b05331e2cae87132bee94

        SHA1

        fd518e5c6db7e7c8db38402ccaa8fb3d882de44d

        SHA256

        bf5b2af915a3d35666daaac46aee6c12ae61d15e9f54cbfda4cb0cbb9e3ff3af

        SHA512

        c2b4fa9c4d756d69328a700eaf65ff7fad61bce3d10e842c59d8e10fe14c566aaff933e53430bb982f26c49a03cedf4197bc35b75b1d61b68e076bae5a2696c5

        Download Submit

      • C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.hydracrypttmp_ID_21570a38
        Filesize

        28KB

        MD5

        39374b9b2988a9b02cf36a34b73d4116

        SHA1

        c670c01e9b37c12ada0cb6938d086683b4beffa0

        SHA256

        7c1319f95b088bd6a6391ba9c98d7caf1e7cb85cd75a88bc6723698909199c3f

        SHA512

        047df782611e2d6525d19bdc0e421358fa2c7cb60cb0a8a5a4132e5bb1ca1125ae5b23a8e822193979be998d1c35b84a9650865f50af6760aa41028f1c8d58c0

        Download Submit

      • C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml.hydracrypttmp_ID_21570a38
        Filesize

        1KB

        MD5

        7351a81c4d20a7aaa0081c018696c54d

        SHA1

        24ca98301c52e490aa08f801d083dd4b8af28f3d

        SHA256

        fd15029d2ddef485fc2464ee95dc76070a9e5425254e15c89f864a5f1eea1798

        SHA512

        5631767d63f24e631ebcc2fad01eadbadccb9c4216095377f59d69e680fc83e4e3250dc86785eee1020d91c3ffcaefea7739a96382c520f7cec25fc1a5f4df12

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\onenote.exe.db.hydracrypttmp_ID_21570a38
        Filesize

        24KB

        MD5

        a6b8dbc8030cc0f1b83618ebc909fd2f

        SHA1

        b80876f99945f583a2285d06e38cd90f85cc7f0b

        SHA256

        24f59e7d5c0edb47a1fd8349adff3b9bdb2e50445ccbd7253619862f75a17ebc

        SHA512

        486e28fe25c77703822ff462eb97d1d501fcbc05a96b8c22564de989abdb7fc25aa3167d8389180e54c6ec345f24c5cea827b230fadd9839246e0d34eb00dc7c

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini.hydracrypttmp_ID_21570a38
        Filesize

        174B

        MD5

        02494c087ed5287d2e72e42ea1c557ca

        SHA1

        d3db903905afe5e0c3f4e6d3260483ac0aa13b7b

        SHA256

        e2fca7cd359c79e2c74edca3871e3107d0a334f340518c24461da353a93c83d6

        SHA512

        b03f9e3215d80f157c599e1903476750571bed3b0628508253c829e55ede82f9b81364e584ca664550415c675a521c498a340dc0aa4f39982cad5d17eeadbd12

        Download Submit

      • C:\Users\Admin\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\Settings\settings.dat.hydracrypttmp_ID_21570a38
        Filesize

        8KB

        MD5

        f13c4d08d9b7141e4817d80756b75628

        SHA1

        50416068bfcff14a0cd930f5faf9ec13b96544fc

        SHA256

        c9aae3b231e457c131c1a5044cde9b6fd2379cde2ea0960ed87e9fd010ea5023

        SHA512

        754caad1a1a83a77e8e9a3c283c2a865edf73c4251cd7de778afaa280830737a6a00a0f4b2599507fe77695c82a5eeaed6bbbde275e6f7bb3cff0030bebfe8a4

        Download Submit

      • C:\Users\Admin\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat.hydracrypt_ID_21570a38
        Filesize

        8KB

        MD5

        e5d3a89a7ed3944e676ae7013753e0be

        SHA1

        684a7760be8ae70e0c7d9904f36e2f8bee20d0f8

        SHA256

        3850933aeb770fd8473228bb99f22f81b0de8c62effc8edba9b965ed249fc36b

        SHA512

        ae740148737f4e9e00b1dc8edf0e940ca013d6a15197dcb461c3173159014df195397e1108d79d8ca4541b48a1b6fbfc7fc360f86b2ded9ed3cdeccded952065

        Download Submit

      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{d27f7a4e-22e4-44a8-a73c-c7a901abf364}\0.1.filtertrie.intermediate.txt.hydracrypttmp_ID_21570a38
        Filesize

        5B

        MD5

        be3a3875375fc92d4e16b08084148255

        SHA1

        f8b3ca86a24f0adbb929ba99f1c9cb8e9fbe66b0

        SHA256

        c3a151ee660698762883214962f25e966a6377648b92fc262f14f01cfe94e33b

        SHA512

        76882da8c63658433832eba398bffe1d16c9b31e6ee27168dca04dfd257cb87faf12e1835ac90680060f7f4fcfa3737f3bf80a9386ffc4e45dc39ad5fa93e89e

        Download Submit

      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{d27f7a4e-22e4-44a8-a73c-c7a901abf364}\0.2.filtertrie.intermediate.txt.hydracrypttmp_ID_21570a38
        Filesize

        5B

        MD5

        855ac6bba178bdffc325b767f928fb5d

        SHA1

        11cf3936d19624200a02b252e7445809c6a8a2d4

        SHA256

        5b8a17a60fa226010357f4279e170c593e482e5f368f5d8f73b154e46d9969d1

        SHA512

        50d636633ca86e0493248c705f8da996588cf6219b4a60d08a96af528cfd2d7fb12bb60596092d79bc0dfb257831e75f9ec7ec070851b9873b99ed931c8602f1

        Download Submit

      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727661992394667.txt.hydracrypttmp_ID_21570a38
        Filesize

        77KB

        MD5

        628204b2f70a70f26bbc7a834c05b82c

        SHA1

        889e0c42d8bfbab319d58b64df8fdcc6edf96ff3

        SHA256

        618c7500ab7098d5fcbdcfe0da9e702f2ac1d158d2ba3712f7e36db76b25b6c2

        SHA512

        3f59a2999666a6def78c5119b5bac0168a37a9d2de9dad5652b231ace60d33d8b92171de127f8b62b33884333d32c7c646bd4c901b76fd615d6d2ddc59c09346

        Download Submit

      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727662487357744.txt.hydracrypttmp_ID_21570a38
        Filesize

        47KB

        MD5

        d65755c3a749e82fc509896068b7d1ba

        SHA1

        eddd971b5be1cdbc5db05e5df0588cadb46547c9

        SHA256

        ca867a020abfe7800ef2860ea881aebc14ea1546ec16ef16bf8de0d3117d53fc

        SHA512

        f01ebbb8b808fe1361e709cf57ddcc92008f784f3589b48c68495130ee1ed4a7d11a86f6966122fbf9cfc5814c4f31765b384b538d8f9846cea8f99a4563b362

        Download Submit

      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727667722373689.txt.hydracrypttmp_ID_21570a38
        Filesize

        63KB

        MD5

        a9a75f0667470f8e9a826860b1fda9b9

        SHA1

        b53f0ed5b51abbe88431b0bda2ff5be7d0c84428

        SHA256

        a38f1cf1afd9f453a140d6087f8114fd1517cf650a421014392a779a7e5ac8af

        SHA512

        49b9b36dd106a932f37ef149091c8d8973f25d3f53d9f173edcafb7c8d052abc3192978c2ef6d9cc51e15a911f5493e0306d66f600d6b1d281f9c5525c8ad794

        Download Submit

      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727670771168387.txt.hydracrypttmp_ID_21570a38
        Filesize

        74KB

        MD5

        17ff62421f0c9e015b37ea10ecf46eae

        SHA1

        13a956fba5bacf58b0a4310d81bdb601078e33e6

        SHA256

        3396becc8fbb3e3244fe1860df3fc50a02e7c831f212a411dd235652ae798c65

        SHA512

        7a2a713e19f7a685544caea0dc57500625996fece0107a5ea410a8b14aeab00f585bec64e264fe1972b4d8863cd696f8df5816c926733b101c905938c133164f

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20241007_092056739.html.hydracrypttmp_ID_21570a38
        Filesize

        93KB

        MD5

        e80012c5625f98b87d46446decd09102

        SHA1

        375786e42e62f11300aab8551685467f6a8f721c

        SHA256

        99a46d8723a075418bb13c4150ba17d6c0d0d03d5f0e7fb6501e82d26f5e5154

        SHA512

        be26e9d1fc1113104d62f09ac649a93c6489f9ddc53575a0fa2974f961c94e6e47936fa3407cb3b951fd396b2423af556dec29b1316deab361c9052c3b2445b3

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\wctBB70.tmp.hydracrypttmp_ID_21570a38
        Filesize

        63KB

        MD5

        85ee6510fa18ea3c49c4e9bc0105d385

        SHA1

        f23c5a8218379173cfa8a9a48bf9c590d213a76f

        SHA256

        23c994642202d3b230f4b27c6ae5e1e2d5ddc082df5020909636ed5231462a65

        SHA512

        a7d421edd420aa6133e7f70290d5692b0888137d9ddd11890418f506f7f7fbc4422753aa1cf99e8b97a5ff70f6faa5ac8d0dc3ab04147e7e66cb550b235398dd

        Download Submit

      • C:\Users\Admin\AppData\Roaming\1$FUWW$FFHEX.dat
        Filesize

        1KB

        MD5

        bd02025c8d6b75ab1d338797a57fb1d1

        SHA1

        6fdeffaba39c41b599486e94d88bfe4d75210628

        SHA256

        a10cd5bc265c188476a1a282a2a6672bfecfb3808e30d70bbffb8edd8f281496

        SHA512

        7b574fa0d35bd785e2f7959a6dda27f48f5150ae7f47f22ba2a045d017b4fde01dd1760b3c89309b21b9aab875d87919b820370793dcb3d631cbdcf09eb92642

        Download Submit

      • C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini.hydracrypttmp_ID_21570a38
        Filesize

        170B

        MD5

        20b457a1c4aa4e04a93d299ae00d4690

        SHA1

        02eeaaac47792c7b4ec8a0c6bdbae86d58613b33

        SHA256

        cb98c487fff4e52bf87dcebabc6a90c82ebe9e03f9d400a97e26832dcbf9219e

        SHA512

        8eb7e6560334f41de23adf83cd08dc08e1e2236f2f7b05df7dec606392ff46f02a683d859adb1348f31ce369e2112914ab2c5caede13e2e94e4ec8f3a3e3e9c7

        Download Submit

      • C:\Users\Public\Videos\README_DECRYPT_HYDRA_ID_21570a38.txt
        Filesize

        915B

        MD5

        d1117ee51aa0dd90c453508e1a9d2061

        SHA1

        f23ed4387d70684312d1404d478c1d59a00c79ef

        SHA256

        f7a572269ec08b016b01d114955dd1a8530bcf426c2bd3a62d0781734bf1145f

        SHA512

        7e31b9ee37b3bb10973930d88865222790b10174b92f205f07473cc39dcbaf62cb1ada193c8494182cc8842ae32d93cca69fdf0e02aad77d68b1940aa3850103

        Download Submit

      • memory/4464-0-0x0000000000A30000-0x0000000000A35000-memory.dmp

        Filesize

        20KB

        Download

      • memory/4920-2236-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/4920-450-0x0000000000400000-0x0000000000978000-memory.dmp

        Filesize

        5.5MB

        Download

      • memory/4920-4244-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/4920-449-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/4920-3-0x0000000000400000-0x0000000000978000-memory.dmp

        Filesize

        5.5MB

        Download

      • memory/4920-1-0x0000000000400000-0x0000000000978000-memory.dmp

        Filesize

        5.5MB

        Download

      • memory/4920-5194-0x0000000000400000-0x0000000000978000-memory.dmp

        Filesize

        5.5MB

        Download

      • memory/4920-5197-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download