Analysis
- max time kernel
81s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20250502-en - resource tags
- submitted
25/09/2025, 14:55
General
- Target 360758c296310ba428d0d52c90e31c05fc43d5889282fa840283cf468f2378e8.exe
- Size 1.8MB
- Sample250925-sajstsbp2v
- SHA256 360758c296310ba428d0d52c90e31c05fc43d5889282fa840283cf468f2378e8
Malware Config
Extracted
-
C:\how_to_decrypt.txt
-
hunters_international
- ATTENTION!!!! Your computer ID: AHN BIOTECHNOLOGIE GMBH ATTENTION to representatives AHN BIOTECHNOLOGIE GMBH!!!! Your system has been tested for security and unfortunately your system was vulnerable. We specialize in file encryption and industrial (economic or corporate) espionage. We don't care about your files or what you do, nothing personal - it's just business. We recommend contacting us as your confidential files have been stolen and will be sold to interested parties unless you pay to remove them from our clouds and auction, or decrypt your files. Your computer ID: AHN BIOTECHNOLOGIE GMBH Please note that if: - you ignore this message for 7 days, your decryption keys will be deleted; - an attempt to change the name of an encrypted file will damage the encrypted file, making it impossible to decrypt; - using third-party free or paid programs will damage the encrypted file, making it impossible to decrypt; For more detailed information write to us: [email protected] Telegram: https://t.me/BlackNevas Reserve Email: [email protected] and [email protected] Your computer ID: AHN BIOTECHNOLOGIE GMBH ATTENTION to representatives AHN BIOTECHNOLOGIE GMBH!!!! If you ignore or refuse to cooperate, we will be forced to hand over your stolen data to our partners for publication in a data leak blog and further sale at auctions. To open .onion sites you need to download the TOR browser https://www.torproject.org/download/ or the multifunctional browser Brave https://brave.com/download/ new private window Tor. Find your details on these sites of our partners: http://kill432ltnkqvaqntbalnsgojqqs2wz4lhnamrqjg66tq6fuvcztilyd.onion https://hunters55rdxciehoqzwv7vgyv6nt37tbwax2reroyzxhou7my5ejyid.onion/companies http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion/blog http://black3gnkizshuynieigw6ejgpblb53mpasftzd6pydqpmq2vn2xf6yd.onion http://embargobe3n5okxyzqphpmk3moinoap2snz5k6765mvtkk7hhi544jid.onion http://k67ivvik3dikqi4gy4ua7xa6idijl4si7k5ad5lotbaeirfcsx4sgbid.onion Your computer ID: AHN BIOTECHNOLOGIE GMBH
-
https://t.me/BlackNevas
-
https://brave.com/download/
-
http://kill432ltnkqvaqntbalnsgojqqs2wz4lhnamrqjg66tq6fuvcztilyd.onion
-
https://hunters55rdxciehoqzwv7vgyv6nt37tbwax2reroyzxhou7my5ejyid.onion/companies
-
http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion/blog
-
http://black3gnkizshuynieigw6ejgpblb53mpasftzd6pydqpmq2vn2xf6yd.onion
-
http://embargobe3n5okxyzqphpmk3moinoap2snz5k6765mvtkk7hhi544jid.onion
-
http://k67ivvik3dikqi4gy4ua7xa6idijl4si7k5ad5lotbaeirfcsx4sgbid.onion
Signatures
- BlackNevas
BlackNevas is a cross-platform ransomware related to the Trigona family.
- Blacknevas family
- Detects Windows variant of BlackNevas ransomware 13 IoCs
- HuntersInternational, Water Ouroboros
HuntersInternational aka Water Ouroboros is a ransomware that operates under a Ransomware-as-a-Service model.
- Hunters_international family
- Drops desktop.ini file(s) 5 IoCs
- Drops file in Program Files directory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\360758c296310ba428d0d52c90e31c05fc43d5889282fa840283cf468f2378e8.exe"C:\Users\Admin\AppData\Local\Temp\360758c296310ba428d0d52c90e31c05fc43d5889282fa840283cf468f2378e8.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
desktop.ini
sjj67zd1xx.u0pn4689r.-encrypted
Click on 'Change' to select default PDF handler.pdf
aic_file_icons_retina_thumb.png
aic_file_icons_highcontrast.png
aic_file_icons_retina_thumb_highContrast_bow.png
aic_file_icons_retina_thumb_highContrast_wob.png
selection-actions2x.png
s_filetype_psd.svg
s_filetype_xd.svg
s_export_18.svg
A12_Spinner.gif
A12_Spinner_2x.gif
A12_Spinner_int.gif
A12_Spinner_int_2x.gif
adc_logo.png
apple-touch-icon-114x114-precomposed.png
apple-touch-icon-72x72-precomposed.png
ccloud_retina.png
createpdf.svg
favicon.ico
illustrations.png
illustrations_retina.png
ind_prog.gif
large_trefoil_2x.png
logo_retina.png
progress_spinner.gif
progress_spinner2x.gif
progress_spinner_dark.gif
progress_spinner_dark2x.gif
s_download_pdf_18.svg
spectrum_spinner.svg
trial-recovery.83234922b7n5c84e20k89vh8l.gkr.-encrypted
trial-recovery.wmxst4385bnl9r291vq10955uu387d29ai34hrfa.484bb65onr.-encrypted
ui-strings.js
ui-strings.js
ui-strings.js
trial-recovery.q2h02862i0.v1k372nw9br.-encrypted
ui-strings.js
ui-strings.js
ui-strings.js
ui-strings.js
icons.png
icons_ie8.gif
icons_retina.png
illustrations.png
illustrations_retina.png
new_icons.png
trial-recovery.0uxoom294wz17f5imdeelx9t77y619wr.00634asr.-encrypted
exportpdf-selector.js
convertpdf-rna-tool-view.js
ui-strings.js
trial-recovery.fwk97mse394e81m4v0zyh6i20ypb3vk3o26.24xlpr.-encrypted
ui-strings.js
core_icons.png
core_icons_fw.png
core_icons_retina.png
sample-thumb.png
check.cur
circle.cur
dot.cur
line.cur
text.cur
x.cur
file_icons.png
file_icons.png
s_empty_folder_state.svg
ui-strings.js
ui-strings.js
selector.js
PlayStore_icon.svg
AppStore_icon.svg
PlayStore_icon.svg
AppStore_icon.svg
PlayStore_icon.svg
AppStore_icon.svg
PlayStore_icon.svg
AppStore_icon.svg
AppStore_icon.svg
PlayStore_icon.svg
AppStore_icon.svg
PlayStore_icon.svg
AppStore_icon.svg
PlayStore_icon.svg
AppStore_icon.svg
PlayStore_icon.svg
AppStore_icon.svg
AppStore_icon.svg
trial-recovery.va0h543lsm918e82v6019dlmayc4b5sm2em4i22cty8p9yd.91r.-encrypted
AppStore_icon.svg
PlayStore_icon.svg
AppStore_icon.svg
PlayStore_icon.svg
AppStore_icon.svg
PlayStore_icon.svg
AppStore_icon.svg
PlayStore_icon.svg
AppStore_icon.svg
PlayStore_icon.svg
AppStore_icon.svg
PlayStore_icon.svg
AppStore_icon.svg
PlayStore_icon.svg
AppStore_icon.svg
PlayStore_icon.svg
MobileAcrobatCard_Light.pdf
MobileScanCard_Light.pdf
pdf-ownership-rdr-en_us.gif
pdf-ownership-variant2-2x.gif
ui-strings.js
ui-strings.js
cstm_brand_preview2x.png
ui-strings.js
ui-strings.js
Download_on_the_App_Store_Badge_en_135x40.svg
Download_on_the_App_Store_Badge_nl_135x40.svg
af_get.svg
am_get.svg
az_get.svg
be_get.svg
bg_get.svg
el_get.svg
et_get.svg
fil_get.svg
id_get.svg
iw_get.svg
lt_get.svg
lv_get.svg
ms_get.svg
nl_get.svg
pt_get.svg
ro_get.svg
sk_get.svg
sl_get.svg
th_get.svg
trial-recovery.kri5o6dudwv48d9gcxtr7bv9006qwp8s8xwcb5.1r.-encrypted
trial-recovery.zz95ka1eu7u5q5y5.0i1f99r.-encrypted
vi_get.svg
zh-hk_get.svg
flags.png
scanAppLogo.png
faf_icons.png
cloud_secured_lg.png
core_icons.png
sfs_icons.png
ui-strings.js
ui-strings.js
ui-strings.js
main.css
ui-strings.js
ui-strings.js
ui-strings.js
example_icons2x.png
core_icons.png
core_icons_retina.png
core_icons.png
core_icons_retina.png
illustrations.png
illustrations_retina.png
new_icons.png
plugin.js
ui-strings.js
ui-strings.js
ui-strings.js
ui-strings.js
DisplayLanguageNames.en_GB.txt
java.exe
javaw.exe
javaws.exe
DisabledGoogleUpdate.exe
Workflow.Targets
Workflow.VisualBasic.Targets
Edge.dat
EdgeWebView.dat
Advertising
Analytics
Content
Entities
LICENSE
Entities
Staging
Logo.png
LogoBeta.png
LogoCanary.png
LogoDev.png
SmallLogo.png
SmallLogoBeta.png
SmallLogoCanary.png
SmallLogoDev.png
camera_mf_trace.wprp
mf_trace.wprp
resources.pri
trial-recovery.p898vk6yvei0femo394n518s89m2zk9u.0xr.-encrypted
identity_helper.Sparse.Beta.msix
identity_helper.Sparse.Canary.msix
identity_helper.Sparse.Dev.msix
ad-selection-attestations.dat
ad-selection-attestations.dat
manifest.json
manifest.json
Edge.dat
EdgeWebView.dat
external_extensions.json
external_extensions.json
af.pak
af.pak
am.pak
am.pak
ar.pak
ar.pak
as.pak
as.pak
az.pak
az.pak
bg.pak
bg.pak
bn-IN.pak
bn-IN.pak
bs.pak
bs.pak
ca-Es-VALENCIA.pak
ca-Es-VALENCIA.pak
ca.pak
ca.pak
cs.pak
cs.pak
cy.pak
cy.pak
da.pak
da.pak
de.pak
de.pak
el.pak
el.pak
en-GB.pak
en-GB.pak
en-US.pak
en-US.pak
es-419.pak
es-419.pak
es.pak
es.pak
et.pak
et.pak
eu.pak
eu.pak
fa.pak
fa.pak
fi.pak
fi.pak
fil.pak
fil.pak
fr-CA.pak
fr-CA.pak
fr.pak
fr.pak
ga.pak
ga.pak
gd.pak
gd.pak
gl.pak
gl.pak
gu.pak
gu.pak
he.pak
he.pak
hi.pak
hi.pak
hr.pak
hr.pak
hu.pak
hu.pak
id.pak
id.pak
is.pak
is.pak
it.pak
it.pak
ja.pak
ja.pak
ka.pak
ka.pak
kk.pak
kk.pak
km.pak
km.pak
kn.pak
kn.pak
ko.pak
ko.pak
kok.pak
kok.pak
lb.pak
lb.pak
lo.pak
lo.pak
lt.pak
lt.pak
lv.pak
lv.pak
mi.pak
mi.pak
mk.pak
mk.pak
ml.pak
ml.pak
mr.pak
mr.pak
ms.pak
ms.pak
mt.pak
mt.pak
nb.pak
nb.pak
ne.pak
ne.pak
nl.pak
nl.pak
nn.pak
nn.pak
or.pak
or.pak
pa.pak
pa.pak
pl.pak
pl.pak
pt-BR.pak
pt-BR.pak
pt-PT.pak
pt-PT.pak
qu.pak
qu.pak
ro.pak
ro.pak
ru.pak
ru.pak
sk.pak
sk.pak
sl.pak
sl.pak
sq.pak
sq.pak
sr-Cyrl-BA.pak
sr-Cyrl-BA.pak
sr-Latn-RS.pak
sr-Latn-RS.pak
sr.pak
sr.pak
sv.pak
sv.pak
ta.pak
ta.pak
te.pak
te.pak
th.pak
th.pak
tr.pak
tr.pak
tt.pak
tt.pak
ug.pak
ug.pak
uk.pak
uk.pak
ur.pak
ur.pak
vi.pak
vi.pak
zh-CN.pak
zh-CN.pak
zh-TW.pak
zh-TW.pak
manifest.json
manifest.json
preloaded_data.pb
Advertising
Analytics
CompatExceptions
CompatExceptions
Content
Cryptomining
Cryptomining
Entities
Fingerprinting
Fingerprinting
LICENSE
Other
Other
Social
Social
TransparentAdvertisers
TransparentAdvertisers
Advertising
Advertising
Analytics
Analytics
Content
Content
Cryptomining
Cryptomining
Entities
Fingerprinting
Fingerprinting
LICENSE
LICENSE
Other
Other
Social
Social
Staging
manifest.json
manifest.json
Logo.png
LogoBeta.png
LogoCanary.png
LogoDev.png
SmallLogo.png
SmallLogoBeta.png
SmallLogoCanary.png
SmallLogoDev.png
widevinecdm.dll.sig
widevinecdm.dll.sig
manifest.json
manifest.json
delegatedWebFeatures.sccd
camera_mf_trace.wprp
mf_trace.wprp
EdgeGameAssist.msix
EdgeGameAssist.msix
VERSION
VERSION
icudtl.dat
icudtl.dat
resources.pri
identity_helper.Sparse.Beta.msix
identity_helper.Sparse.Canary.msix
identity_helper.Sparse.Canary.msix
identity_helper.Sparse.Dev.msix
identity_helper.Sparse.Internal.msix
identity_helper.Sparse.Stable.msix
identity_helper.Sparse.Beta.msix
identity_helper.Sparse.Canary.msix
identity_helper.Sparse.Canary.msix
identity_helper.Sparse.Dev.msix
identity_helper.Sparse.Internal.msix
identity_helper.Sparse.Stable.msix
msedge.dll.sig
msedge.dll.sig
msedge.exe.sig
msedge.exe.sig
msedge_100_percent.pak
msedge_100_percent.pak
msedge_200_percent.pak
msedge_200_percent.pak
msedgewebview2.exe.sig
msedgewebview2.exe.sig
notification_helper.exe
notification_helper.exe
resources.pak
resources.pak
v8_context_snapshot.bin
v8_context_snapshot.bin
vk_swiftshader_icd.json
vk_swiftshader_icd.json
EdgeUpdate.dat
MicrosoftEdgeUpdate.exe
NOTICE.TXT
ad-selection-attestations.dat.DATA
ad-selection-attestations.dat.DATA
manifest.json.DATA
manifest.json.DATA
Edge.dat.DATA
EdgeWebView.dat.DATA
external_extensions.json.DATA
external_extensions.json.DATA
af.pak.DATA
af.pak.DATA
am.pak.DATA
am.pak.DATA
ar.pak.DATA
ar.pak.DATA
as.pak.DATA
as.pak.DATA
az.pak.DATA
az.pak.DATA
bg.pak.DATA
bg.pak.DATA
bn-IN.pak.DATA
bn-IN.pak.DATA
bs.pak.DATA
bs.pak.DATA
ca-Es-VALENCIA.pak.DATA
ca-Es-VALENCIA.pak.DATA
ca.pak.DATA
ca.pak.DATA
cs.pak.DATA
cs.pak.DATA
cy.pak.DATA
cy.pak.DATA
da.pak.DATA
da.pak.DATA
de.pak.DATA
de.pak.DATA
el.pak.DATA
el.pak.DATA
en-GB.pak.DATA
en-GB.pak.DATA
en-US.pak.DATA
en-US.pak.DATA
es-419.pak.DATA
es-419.pak.DATA
es.pak.DATA
es.pak.DATA
et.pak.DATA
et.pak.DATA
eu.pak.DATA
eu.pak.DATA
fa.pak.DATA
fa.pak.DATA
fi.pak.DATA
fi.pak.DATA
fil.pak.DATA
fil.pak.DATA
fr-CA.pak.DATA
fr-CA.pak.DATA
fr.pak.DATA
fr.pak.DATA
ga.pak.DATA
ga.pak.DATA
gd.pak.DATA
gd.pak.DATA
gl.pak.DATA
gl.pak.DATA
gu.pak.DATA
gu.pak.DATA
he.pak.DATA
he.pak.DATA
hi.pak.DATA
hi.pak.DATA
hr.pak.DATA
hr.pak.DATA
hu.pak.DATA
hu.pak.DATA
id.pak.DATA
id.pak.DATA
is.pak.DATA
is.pak.DATA
it.pak.DATA
it.pak.DATA
ja.pak.DATA
ja.pak.DATA
ka.pak.DATA
ka.pak.DATA
kk.pak.DATA
kk.pak.DATA
km.pak.DATA
km.pak.DATA
kn.pak.DATA
kn.pak.DATA
ko.pak.DATA
ko.pak.DATA
kok.pak.DATA
kok.pak.DATA
lb.pak.DATA
lb.pak.DATA
lo.pak.DATA
lo.pak.DATA
lt.pak.DATA
lt.pak.DATA
lv.pak.DATA
lv.pak.DATA
mi.pak.DATA
mi.pak.DATA
mk.pak.DATA
mk.pak.DATA
ml.pak.DATA
ml.pak.DATA
mr.pak.DATA
mr.pak.DATA
ms.pak.DATA
ms.pak.DATA
mt.pak.DATA
mt.pak.DATA
nb.pak.DATA
nb.pak.DATA
ne.pak.DATA
ne.pak.DATA
nl.pak.DATA
nl.pak.DATA
nn.pak.DATA
nn.pak.DATA
or.pak.DATA
or.pak.DATA
pa.pak.DATA
pa.pak.DATA
pl.pak.DATA
pl.pak.DATA
pt-BR.pak.DATA
pt-BR.pak.DATA
pt-PT.pak.DATA
pt-PT.pak.DATA
qu.pak.DATA
qu.pak.DATA
ro.pak.DATA
ro.pak.DATA
ru.pak.DATA
ru.pak.DATA
sk.pak.DATA
sk.pak.DATA
sl.pak.DATA
sl.pak.DATA
sq.pak.DATA
sq.pak.DATA
sr-Cyrl-BA.pak.DATA
sr-Cyrl-BA.pak.DATA
sr-Latn-RS.pak.DATA
sr-Latn-RS.pak.DATA
sr.pak.DATA
sr.pak.DATA
sv.pak.DATA
sv.pak.DATA
ta.pak.DATA
ta.pak.DATA
te.pak.DATA
te.pak.DATA
th.pak.DATA
th.pak.DATA
tr.pak.DATA
tr.pak.DATA
tt.pak.DATA
tt.pak.DATA
ug.pak.DATA
ug.pak.DATA
uk.pak.DATA
uk.pak.DATA
ur.pak.DATA
ur.pak.DATA
vi.pak.DATA
vi.pak.DATA
zh-CN.pak.DATA
zh-CN.pak.DATA
zh-TW.pak.DATA
zh-TW.pak.DATA
manifest.json.DATA
manifest.json.DATA
preloaded_data.pb.DATA
delegatedWebFeatures.sccd.DATA
camera_mf_trace.wprp.DATA
mf_trace.wprp.DATA
EdgeGameAssist.msix.DATA
EdgeGameAssist.msix.DATA
VERSION.DATA
VERSION.DATA
icudtl.dat.DATA
icudtl.dat.DATA
resources.pri.DATA
identity_helper.Sparse.Beta.msix.DATA
identity_helper.Sparse.Canary.msix.DATA
identity_helper.Sparse.Dev.msix.DATA
identity_helper.Sparse.Internal.msix.DATA
identity_helper.Sparse.Stable.msix.DATA
identity_helper.Sparse.Beta.msix.DATA
identity_helper.Sparse.Canary.msix.DATA
identity_helper.Sparse.Dev.msix.DATA
identity_helper.Sparse.Internal.msix.DATA
identity_helper.Sparse.Stable.msix.DATA
msedge.dll.sig.DATA
msedge.dll.sig.DATA
msedge.exe.sig.DATA
msedge.exe.sig.DATA
msedge_100_percent.pak.DATA
msedge_100_percent.pak.DATA
msedge_200_percent.pak.DATA
msedge_200_percent.pak.DATA
msedgewebview2.exe.sig.DATA
msedgewebview2.exe.sig.DATA
resources.pak.DATA
resources.pak.DATA
v8_context_snapshot.bin.DATA
v8_context_snapshot.bin.DATA
vk_swiftshader_icd.json.DATA
vk_swiftshader_icd.json.DATA
Advertising
Analytics
CompatExceptions
CompatExceptions
Content
Cryptomining
Cryptomining
Entities
Fingerprinting
Fingerprinting
LICENSE
Other
Other
Social
Social
TransparentAdvertisers
TransparentAdvertisers
Advertising
Advertising
Analytics
Analytics
Content
Content
Cryptomining
Cryptomining
Entities
Fingerprinting
Fingerprinting
LICENSE
LICENSE
Other
Other
Social
Social
Staging
manifest.json
manifest.json
Logo.png
LogoBeta.png
LogoCanary.png
LogoDev.png
SmallLogo.png
SmallLogoBeta.png
SmallLogoCanary.png
SmallLogoDev.png
widevinecdm.dll.sig
widevinecdm.dll.sig
manifest.json
manifest.json
preloaded_data.pb
delegatedWebFeatures.sccd
stable.identity_helper.exe.manifest
stable.identity_helper.exe.manifest
identity_helper.Sparse.Stable.msix
identity_helper.Sparse.Beta.msix
identity_helper.Sparse.Dev.msix
msedge.exe
msedge_proxy.exe
pwahelper.exe
maintenanceservice.exe
o68nb35l1w44s80v358p6v6e63p9vklt9.07r.-encrypted
MSFT_PackageManagementSource.psm1
MSFT_PackageManagement.psm1
PackageManagementDscUtilities.psm1
PackageManagement.format.ps1xml
PackageProviderFunctions.psm1
PSGet.Format.ps1xml
PSGet.Resource.psd1
PSModule.psm1
setup.exe
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-console-l1-2-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
msvcp140.dll
ucrtbase.dll
vcruntime140.dll
vcruntime140_1.dll
messages_zh_TW.properties
glib.md
gstreamer.md
icu_web.md
libxml2.md
mesa3d.md
public_suffix.md
webkit.md
bcel.md
dom.md
ecc.md
jpeg.md
libpng.md
mesa3d.md
pkcs11cryptotoken.md
santuario.md
xalan.md
xerces.md
xmlresolver.md
msvcp140_1.dll
msvcp140_2.dll
classlist
CIEXYZ.pf
PYCC.pf
content-types.properties
currency.data
deploy.jar
ffjcext.zip
messages_es.properties
messages_fr.properties
messages_ja.properties
messages_ko.properties
messages_sv.properties
messages_zh_CN.properties
splash.gif
splash_11-lic.gif
access-bridge-64.jar
cldrdata.jar
dnsns.jar
jaccess.jar
jfxrt.jar
nashorn.jar
sunec.jar
sunjce_provider.jar
sunmscapi.jar
sunpkcs11.jar
zipfs.jar
flavormap.properties
fontconfig.bfc
fontconfig.properties.src
LucidaBrightDemiBold.ttf
LucidaBrightDemiItalic.ttf
LucidaBrightItalic.ttf
LucidaBrightRegular.ttf
LucidaSansDemiBold.ttf
LucidaSansRegular.ttf
LucidaTypewriterBold.ttf
LucidaTypewriterRegular.ttf
h.x29mqj5i2hr.-encrypted
hijrah-config-umalqura.properties
jce.jar
jfr.jar
default.jfc
profile.jfc
jfxswt.jar
jvm.hprof.txt
jmxremote.access
management.properties
snmp.acl.template
net.properties
plugin.jar
psfontj2d.properties
resources.jar
blacklist
cacerts
java.security
US_export_policy.jar
local_policy.jar
US_export_policy.jar
local_policy.jar
public_suffix_list.dat
tzdb.dat
tzmappings
IntegratedOffice.exe
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-xstate-l2-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
concrt140.dll
trial-recovery.8ota88ja4s0e1f1tp830pj1z9ll9f8mnssg9.pkr6zpb3zkr.-encrypted
vccorlib140.dll
pkeyconfig-office.xrm-ms
pidgenx.dll
pkeyconfig-office.xrm-ms
PREVIEWTEMPLATE2.POTX
word2013bw.dotx
offsym.ttf
offsymb.ttf
offsymk.ttf
offsyml.ttf
offsymsb.ttf
offsymsl.ttf
offsymt.ttf
offsymxb.ttf
offsymxl.ttf
ISO690.XSL
trial-recovery.092li8r8m1z04771x0q9o5i09o0b7o9y6jkn1ss0i.6vom35555r.-encrypted
libcrypto-1_1-x64.dll
libssl-1_1-x64.dll
UCRTBASE.DLL
mfc140u.dll
msvcp120.dll
msvcp140.dll
msvcr120.dll
vcruntime140.dll
SLINTL.DLL
AppXManifestLoc.16.en-us.xml
DBGCORE.DLL
DBGHELP.DLL
osmdp64.msi
Csi.dll
as80.xsl
as90.xsl
db2v0801.xsl
informix.xsl
msjet.xsl
orcl7.xsl
sql2000.xsl
sql70.xsl
sql90.xsl
sqlpdw.xsl
sybase.xsl
trdtv2r41.xsl
Microsoft.AnalysisServices.Common.dll
Microsoft.AnalysisServices.Excel.BackEnd.dll
Microsoft.Data.ConnectionUI.Dialog.dll
Microsoft.Data.ConnectionUI.dll
Microsoft.SqlServer.Configuration.SString.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-xstate-l2-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
concrt140.dll
mfc140u.dll
msvcp120.dll
msvcp140.dll
msvcr120.dll
trial-recovery.44t9sj54kx13slb47206egizfu87a5m5702fjkd8qk1db.lgn0br.-encrypted
ucrtbase.dll
vccorlib140.dll
vcruntime140.dll
hive.xsl
as80.xsl
as90.xsl
db2v0801.xsl
msql.xsl
orcl7.xsl
sql120.xsl
sql90.xsl
sqlpdw.xsl
trdtv2r41.xsl
vlc.mo
vlc.mo
trial-recovery.1f65t8p38xj351p099e0y.76id9jpur.-encrypted
Microsoft.DiaSymReader.Native.amd64.dll
mscordaccore.dll
trial-recovery.s.u48r.-encrypted
D3DCompiler_47_cor3.dll
vcruntime140_cor3.dll
Manifest.xml
AirSpace.Etw.man
C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml
C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml
C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml
C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml
C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml
C2RManifest.PowerView.PowerView.x-none.msi.16.x-none.xml
C2RManifest.Proof.Culture.msi.16.en-us.xml
C2RManifest.Proof.Culture.msi.16.es-es.xml
C2RManifest.Proof.Culture.msi.16.fr-fr.xml
C2RManifest.Word.Word.x-none.msi.16.x-none.xml
C2RManifest.dcfmui.msi.16.en-us.xml
C2RManifest.excelmui.msi.16.en-us.xml
C2RManifest.office32mui.msi.16.en-us.xml
C2RManifest.office32ww.msi.16.x-none.xml
C2RManifest.officemui.msi.16.en-us.xml
C2RManifest.onenotemui.msi.16.en-us.xml
C2RManifest.osmmui.msi.16.en-us.xml
C2RManifest.osmuxmui.msi.16.en-us.xml
C2RManifest.powerpointmui.msi.16.en-us.xml
C2RManifest.shared.Office.x-none.msi.16.x-none.xml
C2RManifest.wordmui.msi.16.en-us.xml
integrator.exe
msoutilstat.etw.man
wordEtw.man
Pending.GRL
edbres00002.jrs
user.bmp
user.png
windowsdesktop-runtime-7.0.16-win-x64.msi
trial-recovery.w44iy7h4mbt69jm3w2176u91tu46.45tr.-encrypted
dotnet-runtime-8.0.15-win-x64.msi
data_2
data_0
data_1
data_3
index
Login Data For Account
Safe Browsing Cookies
index
db
ukm_db
f_000045
index
128.png
messages.json
verified_contents.json
offscreendocument_main.js
service_worker_bin_prod.js
content_new.js
Network Action Predictor
Trust Tokens
Shortcuts
Top Sites
QuotaManager
heavy_ad_intervention_opt_out.db
campaign_history
onenote.exe_Rules.xml
officeclicktorun.exe.db
OneDriveSetup.exe
trial-recovery.mytt183s5rx8s0sqvh277ry98icfg0fov4.9938p1jr.-encrypted
asrouter.ftl
MSIMGSIZ.DAT
8p1md.rmr.-encrypted
Microsoft_AutoGenerated_{51325390-AE6A-68FC-A315-0950CC83A166}
Microsoft_AutoGenerated_{C804BBA7-FA5F-CBF7-8B55-2096E5F972CB}
Microsoft_Windows_Explorer
https___java_com_help
{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_MdSched_exe
{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_quickassist_exe
{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}_odbcad32_exe
Apps.index
0.0.filtertrie.intermediate.txt
Apps.ft
AppCache133906694916241430.txt
AppCache133906695915863397.txt
AppCache133906702401996875.txt
AppCache133906704555137120.txt
AppCache133906706326996782.txt
b68xvrh794vzv.8d8ld50q16r.-encrypted
TM02851216[[fn=apasixtheditionofficeonline]].xsl
TM02851219[[fn=gostname]].xsl
TM02851220[[fn=gosttitle]].xsl
TM02851221[[fn=harvardanglia2008officeonline]].xsl
TM02851222[[fn=ieee2006officeonline]].xsl
TM02851224[[fn=iso690nmerical]].xsl
TM02851225[[fn=mlaseventheditionofficeonline]].xsl
TM02851226[[fn=turabian]].xsl
cookies.sqlite-shm
1657114595AmcateirvtiSty.sqlite
2010_x64.log.html
how_to_decrypt.txt
memory/2768-3-0x0000000000400000-0x00000000005D9000-memory.dmp
memory/2768-65354-0x0000000000400000-0x00000000005D9000-memory.dmp
memory/2768-79916-0x0000000000400000-0x00000000005D9000-memory.dmp
memory/2768-24448-0x0000000000400000-0x00000000005D9000-memory.dmp
memory/2768-66355-0x0000000000400000-0x00000000005D9000-memory.dmp
memory/2768-59189-0x0000000000400000-0x00000000005D9000-memory.dmp
memory/2768-11488-0x0000000000400000-0x00000000005D9000-memory.dmp
memory/2768-38011-0x0000000000400000-0x00000000005D9000-memory.dmp
memory/2768-55382-0x0000000000400000-0x00000000005D9000-memory.dmp
memory/2768-2-0x0000000000400000-0x00000000005D9000-memory.dmp
memory/2768-13-0x0000000000400000-0x00000000005D9000-memory.dmp
memory/2768-14-0x0000000000400000-0x00000000005D9000-memory.dmp
memory/2768-1-0x0000000000400000-0x00000000005D9000-memory.dmp