Resubmissions
18-04-2024 11:18
240418-ned1xsbd66 1018-04-2024 11:18
240418-nea92abd64 1018-04-2024 11:18
240418-neay9scf7z 1018-04-2024 11:18
240418-neacqscf7y 718-04-2024 11:18
240418-nd92zacf7x 718-04-2024 09:59
240418-lz5chaba8t 7Analysis
-
max time kernel
1190s -
max time network
841s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
18-04-2024 11:18
General
-
Target
0145f04a8356780d52774ce5f7dd0a02f6d5b321694ed805ce3e27bdf04d3c94.exe
-
Size
371KB
-
MD5
eafe645b56c3f5cb746fb5f8504f6035
-
SHA1
f539987de9fe59bff20483ac7a124afafc27036b
-
SHA256
0145f04a8356780d52774ce5f7dd0a02f6d5b321694ed805ce3e27bdf04d3c94
-
SHA512
61af2cfa960a72b66d54d0ee121acb5c54d455b05eb85fb2d7df2958d3134d348c87a5aef2aa46319532407f7ebf01eaedfb8dd889bb0f67ce5edc067445e806
-
SSDEEP
6144:hnzQnu/cmM1oSigOQT2F8U92Iu7DMVQZhWLv3RXdYX9ji+uhi2PsrhY:dzQnkM1oSiBGI8bxn5W6i+uo20tY
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\Downloads\_DECRYPT_INFO_yhxlado.html
Ransom Note
<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Transitional//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd'>
<!-- saved from url=(0014)about:internet -->
<html xmlns='http://www.w3.org/1999/xhtml'>
<head>
<meta http-equiv='Content-Type' content='text/html; charset=UTF-8' />
<title>yhxlado decrypt</title>
<style type='text/css'>
<!--
html, body {margin: 0;padding: 0;margin-left: 0px;margin-top: 0px;margin-right: 0px;margin-bottom: 0px; background-color: #bfbfbf; height: 100%;}
a {color:426BBD; font-family:Tahoma, Verdana, Arial, Helvetica; font-size:12px;}
td {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #f0f0f0;
font-size: 14px;
}
.style1 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #d7001e;
font-size: 48px;
}
.style3 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #f5e700;
font-size: 60px;
}
.style4 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #28caf9;
font-size: 14px;
}
.style5 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #f5e700;
font-size: 14px;
}
.style6 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #d7001e;
font-size: 14px;
}
.style7 {
width:685px;
height:120px;
background-color:#393838;
border:1px solid #565656;
font-family: Courier New;
font-weight: bold;
color: #f0f0f0;
font-size: 13px;
}
.styled-select select {
background-color:#393838;
font-weight: bold;
color: #f0f0f0;
width: 178px;
padding: 5px;
font-size: 16px;
line-height: 1;
border: 0;
border-radius: 0;
height: 34px;
-webkit-appearance: none;
}
-->
</style>
<script type='text/javascript'>
function init()
{
var xtime;
document.getElementById('fe_text').innerHTML = '00:00:00';
var language = window.navigator.userLanguage || window.navigator.language;
if (language.indexOf('-') !== -1)
language = language.split('-')[0];
if (language.indexOf('_') !== -1)
language = language.split('_')[0];
change_lang(language);
var ua = window.navigator.userAgent;
var msie = ua.indexOf('MSIE ');
xtime = Math.floor( (1713439652+(12*60*60)) - (Date.now()/1000));
if (msie == 0)
window.setTimeout('update_timestamp('+xtime+')',1000);
else
update_timestamp(xtime);
}
function component(x, y, z)
{
var res
if (z == 1)
res = Math.floor(x / y);
else
res = Math.floor(x / y) % z;
if (res < 10)
res = '0'+res;
return res;
}
function update_timestamp(tstamp)
{
if (tstamp < 1)
{
document.getElementById('fe_text').innerHTML = '00:00:00';
}
else
{
var hours = component(tstamp, 60*60, 1),
minutes = component(tstamp, 60, 60),
seconds = component(tstamp, 1, 60);
document.getElementById('fe_text').innerHTML = hours+':'+minutes+':'+seconds;
tstamp-=1;
window.setTimeout('update_timestamp('+tstamp+')',1000);
}
}
function change_lang(lang)
{
if (lang == "de")
show_de();
else if (lang == "es")
show_es();
else if (lang == "fr")
show_fr();
else if (lang == "it")
show_it();
else if (lang == "nl")
show_nl();
else
show_en();
}
function show_en()
{
document.getElementById('text_01').innerHTML = 'WARNING!';
document.getElementById('text_02').innerHTML = 'Your personal files are encrypted.';
document.getElementById('text_03').innerHTML = 'Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. The server will eliminate the key after a time period specified in this window.';
document.getElementById('text_09').innerHTML = 'Download TOR Browser from';
document.getElementById('text_10').innerHTML = 'In the Tor Browser open the';
document.getElementById('text_11').innerHTML = '(Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable).';
document.getElementById('text_12').innerHTML = 'Write in the following public key in the input from on server:';
}
function show_de()
{
document.getElementById('text_01').innerHTML = 'WARNUNG!';
document.getElementById('text_02').innerHTML = 'Ihre persönlichen Dateien sind verschlüsselt!';
document.getElementById('text_03').innerHTML = 'Ihre Dokumente, Fotos, Datenbanken und andere wichtige Dateien wurden mit der stärkste Verschlüsselung und einem einzigartigen Schlüssel verschlüsselt, der für diesen Computer generiert wurde. Der Dechiffrierschlüssel ist auf einem geheimen Internet-Server gespeichert und niemand kann Ihre Dateien entschlüsseln, bis Sie bezahlen und den privaten Schlüssel erhalten. Der Server wird den Schlüssel nach einer bestimmten Zeit löschen, die in diesem Fenster angezeigt wird.';
document.getElementById('text_09').innerHTML = 'Laden Sie TOR-Browser von';
document.getElementById('text_10').innerHTML = 'Im Tor-Browser öffnen Sie';
document.getElementById('text_11').innerHTML = '(Beachten Sie, dass dieser Server nur über den Tor-Browser verfügbar ist. Wiederholen Sie den Vorgang nach 1 Stunde, wenn die Website nicht erreichbar ist).';
document.getElementById('text_12').innerHTML = 'Schreiben Sie den folgenden öffentlichen Schlüssel in die Eingabemaske auf dem Server:';
}
function show_es()
{
document.getElementById('text_01').innerHTML = '¡PELIGRO!';
document.getElementById('text_02').innerHTML = '¡Tus archivos personales han sido encriptados!';
document.getElementById('text_03').innerHTML = 'Tus documentos, fotos, bases de datos y otros archivos importantes han sido encriptados con una encriptación extremadamente fuerte y una clave única, generada para este computador. La clave de desencriptación privada está almacenada en un servidor de internet secreto. El servidor eliminará la clave luego del tiempo especificado en esta ventana.';
document.getElementById('text_09').innerHTML = 'Descarga el navegador TOR desde';
document.getElementById('text_10').innerHTML = 'En el navegador TOR abre';
document.getElementById('text_11').innerHTML = '(Nota que este servidor solo es accesible desde el navegador TOR. Intenta nuevamente en 1 hora si no puedes acceder).';
document.getElementById('text_12').innerHTML = 'Escribe la siguiente clave publica en la forma de ingreso del servidor:';
}
function show_fr()
{
document.getElementById('text_01').innerHTML = 'ATTENTION!';
document.getElementById('text_02').innerHTML = 'Vos fichiers personnels ont été cryptés !';
document.getElementById('text_03').innerHTML = 'Vos documents, photos, bases de données, et autres fichiers importants ont été cryptées avec le meilleur processus de cryptage et une clé unique générée pour cet ordinateur. La clé privée de cryptage est accessible sur un serveur Internet secret et personne ne peut décrypter vos fichiers à moins que vous ne payiez et obtenez cette clé. Le serveur éliminera la clé après le compte à rebours affiché sur cette fenêtre.';
document.getElementById('text_09').innerHTML = 'Télécharger le navigateur TOR de';
document.getElementById('text_10').innerHTML = 'Dans le navigateur, ouvrez ';
document.getElementById('text_11').innerHTML = '(Veuillez noter que ce serveur est disponible via le navigateur Tor uniquement. Réessayez dans 1 heure si le site n’est pas accessible).';
document.getElementById('text_12').innerHTML = 'Ecrivez les clés publiques suivantes sur le portail d’entrée du serveur :';
}
function show_it()
{
document.getElementById('text_01').innerHTML = 'ATTENZIONE!';
document.getElementById('text_02').innerHTML = 'I tuoi file personali sono criptati!';
document.getElementById('text_03').innerHTML = 'I tuoi documenti, le tue foto, database e altri file importanti sono stati criptati con forte codificazione ed una chiave unica, generata appositamente per questo computer. La chiave segreta di decriptazione è conservata su un server Internet segreto e nessuno può decriptare i tuoi file finché non paghi per ottenere la chiave. Il server eliminerà la chiave dopo il tempo indicato in questa finestra.';
document.getElementById('text_09').innerHTML = 'Scarica il Browser TOR da';
document.getElementById('text_10').innerHTML = 'Nel Browser TOR apri il link';
document.getElementById('text_11').innerHTML = '(Nota che questo server è disponibile solo tramite il Browser TOR. Riprova tra un’ora se il sito non è raggiungibile).';
document.getElementById('text_12').innerHTML = 'Scrivi la seguente chiave pubblica nel modulo di input sul server:';
}
function show_nl()
{
document.getElementById('text_01').innerHTML = 'WAARSCHUWING!';
document.getElementById('text_02').innerHTML = 'Uw persoonlijke bestanden zijn gecodeerd!';
document.getElementById('text_03').innerHTML = 'Uw documenten, foto’s, databases en andere belangrijke bestanden zijn gecodeerd met de sterkste encryptie en een unieke sleutel, gegenereerd voor deze computer. De persoonlijke decoderingssleutel is te vinden op een geheime Internet server en niemand kan uw bestanden decoderen totdat u betaalt en de persoonlijke sleutel heeft. De server zal de sleutel elimineren na de tijdsperiode genoemd in dit venster.';
document.getElementById('text_09').innerHTML = 'Download de TOR Browser van';
document.getElementById('text_10').innerHTML = 'In de Tor Browser, open';
document.getElementById('text_11').innerHTML = '(Let op dat deze server alleen via de Tor Browser te bereiken is. Probeer het na een uur weer als de site niet werkt).';
document.getElementById('text_12').innerHTML = 'Schrijf in de volgende openbare sleutel in het invoerformulier op de server:';
}
//var language = window.navigator.userLanguage || window.navigator.language;
//alert(language);
</script>
</head>
<body onload='init();'>
<div align='center'>
<table width='700' height='100%' border='0' cellpadding='0' cellspacing='0' bgcolor='#000000'>
<tr>
<td width='225' align='left'><img src='file:///C:/Users/Admin/AppData/Local/Temp/yhxlado.gif' width='225' height='221' /></td>
<td width='415' valign='top'><div align='center' class='style1' id='text_01'>WARNING!</div><br />
<div align='center' id='text_02'>Your personal files are encrypted.<br />
<br />
<br />
</div>
<div align='center' class='style3' id='fe_text'></div></p>
<div class="styled-select" align='center'>
<select id ="ddl" name="ddl" onmousedown="this.value='';" onchange="change_lang(this.value);">
<option selected disabled value="" style="display:none;">Select language</option>
<option value='en'> ENGLISH</option>
<option value='de'> GERMAN</option>
<option value='es'> SPANISH</option>
<option value='fr'> FRENCH</option>
<option value='it'> ITALIAN</option>
<option value='nl'> DUTCH</option>
</select>
</div>
</td>
</tr>
<tr>
<td colspan='2' align='center'><table width='97%' border='0' cellpadding='0' cellspacing='0'>
<tr>
<td colspan='2' align='left'>
<br />
<div id='text_03'>Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. The server will eliminate the key after a time period specified in this window.</div><br />
<br />
</td>
</tr>
<tr>
<td colspan='2' align='left'>
1) <span id='text_09'>Download TOR Browser from</span> <a href='http://torproject.org' class='style4'>http://torproject.org</a><br />
2) <span id='text_10'>In the Tor Browser open the</span> <span class='style6'>http://maktubmvgn22y2ns.onion</span><br /><br />
<span id='text_11'>(Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable).</span><br />
<br />
<span class='style5' id='text_12'>Write in the following public key in the input from on server:</span><br /><br />
<div align='center'><textarea class='style7'>
67BKQ-66SGF-VAD15-AM6ZX-H66RB-BYT6B-T03HH-WZ41D-W6VR0-UYW5H-M7GX4-XE3AY-EP8UU-7EAWS
YJERH-CSPNK-QWBPK-SV782-2YDN0-J8EE3-26C0G-74URS-UGVD5-RKB7H-FGB35-S2X3X-6WR3R-UK3AK
61M3W-4402J-UMY6C-TEC0Z-QFD78-R34CN-B2TYT-M6QEY-EPTY5-CZRU2-WQW81-UCNUE-JSFSK-QHUBH
B0HAS-3Q866-7N38X-EK4DY-Z2HUA-NMPY4-KFTZU-JPZNJ-5D2YD-U56FM-NUTJQ-DCHPA-2J1RE-4GU0F
RR4WF-GZV6B-Q1NJK-XF73E-78KW3-XUYJW-4A0J8-CGWSV-E3CMT-RH5WA-XWD3G-AKKHG-NQAHR-AM0UU
UUN2G-130ZQ-SNB71-211KY-JRMCQ-XPBJM-7HFJN-XGEVS-1UCXY-D0EKX-RKWFY-4FAQ1
</textarea>
<br />
</div>
<br />
<br />
<br />
</div>
</td>
</tr>
</table></td>
</tr>
</table>
</div>
</body>
</html>
URLs
http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd'>
http-equiv='Content-Type
Extracted
Path
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\_DECRYPT_INFO_yhxlado.html
Ransom Note
<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Transitional//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd'>
<!-- saved from url=(0014)about:internet -->
<html xmlns='http://www.w3.org/1999/xhtml'>
<head>
<meta http-equiv='Content-Type' content='text/html; charset=UTF-8' />
<title>yhxlado decrypt</title>
<style type='text/css'>
<!--
html, body {margin: 0;padding: 0;margin-left: 0px;margin-top: 0px;margin-right: 0px;margin-bottom: 0px; background-color: #bfbfbf; height: 100%;}
a {color:426BBD; font-family:Tahoma, Verdana, Arial, Helvetica; font-size:12px;}
td {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #f0f0f0;
font-size: 14px;
}
.style1 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #d7001e;
font-size: 48px;
}
.style3 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #f5e700;
font-size: 60px;
}
.style4 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #28caf9;
font-size: 14px;
}
.style5 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #f5e700;
font-size: 14px;
}
.style6 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #d7001e;
font-size: 14px;
}
.style7 {
width:685px;
height:120px;
background-color:#393838;
border:1px solid #565656;
font-family: Courier New;
font-weight: bold;
color: #f0f0f0;
font-size: 13px;
}
.styled-select select {
background-color:#393838;
font-weight: bold;
color: #f0f0f0;
width: 178px;
padding: 5px;
font-size: 16px;
line-height: 1;
border: 0;
border-radius: 0;
height: 34px;
-webkit-appearance: none;
}
-->
</style>
<script type='text/javascript'>
function init()
{
var xtime;
document.getElementById('fe_text').innerHTML = '00:00:00';
var language = window.navigator.userLanguage || window.navigator.language;
if (language.indexOf('-') !== -1)
language = language.split('-')[0];
if (language.indexOf('_') !== -1)
language = language.split('_')[0];
change_lang(language);
var ua = window.navigator.userAgent;
var msie = ua.indexOf('MSIE ');
xtime = Math.floor( (1713439656+(12*60*60)) - (Date.now()/1000));
if (msie == 0)
window.setTimeout('update_timestamp('+xtime+')',1000);
else
update_timestamp(xtime);
}
function component(x, y, z)
{
var res
if (z == 1)
res = Math.floor(x / y);
else
res = Math.floor(x / y) % z;
if (res < 10)
res = '0'+res;
return res;
}
function update_timestamp(tstamp)
{
if (tstamp < 1)
{
document.getElementById('fe_text').innerHTML = '00:00:00';
}
else
{
var hours = component(tstamp, 60*60, 1),
minutes = component(tstamp, 60, 60),
seconds = component(tstamp, 1, 60);
document.getElementById('fe_text').innerHTML = hours+':'+minutes+':'+seconds;
tstamp-=1;
window.setTimeout('update_timestamp('+tstamp+')',1000);
}
}
function change_lang(lang)
{
if (lang == "de")
show_de();
else if (lang == "es")
show_es();
else if (lang == "fr")
show_fr();
else if (lang == "it")
show_it();
else if (lang == "nl")
show_nl();
else
show_en();
}
function show_en()
{
document.getElementById('text_01').innerHTML = 'WARNING!';
document.getElementById('text_02').innerHTML = 'Your personal files are encrypted.';
document.getElementById('text_03').innerHTML = 'Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. The server will eliminate the key after a time period specified in this window.';
document.getElementById('text_09').innerHTML = 'Download TOR Browser from';
document.getElementById('text_10').innerHTML = 'In the Tor Browser open the';
document.getElementById('text_11').innerHTML = '(Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable).';
document.getElementById('text_12').innerHTML = 'Write in the following public key in the input from on server:';
}
function show_de()
{
document.getElementById('text_01').innerHTML = 'WARNUNG!';
document.getElementById('text_02').innerHTML = 'Ihre persönlichen Dateien sind verschlüsselt!';
document.getElementById('text_03').innerHTML = 'Ihre Dokumente, Fotos, Datenbanken und andere wichtige Dateien wurden mit der stärkste Verschlüsselung und einem einzigartigen Schlüssel verschlüsselt, der für diesen Computer generiert wurde. Der Dechiffrierschlüssel ist auf einem geheimen Internet-Server gespeichert und niemand kann Ihre Dateien entschlüsseln, bis Sie bezahlen und den privaten Schlüssel erhalten. Der Server wird den Schlüssel nach einer bestimmten Zeit löschen, die in diesem Fenster angezeigt wird.';
document.getElementById('text_09').innerHTML = 'Laden Sie TOR-Browser von';
document.getElementById('text_10').innerHTML = 'Im Tor-Browser öffnen Sie';
document.getElementById('text_11').innerHTML = '(Beachten Sie, dass dieser Server nur über den Tor-Browser verfügbar ist. Wiederholen Sie den Vorgang nach 1 Stunde, wenn die Website nicht erreichbar ist).';
document.getElementById('text_12').innerHTML = 'Schreiben Sie den folgenden öffentlichen Schlüssel in die Eingabemaske auf dem Server:';
}
function show_es()
{
document.getElementById('text_01').innerHTML = '¡PELIGRO!';
document.getElementById('text_02').innerHTML = '¡Tus archivos personales han sido encriptados!';
document.getElementById('text_03').innerHTML = 'Tus documentos, fotos, bases de datos y otros archivos importantes han sido encriptados con una encriptación extremadamente fuerte y una clave única, generada para este computador. La clave de desencriptación privada está almacenada en un servidor de internet secreto. El servidor eliminará la clave luego del tiempo especificado en esta ventana.';
document.getElementById('text_09').innerHTML = 'Descarga el navegador TOR desde';
document.getElementById('text_10').innerHTML = 'En el navegador TOR abre';
document.getElementById('text_11').innerHTML = '(Nota que este servidor solo es accesible desde el navegador TOR. Intenta nuevamente en 1 hora si no puedes acceder).';
document.getElementById('text_12').innerHTML = 'Escribe la siguiente clave publica en la forma de ingreso del servidor:';
}
function show_fr()
{
document.getElementById('text_01').innerHTML = 'ATTENTION!';
document.getElementById('text_02').innerHTML = 'Vos fichiers personnels ont été cryptés !';
document.getElementById('text_03').innerHTML = 'Vos documents, photos, bases de données, et autres fichiers importants ont été cryptées avec le meilleur processus de cryptage et une clé unique générée pour cet ordinateur. La clé privée de cryptage est accessible sur un serveur Internet secret et personne ne peut décrypter vos fichiers à moins que vous ne payiez et obtenez cette clé. Le serveur éliminera la clé après le compte à rebours affiché sur cette fenêtre.';
document.getElementById('text_09').innerHTML = 'Télécharger le navigateur TOR de';
document.getElementById('text_10').innerHTML = 'Dans le navigateur, ouvrez ';
document.getElementById('text_11').innerHTML = '(Veuillez noter que ce serveur est disponible via le navigateur Tor uniquement. Réessayez dans 1 heure si le site n’est pas accessible).';
document.getElementById('text_12').innerHTML = 'Ecrivez les clés publiques suivantes sur le portail d’entrée du serveur :';
}
function show_it()
{
document.getElementById('text_01').innerHTML = 'ATTENZIONE!';
document.getElementById('text_02').innerHTML = 'I tuoi file personali sono criptati!';
document.getElementById('text_03').innerHTML = 'I tuoi documenti, le tue foto, database e altri file importanti sono stati criptati con forte codificazione ed una chiave unica, generata appositamente per questo computer. La chiave segreta di decriptazione è conservata su un server Internet segreto e nessuno può decriptare i tuoi file finché non paghi per ottenere la chiave. Il server eliminerà la chiave dopo il tempo indicato in questa finestra.';
document.getElementById('text_09').innerHTML = 'Scarica il Browser TOR da';
document.getElementById('text_10').innerHTML = 'Nel Browser TOR apri il link';
document.getElementById('text_11').innerHTML = '(Nota che questo server è disponibile solo tramite il Browser TOR. Riprova tra un’ora se il sito non è raggiungibile).';
document.getElementById('text_12').innerHTML = 'Scrivi la seguente chiave pubblica nel modulo di input sul server:';
}
function show_nl()
{
document.getElementById('text_01').innerHTML = 'WAARSCHUWING!';
document.getElementById('text_02').innerHTML = 'Uw persoonlijke bestanden zijn gecodeerd!';
document.getElementById('text_03').innerHTML = 'Uw documenten, foto’s, databases en andere belangrijke bestanden zijn gecodeerd met de sterkste encryptie en een unieke sleutel, gegenereerd voor deze computer. De persoonlijke decoderingssleutel is te vinden op een geheime Internet server en niemand kan uw bestanden decoderen totdat u betaalt en de persoonlijke sleutel heeft. De server zal de sleutel elimineren na de tijdsperiode genoemd in dit venster.';
document.getElementById('text_09').innerHTML = 'Download de TOR Browser van';
document.getElementById('text_10').innerHTML = 'In de Tor Browser, open';
document.getElementById('text_11').innerHTML = '(Let op dat deze server alleen via de Tor Browser te bereiken is. Probeer het na een uur weer als de site niet werkt).';
document.getElementById('text_12').innerHTML = 'Schrijf in de volgende openbare sleutel in het invoerformulier op de server:';
}
//var language = window.navigator.userLanguage || window.navigator.language;
//alert(language);
</script>
</head>
<body onload='init();'>
<div align='center'>
<table width='700' height='100%' border='0' cellpadding='0' cellspacing='0' bgcolor='#000000'>
<tr>
<td width='225' align='left'><img src='file:///C:/Users/Admin/AppData/Local/Temp/yhxlado.gif' width='225' height='221' /></td>
<td width='415' valign='top'><div align='center' class='style1' id='text_01'>WARNING!</div><br />
<div align='center' id='text_02'>Your personal files are encrypted.<br />
<br />
<br />
</div>
<div align='center' class='style3' id='fe_text'></div></p>
<div class="styled-select" align='center'>
<select id ="ddl" name="ddl" onmousedown="this.value='';" onchange="change_lang(this.value);">
<option selected disabled value="" style="display:none;">Select language</option>
<option value='en'> ENGLISH</option>
<option value='de'> GERMAN</option>
<option value='es'> SPANISH</option>
<option value='fr'> FRENCH</option>
<option value='it'> ITALIAN</option>
<option value='nl'> DUTCH</option>
</select>
</div>
</td>
</tr>
<tr>
<td colspan='2' align='center'><table width='97%' border='0' cellpadding='0' cellspacing='0'>
<tr>
<td colspan='2' align='left'>
<br />
<div id='text_03'>Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. The server will eliminate the key after a time period specified in this window.</div><br />
<br />
</td>
</tr>
<tr>
<td colspan='2' align='left'>
1) <span id='text_09'>Download TOR Browser from</span> <a href='http://torproject.org' class='style4'>http://torproject.org</a><br />
2) <span id='text_10'>In the Tor Browser open the</span> <span class='style6'>http://maktubmvgn22y2ns.onion</span><br /><br />
<span id='text_11'>(Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable).</span><br />
<br />
<span class='style5' id='text_12'>Write in the following public key in the input from on server:</span><br /><br />
<div align='center'><textarea class='style7'>
67BKQ-66SGF-VAD15-AM6ZX-H66RB-BYT6B-T03HH-WZ41D-W6VR0-UYW5H-M7GX4-XE3AY-EP8UU-7EAWS
YJERH-CSPNK-QWBPK-SV782-2YDN0-J8EE3-26C0G-74URS-UGVD5-RKB7H-FGB35-S2X3X-6WR3R-UK3AK
61M3W-4402J-UMY6C-TEC0Z-QFD78-R34CN-B2TYT-M6QEY-EPTY5-CZRU2-WQW81-UCNUE-JSFSK-QHUBH
B0HAS-3Q866-7N38X-EK4DY-Z2HUA-NMPY4-KFTZU-JPZNJ-5D2YD-U56FM-NUTJQ-DCHPA-2J1RE-4GU0F
RR4WF-GZV6B-Q1NJK-XF73E-78KW3-XUYJW-4A0J8-CGWSV-E3CMT-RH5WA-XWD3G-AKKHG-NQAHR-AM0UU
UUN2G-130ZQ-SNB71-211KY-JRMCQ-XPBJM-7HFJN-XGEVS-1UCXY-D0EKX-RKWFY-4FAQ1
</textarea>
<br />
</div>
<br />
<br />
<br />
</div>
</td>
</tr>
</table></td>
</tr>
</table>
</div>
</body>
</html>
URLs
http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd'>
http-equiv='Content-Type
Extracted
Path
C:\Users\Admin\Favorites\Links for United States\_DECRYPT_INFO_yhxlado.html
Ransom Note
<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Transitional//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd'>
<!-- saved from url=(0014)about:internet -->
<html xmlns='http://www.w3.org/1999/xhtml'>
<head>
<meta http-equiv='Content-Type' content='text/html; charset=UTF-8' />
<title>yhxlado decrypt</title>
<style type='text/css'>
<!--
html, body {margin: 0;padding: 0;margin-left: 0px;margin-top: 0px;margin-right: 0px;margin-bottom: 0px; background-color: #bfbfbf; height: 100%;}
a {color:426BBD; font-family:Tahoma, Verdana, Arial, Helvetica; font-size:12px;}
td {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #f0f0f0;
font-size: 14px;
}
.style1 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #d7001e;
font-size: 48px;
}
.style3 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #f5e700;
font-size: 60px;
}
.style4 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #28caf9;
font-size: 14px;
}
.style5 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #f5e700;
font-size: 14px;
}
.style6 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #d7001e;
font-size: 14px;
}
.style7 {
width:685px;
height:120px;
background-color:#393838;
border:1px solid #565656;
font-family: Courier New;
font-weight: bold;
color: #f0f0f0;
font-size: 13px;
}
.styled-select select {
background-color:#393838;
font-weight: bold;
color: #f0f0f0;
width: 178px;
padding: 5px;
font-size: 16px;
line-height: 1;
border: 0;
border-radius: 0;
height: 34px;
-webkit-appearance: none;
}
-->
</style>
<script type='text/javascript'>
function init()
{
var xtime;
document.getElementById('fe_text').innerHTML = '00:00:00';
var language = window.navigator.userLanguage || window.navigator.language;
if (language.indexOf('-') !== -1)
language = language.split('-')[0];
if (language.indexOf('_') !== -1)
language = language.split('_')[0];
change_lang(language);
var ua = window.navigator.userAgent;
var msie = ua.indexOf('MSIE ');
xtime = Math.floor( (1713439657+(12*60*60)) - (Date.now()/1000));
if (msie == 0)
window.setTimeout('update_timestamp('+xtime+')',1000);
else
update_timestamp(xtime);
}
function component(x, y, z)
{
var res
if (z == 1)
res = Math.floor(x / y);
else
res = Math.floor(x / y) % z;
if (res < 10)
res = '0'+res;
return res;
}
function update_timestamp(tstamp)
{
if (tstamp < 1)
{
document.getElementById('fe_text').innerHTML = '00:00:00';
}
else
{
var hours = component(tstamp, 60*60, 1),
minutes = component(tstamp, 60, 60),
seconds = component(tstamp, 1, 60);
document.getElementById('fe_text').innerHTML = hours+':'+minutes+':'+seconds;
tstamp-=1;
window.setTimeout('update_timestamp('+tstamp+')',1000);
}
}
function change_lang(lang)
{
if (lang == "de")
show_de();
else if (lang == "es")
show_es();
else if (lang == "fr")
show_fr();
else if (lang == "it")
show_it();
else if (lang == "nl")
show_nl();
else
show_en();
}
function show_en()
{
document.getElementById('text_01').innerHTML = 'WARNING!';
document.getElementById('text_02').innerHTML = 'Your personal files are encrypted.';
document.getElementById('text_03').innerHTML = 'Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. The server will eliminate the key after a time period specified in this window.';
document.getElementById('text_09').innerHTML = 'Download TOR Browser from';
document.getElementById('text_10').innerHTML = 'In the Tor Browser open the';
document.getElementById('text_11').innerHTML = '(Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable).';
document.getElementById('text_12').innerHTML = 'Write in the following public key in the input from on server:';
}
function show_de()
{
document.getElementById('text_01').innerHTML = 'WARNUNG!';
document.getElementById('text_02').innerHTML = 'Ihre persönlichen Dateien sind verschlüsselt!';
document.getElementById('text_03').innerHTML = 'Ihre Dokumente, Fotos, Datenbanken und andere wichtige Dateien wurden mit der stärkste Verschlüsselung und einem einzigartigen Schlüssel verschlüsselt, der für diesen Computer generiert wurde. Der Dechiffrierschlüssel ist auf einem geheimen Internet-Server gespeichert und niemand kann Ihre Dateien entschlüsseln, bis Sie bezahlen und den privaten Schlüssel erhalten. Der Server wird den Schlüssel nach einer bestimmten Zeit löschen, die in diesem Fenster angezeigt wird.';
document.getElementById('text_09').innerHTML = 'Laden Sie TOR-Browser von';
document.getElementById('text_10').innerHTML = 'Im Tor-Browser öffnen Sie';
document.getElementById('text_11').innerHTML = '(Beachten Sie, dass dieser Server nur über den Tor-Browser verfügbar ist. Wiederholen Sie den Vorgang nach 1 Stunde, wenn die Website nicht erreichbar ist).';
document.getElementById('text_12').innerHTML = 'Schreiben Sie den folgenden öffentlichen Schlüssel in die Eingabemaske auf dem Server:';
}
function show_es()
{
document.getElementById('text_01').innerHTML = '¡PELIGRO!';
document.getElementById('text_02').innerHTML = '¡Tus archivos personales han sido encriptados!';
document.getElementById('text_03').innerHTML = 'Tus documentos, fotos, bases de datos y otros archivos importantes han sido encriptados con una encriptación extremadamente fuerte y una clave única, generada para este computador. La clave de desencriptación privada está almacenada en un servidor de internet secreto. El servidor eliminará la clave luego del tiempo especificado en esta ventana.';
document.getElementById('text_09').innerHTML = 'Descarga el navegador TOR desde';
document.getElementById('text_10').innerHTML = 'En el navegador TOR abre';
document.getElementById('text_11').innerHTML = '(Nota que este servidor solo es accesible desde el navegador TOR. Intenta nuevamente en 1 hora si no puedes acceder).';
document.getElementById('text_12').innerHTML = 'Escribe la siguiente clave publica en la forma de ingreso del servidor:';
}
function show_fr()
{
document.getElementById('text_01').innerHTML = 'ATTENTION!';
document.getElementById('text_02').innerHTML = 'Vos fichiers personnels ont été cryptés !';
document.getElementById('text_03').innerHTML = 'Vos documents, photos, bases de données, et autres fichiers importants ont été cryptées avec le meilleur processus de cryptage et une clé unique générée pour cet ordinateur. La clé privée de cryptage est accessible sur un serveur Internet secret et personne ne peut décrypter vos fichiers à moins que vous ne payiez et obtenez cette clé. Le serveur éliminera la clé après le compte à rebours affiché sur cette fenêtre.';
document.getElementById('text_09').innerHTML = 'Télécharger le navigateur TOR de';
document.getElementById('text_10').innerHTML = 'Dans le navigateur, ouvrez ';
document.getElementById('text_11').innerHTML = '(Veuillez noter que ce serveur est disponible via le navigateur Tor uniquement. Réessayez dans 1 heure si le site n’est pas accessible).';
document.getElementById('text_12').innerHTML = 'Ecrivez les clés publiques suivantes sur le portail d’entrée du serveur :';
}
function show_it()
{
document.getElementById('text_01').innerHTML = 'ATTENZIONE!';
document.getElementById('text_02').innerHTML = 'I tuoi file personali sono criptati!';
document.getElementById('text_03').innerHTML = 'I tuoi documenti, le tue foto, database e altri file importanti sono stati criptati con forte codificazione ed una chiave unica, generata appositamente per questo computer. La chiave segreta di decriptazione è conservata su un server Internet segreto e nessuno può decriptare i tuoi file finché non paghi per ottenere la chiave. Il server eliminerà la chiave dopo il tempo indicato in questa finestra.';
document.getElementById('text_09').innerHTML = 'Scarica il Browser TOR da';
document.getElementById('text_10').innerHTML = 'Nel Browser TOR apri il link';
document.getElementById('text_11').innerHTML = '(Nota che questo server è disponibile solo tramite il Browser TOR. Riprova tra un’ora se il sito non è raggiungibile).';
document.getElementById('text_12').innerHTML = 'Scrivi la seguente chiave pubblica nel modulo di input sul server:';
}
function show_nl()
{
document.getElementById('text_01').innerHTML = 'WAARSCHUWING!';
document.getElementById('text_02').innerHTML = 'Uw persoonlijke bestanden zijn gecodeerd!';
document.getElementById('text_03').innerHTML = 'Uw documenten, foto’s, databases en andere belangrijke bestanden zijn gecodeerd met de sterkste encryptie en een unieke sleutel, gegenereerd voor deze computer. De persoonlijke decoderingssleutel is te vinden op een geheime Internet server en niemand kan uw bestanden decoderen totdat u betaalt en de persoonlijke sleutel heeft. De server zal de sleutel elimineren na de tijdsperiode genoemd in dit venster.';
document.getElementById('text_09').innerHTML = 'Download de TOR Browser van';
document.getElementById('text_10').innerHTML = 'In de Tor Browser, open';
document.getElementById('text_11').innerHTML = '(Let op dat deze server alleen via de Tor Browser te bereiken is. Probeer het na een uur weer als de site niet werkt).';
document.getElementById('text_12').innerHTML = 'Schrijf in de volgende openbare sleutel in het invoerformulier op de server:';
}
//var language = window.navigator.userLanguage || window.navigator.language;
//alert(language);
</script>
</head>
<body onload='init();'>
<div align='center'>
<table width='700' height='100%' border='0' cellpadding='0' cellspacing='0' bgcolor='#000000'>
<tr>
<td width='225' align='left'><img src='file:///C:/Users/Admin/AppData/Local/Temp/yhxlado.gif' width='225' height='221' /></td>
<td width='415' valign='top'><div align='center' class='style1' id='text_01'>WARNING!</div><br />
<div align='center' id='text_02'>Your personal files are encrypted.<br />
<br />
<br />
</div>
<div align='center' class='style3' id='fe_text'></div></p>
<div class="styled-select" align='center'>
<select id ="ddl" name="ddl" onmousedown="this.value='';" onchange="change_lang(this.value);">
<option selected disabled value="" style="display:none;">Select language</option>
<option value='en'> ENGLISH</option>
<option value='de'> GERMAN</option>
<option value='es'> SPANISH</option>
<option value='fr'> FRENCH</option>
<option value='it'> ITALIAN</option>
<option value='nl'> DUTCH</option>
</select>
</div>
</td>
</tr>
<tr>
<td colspan='2' align='center'><table width='97%' border='0' cellpadding='0' cellspacing='0'>
<tr>
<td colspan='2' align='left'>
<br />
<div id='text_03'>Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. The server will eliminate the key after a time period specified in this window.</div><br />
<br />
</td>
</tr>
<tr>
<td colspan='2' align='left'>
1) <span id='text_09'>Download TOR Browser from</span> <a href='http://torproject.org' class='style4'>http://torproject.org</a><br />
2) <span id='text_10'>In the Tor Browser open the</span> <span class='style6'>http://maktubmvgn22y2ns.onion</span><br /><br />
<span id='text_11'>(Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable).</span><br />
<br />
<span class='style5' id='text_12'>Write in the following public key in the input from on server:</span><br /><br />
<div align='center'><textarea class='style7'>
67BKQ-66SGF-VAD15-AM6ZX-H66RB-BYT6B-T03HH-WZ41D-W6VR0-UYW5H-M7GX4-XE3AY-EP8UU-7EAWS
YJERH-CSPNK-QWBPK-SV782-2YDN0-J8EE3-26C0G-74URS-UGVD5-RKB7H-FGB35-S2X3X-6WR3R-UK3AK
61M3W-4402J-UMY6C-TEC0Z-QFD78-R34CN-B2TYT-M6QEY-EPTY5-CZRU2-WQW81-UCNUE-JSFSK-QHUBH
B0HAS-3Q866-7N38X-EK4DY-Z2HUA-NMPY4-KFTZU-JPZNJ-5D2YD-U56FM-NUTJQ-DCHPA-2J1RE-4GU0F
RR4WF-GZV6B-Q1NJK-XF73E-78KW3-XUYJW-4A0J8-CGWSV-E3CMT-RH5WA-XWD3G-AKKHG-NQAHR-AM0UU
UUN2G-130ZQ-SNB71-211KY-JRMCQ-XPBJM-7HFJN-XGEVS-1UCXY-D0EKX-RKWFY-4FAQ1
</textarea>
<br />
</div>
<br />
<br />
<br />
</div>
</td>
</tr>
</table></td>
</tr>
</table>
</div>
</body>
</html>
URLs
http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd'>
http-equiv='Content-Type
Extracted
Path
C:\Users\Admin\Contacts\_DECRYPT_INFO_yhxlado.html
Ransom Note
<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Transitional//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd'>
<!-- saved from url=(0014)about:internet -->
<html xmlns='http://www.w3.org/1999/xhtml'>
<head>
<meta http-equiv='Content-Type' content='text/html; charset=UTF-8' />
<title>yhxlado decrypt</title>
<style type='text/css'>
<!--
html, body {margin: 0;padding: 0;margin-left: 0px;margin-top: 0px;margin-right: 0px;margin-bottom: 0px; background-color: #bfbfbf; height: 100%;}
a {color:426BBD; font-family:Tahoma, Verdana, Arial, Helvetica; font-size:12px;}
td {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #f0f0f0;
font-size: 14px;
}
.style1 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #d7001e;
font-size: 48px;
}
.style3 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #f5e700;
font-size: 60px;
}
.style4 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #28caf9;
font-size: 14px;
}
.style5 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #f5e700;
font-size: 14px;
}
.style6 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #d7001e;
font-size: 14px;
}
.style7 {
width:685px;
height:120px;
background-color:#393838;
border:1px solid #565656;
font-family: Courier New;
font-weight: bold;
color: #f0f0f0;
font-size: 13px;
}
.styled-select select {
background-color:#393838;
font-weight: bold;
color: #f0f0f0;
width: 178px;
padding: 5px;
font-size: 16px;
line-height: 1;
border: 0;
border-radius: 0;
height: 34px;
-webkit-appearance: none;
}
-->
</style>
<script type='text/javascript'>
function init()
{
var xtime;
document.getElementById('fe_text').innerHTML = '00:00:00';
var language = window.navigator.userLanguage || window.navigator.language;
if (language.indexOf('-') !== -1)
language = language.split('-')[0];
if (language.indexOf('_') !== -1)
language = language.split('_')[0];
change_lang(language);
var ua = window.navigator.userAgent;
var msie = ua.indexOf('MSIE ');
xtime = Math.floor( (1713439658+(12*60*60)) - (Date.now()/1000));
if (msie == 0)
window.setTimeout('update_timestamp('+xtime+')',1000);
else
update_timestamp(xtime);
}
function component(x, y, z)
{
var res
if (z == 1)
res = Math.floor(x / y);
else
res = Math.floor(x / y) % z;
if (res < 10)
res = '0'+res;
return res;
}
function update_timestamp(tstamp)
{
if (tstamp < 1)
{
document.getElementById('fe_text').innerHTML = '00:00:00';
}
else
{
var hours = component(tstamp, 60*60, 1),
minutes = component(tstamp, 60, 60),
seconds = component(tstamp, 1, 60);
document.getElementById('fe_text').innerHTML = hours+':'+minutes+':'+seconds;
tstamp-=1;
window.setTimeout('update_timestamp('+tstamp+')',1000);
}
}
function change_lang(lang)
{
if (lang == "de")
show_de();
else if (lang == "es")
show_es();
else if (lang == "fr")
show_fr();
else if (lang == "it")
show_it();
else if (lang == "nl")
show_nl();
else
show_en();
}
function show_en()
{
document.getElementById('text_01').innerHTML = 'WARNING!';
document.getElementById('text_02').innerHTML = 'Your personal files are encrypted.';
document.getElementById('text_03').innerHTML = 'Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. The server will eliminate the key after a time period specified in this window.';
document.getElementById('text_09').innerHTML = 'Download TOR Browser from';
document.getElementById('text_10').innerHTML = 'In the Tor Browser open the';
document.getElementById('text_11').innerHTML = '(Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable).';
document.getElementById('text_12').innerHTML = 'Write in the following public key in the input from on server:';
}
function show_de()
{
document.getElementById('text_01').innerHTML = 'WARNUNG!';
document.getElementById('text_02').innerHTML = 'Ihre persönlichen Dateien sind verschlüsselt!';
document.getElementById('text_03').innerHTML = 'Ihre Dokumente, Fotos, Datenbanken und andere wichtige Dateien wurden mit der stärkste Verschlüsselung und einem einzigartigen Schlüssel verschlüsselt, der für diesen Computer generiert wurde. Der Dechiffrierschlüssel ist auf einem geheimen Internet-Server gespeichert und niemand kann Ihre Dateien entschlüsseln, bis Sie bezahlen und den privaten Schlüssel erhalten. Der Server wird den Schlüssel nach einer bestimmten Zeit löschen, die in diesem Fenster angezeigt wird.';
document.getElementById('text_09').innerHTML = 'Laden Sie TOR-Browser von';
document.getElementById('text_10').innerHTML = 'Im Tor-Browser öffnen Sie';
document.getElementById('text_11').innerHTML = '(Beachten Sie, dass dieser Server nur über den Tor-Browser verfügbar ist. Wiederholen Sie den Vorgang nach 1 Stunde, wenn die Website nicht erreichbar ist).';
document.getElementById('text_12').innerHTML = 'Schreiben Sie den folgenden öffentlichen Schlüssel in die Eingabemaske auf dem Server:';
}
function show_es()
{
document.getElementById('text_01').innerHTML = '¡PELIGRO!';
document.getElementById('text_02').innerHTML = '¡Tus archivos personales han sido encriptados!';
document.getElementById('text_03').innerHTML = 'Tus documentos, fotos, bases de datos y otros archivos importantes han sido encriptados con una encriptación extremadamente fuerte y una clave única, generada para este computador. La clave de desencriptación privada está almacenada en un servidor de internet secreto. El servidor eliminará la clave luego del tiempo especificado en esta ventana.';
document.getElementById('text_09').innerHTML = 'Descarga el navegador TOR desde';
document.getElementById('text_10').innerHTML = 'En el navegador TOR abre';
document.getElementById('text_11').innerHTML = '(Nota que este servidor solo es accesible desde el navegador TOR. Intenta nuevamente en 1 hora si no puedes acceder).';
document.getElementById('text_12').innerHTML = 'Escribe la siguiente clave publica en la forma de ingreso del servidor:';
}
function show_fr()
{
document.getElementById('text_01').innerHTML = 'ATTENTION!';
document.getElementById('text_02').innerHTML = 'Vos fichiers personnels ont été cryptés !';
document.getElementById('text_03').innerHTML = 'Vos documents, photos, bases de données, et autres fichiers importants ont été cryptées avec le meilleur processus de cryptage et une clé unique générée pour cet ordinateur. La clé privée de cryptage est accessible sur un serveur Internet secret et personne ne peut décrypter vos fichiers à moins que vous ne payiez et obtenez cette clé. Le serveur éliminera la clé après le compte à rebours affiché sur cette fenêtre.';
document.getElementById('text_09').innerHTML = 'Télécharger le navigateur TOR de';
document.getElementById('text_10').innerHTML = 'Dans le navigateur, ouvrez ';
document.getElementById('text_11').innerHTML = '(Veuillez noter que ce serveur est disponible via le navigateur Tor uniquement. Réessayez dans 1 heure si le site n’est pas accessible).';
document.getElementById('text_12').innerHTML = 'Ecrivez les clés publiques suivantes sur le portail d’entrée du serveur :';
}
function show_it()
{
document.getElementById('text_01').innerHTML = 'ATTENZIONE!';
document.getElementById('text_02').innerHTML = 'I tuoi file personali sono criptati!';
document.getElementById('text_03').innerHTML = 'I tuoi documenti, le tue foto, database e altri file importanti sono stati criptati con forte codificazione ed una chiave unica, generata appositamente per questo computer. La chiave segreta di decriptazione è conservata su un server Internet segreto e nessuno può decriptare i tuoi file finché non paghi per ottenere la chiave. Il server eliminerà la chiave dopo il tempo indicato in questa finestra.';
document.getElementById('text_09').innerHTML = 'Scarica il Browser TOR da';
document.getElementById('text_10').innerHTML = 'Nel Browser TOR apri il link';
document.getElementById('text_11').innerHTML = '(Nota che questo server è disponibile solo tramite il Browser TOR. Riprova tra un’ora se il sito non è raggiungibile).';
document.getElementById('text_12').innerHTML = 'Scrivi la seguente chiave pubblica nel modulo di input sul server:';
}
function show_nl()
{
document.getElementById('text_01').innerHTML = 'WAARSCHUWING!';
document.getElementById('text_02').innerHTML = 'Uw persoonlijke bestanden zijn gecodeerd!';
document.getElementById('text_03').innerHTML = 'Uw documenten, foto’s, databases en andere belangrijke bestanden zijn gecodeerd met de sterkste encryptie en een unieke sleutel, gegenereerd voor deze computer. De persoonlijke decoderingssleutel is te vinden op een geheime Internet server en niemand kan uw bestanden decoderen totdat u betaalt en de persoonlijke sleutel heeft. De server zal de sleutel elimineren na de tijdsperiode genoemd in dit venster.';
document.getElementById('text_09').innerHTML = 'Download de TOR Browser van';
document.getElementById('text_10').innerHTML = 'In de Tor Browser, open';
document.getElementById('text_11').innerHTML = '(Let op dat deze server alleen via de Tor Browser te bereiken is. Probeer het na een uur weer als de site niet werkt).';
document.getElementById('text_12').innerHTML = 'Schrijf in de volgende openbare sleutel in het invoerformulier op de server:';
}
//var language = window.navigator.userLanguage || window.navigator.language;
//alert(language);
</script>
</head>
<body onload='init();'>
<div align='center'>
<table width='700' height='100%' border='0' cellpadding='0' cellspacing='0' bgcolor='#000000'>
<tr>
<td width='225' align='left'><img src='file:///C:/Users/Admin/AppData/Local/Temp/yhxlado.gif' width='225' height='221' /></td>
<td width='415' valign='top'><div align='center' class='style1' id='text_01'>WARNING!</div><br />
<div align='center' id='text_02'>Your personal files are encrypted.<br />
<br />
<br />
</div>
<div align='center' class='style3' id='fe_text'></div></p>
<div class="styled-select" align='center'>
<select id ="ddl" name="ddl" onmousedown="this.value='';" onchange="change_lang(this.value);">
<option selected disabled value="" style="display:none;">Select language</option>
<option value='en'> ENGLISH</option>
<option value='de'> GERMAN</option>
<option value='es'> SPANISH</option>
<option value='fr'> FRENCH</option>
<option value='it'> ITALIAN</option>
<option value='nl'> DUTCH</option>
</select>
</div>
</td>
</tr>
<tr>
<td colspan='2' align='center'><table width='97%' border='0' cellpadding='0' cellspacing='0'>
<tr>
<td colspan='2' align='left'>
<br />
<div id='text_03'>Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. The server will eliminate the key after a time period specified in this window.</div><br />
<br />
</td>
</tr>
<tr>
<td colspan='2' align='left'>
1) <span id='text_09'>Download TOR Browser from</span> <a href='http://torproject.org' class='style4'>http://torproject.org</a><br />
2) <span id='text_10'>In the Tor Browser open the</span> <span class='style6'>http://maktubmvgn22y2ns.onion</span><br /><br />
<span id='text_11'>(Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable).</span><br />
<br />
<span class='style5' id='text_12'>Write in the following public key in the input from on server:</span><br /><br />
<div align='center'><textarea class='style7'>
67BKQ-66SGF-VAD15-AM6ZX-H66RB-BYT6B-T03HH-WZ41D-W6VR0-UYW5H-M7GX4-XE3AY-EP8UU-7EAWS
YJERH-CSPNK-QWBPK-SV782-2YDN0-J8EE3-26C0G-74URS-UGVD5-RKB7H-FGB35-S2X3X-6WR3R-UK3AK
61M3W-4402J-UMY6C-TEC0Z-QFD78-R34CN-B2TYT-M6QEY-EPTY5-CZRU2-WQW81-UCNUE-JSFSK-QHUBH
B0HAS-3Q866-7N38X-EK4DY-Z2HUA-NMPY4-KFTZU-JPZNJ-5D2YD-U56FM-NUTJQ-DCHPA-2J1RE-4GU0F
RR4WF-GZV6B-Q1NJK-XF73E-78KW3-XUYJW-4A0J8-CGWSV-E3CMT-RH5WA-XWD3G-AKKHG-NQAHR-AM0UU
UUN2G-130ZQ-SNB71-211KY-JRMCQ-XPBJM-7HFJN-XGEVS-1UCXY-D0EKX-RKWFY-4FAQ1
</textarea>
<br />
</div>
<br />
<br />
<br />
</div>
</td>
</tr>
</table></td>
</tr>
</table>
</div>
</body>
</html>
URLs
http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd'>
http-equiv='Content-Type
Extracted
Path
C:\Users\Admin\Desktop\backup_yhxlado\_DECRYPT_INFO_yhxlado.html
Ransom Note
<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Transitional//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd'>
<!-- saved from url=(0014)about:internet -->
<html xmlns='http://www.w3.org/1999/xhtml'>
<head>
<meta http-equiv='Content-Type' content='text/html; charset=UTF-8' />
<title>yhxlado decrypt</title>
<style type='text/css'>
<!--
html, body {margin: 0;padding: 0;margin-left: 0px;margin-top: 0px;margin-right: 0px;margin-bottom: 0px; background-color: #bfbfbf; height: 100%;}
a {color:426BBD; font-family:Tahoma, Verdana, Arial, Helvetica; font-size:12px;}
td {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #f0f0f0;
font-size: 14px;
}
.style1 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #d7001e;
font-size: 48px;
}
.style3 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #f5e700;
font-size: 60px;
}
.style4 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #28caf9;
font-size: 14px;
}
.style5 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #f5e700;
font-size: 14px;
}
.style6 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #d7001e;
font-size: 14px;
}
.style7 {
width:685px;
height:120px;
background-color:#393838;
border:1px solid #565656;
font-family: Courier New;
font-weight: bold;
color: #f0f0f0;
font-size: 13px;
}
.styled-select select {
background-color:#393838;
font-weight: bold;
color: #f0f0f0;
width: 178px;
padding: 5px;
font-size: 16px;
line-height: 1;
border: 0;
border-radius: 0;
height: 34px;
-webkit-appearance: none;
}
-->
</style>
<script type='text/javascript'>
function init()
{
var xtime;
document.getElementById('fe_text').innerHTML = '00:00:00';
var language = window.navigator.userLanguage || window.navigator.language;
if (language.indexOf('-') !== -1)
language = language.split('-')[0];
if (language.indexOf('_') !== -1)
language = language.split('_')[0];
change_lang(language);
var ua = window.navigator.userAgent;
var msie = ua.indexOf('MSIE ');
xtime = Math.floor( (1713439653+(12*60*60)) - (Date.now()/1000));
if (msie == 0)
window.setTimeout('update_timestamp('+xtime+')',1000);
else
update_timestamp(xtime);
}
function component(x, y, z)
{
var res
if (z == 1)
res = Math.floor(x / y);
else
res = Math.floor(x / y) % z;
if (res < 10)
res = '0'+res;
return res;
}
function update_timestamp(tstamp)
{
if (tstamp < 1)
{
document.getElementById('fe_text').innerHTML = '00:00:00';
}
else
{
var hours = component(tstamp, 60*60, 1),
minutes = component(tstamp, 60, 60),
seconds = component(tstamp, 1, 60);
document.getElementById('fe_text').innerHTML = hours+':'+minutes+':'+seconds;
tstamp-=1;
window.setTimeout('update_timestamp('+tstamp+')',1000);
}
}
function change_lang(lang)
{
if (lang == "de")
show_de();
else if (lang == "es")
show_es();
else if (lang == "fr")
show_fr();
else if (lang == "it")
show_it();
else if (lang == "nl")
show_nl();
else
show_en();
}
function show_en()
{
document.getElementById('text_01').innerHTML = 'WARNING!';
document.getElementById('text_02').innerHTML = 'Your personal files are encrypted.';
document.getElementById('text_03').innerHTML = 'Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. The server will eliminate the key after a time period specified in this window.';
document.getElementById('text_09').innerHTML = 'Download TOR Browser from';
document.getElementById('text_10').innerHTML = 'In the Tor Browser open the';
document.getElementById('text_11').innerHTML = '(Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable).';
document.getElementById('text_12').innerHTML = 'Write in the following public key in the input from on server:';
}
function show_de()
{
document.getElementById('text_01').innerHTML = 'WARNUNG!';
document.getElementById('text_02').innerHTML = 'Ihre persönlichen Dateien sind verschlüsselt!';
document.getElementById('text_03').innerHTML = 'Ihre Dokumente, Fotos, Datenbanken und andere wichtige Dateien wurden mit der stärkste Verschlüsselung und einem einzigartigen Schlüssel verschlüsselt, der für diesen Computer generiert wurde. Der Dechiffrierschlüssel ist auf einem geheimen Internet-Server gespeichert und niemand kann Ihre Dateien entschlüsseln, bis Sie bezahlen und den privaten Schlüssel erhalten. Der Server wird den Schlüssel nach einer bestimmten Zeit löschen, die in diesem Fenster angezeigt wird.';
document.getElementById('text_09').innerHTML = 'Laden Sie TOR-Browser von';
document.getElementById('text_10').innerHTML = 'Im Tor-Browser öffnen Sie';
document.getElementById('text_11').innerHTML = '(Beachten Sie, dass dieser Server nur über den Tor-Browser verfügbar ist. Wiederholen Sie den Vorgang nach 1 Stunde, wenn die Website nicht erreichbar ist).';
document.getElementById('text_12').innerHTML = 'Schreiben Sie den folgenden öffentlichen Schlüssel in die Eingabemaske auf dem Server:';
}
function show_es()
{
document.getElementById('text_01').innerHTML = '¡PELIGRO!';
document.getElementById('text_02').innerHTML = '¡Tus archivos personales han sido encriptados!';
document.getElementById('text_03').innerHTML = 'Tus documentos, fotos, bases de datos y otros archivos importantes han sido encriptados con una encriptación extremadamente fuerte y una clave única, generada para este computador. La clave de desencriptación privada está almacenada en un servidor de internet secreto. El servidor eliminará la clave luego del tiempo especificado en esta ventana.';
document.getElementById('text_09').innerHTML = 'Descarga el navegador TOR desde';
document.getElementById('text_10').innerHTML = 'En el navegador TOR abre';
document.getElementById('text_11').innerHTML = '(Nota que este servidor solo es accesible desde el navegador TOR. Intenta nuevamente en 1 hora si no puedes acceder).';
document.getElementById('text_12').innerHTML = 'Escribe la siguiente clave publica en la forma de ingreso del servidor:';
}
function show_fr()
{
document.getElementById('text_01').innerHTML = 'ATTENTION!';
document.getElementById('text_02').innerHTML = 'Vos fichiers personnels ont été cryptés !';
document.getElementById('text_03').innerHTML = 'Vos documents, photos, bases de données, et autres fichiers importants ont été cryptées avec le meilleur processus de cryptage et une clé unique générée pour cet ordinateur. La clé privée de cryptage est accessible sur un serveur Internet secret et personne ne peut décrypter vos fichiers à moins que vous ne payiez et obtenez cette clé. Le serveur éliminera la clé après le compte à rebours affiché sur cette fenêtre.';
document.getElementById('text_09').innerHTML = 'Télécharger le navigateur TOR de';
document.getElementById('text_10').innerHTML = 'Dans le navigateur, ouvrez ';
document.getElementById('text_11').innerHTML = '(Veuillez noter que ce serveur est disponible via le navigateur Tor uniquement. Réessayez dans 1 heure si le site n’est pas accessible).';
document.getElementById('text_12').innerHTML = 'Ecrivez les clés publiques suivantes sur le portail d’entrée du serveur :';
}
function show_it()
{
document.getElementById('text_01').innerHTML = 'ATTENZIONE!';
document.getElementById('text_02').innerHTML = 'I tuoi file personali sono criptati!';
document.getElementById('text_03').innerHTML = 'I tuoi documenti, le tue foto, database e altri file importanti sono stati criptati con forte codificazione ed una chiave unica, generata appositamente per questo computer. La chiave segreta di decriptazione è conservata su un server Internet segreto e nessuno può decriptare i tuoi file finché non paghi per ottenere la chiave. Il server eliminerà la chiave dopo il tempo indicato in questa finestra.';
document.getElementById('text_09').innerHTML = 'Scarica il Browser TOR da';
document.getElementById('text_10').innerHTML = 'Nel Browser TOR apri il link';
document.getElementById('text_11').innerHTML = '(Nota che questo server è disponibile solo tramite il Browser TOR. Riprova tra un’ora se il sito non è raggiungibile).';
document.getElementById('text_12').innerHTML = 'Scrivi la seguente chiave pubblica nel modulo di input sul server:';
}
function show_nl()
{
document.getElementById('text_01').innerHTML = 'WAARSCHUWING!';
document.getElementById('text_02').innerHTML = 'Uw persoonlijke bestanden zijn gecodeerd!';
document.getElementById('text_03').innerHTML = 'Uw documenten, foto’s, databases en andere belangrijke bestanden zijn gecodeerd met de sterkste encryptie en een unieke sleutel, gegenereerd voor deze computer. De persoonlijke decoderingssleutel is te vinden op een geheime Internet server en niemand kan uw bestanden decoderen totdat u betaalt en de persoonlijke sleutel heeft. De server zal de sleutel elimineren na de tijdsperiode genoemd in dit venster.';
document.getElementById('text_09').innerHTML = 'Download de TOR Browser van';
document.getElementById('text_10').innerHTML = 'In de Tor Browser, open';
document.getElementById('text_11').innerHTML = '(Let op dat deze server alleen via de Tor Browser te bereiken is. Probeer het na een uur weer als de site niet werkt).';
document.getElementById('text_12').innerHTML = 'Schrijf in de volgende openbare sleutel in het invoerformulier op de server:';
}
//var language = window.navigator.userLanguage || window.navigator.language;
//alert(language);
</script>
</head>
<body onload='init();'>
<div align='center'>
<table width='700' height='100%' border='0' cellpadding='0' cellspacing='0' bgcolor='#000000'>
<tr>
<td width='225' align='left'><img src='file:///C:/Users/Admin/AppData/Local/Temp/yhxlado.gif' width='225' height='221' /></td>
<td width='415' valign='top'><div align='center' class='style1' id='text_01'>WARNING!</div><br />
<div align='center' id='text_02'>Your personal files are encrypted.<br />
<br />
<br />
</div>
<div align='center' class='style3' id='fe_text'></div></p>
<div class="styled-select" align='center'>
<select id ="ddl" name="ddl" onmousedown="this.value='';" onchange="change_lang(this.value);">
<option selected disabled value="" style="display:none;">Select language</option>
<option value='en'> ENGLISH</option>
<option value='de'> GERMAN</option>
<option value='es'> SPANISH</option>
<option value='fr'> FRENCH</option>
<option value='it'> ITALIAN</option>
<option value='nl'> DUTCH</option>
</select>
</div>
</td>
</tr>
<tr>
<td colspan='2' align='center'><table width='97%' border='0' cellpadding='0' cellspacing='0'>
<tr>
<td colspan='2' align='left'>
<br />
<div id='text_03'>Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. The server will eliminate the key after a time period specified in this window.</div><br />
<br />
</td>
</tr>
<tr>
<td colspan='2' align='left'>
1) <span id='text_09'>Download TOR Browser from</span> <a href='http://torproject.org' class='style4'>http://torproject.org</a><br />
2) <span id='text_10'>In the Tor Browser open the</span> <span class='style6'>http://maktubmvgn22y2ns.onion</span><br /><br />
<span id='text_11'>(Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable).</span><br />
<br />
<span class='style5' id='text_12'>Write in the following public key in the input from on server:</span><br /><br />
<div align='center'><textarea class='style7'>
67BKQ-66SGF-VAD15-AM6ZX-H66RB-BYT6B-T03HH-WZ41D-W6VR0-UYW5H-M7GX4-XE3AY-EP8UU-7EAWS
YJERH-CSPNK-QWBPK-SV782-2YDN0-J8EE3-26C0G-74URS-UGVD5-RKB7H-FGB35-S2X3X-6WR3R-UK3AK
61M3W-4402J-UMY6C-TEC0Z-QFD78-R34CN-B2TYT-M6QEY-EPTY5-CZRU2-WQW81-UCNUE-JSFSK-QHUBH
B0HAS-3Q866-7N38X-EK4DY-Z2HUA-NMPY4-KFTZU-JPZNJ-5D2YD-U56FM-NUTJQ-DCHPA-2J1RE-4GU0F
RR4WF-GZV6B-Q1NJK-XF73E-78KW3-XUYJW-4A0J8-CGWSV-E3CMT-RH5WA-XWD3G-AKKHG-NQAHR-AM0UU
UUN2G-130ZQ-SNB71-211KY-JRMCQ-XPBJM-7HFJN-XGEVS-1UCXY-D0EKX-RKWFY-4FAQ1
</textarea>
<br />
</div>
<br />
<br />
<br />
</div>
</td>
</tr>
</table></td>
</tr>
</table>
</div>
</body>
</html>
URLs
http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd'>
http-equiv='Content-Type
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (151) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
ACProtect 1.3x - 1.4x DLL software 3 IoCs
Detects file using ACProtect software.
-
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Office loads VBA resources, possible macro or embedded object present
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Modifies Internet Explorer settings 1 TTPs 31 IoCs
-
Modifies registry class 64 IoCs
-
Modifies system certificate store 2 TTPs 6 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0145f04a8356780d52774ce5f7dd0a02f6d5b321694ed805ce3e27bdf04d3c94.exe"C:\Users\Admin\AppData\Local\Temp\0145f04a8356780d52774ce5f7dd0a02f6d5b321694ed805ce3e27bdf04d3c94.exe"1⤵
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0145f04a8356780d52774ce5f7dd0a02f6d5b321694ed805ce3e27bdf04d3c94.rtf"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
-
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5e6b030237c91d6e52407a748ae3b5d5d
SHA1edd1fe5f6e188170ee4117c781fc3d82565348a8
SHA2566a17530acabac75c8a412862be3280abf7d805403fee749c229dd182e812e963
SHA5125e8b298ed8ef27b4d095cf4e02a0281a0b069206faea986adf5471782906b86d56846c8416c2f2bdd9d358f8da6023560ca18811dc7c0182190aebec5c181b98
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
344B
MD5255d515851e321b15f0e041d1596f6c2
SHA1df8bde59a19b64d378c1775f89d4381640df175c
SHA2561791800289e55aacada857fdb372fd08aa831ff091dac412cb1c7589bf2c450d
SHA512146db013ac66de9610f79ff89176037ce542aaddceb4ee9db81cb8b19869862a7b8e4c23de48983c2d7ced5ac67995f50124b05fc08015396fcdf030c3aec6a4
-
Filesize
4KB
MD52d5020c82de674b48cfd17cc20fcbba2
SHA14e317eaeebd839ee5f6eb3925a9fbee819c5349c
SHA256120becd55248f4a2ccbbc99ba9d3c2932223264a95cd72e9ae7568be61277e9a
SHA512ffbbdda009237d6825f6cd6f751a41f4f9d716186901ffdbeed56c2d1410245771decd07f591cf56cafdd4bbebd4e4c74f009ff15736d5321635e34ff17d0d8d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
20KB
MD588be22e64b899e60e9bbfe912eac39d4
SHA1f3135542879e1e820d978e9aa79bc0c6f0f8dab2
SHA2564ab29ce90aaf4cbacbfad2806fa42817b649b5b0995152aa89887d06f729c905
SHA512f4ce800e86cb8d1fa135c84bc3f6cfaf265689c5e2cebd6db78bd99c39805b31229dfd0eebb32bde4a54b412042a13f319b7605e7c57d166862049ba795b5352
-
Filesize
12KB
MD55996058f58b76feb25ae7bf16a8ab37e
SHA1addf701eb9fb1dfbbf6f0baea9f864bb272e9448
SHA2565b57a1e4fffa171a78cc4fe6962b18d1578a3e8c32c8b216f5826485fb3b6710
SHA5120f185dcdffb1ad42f88eb8c76c8f98688b88160c53c9f67df8dac301862aeed051fd2b50723164e0741502995a74570258179ca71a8165e6034f84acf457bddb
-
Filesize
12KB
MD59c167b421ccd33871de9d7ce4bdc8e17
SHA158f86417f494eba832ba3c8f8592f7632f985e5a
SHA256fd805da6d5377abd01bf0ed5e42c62a68b20e25fafe5a65f4566cec45ac8d4de
SHA512cd3bbf90c542553c3badaca3869805a0e6740a7c6dbe2a24d110de4157a8ca990bea231d43629ef72880fd4e6b8ec34c87929188b0004b802da7d352283305eb
-
Filesize
12KB
MD518ea15b3a026c5df8c1ee4d69d1106f1
SHA1c3541722e0e041d84b41c14422da99d694736a14
SHA2567deda49daaef8fa644aff3cb116b27641c9dec11c022da950bb246e9e4f999ef
SHA512dd05565836696f943a439e69642716cdce989ac92bbe13f53166f88c37ad8b1de798a471f7786712b1ba8f80242354959a818112be32860997f7ea0626f69322
-
Filesize
12KB
MD5f1f80a9bda658d48042e0621fb85a118
SHA11e35c43fa39856af53edee3b6f114a2a20234515
SHA256c7884032cfec01d921ab525e558848c6a5a463fdf907e9b52dcb0389d80b8ce8
SHA5128d72a0047f2985dfafd63addb956a4de1d73bd519a6c93640c43f6831108447eec9d21a71f8a92b6a91e41a06da0d091362dc4f07d57b99973ff45327d66b268
-
Filesize
160KB
-
Filesize
72KB
-
Filesize
388KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
388KB
-
Filesize
352KB
-
Filesize
160KB
-
Filesize
388KB
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
160KB
-
Filesize
388KB
-
Filesize
352KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
44KB
-
Filesize
44KB