Overview

overview

10

Static

static

10

08751be484...2d.dll

windows11-21h2-x64

10

0a9f79abd4...51.exe

windows11-21h2-x64

3

0di3x.exe

windows11-21h2-x64

10

2019-09-02...10.exe

windows11-21h2-x64

10

2c01b00772...eb.exe

windows11-21h2-x64

10

31.exe

windows11-21h2-x64

10

3DMark 11 ...on.exe

windows11-21h2-x64

3

42f9729255...61.exe

windows11-21h2-x64

10

5da0116af4...18.exe

windows11-21h2-x64

5

69c56d12ed...6b.exe

windows11-21h2-x64

10

905d572f23...50.exe

windows11-21h2-x64

10

948340be97...54.exe

windows11-21h2-x64

10

95560f1a46...f9.dll

windows11-21h2-x64

3

Archive.zi...3e.exe

windows11-21h2-x64

8

DiskIntern...en.exe

windows11-21h2-x64

3

ForceOp 2....ce.exe

windows11-21h2-x64

7

HYDRA.exe

windows11-21h2-x64

10

KLwC6vii.exe

windows11-21h2-x64

1

Keygen.exe

windows11-21h2-x64

10

Lonelyscre...ox.exe

windows11-21h2-x64

3

LtHv0O2KZDK4M637.exe

windows11-21h2-x64

10

Magic_File...ja.exe

windows11-21h2-x64

3

OnlineInstaller.exe

windows11-21h2-x64

8

Remouse.Mi...cg.exe

windows11-21h2-x64

3

SecuriteIn...dE.exe

windows11-21h2-x64

10

SecuriteIn...ee.dll

windows11-21h2-x64

10

SecurityTa...up.exe

windows11-21h2-x64

4

Treasure.V...ox.exe

windows11-21h2-x64

3

VyprVPN.exe

windows11-21h2-x64

10

WSHSetup[1].exe

windows11-21h2-x64

3

Yard.dll

windows11-21h2-x64

10

b2bd3de3e5...2).exe

windows11-21h2-x64

10

Resubmissions

15/08/2026, 21:19

260815-z592tshg57

12/05/2026, 09:30

260512-lghqsah14t

12/05/2026, 09:29

260512-lf4a4ad17m

11/05/2026, 13:07

260511-qcln4aaw4z

09/05/2026, 21:41

260509-1j69gsdv7w10

09/05/2026, 21:41

260509-1jyx4sdv7s

19/04/2026, 22:54

260419-2vxd4aby7r

11/04/2026, 06:46

260411-hjw5eaas2p

25/03/2026, 09:51

260325-lvksascz5w10

22/02/2026, 15:16

260222-snsb5ab16e10

Analysis

  • max time kernel
    97s
  • max time network
    104s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250619-en
  • resource tags

    arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    27/06/2025, 17:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
  • Size 80KB
  • Sample250627-v1z9lsstdw
  • SHA256 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
hakbitcredential_accessdefense_evasiondiscoveryexecutionransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt

  • hakbit

Ransom Note
  • To recover your data contact the email below [email protected] Key Identifier: jPq+Ev2/y3V3sI2zcw60nc9jWKqdLo38LnL4CLNjsbiQ7ubVWtt6gGgwGi+w27CKL7VzMhO6GhsLabG2auLWJEP1Ay/M889Ny4px+9nZQj8pxlGWid9EsgjzxMnavMJDuMbyw3KCdUEru2+EK+ZPgVTIudw3DGocttvoSpJL98HOsN2nOp0SsAWv8d8TpmUk4n9ATRIwBIEAW6BJvBiVqwMOPOJcjNH+ZTOxc8BvpZdXT/tglgfPMTqxq1X2IvzbwNKuqrbsKY96/UvfGy4s47NprCPbTq5OvDhwN4TqXAPQt2zhphBdWvN71hs9QCco57wwvZkREJxINt9nmO4bVvfdu+Gi4Y1ojZn1QUH53J3yE653IhaiHOhwVVYdFclqLfeRBBrN2v4Y6UPPIPlqnRHbYc6BUy3DHWyqocANrak/YZ4lHoli3rzn1R79FWdz+Lj5bV9At+qX9O3XNjX37cn3zxsw3in4uNBvC8PSZvEdtEgdvZ2q/MYETIBxRdZM9QMY0dpDIRvtYplI72yyAfkY4G1sz0o45/e7AtLaoXj8Yn26POo3TX+mNoq0zk2JdLlOiB12kC+E65n3Mfww9S0mMllAKUjB7tmgmDpMEwXltCuI/cgeO9qEKM4rFuKOFc55RFVc+2eZZ3YvfVFwYnh55ouA2WPA/eueT9QakOs= Number of files that were processed is: 422

Signatures

  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Hakbit

    Ransomware which encrypts files using AES, first seen in November 2019.

    ransomwarehakbit
  • Hakbit family
    hakbit
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Kills process with taskkill 47 IoCs
    defense_evasion
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
    "C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"
    1⤵
    • Drops startup file
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2408
    • C:\Windows\SYSTEM32\sc.exe
      "sc.exe" config SQLTELEMETRY start= disabled
      2⤵
      • Launches sc.exe
      PID:988
    • C:\Windows\SYSTEM32\sc.exe
      "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
      2⤵
      • Launches sc.exe
      PID:904
    • C:\Windows\SYSTEM32\sc.exe
      "sc.exe" config SQLWriter start= disabled
      2⤵
      • Launches sc.exe
      PID:3048
    • C:\Windows\SYSTEM32\sc.exe
      "sc.exe" config SstpSvc start= disabled
      2⤵
      • Launches sc.exe
      PID:3328
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /IM mspub.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:5424
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin
      2⤵
        PID:4932
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM mydesktopqos.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5368
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM mydesktopservice.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5720
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM mysqld.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5064
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM sqbcoreservice.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4116
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM firefoxconfig.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4464
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM agntsvc.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:6052
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM thebat.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4076
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM steam.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1364
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM encsvc.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1648
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM excel.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4636
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM CNTAoSMgr.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4848
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM sqlwriter.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5888
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM tbirdconfig.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:956
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM dbeng50.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4788
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM thebat64.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5832
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM ocomm.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1072
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM infopath.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:6040
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM mbamtray.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2672
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM zoolz.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:6136
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" IM thunderbird.exe /F
        2⤵
        • Kills process with taskkill
        PID:4224
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM dbsnmp.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4844
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM xfssvccon.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1284
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM mspub.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1388
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM Ntrtscan.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:480
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM isqlplussvc.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5628
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM onenote.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:6140
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM PccNTMon.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4584
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM msaccess.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5132
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM outlook.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4880
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM tmlisten.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4896
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM msftesql.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4904
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM powerpnt.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4424
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM mydesktopqos.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4856
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM visio.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4984
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM mydesktopservice.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2352
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM winword.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5036
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM mysqld-nt.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5068
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM wordpad.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4968
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM mysqld-opt.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4064
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM ocautoupds.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5228
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM ocssd.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:6000
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM oracle.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3804
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM sqlagent.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5456
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM sqlbrowser.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5028
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM sqlservr.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5020
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /IM synctime.exe /F
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:572
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:484
      • C:\Windows\System32\notepad.exe
        "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
        2⤵
        • Opens file in notepad (likely ransom note)
        PID:2148
      • C:\Windows\SYSTEM32\cmd.exe
        "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
        2⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:5612
        • C:\Windows\system32\PING.EXE
          ping 127.0.0.7 -n 3
          3⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:760
        • C:\Windows\system32\fsutil.exe
          fsutil file setZeroData offset=0 length=524288 “%s”
          3⤵
            PID:1992
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
          2⤵
            PID:916
            • C:\Windows\system32\choice.exe
              choice /C Y /N /D Y /T 3
              3⤵
                PID:6724

          Network

                MITRE ATT&CK Enterprise v16

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                System Services

                1
                T1569

                Service Execution

                1
                T1569.002

                Persistence

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Privilege Escalation

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Defense Evasion

                Credential Access

                Credentials from Password Stores

                2
                T1555

                Credentials from Web Browsers

                1
                T1555.003

                Windows Credential Manager

                1
                T1555.004

                Unsecured Credentials

                1
                T1552

                Credentials In Files

                1
                T1552.001

                Discovery

                Browser Information Discovery

                1
                T1217

                Remote System Discovery

                1
                T1018

                System Information Discovery

                1
                T1082

                System Network Configuration Discovery

                1
                T1016

                Internet Connection Discovery

                1
                T1016.001

                Lateral Movement

                Collection

                Data from Local System

                1
                T1005

                Command and Control

                Exfiltration

                Impact

                Service Stop

                1
                T1489

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                edbtmp.log
                • Path C:\ProgramData\Microsoft\Network\Downloader\edbtmp.log
                • Size 1.3MB
                • SHA256 0f01ac6b821a4379d9d491390219852bb71ce22be27e8719338f2a08e0ead204
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                windowsdesktop-runtime-7.0.16-win-x64.msi
                • Path C:\ProgramData\Package Cache\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}v56.64.8804\windowsdesktop-runtime-7.0.16-win-x64.msi
                • Size 28.8MB
                • SHA256 d196a570e1971efc34874b40b4727f12f635f6294859d719615c13ba66a7b79b
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                dotnet-hostfxr-7.0.16-win-x64.msi.energy[[email protected]]
                • Path C:\ProgramData\Package Cache\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}v56.64.8781\dotnet-hostfxr-7.0.16-win-x64.msi.energy[[email protected]]
                • Size 804KB
                • SHA256 5bf3bda0b5d654b8d5a3347a38025e8a1f0d70a93135e0c892c3215274edf538
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                dotnet-runtime-6.0.27-win-x64.msi
                • Path C:\ProgramData\Package Cache\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}v48.108.8828\dotnet-runtime-6.0.27-win-x64.msi
                • Size 25.7MB
                • SHA256 107410c06966c5a166ca5205fa07d69053d647b0c12a664a7b72bcf06e25330f
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                vc_runtimeAdditional_x86.msi.energy[[email protected]]
                • Path C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.energy[[email protected]]
                • Size 180KB
                • SHA256 7fe0049d726d42b6355ee212c3423a0bd66c6818074bc826e490c5b2345cdd6c
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                powershell.exe.log
                • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                • Size 2KB
                • SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 944B
                • SHA256 36cbb00b016c9f97645fb628ef72b524dfbdf6e08d626e5c837bbbb9075dcb52
                • MD5 SHA1 SHA512
                Submit Download

                __PSScriptPolicyTest_mzrcxv3z.0sc.ps1
                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mzrcxv3z.0sc.ps1
                • Size 60B
                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                • MD5 SHA1 SHA512
                Submit Download

                HOW_TO_DECYPHER_FILES.txt
                • Path C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
                • Size 828B
                • SHA256 75dfdce75a4189068b2330c7a031274a37ec25ca1976e458a06094b125dfa6c7
                • MD5 SHA1 SHA512
                Submit Download

                memory/484-23-0x000001FEC7A20000-0x000001FEC7A42000-memory.dmp
                Download

                memory/2408-0-0x0000000000520000-0x000000000053A000-memory.dmp
                Download

                memory/2408-1-0x000000001B220000-0x000000001B230000-memory.dmp
                Download

                memory/2408-398-0x000000001B220000-0x000000001B230000-memory.dmp
                Download